Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Windows 7: Startseite in Browsern auf fremden Suchmaschinen + flackernder Browser

Windows 7: Startseite in Browsern auf fremden Suchmaschinen + flackernder Browser


Log-Analyse und Auswertung: Windows 7: Startseite in Browsern auf fremden Suchmaschinen + flackernder Browser

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Alt 12.09.2014, 13:04   #1
Summer_Storm
 
Windows 7: Startseite in Browsern auf fremden Suchmaschinen + flackernder Browser - Standard

Windows 7: Startseite in Browsern auf fremden Suchmaschinen + flackernder Browser


Hi, ich habe seit einigen Wochen komische Suchseiten statt meiner Startseite (habe ich nie benutzt). Weil ich keine Zeit hatte, habe ich das ignoriert. Seit wenigen Tagen flackert nun mein Browser manchmal und ich sehr langsam. Erst habe ich gedacht, es liege an einem Wackelkontakt der Kabel, habe alle überprüft aber nichts hat sich gebessert. Dann habe ich gemerkt, dass nicht der ganze Bildschirm flackert, sondern immer nur der Browser (ich benutze meist Firefox, selten Internet Explorer). Da dachte ich, ich müsse doch mal was tun. Habe den "SaveFinder" gegoogelt und mittels Anleitungen alle Toolbars und verdächtige Sachen deinstalliert. Im Firefox tauchen jetzt auch keine komischen Suchseiten mehr auf, aber noch im Internet Explorer, egal was ich mache. Das Flackern blieb von alle dem unbeeindruckt.
Nun, bin ich auf eure Seite gestoßen und habe mir den Malwarebytes Anti-Malware runtergeladen und den Threat Scan durchgeführt. Dann erst habe ich mich in eurem Forum angemeldet. Darum wollte ich erstmal fragen, ob ich jetzt die Schritte 1-4 durchgehen sollte.
Anbei die Ergebnisse des Scans. Es sieht für mich als Laien mit 338 Problemen detektiert sehr schlimm aus. Meint ihr ich muss den Computer neuinstallieren , oder ist da noch was zu retten?
Falls ihr sagt, ich muss ihn neuinstallieren, könnt ihr mir sagen, wie ich am besten meine Daten sichere, ohne alle Viren mit zu speichern!?... Und kann ich EndNote speichern, weil ich nicht wüsste, wo ich das sonst wieder kostenlos herkriegen würde... Wäre super nett wenn mir einer helfen könnte! Vielen Dank für eure Hilfe! Das ist eine tolle Seite!

Alt 12.09.2014, 14:07   #2
M-K-D-B
/// TB-Ausbilder
 
Windows 7: Startseite in Browsern auf fremden Suchmaschinen + flackernder Browser - Standard

Windows 7: Startseite in Browsern auf fremden Suchmaschinen + flackernder Browser





Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.


Bitte beachte folgende Hinweise:
  • Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support unterbrechen bis jegliche Art von illegaler Software vom Rechner entfernt wurde.
  • Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
  • Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo.
    Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
  • Während der Bereinigung bitte nichts installieren oder deinstallieren, außer ich bitte dich darum!
  • Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort zu starten!


Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:
So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke aauf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Danke für deine Mitarbeit!






Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

__________________
Alt 12.09.2014, 17:20   #3
Summer_Storm
 
Windows 7: Startseite in Browsern auf fremden Suchmaschinen + flackernder Browser - Standard

Windows 7: Startseite in Browsern auf fremden Suchmaschinen + flackernder Browser


Code:
ATTFilter
<?xml version="1.0" encoding="UTF-16" ?>
<mbam-log>
<header>
<date>2014/09/12 16:58:34 +0200</date>
<logfile>mbam-log-2014-09-12 (16-58-32).xml</logfile>
<isadmin>yes</isadmin>
</header>
<engine>
<version>2.00.2.1012</version>
<malware-database>v2014.09.12.03</malware-database>
<rootkit-database>v2014.09.12.01</rootkit-database>
<license>trial</license>
<file-protection>enabled</file-protection>
<web-protection>enabled</web-protection>
<self-protection>disabled</self-protection>
</engine>
<system>
<osversion>Windows 7 Service Pack 1</osversion>
<arch>x86</arch>
<username>Sarah</username>
<filesys>NTFS</filesys>
</system>
<summary>
<type>threat</type>
<result>completed</result>
<objects>399309</objects>
<time>2240</time>
<processes>0</processes>
<modules>0</modules>
<keys>27</keys>
<values>15</values>
<datas>19</datas>
<folders>49</folders>
<files>233</files>
<sectors>0</sectors>
</summary>
<options>
<memory>enabled</memory>
<startup>enabled</startup>
<filesystem>enabled</filesystem>
<archives>enabled</archives>
<rootkits>disabled</rootkits>
<deeprootkit>disabled</deeprootkit>
<heuristics>enabled</heuristics>
<pup>enabled</pup>
<pum>enabled</pum>
</options>
<items>
<key><path>HKLM\SOFTWARE\CLASSES\APPID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}</path><vendor>PUP.Optional.Delta.A</vendor><action></action><hash>b211628a730863d38351caf1768cdf21</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}</path><vendor>PUP.Optional.FrostwireTB.A</vendor><action></action><hash>b80bf3f9493262d4a79c3e8172903cc4</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\TYPELIB\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}</path><vendor>PUP.Optional.FrostwireTB.A</vendor><action></action><hash>b80bf3f9493262d4a79c3e8172903cc4</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\INTERFACE\{6C434537-053E-486D-B62A-160059D9D456}</path><vendor>PUP.Optional.FrostwireTB.A</vendor><action></action><hash>b80bf3f9493262d4a79c3e8172903cc4</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\INTERFACE\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}</path><vendor>PUP.Optional.FrostwireTB.A</vendor><action></action><hash>b80bf3f9493262d4a79c3e8172903cc4</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\INTERFACE\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}</path><vendor>PUP.Optional.FrostwireTB.A</vendor><action></action><hash>b80bf3f9493262d4a79c3e8172903cc4</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\GenericAskToolbar.ToolbarWnd.1</path><vendor>PUP.Optional.FrostwireTB.A</vendor><action></action><hash>b80bf3f9493262d4a79c3e8172903cc4</hash></key>
<key><path>HKLM\SOFTWARE\CLASSES\GenericAskToolbar.ToolbarWnd</path><vendor>PUP.Optional.FrostwireTB.A</vendor><action></action><hash>b80bf3f9493262d4a79c3e8172903cc4</hash></key>
<key><path>HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{D4027C7F-154A-4066-A1AD-4243D8127440}</path><vendor>PUP.Optional.FrostwireTB.A</vendor><action></action><hash>b80bf3f9493262d4a79c3e8172903cc4</hash></key>
<key><path>HKU\S-1-5-21-923278769-240386288-3162056909-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{D4027C7F-154A-4066-A1AD-4243D8127440}</path><vendor>PUP.Optional.FrostwireTB.A</vendor><action></action><hash>b80bf3f9493262d4a79c3e8172903cc4</hash></key>
<key><path>HKU\S-1-5-21-923278769-240386288-3162056909-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{D4027C7F-154A-4066-A1AD-4243D8127440}</path><vendor>PUP.Optional.FrostwireTB.A</vendor><action></action><hash>b80bf3f9493262d4a79c3e8172903cc4</hash></key>
<key><path>HKU\S-1-5-21-923278769-240386288-3162056909-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{D4027C7F-154A-4066-A1AD-4243D8127440}</path><vendor>PUP.Optional.FrostwireTB.A</vendor><action></action><hash>b80bf3f9493262d4a79c3e8172903cc4</hash></key>
<key><path>HKU\S-1-5-21-923278769-240386288-3162056909-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{D4027C7F-154A-4066-A1AD-4243D8127440}</path><vendor>PUP.Optional.FrostwireTB.A</vendor><action></action><hash>b80bf3f9493262d4a79c3e8172903cc4</hash></key>
<key><path>HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006ee092-9658-4fd6-bd8e-a21a348e59f5}</path><vendor>PUP.Optional.Snapdo.T</vendor><action></action><hash>6b58cd1ff8837abc3e0f0bb4956d4db3</hash></key>
<key><path>HKU\S-1-5-21-923278769-240386288-3162056909-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006EE092-9658-4FD6-BD8E-A21A348E59F5}</path><vendor>PUP.Optional.Snapdo.T</vendor><action></action><hash>6b58cd1ff8837abc3e0f0bb4956d4db3</hash></key>
<key><path>HKU\S-1-5-21-923278769-240386288-3162056909-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006EE092-9658-4FD6-BD8E-A21A348E59F5}</path><vendor>PUP.Optional.Snapdo.T</vendor><action></action><hash>6b58cd1ff8837abc3e0f0bb4956d4db3</hash></key>
<key><path>HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006EE092-9658-4FD6-BD8E-A21A348E59F5}</path><vendor>PUP.Optional.Snapdo.T</vendor><action></action><hash>6b58cd1ff8837abc3e0f0bb4956d4db3</hash></key>
<key><path>HKU\S-1-5-21-923278769-240386288-3162056909-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}</path><vendor>PUP.Optional.QuickShare.A</vendor><action></action><hash>408322ca92e958de74eff0cbb84a3bc5</hash></key>
<key><path>HKU\S-1-5-21-923278769-240386288-3162056909-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}</path><vendor>PUP.Optional.QuickShare.A</vendor><action></action><hash>408322ca92e958de74eff0cbb84a3bc5</hash></key>
<key><path>HKU\S-1-5-21-923278769-240386288-3162056909-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{82249076-D5C8-431D-982B-023779779587}</path><vendor>PUP.Optional.PlurPush.A</vendor><action></action><hash>d9ea42aa95e60f2771fd6459bf4330d0</hash></key>
<key><path>HKU\S-1-5-21-923278769-240386288-3162056909-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{82249076-D5C8-431D-982B-023779779587}</path><vendor>PUP.Optional.PlurPush.A</vendor><action></action><hash>d9ea42aa95e60f2771fd6459bf4330d0</hash></key>
<key><path>HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{3bbd3c14-4c16-4989-8366-95bc9179779d}</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>8d3638b44d2e9c9a659fcdb6d52d24dc</hash></key>
<key><path>HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\VOPackage</path><vendor>PUP.Optional.VOPackage.A</vendor><action></action><hash>962dd418afccef4753d40053cb35ac54</hash></key>
<key><path>HKU\S-1-5-21-923278769-240386288-3162056909-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr</path><vendor>PUP.Optional.DataMngr.A</vendor><action></action><hash>675ce00ca5d6f3434b7347fe06fe60a0</hash></key>
<key><path>HKU\S-1-5-21-923278769-240386288-3162056909-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr_Toolbar</path><vendor>PUP.Optional.DataMngr.A</vendor><action></action><hash>7a497c70e59677bfe6d791b412f2b34d</hash></key>
<key><path>HKU\S-1-5-21-923278769-240386288-3162056909-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>893a816bfe7d84b2827b74b58083dc24</hash></key>
<key><path>HKU\S-1-5-21-923278769-240386288-3162056909-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SMARTBAR</path><vendor>PUP.Optional.ShoppingHelper.A</vendor><action></action><hash>33905d8ff58694a2116440270400bf41</hash></key>
<value><path>HKU\S-1-5-21-923278769-240386288-3162056909-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER</path><valuename>{D4027C7F-154A-4066-A1AD-4243D8127440}</valuename><vendor>PUP.Optional.FrostwireTB.A</vendor><action></action><valuedata>|ÔJf@¡*BCØt@</valuedata><hash>b80bf3f9493262d4a79c3e8172903cc4</hash></value>
<value><path>HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR</path><valuename>{D4027C7F-154A-4066-A1AD-4243D8127440}</valuename><vendor>PUP.Optional.FrostwireTB.A</vendor><action></action><valuedata></valuedata><hash>b80bf3f9493262d4a79c3e8172903cc4</hash></value>
<value><path>HKU\S-1-5-21-923278769-240386288-3162056909-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER</path><valuename>{3BBD3C14-4C16-4989-8366-95BC9179779D}</valuename><vendor>PUP.Optional.Conduit.A</vendor><action></action><valuedata>&lt;½;L‰Iƒf•¼‘yw</valuedata><hash>8d3638b44d2e9c9a659fcdb6d52d24dc</hash></value>
<value><path>HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS</path><valuename>{3BBD3C14-4C16-4989-8366-95BC9179779D}</valuename><vendor>PUP.Optional.Conduit.A</vendor><action></action><valuedata></valuedata><hash>8d3638b44d2e9c9a659fcdb6d52d24dc</hash></value>
<value><path>HKU\S-1-5-21-923278769-240386288-3162056909-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{D4027C7F-154A-4066-A1AD-4243D8127440}</path><valuename></valuename><vendor>PUP.Optional.FrostwireTB.A</vendor><action></action><valuedata></valuedata><hash>487bbf2daad164d2e85b00bf946e9967</hash></value>
<value><path>HKU\S-1-5-21-923278769-240386288-3162056909-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{3BBD3C14-4C16-4989-8366-95BC9179779D}</path><valuename></valuename><vendor>PUP.Optional.Conduit.A</vendor><action></action><valuedata></valuedata><hash>e1e214d8304bd264d62e453e13efd729</hash></value>
<value><path>HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{D4027C7F-154A-4066-A1AD-4243D8127440}</path><valuename></valuename><vendor>PUP.Optional.FrostwireTB.A</vendor><action></action><valuedata></valuedata><hash>06bd1cd0aecd68cec77cf9c6847eba46</hash></value>
<value><path>HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS\{3bbd3c14-4c16-4989-8366-95bc9179779d}</path><valuename></valuename><vendor>PUP.Optional.Conduit.A</vendor><action></action><valuedata></valuedata><hash>ccf77b7199e21323f2124d36fe046c94</hash></value>
<value><path>HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR</path><valuename>{ae07101b-46d4-4a98-af68-0333ea26e113}</valuename><vendor>PUP.Optional.SmartBar</vendor><action></action><valuedata>Smartbar</valuedata><hash>309304e80a71290d221aeb134ab818e8</hash></value>
<value><path>HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\VOPACKAGE</path><valuename>UninstallString</valuename><vendor>PUP.Optional.VOPackage</vendor><action></action><valuedata>&quot;C:\Users\Sarah\AppData\Roaming\VOPackage\uninstall.exe&quot;</valuedata><hash>4d76b339e893a78f600cef18af54ee12</hash></value>
<value><path>HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES</path><valuename>DefaultScope</valuename><vendor>PUP.Optional.Snapdo.T</vendor><action></action><valuedata>{006ee092-9658-4fd6-bd8e-a21a348e59f5}</valuedata><hash>d1f28c60fe7dd363d937ba4e16ed7c84</hash></value>
<value><path>HKU\S-1-5-21-923278769-240386288-3162056909-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES</path><valuename>DefaultScope</valuename><vendor>PUP.Optional.Snapdo.T</vendor><action></action><valuedata>{006ee092-9658-4fd6-bd8e-a21a348e59f5}</valuedata><hash>8f34b7357704e74ff71919efef1458a8</hash></value>
<value><path>HKU\S-1-5-21-923278769-240386288-3162056909-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SMARTBAR</path><valuename>publisher</valuename><vendor>PUP.Optional.ShoppingHelper.A</vendor><action></action><valuedata>ShoppingHelper</valuedata><hash>33905d8ff58694a2116440270400bf41</hash></value>
<value><path>HKU\S-1-5-21-923278769-240386288-3162056909-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES</path><valuename>DefaultScope</valuename><vendor>PUP.Optional.Snapdo.T</vendor><action></action><valuedata>{006ee092-9658-4fd6-bd8e-a21a348e59f5}</valuedata><hash>f2d1b03c80fbfa3cba560503da2939c7</hash></value>
<value><path>HKU\S-1-5-21-923278769-240386288-3162056909-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES</path><valuename>DefaultScope</valuename><vendor>PUP.Optional.Snapdo.T</vendor><action></action><valuedata>{006ee092-9658-4fd6-bd8e-a21a348e59f5}</valuedata><hash>19aafbf1215a7abc917fbc4cb94a0ff1</hash></value>
<data><path>HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL</path><valuename>Default</valuename><vendor>PUP.Optional.SnapDo.A</vendor><action></action><valuedata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q={searchTerms}</valuedata><baddata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q={searchTerms}</baddata><gooddata>www.google.com</gooddata><hash>fac946a6136879bdaa71836e41c319e7</hash></data>
<data><path>HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN</path><valuename>Start Page</valuename><vendor>PUP.Optional.Snapdo</vendor><action></action><valuedata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8lqw9z6KzCzs0u_J7E1gWqaX6GQnXpLXoGqDH54KArvHgFXCTIP_dCnZOZjDVASI,</valuedata><baddata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8lqw9z6KzCzs0u_J7E1gWqaX6GQnXpLXoGqDH54KArvHgFXCTIP_dCnZOZjDVASI,</baddata><gooddata>www.google.com</gooddata><hash>5e6531bb0b70e65050322dcda65e16ea</hash></data>
<data><path>HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN</path><valuename>Search Bar</valuename><vendor>PUP.Optional.Snapdo</vendor><action></action><valuedata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q={searchTerms}</valuedata><baddata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q={searchTerms}</baddata><gooddata>www.google.com</gooddata><hash>cff4a14b0675b482b6caa753768e5da3</hash></data>
<data><path>HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN</path><valuename>Search Page</valuename><vendor>PUP.Optional.Snapdo</vendor><action></action><valuedata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q={searchTerms}</valuedata><baddata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q={searchTerms}</baddata><gooddata>www.google.com</gooddata><hash>0cb78e5e79026dc93c45a456798b7a86</hash></data>
<data><path>HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH</path><valuename>Default_Search_URL</valuename><vendor>PUP.Optional.Snapdo</vendor><action></action><valuedata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q={searchTerms}</valuedata><baddata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q={searchTerms}</baddata><gooddata>www.google.com</gooddata><hash>b3100ae2accf280e641fa6548b7960a0</hash></data>
<data><path>HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH</path><valuename>SearchAssistant</valuename><vendor>PUP.Optional.Snapdo</vendor><action></action><valuedata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q={searchTerms}</valuedata><baddata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q={searchTerms}</baddata><gooddata>www.google.com</gooddata><hash>c5fe6686b0cb181ed1b3fcfe3bc9a15f</hash></data>
<data><path>HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL</path><valuename>Default</valuename><vendor>PUP.Optional.SnapDo.A</vendor><action></action><valuedata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q={searchTerms}</valuedata><baddata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q={searchTerms}</baddata><gooddata>www.google.com</gooddata><hash>259ed517e398ef47a577658c84808878</hash></data>
<data><path>HKU\S-1-5-21-923278769-240386288-3162056909-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN</path><valuename>Search Page</valuename><vendor>PUP.Optional.Snapdo</vendor><action></action><valuedata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3A,&amp;q={searchTerms}</valuedata><baddata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3A,&amp;q={searchTerms}</baddata><gooddata>www.google.com</gooddata><hash>774c47a537440d29a9d85aa0cd378c74</hash></data>
<data><path>HKU\S-1-5-21-923278769-240386288-3162056909-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN</path><valuename>Start Page</valuename><vendor>PUP.Optional.Snapdo</vendor><action></action><valuedata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8lqw9z6KzCzs0u_J7E1gWqaX6GQnXpLXoGqDH54KArvHgFXCTIP_dCnZOZjDVASU,</valuedata><baddata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8lqw9z6KzCzs0u_J7E1gWqaX6GQnXpLXoGqDH54KArvHgFXCTIP_dCnZOZjDVASU,</baddata><gooddata>www.google.com</gooddata><hash>fac96b818cefe551d5ad74868282649c</hash></data>
<data><path>HKU\S-1-5-21-923278769-240386288-3162056909-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN</path><valuename>Search Bar</valuename><vendor>PUP.Optional.Snapdo</vendor><action></action><valuedata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3A,&amp;q={searchTerms}</valuedata><baddata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3A,&amp;q={searchTerms}</baddata><gooddata>www.google.com</gooddata><hash>9a29be2e3a41f541651be317be463bc5</hash></data>
<data><path>HKU\S-1-5-21-923278769-240386288-3162056909-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH</path><valuename>Default_Search_URL</valuename><vendor>PUP.Optional.Snapdo</vendor><action></action><valuedata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3A,&amp;q={searchTerms}</valuedata><baddata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3A,&amp;q={searchTerms}</baddata><gooddata>www.google.com</gooddata><hash>507318d457243303d1b2be3c0bf9c23e</hash></data>
<data><path>HKU\S-1-5-21-923278769-240386288-3162056909-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH</path><valuename>SearchAssistant</valuename><vendor>PUP.Optional.Snapdo</vendor><action></action><valuedata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3A,&amp;q={searchTerms}</valuedata><baddata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3A,&amp;q={searchTerms}</baddata><gooddata>www.google.com</gooddata><hash>3d86c12bbebdfc3af98bc03a5da7c838</hash></data>
<data><path>HKU\S-1-5-21-923278769-240386288-3162056909-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL</path><valuename>Default</valuename><vendor>PUP.Optional.SnapDo.A</vendor><action></action><valuedata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3A,&amp;q={searchTerms}</valuedata><baddata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3A,&amp;q={searchTerms}</baddata><gooddata>www.google.com</gooddata><hash>d9eac527b6c59f97cf4d925f40c46a96</hash></data>
<data><path>HKU\S-1-5-21-923278769-240386288-3162056909-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN</path><valuename>Start Page</valuename><vendor>PUP.Optional.Snapdo</vendor><action></action><valuedata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8lqw9z6KzCzs0u_J7E1gWqaX6GQnXpLXoGqDH54KArvHgFXCTIP_dCnZOZjDVASI,</valuedata><baddata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8lqw9z6KzCzs0u_J7E1gWqaX6GQnXpLXoGqDH54KArvHgFXCTIP_dCnZOZjDVASI,</baddata><gooddata>www.google.com</gooddata><hash>ecd70ae25f1c4ee8532f1cde8c78758b</hash></data>
<data><path>HKU\S-1-5-21-923278769-240386288-3162056909-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN</path><valuename>Search Bar</valuename><vendor>PUP.Optional.Snapdo</vendor><action></action><valuedata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q={searchTerms}</valuedata><baddata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q={searchTerms}</baddata><gooddata>www.google.com</gooddata><hash>3e85b43879023bfb2e52f8023dc723dd</hash></data>
<data><path>HKU\S-1-5-21-923278769-240386288-3162056909-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN</path><valuename>Search Page</valuename><vendor>PUP.Optional.Snapdo</vendor><action></action><valuedata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q={searchTerms}</valuedata><baddata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q={searchTerms}</baddata><gooddata>www.google.com</gooddata><hash>c7fc5597dba02e08f28f03f702029868</hash></data>
<data><path>HKU\S-1-5-21-923278769-240386288-3162056909-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH</path><valuename>Default_Search_URL</valuename><vendor>PUP.Optional.Snapdo</vendor><action></action><valuedata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q={searchTerms}</valuedata><baddata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q={searchTerms}</baddata><gooddata>www.google.com</gooddata><hash>21a2f0fc0c6f89add6adc53526de1ae6</hash></data>
<data><path>HKU\S-1-5-21-923278769-240386288-3162056909-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH</path><valuename>SearchAssistant</valuename><vendor>PUP.Optional.Snapdo</vendor><action></action><valuedata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q={searchTerms}</valuedata><baddata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q={searchTerms}</baddata><gooddata>www.google.com</gooddata><hash>863d83697407c86e0e7604f66c987a86</hash></data>
<data><path>HKU\S-1-5-21-923278769-240386288-3162056909-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL</path><valuename>Default</valuename><vendor>PUP.Optional.SnapDo.A</vendor><action></action><valuedata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q={searchTerms}</valuedata><baddata>hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q={searchTerms}</baddata><gooddata>www.google.com</gooddata><hash>348f27c5582386b025f79c550df7c13f</hash></data>
<folder><path>C:\Users\Sarah\AppData\Roaming\OpenCandy</path><vendor>PUP.Optional.OpenCandy</vendor><action></action><hash>dee540ac8eed77bf3dfcaf20966c31cf</hash></folder>
<folder><path>C:\Users\Sarah\AppData\Roaming\OpenCandy\7F47F4897B06466391975239152579A8</path><vendor>PUP.Optional.OpenCandy</vendor><action></action><hash>dee540ac8eed77bf3dfcaf20966c31cf</hash></folder>
<folder><path>C:\Users\Sarah\AppData\Roaming\OpenCandy\E0FE69F5708644DEB5CBD008E13193AF</path><vendor>PUP.Optional.OpenCandy</vendor><action></action><hash>dee540ac8eed77bf3dfcaf20966c31cf</hash></folder>
<folder><path>C:\Users\Sarah\AppData\Local\Temp\mt_ffx\Delta</path><vendor>PUP.Optional.Delta.A</vendor><action></action><hash>fec5d6167ffc0a2c4016e6e9e41ecb35</hash></folder>
<folder><path>C:\Users\Sarah\AppData\Local\Temp\mt_ffx\Delta\delta</path><vendor>PUP.Optional.Delta.A</vendor><action></action><hash>fec5d6167ffc0a2c4016e6e9e41ecb35</hash></folder>
<folder><path>C:\Users\Sarah\AppData\Local\Temp\mt_ffx\Delta\delta\1.8.21.5</path><vendor>PUP.Optional.Delta.A</vendor><action></action><hash>fec5d6167ffc0a2c4016e6e9e41ecb35</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\PriceGong</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\AddedAppDialog</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\DefualtImages</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\DetectedAppDialog</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\EngineFirstTimeDialog</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\NewSearchProtectorDialog</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\NewSearchProtectorDialog\images</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorBubbleDialog</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorBubbleDialog\images</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorDialog</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorDialog\Images</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorRetakeoverDialog</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorRetakeoverDialog\Images</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\ToolbarFirstTimeDialog</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\ToolbarFirstTimeDialog\images</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\ToolbarUntrustedAppsApprovalDialog</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\UninstallDialog</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\UntrustedAddedAppDialog</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\UntrustedAppApprovalDialog</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\UntrustedAppPendingDialog</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\EmailNotifier</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\ExternalComponent</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Logs</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\MyStuffApps</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\plugins</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3\bin</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\RadioPlayer</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Repository</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Repository\conduit_CT3201318_CT3201318</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Repository\conduit_CT3201318_CT3201318\AppsMetaData</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Repository\conduit_CT3201318_CT3201318\DynamicDialogs</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Repository\conduit_CT3201318_CT3201318\ToolbarLogin</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Repository\conduit_CT3201318_CT3201318\ToolbarSettings</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Repository\conduit_CT3201318_en</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Repository\conduit_CT3201318_en\ToolbarTranslation</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\SearchInNewTab</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<folder><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\UserDefinedItems</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></folder>
<file><path>C:\Users\Sarah\AppData\Roaming\OpenCandy\E0FE69F5708644DEB5CBD008E13193AF\DeltaTB.exe</path><vendor>PUP.Optional.Delta.A</vendor><action></action><hash>cdf611db611a320414d23fd7956c21df</hash></file>
<file><path>C:\Users\Sarah\AppData\Roaming\VOPackage\Uninstall.exe</path><vendor>PUP.Optional.VOPackage.A</vendor><action></action><hash>962dd418afccef4753d40053cb35ac54</hash></file>
<file><path>C:\Users\Sarah\AppData\Roaming\VOPackage\VOPackage.exe</path><vendor>PUP.Optional.VOPackage.A</vendor><action></action><hash>348fedff85f63105ac7b025106fa916f</hash></file>
<file><path>C:\Users\Sarah\AppData\Local\Temp\0FABA8BB-BAB0-7891-817B-68C91482EB66\Latest\ccp.exe</path><vendor>Trojan.RotBrowse</vendor><action></action><hash>2b982ebe7209b284fc8a3d9f6b990af6</hash></file>
<file><path>C:\Users\Sarah\AppData\Local\Temp\0FABA8BB-BAB0-7891-817B-68C91482EB66\Latest\CrxInstaller.dum</path><vendor>PUP.Optional.Babylon.A</vendor><action></action><hash>873c7d6f0774a096d4c3f137b24f42be</hash></file>
<file><path>C:\Users\Sarah\AppData\Local\Temp\0FABA8BB-BAB0-7891-817B-68C91482EB66\Latest\MyBabylonTB.exe</path><vendor>PUP.Optional.Delta</vendor><action></action><hash>07bc628a7605d066dba940d830d1f010</hash></file>
<file><path>C:\Users\Sarah\AppData\Local\Temp\0FABA8BB-BAB0-7891-817B-68C91482EB66\Latest\Setup.exe</path><vendor>PUP.Optional.Babylon.A</vendor><action></action><hash>0ab9b834b8c355e1a8ea130b7e826997</hash></file>
<file><path>C:\Users\Sarah\Downloads\FLV_Runner.exe</path><vendor>PUP.Optional.Conduit</vendor><action></action><hash>7f44e408ed8e1b1bd9dc959a5aa60af6</hash></file>
<file><path>C:\Users\Sarah\Downloads\Java.exe</path><vendor>PUP.Optional.BundleInstaller.A</vendor><action></action><hash>3e85d418d6a5e254dc20e272bc45f30d</hash></file>
<file><path>C:\Users\Sarah\Downloads\setup.exe</path><vendor>PUP.Optional.OutBrowse</vendor><action></action><hash>e8dbe6066318bb7bcddbd0a65ba9a15f</hash></file>
<file><path>C:\Users\Sarah\Desktop\Configure VO Package.lnk</path><vendor>PUP.Optional.VOPackage</vendor><action></action><hash>b90aa8447308fd39d779ff02e51edd23</hash></file>
<file><path>C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\092exu8s.default\searchplugins\Web Search.xml</path><vendor>PUP.Optional.WebSearch.A</vendor><action></action><hash>aa1908e4116a092d3e741b0ace35e51b</hash></file>
<file><path>C:\Users\Sarah\AppData\Roaming\OpenCandy\7F47F4897B06466391975239152579A8\TuneUpUtilities2013-2200217_de-DE.exe</path><vendor>PUP.Optional.OpenCandy</vendor><action></action><hash>dee540ac8eed77bf3dfcaf20966c31cf</hash></file>
<file><path>C:\Users\Sarah\AppData\Roaming\OpenCandy\E0FE69F5708644DEB5CBD008E13193AF\5472.ico</path><vendor>PUP.Optional.OpenCandy</vendor><action></action><hash>dee540ac8eed77bf3dfcaf20966c31cf</hash></file>
<file><path>C:\Users\Sarah\AppData\Roaming\OpenCandy\E0FE69F5708644DEB5CBD008E13193AF\EBB77268-338F-4C6A-8590-AD88FED26F4A</path><vendor>PUP.Optional.OpenCandy</vendor><action></action><hash>dee540ac8eed77bf3dfcaf20966c31cf</hash></file>
<file><path>C:\Users\Sarah\AppData\Roaming\OpenCandy\E0FE69F5708644DEB5CBD008E13193AF\OCBrowserHelper_1.0.6.125.exe</path><vendor>PUP.Optional.OpenCandy</vendor><action></action><hash>dee540ac8eed77bf3dfcaf20966c31cf</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\1.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\a.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\b.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\c.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\d.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\e.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\f.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\g.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\h.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\i.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\j.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\k.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\l.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\m.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\mru.xml</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\n.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\o.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\p.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\q.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\r.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\s.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\t.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\u.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\v.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\w.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\wlu.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\x.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\y.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\PriceGong\Data\z.txt</path><vendor>PUP.Optional.PriceGong.A</vendor><action></action><hash>398af0fcfd7ecc6a2394a131e71b35cb</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\ldrtbFLV_.dll</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\tbFLV_.dll</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\ThirdPartyComponents.xml</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\toolbar.cfg</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_images_main_menu_home_page_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_images_main_menu_options_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_images_main_menu_privacy_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_images_main_menu_refresh_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_images_main_menu_shrink_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_images_main_menu_upgrade_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_images_SearchEngines_dictionary_search_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_images_SearchEngines_ebay_search_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_68_300_CT3008668_Images_633590752453893750_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_68_300_CT3008668_Images_633590753577643750_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_68_300_CT3008668_Images_633629754211018750_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_68_300_CT3008668_Images_Email_xml-10-Classic-633439771938243750_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_68_300_CT3008668_Images_Facebook_xml-3-Facebook-634167202439133750_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_68_300_CT3008668_Images_SearchActivationButton-go_but01_gif-General-633629754908675000_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___oryte_com_content_icons_calendar_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_68_300_CT3008668_Images_633590751926237500_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankimages_commandcomps_block_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankImages_ConduitEngine_ContextMenu_LikeIcon_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Logout_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_images_main_menu_help_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_images_SearchEngines_encyc_search_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___tools_wiseconvert_com_images_menu_flv_icon_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_images_SearchEngines_images_search_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_images_SearchEngines_news_icon_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_images_searchengines_search_icon_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_images_SearchEngines_shopping_search_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_images_SearchEngines_weather_icon_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___tools_wiseconvert_com_images_menu_archive_icon_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___tools_wiseconvert_com_images_menu_audio_icon_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___tools_wiseconvert_com_images_menu_file_tools_icon_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___oryte_com_content_icons_calculator_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___oryte_com_content_icons_calculator_sci_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___tools_wiseconvert_com_images_menu_image_icon_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___tools_wiseconvert_com_images_menu_open_documents_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___tools_wiseconvert_com_images_menu_pdf_icon_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___tools_wiseconvert_com_images_menu_video_icon_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___tools_wiseconvert_com_images_menu_view_pdf_icon_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___weather_conduit_com_images_weather_Default_sunny_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_MoreFromPublisher_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_More_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Options_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Privacy_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Refresh_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Upgrade_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Events_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_BankImages_Facebook_Facebook_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Friends_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Groups_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Home_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Inbox_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___oryte_com_content_icons_calories_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___oryte_com_content_icons_clock_ico.ico</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___oryte_com_content_icons_clothes_ico.ico</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___oryte_com_content_icons_coins_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___oryte_com_content_icons_datecalc_ico.ico</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___oryte_com_content_icons_fileconverter_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___oryte_com_content_icons_map_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___oryte_com_content_icons_spellchecker_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___oryte_com_content_icons_stopwatch_ico.ico</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___oryte_com_content_icons_translator_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___oryte_com_content_icons_unitconverter_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___oryte_com_content_icons_widget_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___oryte_com_content_icons_worddef_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___oryte_com_content_todo_img_favicon_ico.ico</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_18_320_CT3201318_Images_634688351076901355_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_68_300_CT3008668_Images_633590750635300000_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_68_300_CT3008668_Images_633590751044362500_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Photos_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Profile_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Settings_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Share_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Status_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_images_ClientImages_radio_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_Images_ClientResources_mini_browser_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_images_main_menu_about_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_images_main_menu_clear_history_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_images_main_menu_contact_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankimages_CommandComps_calculator_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankimages_CommandComps_excel_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankimages_CommandComps_MsAccess_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankimages_CommandComps_msnmessenger_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankimages_CommandComps_notepad_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankimages_CommandComps_office_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankimages_CommandComps_OutlookExpress_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankimages_CommandComps_Outlook_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankimages_CommandComps_paint_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankimages_CommandComps_powerpoint_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankimages_CommandComps_RegistryEditor_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankimages_CommandComps_winword_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_conduit_com_bankimages_CommandComps_WMPlayer_gif.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_About_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Browse_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Hide_png.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\RoundedCornersIE9.css</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\DialogsAPI.js</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\excanvas.js</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\generalDialogStyle.css</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\PIE.htc</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\RoundedCorners.css</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\settings.js</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\version.txt</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\AddedAppDialog\app-added.js</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\AddedAppDialog\main.html</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\DefualtImages\icon.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\DetectedAppDialog\app-2go.js</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\DetectedAppDialog\main.html</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\EngineFirstTimeDialog\EngineFirstTimeDialog.js</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\EngineFirstTimeDialog\main.html</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\EngineFirstTimeDialog\right-click.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\NewSearchProtectorDialog\main.html</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\NewSearchProtectorDialog\SearchProtector.css</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\NewSearchProtectorDialog\SearchProtector.js</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\NewSearchProtectorDialog\images\ok-button.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\NewSearchProtectorDialog\images\separation-line.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\NewSearchProtectorDialog\images\warning.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorBubbleDialog\bubble.css</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorBubbleDialog\bubble.js</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorBubbleDialog\main.html</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorBubbleDialog\images\information.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorBubbleDialog\images\x-default-LTR.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorBubbleDialog\images\x-default-RTL.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorBubbleDialog\images\x-mouseover-LTR.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorBubbleDialog\images\x-mouseover-RTL.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorDialog\main.html</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorDialog\SearchProtector.css</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorDialog\SearchProtector.js</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorDialog\Images\info.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorDialog\Images\ok-on.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorDialog\Images\ok.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorRetakeoverDialog\main.html</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorRetakeoverDialog\SearchProtectorRetakeover.css</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorRetakeoverDialog\SearchProtectorRetakeover.js</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorRetakeoverDialog\Images\Icon.jpg</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorRetakeoverDialog\Images\Icon.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorRetakeoverDialog\Images\info.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorRetakeoverDialog\Images\ok-on.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\SearchProtectorRetakeoverDialog\Images\ok.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\ToolbarFirstTimeDialog\main.html</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\ToolbarFirstTimeDialog\ToolbarFirstTimeDialog.css</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\ToolbarFirstTimeDialog\ToolbarFirstTimeDialog.js</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\ToolbarFirstTimeDialog\images\app-store-icon.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\ToolbarFirstTimeDialog\images\arrow.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\ToolbarFirstTimeDialog\images\divider.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\ToolbarFirstTimeDialog\images\emailNotifier.gif</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\ToolbarFirstTimeDialog\images\facebook.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\ToolbarFirstTimeDialog\images\radio.GIF</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\ToolbarFirstTimeDialog\images\Thumbs.db</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\ToolbarFirstTimeDialog\images\truste_welcome.GIF</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\ToolbarFirstTimeDialog\images\weather.GIF</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\ToolbarUntrustedAppsApprovalDialog\main.html</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\ToolbarUntrustedAppsApprovalDialog\ToolbarUntrustedAppsApprovalDialog.js</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\UntrustedAddedAppDialog\main.html</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\UntrustedAddedAppDialog\UT-app-dialog-added.js</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\UntrustedAppApprovalDialog\main.html</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\UntrustedAppApprovalDialog\UT-app-dialog-needs-your-approval.js</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\UntrustedAppPendingDialog\main.html</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Dialogs\UntrustedAppPendingDialog\UT-app-dialog-is-waiting.js</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\EmailNotifier\AccountTypes.xml</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\EmailNotifier\aol.com.xml</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\EmailNotifier\comcast.net.xml</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\EmailNotifier\google.com.xml</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\EmailNotifier\hotmail.com.xml</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\EmailNotifier\yahoo.com.xml</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=GottenApps&amp;locale=en.xml</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=OtherApps&amp;locale=en.xml</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=SharedApps&amp;locale=en.xml</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=Toolbar&amp;locale=en.xml</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\ExternalComponent\http___oryte_com_content_translate_xml_tools_xml.xml</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\ExternalComponent\http___tools_wiseconvert_com_tools_xml.xml</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\manifest.xml</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3\bin\PriceGongIE.dll</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.5.3\bin\PriceGong_16.png</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\RadioPlayer\IP_Stations_Media_List.xml</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\RadioPlayer\Predefined_Media_List.xml</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Repository\conduit_CT3201318_CT3201318\AppsMetaData\data.bck.txt</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Repository\conduit_CT3201318_CT3201318\AppsMetaData\data.txt</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Repository\conduit_CT3201318_CT3201318\DynamicDialogs\data.txt</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Repository\conduit_CT3201318_CT3201318\ToolbarLogin\data.txt</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Repository\conduit_CT3201318_CT3201318\ToolbarSettings\data.txt</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\Repository\conduit_CT3201318_en\ToolbarTranslation\data.txt</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Sarah\AppData\LocalLow\FLV_Runner\SearchInNewTab\SearchInNewTabContent.xml</path><vendor>PUP.Optional.Conduit.A</vendor><action></action><hash>398a7478d2a94ee8b372b3327b87639d</hash></file>
<file><path>C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\092exu8s.default\prefs.js</path><vendor>PUP.Optional.SnapDo.A</vendor><action></action><baddata>user_pref(&quot;keyword.URL&quot;, &quot;hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&amp;q=&quot;);</baddata><gooddata></gooddata><hash>4281ca22a0db092d2887fb32768f36ca</hash></file>
<file><path>C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\092exu8s.default\prefs.js</path><vendor>PUP.Optional.Snapdo.A</vendor><action></action><baddata>user_pref(&quot;browser.startup.homepage&quot;, &quot;hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8lqw9z6KzCzs0u_J7E1gWqaX6GQnXpLXoGqDH54KArvHgFXCTIP_dCnZOZjDVASI,&quot;);</baddata><gooddata></gooddata><hash>dee5717b7efdcb6bbf4056d71aeb5ca4</hash></file>
<file><path>C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Preferences</path><vendor>PUP.Optional.Snapdo.A</vendor><action></action><baddata>  &quot;homepage&quot;: &quot;hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8lqw9z6KzCzs0u_J7E1gWqaX6GQnXpLXoGqDH54KArvHgFXCTIP_dCnZOZjDVASI,&quot;,</baddata><gooddata></gooddata><hash>942fd11b5724dd59a4b850ddcd3811ef</hash></file>
</items>
</mbam-log>
__________________
Geändert von Summer_Storm (12.09.2014 um 17:27 Uhr)

Alt 12.09.2014, 17:31   #4
Summer_Storm
 
Windows 7: Startseite in Browsern auf fremden Suchmaschinen + flackernder Browser - Standard

Windows 7: Startseite in Browsern auf fremden Suchmaschinen + flackernder Browser


Hi Matthias, vielen Dank für deine Hilfe! Eben habe ich dir den Export Log von Malware geschickt. Jetzt schicke ich dir die Ergebnisse von FRST.txt

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-09-2014
Ran by Sarah (administrator) on MULCH on 12-09-2014 18:23:50
Running from C:\Users\Sarah\Downloads
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe
(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Adobe Systems Inc.) C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [38768 2009-10-03] (Adobe Systems Incorporated)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [Acrobat Assistant 8.0] => C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [640376 2009-10-02] (Adobe Systems Inc.)
HKLM\...\Run: [hpqSRMon] => C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [ApnUpdater] => "C:\Program Files\Ask.com\Updater\Updater.exe"
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.)
HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [421776 2012-06-07] (Apple Inc.)
HKLM\...\Run: [mobilegeni daemon] => C:\Program Files\Mobogenie\DaemonProcess.exe    noìÄuà0= ŠT=`eC:\Windows\system32\user32.dll                         ]\ðÄuà0=     
HKU\S-1-5-21-923278769-240386288-3162056909-1001\...\Run: [msnmsgr] => "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
HKU\S-1-5-21-923278769-240386288-3162056909-1001\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x91000000
HKU\S-1-5-21-923278769-240386288-3162056909-1001\...\MountPoints2: H - H:\LaunchU3.exe -a
HKU\S-1-5-21-923278769-240386288-3162056909-1001\...\MountPoints2: {981c1f8c-f730-11df-aefb-806e6f6e6963} - H:\LaunchU3.exe -a
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3A,&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8lqw9z6KzCzs0u_J7E1gWqaX6GQnXpLXoGqDH54KArvHgFXCTIP_dCnZOZjDVASU,
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE47CAC211E82CA01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3A,&q={searchTerms}
URLSearchHook: HKLM - (No Name) - {a7347e8c-1ca6-469b-951e-4a23c4437935} -  No File
URLSearchHook: HKLM - (No Name) - {3bbd3c14-4c16-4989-8366-95bc9179779d} -  No File
SearchScopes: HKLM - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&q={searchTerms}
SearchScopes: HKLM - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&q={searchTerms}
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3A,&q={searchTerms}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3A,&q={searchTerms}
BHO: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: No Name -> {3bbd3c14-4c16-4989-8366-95bc9179779d} ->  No File
BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} ->  No File
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: No Name -> {a7347e8c-1ca6-469b-951e-4a23c4437935} ->  No File
BHO: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO: Avira SearchFree Toolbar plus Web Protection -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files\Ask.com\GenericAskToolbar.dll No File
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll No File
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKCU - No Name - {A7347E8C-1CA6-469B-951E-4A23C4437935} -  No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll No File
Toolbar: HKCU - No Name - {3BBD3C14-4C16-4989-8366-95BC9179779D} -  No File
DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} hxxp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0045-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\6xmli54h.default-1410170197280
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF Plugin: @divx.com/DivX Player Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Windows\system32\npdeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\6xmli54h.default-1410170197280\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Skype extension - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-09-08]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-02-22]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

Chrome: 
=======
CHR HomePage: Default -> hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8lqw9z6KzCzs0u_J7E1gWqaX6GQnXpLXoGqDH54KArvHgFXCTIP_dCnZOZjDVASI,
CHR StartupUrls: Default -> "hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8lqw9z6KzCzs0u_J7E1gWqaX6GQnXpLXoGqDH54KArvHgFXCTIP_dCnZOZjDVASI,"
CHR DefaultSearchKeyword: Default -> search.snapdo.com
CHR DefaultSearchURL: Default -> hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3ZQQWnWE23Qik11mFwB7WTYnaVdQO2kd5h4ba0Ukf_Jpvbci60sF0VZ3KMSws1Fe-CCAwz_3SbcVemoagra91YQtUQWKxBHH8mptHcct1gqUOWwtxRF71vGoXK1jVamBQ1qyCwavOYOUkXY0dK9j6j8MOejeMz3c,&q={searchTerms}
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR CustomProfile: C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-29]
CHR Extension: (AdBlock) - C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-04-21]
CHR Extension: (Reise durch Mittelerde) - C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjgkjeheegjnnmheaflhdocglkiegoni [2013-12-12]
CHR Extension: (Google Wallet) - C:\Users\Sarah\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [651720 2009-11-08] (Macrovision Europe Ltd.) [File not signed]
S2 gupdate1ca7c36ba35337e; C:\Program Files\Google\Update\GoogleUpdate.exe [133104 2009-12-13] (Google Inc.)
R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [248832 2009-05-21] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-05-21] (Hewlett-Packard Co.) [File not signed]
R2 HPSLPSVC; C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL [660992 2009-05-21] (Hewlett-Packard Co.) [File not signed]
R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
S3 OpenVPNService; C:\Program Files\OpenVPN\bin\openvpnserv.exe [14848 2011-12-15] () [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-09-12] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R1 StarOpen; C:\Windows\system32\Drivers\StarOpen.sys [5632 2006-07-24] () [File not signed]
R3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [26624 2011-12-15] (The OpenVPN Project)
R3 TNET1130; C:\Windows\System32\DRIVERS\GPlus.sys [283392 2004-05-21] ()

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-12 18:23 - 2014-09-12 18:24 - 00019322 _____ () C:\Users\Sarah\Downloads\FRST.txt
2014-09-12 18:23 - 2014-09-12 18:23 - 00000000 ____D () C:\FRST
2014-09-12 18:22 - 2014-09-12 18:22 - 01097728 _____ (Farbar) C:\Users\Sarah\Downloads\FRST.exe
2014-09-12 18:17 - 2014-09-12 18:17 - 00184644 _____ () C:\Users\Sarah\Desktop\malware.xml
2014-09-12 15:08 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-12 15:08 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-12 15:08 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-12 15:08 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-12 15:08 - 2014-08-18 23:57 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-12 15:08 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-12 15:08 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-12 15:08 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-12 15:08 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-12 15:08 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-12 15:08 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-12 15:08 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-12 15:08 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-12 15:08 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-12 15:08 - 2014-08-18 23:36 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-12 15:08 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-12 15:08 - 2014-08-18 23:30 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-12 15:08 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-12 15:08 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-12 15:08 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-12 15:08 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-12 15:08 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-12 15:08 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-12 15:08 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-12 15:08 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-12 15:08 - 2014-08-18 23:08 - 00673792 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-12 15:08 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-12 15:08 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-12 15:08 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-12 15:08 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-12 15:07 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-12 13:30 - 2014-09-12 13:31 - 00000472 _____ () C:\Users\Sarah\Downloads\defogger_disable.log
2014-09-12 13:30 - 2014-09-12 13:30 - 00000000 _____ () C:\Users\Sarah\defogger_reenable
2014-09-12 13:27 - 2014-09-12 13:27 - 00050477 _____ () C:\Users\Sarah\Downloads\Defogger.exe
2014-09-12 13:06 - 2014-09-12 16:58 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-12 13:03 - 2014-09-12 13:03 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-12 13:03 - 2014-09-12 13:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-09-12 13:03 - 2014-09-12 13:03 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-12 13:03 - 2014-09-12 13:03 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-09-12 13:03 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-12 13:03 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-12 13:03 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-12 13:02 - 2014-09-12 13:02 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Sarah\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-12 12:50 - 2014-09-12 12:50 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Sarah\Downloads\SpyHunter-Installer.exe
2014-09-12 08:47 - 2014-09-05 03:52 - 00445952 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-12 08:47 - 2014-09-05 03:47 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-12 08:47 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-12 08:47 - 2014-07-07 03:40 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-12 08:47 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-12 08:47 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-11 20:02 - 2014-09-11 20:02 - 00069288 _____ () C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-08 11:35 - 2013-10-08 08:51 - 00873384 _____ (Oracle Corporation) C:\Windows\system32\npdeployJava1.dll
2014-09-08 11:35 - 2013-10-08 08:51 - 00796072 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2014-09-08 11:22 - 2014-09-08 21:25 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-08 10:15 - 2014-08-23 03:46 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-09-08 10:15 - 2014-08-23 02:42 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-09-06 13:51 - 2014-09-06 13:51 - 00000000 ____D () C:\Users\Gast\AppData\Local\Google
2014-09-06 13:50 - 2014-09-06 13:50 - 00000000 ____D () C:\Users\Gast\AppData\Local\MoboGenie
2014-08-29 00:25 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-29 00:25 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-29 00:25 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-29 00:25 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-29 00:24 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-29 00:24 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-29 00:24 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-29 00:24 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-29 00:24 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-27 20:52 - 2014-08-27 20:52 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-08-27 20:47 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-27 20:47 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-27 20:47 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-27 20:47 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-27 11:16 - 2014-08-27 11:16 - 00000000 ____D () C:\Users\Sarah\AppData\Roaming\Mobogenie
2014-08-27 10:31 - 2014-07-14 03:42 - 00654336 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-27 10:31 - 2014-06-16 03:44 - 00730048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-27 10:31 - 2014-06-16 03:44 - 00219072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2014-08-27 10:31 - 2014-06-16 03:40 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-08-27 10:29 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-27 10:29 - 2014-06-18 03:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
2014-08-27 10:29 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-08-27 10:29 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-08-27 10:29 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-08-27 10:29 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-08-27 10:29 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-08-27 10:29 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-08-27 10:29 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-08-27 10:29 - 2014-03-04 11:17 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-08-27 10:29 - 2014-03-04 11:17 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-08-27 10:29 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-08-27 10:29 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-08-27 10:29 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-08-27 10:29 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-08-27 10:29 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-08-27 10:29 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-08-27 10:28 - 2014-06-06 11:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-08-27 10:28 - 2014-06-03 11:30 - 00101824 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-27 10:28 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-27 10:28 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-27 10:28 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-27 10:28 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-08-27 10:28 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-08-27 10:28 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-08-27 10:28 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-08-27 10:28 - 2014-05-30 09:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-08-27 10:28 - 2014-05-30 09:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-08-27 10:28 - 2014-05-30 08:36 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-08-27 10:28 - 2014-04-05 04:25 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-08-27 10:28 - 2014-04-05 04:24 - 00187840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-08-27 10:27 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-27 10:27 - 2014-05-08 11:06 - 02742784 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-08-27 10:27 - 2014-05-08 11:06 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2014-08-27 10:27 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-08-27 10:27 - 2014-04-12 04:15 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-08-27 10:27 - 2014-04-12 04:15 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-08-27 10:27 - 2014-04-12 04:12 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-08-27 10:27 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-08-27 10:27 - 2014-04-12 04:12 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-08-27 10:27 - 2014-04-12 04:11 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-12 18:24 - 2014-09-12 18:23 - 00019322 _____ () C:\Users\Sarah\Downloads\FRST.txt
2014-09-12 18:23 - 2014-09-12 18:23 - 00000000 ____D () C:\FRST
2014-09-12 18:22 - 2014-09-12 18:22 - 01097728 _____ (Farbar) C:\Users\Sarah\Downloads\FRST.exe
2014-09-12 18:17 - 2014-09-12 18:17 - 00184644 _____ () C:\Users\Sarah\Desktop\malware.xml
2014-09-12 18:06 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-09-12 17:44 - 2009-12-13 23:08 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-12 16:58 - 2014-09-12 13:06 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-12 16:33 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-09-12 15:39 - 2009-12-13 23:08 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-12 15:39 - 2009-10-24 17:25 - 01911577 _____ () C:\Windows\WindowsUpdate.log
2014-09-12 15:37 - 2009-07-14 06:34 - 00023344 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-12 15:37 - 2009-07-14 06:34 - 00023344 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-12 15:32 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-12 15:31 - 2009-07-14 06:39 - 00105718 _____ () C:\Windows\setupact.log
2014-09-12 15:07 - 2013-08-18 03:13 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-12 14:44 - 2014-05-09 13:55 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-12 14:44 - 2009-10-24 17:37 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-12 14:44 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-09-12 14:39 - 2009-10-24 17:28 - 01594028 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-12 14:34 - 2014-02-22 00:06 - 00006040 _____ () C:\Windows\system32\TEST.log
2014-09-12 13:31 - 2014-09-12 13:30 - 00000472 _____ () C:\Users\Sarah\Downloads\defogger_disable.log
2014-09-12 13:30 - 2014-09-12 13:30 - 00000000 _____ () C:\Users\Sarah\defogger_reenable
2014-09-12 13:30 - 2009-10-24 17:33 - 00000000 ____D () C:\Users\Sarah
2014-09-12 13:27 - 2014-09-12 13:27 - 00050477 _____ () C:\Users\Sarah\Downloads\Defogger.exe
2014-09-12 13:03 - 2014-09-12 13:03 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-12 13:03 - 2014-09-12 13:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-09-12 13:03 - 2014-09-12 13:03 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-12 13:03 - 2014-09-12 13:03 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-09-12 13:02 - 2014-09-12 13:02 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Sarah\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-12 12:50 - 2014-09-12 12:50 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Sarah\Downloads\SpyHunter-Installer.exe
2014-09-11 20:02 - 2014-09-11 20:02 - 00069288 _____ () C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-08 21:27 - 2009-07-14 06:33 - 01636240 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-08 21:25 - 2014-09-08 11:22 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-08 21:25 - 2012-04-26 22:08 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-09-08 21:25 - 2009-11-05 19:09 - 00359792 _____ () C:\Windows\PFRO.log
2014-09-08 12:10 - 2009-12-13 22:56 - 00000000 ____D () C:\Program Files\Google
2014-09-08 12:09 - 2010-06-30 22:59 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-09-08 12:05 - 2014-04-16 21:47 - 00000000 ____D () C:\Users\Sarah\Documents\Mobogenie
2014-09-08 12:04 - 2014-04-16 21:47 - 00000000 ____D () C:\Users\Sarah\AppData\Local\Mobogenie
2014-09-06 13:51 - 2014-09-06 13:51 - 00000000 ____D () C:\Users\Gast\AppData\Local\Google
2014-09-06 13:50 - 2014-09-06 13:50 - 00000000 ____D () C:\Users\Gast\AppData\Local\MoboGenie
2014-09-05 03:52 - 2014-09-12 08:47 - 00445952 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-05 03:47 - 2014-09-12 08:47 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-29 00:02 - 2009-07-14 10:56 - 00000000 ____D () C:\Program Files\Windows Journal
2014-08-27 21:06 - 2009-11-04 23:49 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-08-27 20:52 - 2014-08-27 20:52 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-08-27 20:45 - 2010-06-05 16:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-08-27 20:45 - 2009-10-24 23:50 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-08-27 11:16 - 2014-08-27 11:16 - 00000000 ____D () C:\Users\Sarah\AppData\Roaming\Mobogenie
2014-08-27 10:10 - 2014-04-16 21:47 - 00000000 ____D () C:\Users\Sarah\AppData\Local\cache
2014-08-25 06:53 - 2009-10-24 17:37 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-08-23 03:46 - 2014-09-08 10:15 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 02:42 - 2014-09-08 10:15 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-19 19:39 - 2014-09-12 15:08 - 00327872 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-19 00:26 - 2014-09-12 15:08 - 17455104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-19 00:08 - 2014-09-12 15:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-18 23:57 - 2014-09-12 15:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-18 23:57 - 2014-09-12 15:08 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-18 23:46 - 2014-09-12 15:08 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-18 23:45 - 2014-09-12 15:08 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-18 23:44 - 2014-09-12 15:08 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-18 23:44 - 2014-09-12 15:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-18 23:42 - 2014-09-12 15:08 - 02185728 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-18 23:39 - 2014-09-12 15:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-18 23:39 - 2014-09-12 15:08 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-18 23:37 - 2014-09-12 15:08 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-18 23:36 - 2014-09-12 15:08 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-18 23:36 - 2014-09-12 15:08 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-18 23:35 - 2014-09-12 15:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-18 23:30 - 2014-09-12 15:08 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-18 23:27 - 2014-09-12 15:08 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-18 23:22 - 2014-09-12 15:08 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-18 23:19 - 2014-09-12 15:08 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-18 23:17 - 2014-09-12 15:08 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-18 23:17 - 2014-09-12 15:08 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-18 23:15 - 2014-09-12 15:08 - 11769856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-18 23:09 - 2014-09-12 15:08 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-18 23:08 - 2014-09-12 15:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-18 23:08 - 2014-09-12 15:08 - 00673792 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-18 23:07 - 2014-09-12 15:08 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-18 22:46 - 2014-09-12 15:08 - 01812992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-18 22:38 - 2014-09-12 15:08 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-18 22:36 - 2014-09-12 15:08 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

Some content of TEMP:
====================
C:\Users\Sarah\AppData\Local\Temp\CmdLineExt.dll
C:\Users\Sarah\AppData\Local\Temp\contentDATs.exe
C:\Users\Sarah\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\Sarah\AppData\Local\Temp\FlashPlayerUpdate01.exe
C:\Users\Sarah\AppData\Local\Temp\FlashPlayerUpdate02.exe
C:\Users\Sarah\AppData\Local\Temp\FlashPlayerUpdate03.exe
C:\Users\Sarah\AppData\Local\Temp\FlashPlayerUpdate04.exe
C:\Users\Sarah\AppData\Local\Temp\instract.exe
C:\Users\Sarah\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe
C:\Users\Sarah\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\Sarah\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Sarah\AppData\Local\Temp\ose00000.exe
C:\Users\Sarah\AppData\Local\Temp\Risweb32.exe
C:\Users\Sarah\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\Sarah\AppData\Local\Temp\SHSetup.exe
C:\Users\Sarah\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Sarah\AppData\Local\Temp\uninst1.exe
C:\Users\Sarah\AppData\Local\Temp\ys_4jghc.dll
C:\Users\Sarah\AppData\Local\Temp\{123879A4-FF99-4226-AF16-6D756BB87920}-28.0.1500.72_chrome_installer.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-12 14:25

==================== End Of Log ============================
--- --- ---

--- --- ---


und hier von Addition.txt
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 11-09-2014
Ran by Sarah at 2014-09-12 18:25:24
Running from C:\Users\Sarah\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

 Update for Microsoft Office 2007 (KB2508958) (HKLM\...\{90120000-0015-0000-0000-0000000FF1CE}_Access_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)
 Update for Microsoft Office 2007 (KB2508958) (HKLM\...\{90120000-0016-0000-0000-0000000FF1CE}_EXCEL_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)
 Update for Microsoft Office 2007 (KB2508958) (HKLM\...\{90120000-0018-0000-0000-0000000FF1CE}_POWERPOINT_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)
 Update for Microsoft Office 2007 (KB2508958) (HKLM\...\{90120000-001B-0000-0000-0000000FF1CE}_WORD_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)
32 Bit HP CIO Components Installer (Version: 7.1.8 - Hewlett-Packard) Hidden
AAC Decoder (HKLM\...\{AEF9DC35ADDF4825B049ACBFD1C6EB37}) (Version: 7.1.0 - DivX, Inc.)
Accelrys Discovery Studio 3.5 Client (HKLM\...\{88BD4B2F-B6A7-462D-A8FC-D4B79FEE460E}) (Version: 3.50.0000 - Accelrys Software Inc.)
Accelrys DS ActiveX Control 3.5 (HKLM\...\{46C6845D-5FBD-4CFF-BD25-8092D1D0A2EB}) (Version: 3.5.0 - Accelrys Software Inc.)
Accelrys License Pack (HKLM\...\{9D0A98A1-E339-4B43-9ACC-E06D8542B07F}) (Version: 7.6.7 - Accelrys Software Inc.)
Adobe Acrobat 9 Pro Extended - English, Français, Deutsch (HKLM\...\{AC76BA86-1033-F400-7761-000000000004}{AC76BA86-1033-F400-7761-000000000004}) (Version: 9.2.0 - Adobe Systems)
Adobe Acrobat 9 Pro Extended - English, Français, Deutsch (Version: 9.2.0 - Adobe Systems) Hidden
Adobe Acrobat 9.2.0 - CPSID_50026 (HKLM\...\{AC76BA86-1033-F400-7761-000000000004}_920) (Version:  - Adobe Systems Incorporated)
Adobe After Effects CS3 (HKLM\...\Adobe_c83a500a161dde01884a425833966c4) (Version: 8 - Adobe Systems Incorporated)
Adobe After Effects CS3 (Version: 8 - Adobe Systems Incorporated) Hidden
Adobe After Effects CS3 Presets (Version: 8 - Adobe Systems Incorporated) Hidden
Adobe After Effects CS3 Template Projects & Footage (Version: 8 - Adobe Systems Incorporated) Hidden
Adobe After Effects CS3 Third Party Content (Version: 3 - Adobe Systems Incorporated) Hidden
Adobe Anchor Service CS3 (Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Asset Services CS3 (Version: 3 - Adobe Systems Incorporated) Hidden
Adobe Bridge CS3 (Version: 2 - Adobe Systems Incorporated) Hidden
Adobe Bridge Start Meeting (Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Camera Raw 4.0 (Version: 4.0 - Adobe Systems Incorporated) Hidden
Adobe CMaps (Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Color - Photoshop Specific (Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Color Common Settings (Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Color EU Recommended Settings (Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Color JA Extra Settings (Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Color NA Extra Settings (Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Default Language CS3 (Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Device Central CS3 (Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Dreamweaver CS3 (HKLM\...\Adobe_25db75244653b42cb93dc27939d1c0e) (Version: 9.0 - Adobe Systems Incorporated)
Adobe Dreamweaver CS3 (Version: 9 - Adobe Systems Incorporated) Hidden
Adobe ExtendScript Toolkit 2 (Version: 2.0 - Adobe Systems Incorporated) Hidden
Adobe Extension Manager CS3 (Version: 1.8 - Adobe Systems Incorporated) Hidden
Adobe Fireworks CS3 (HKLM\...\Adobe_6c7ed6c08f4acf68bf0512885eec384) (Version: 9.0 - Adobe Systems Incorporated)
Adobe Fireworks CS3 (Version: 9.0 - Adobe Systems Incorporated) Hidden
Adobe Flash CS3 (Version: 9.0 - Adobe Systems Incorporated) Hidden
Adobe Flash CS3 Professional (HKLM\...\Adobe_2225677e524ae91efb80c700be972bf) (Version: 9.0.0 - Adobe Systems Incorporated)
Adobe Flash Video Encoder (Version: 2.0 - Adobe Systems Incorporated) Hidden
Adobe Fonts All (Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Help Viewer CS3 (Version: 1 - Adobe Systems Incorporated) Hidden
Adobe Illustrator CS3 (HKLM\...\Adobe_c015d5ef39552390a753ee735d16041) (Version: 13.0 - Adobe Systems Incorporated)
Adobe Illustrator CS3 (Version: 13.0 - Adobe Systems Incorporated) Hidden
Adobe Linguistics CS3 (Version: 3.0.0 - Adobe Systems Incorporated) Hidden
Adobe MotionPicture Color Files (Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe PageMaker 6.5 (HKLM\...\Adobe PageMaker 6.5) (Version:  - )
Adobe PDF Library Files (Version: 8.0 - Adobe Systems Incorporated) Hidden
Adobe Photoshop 7.0 (HKLM\...\Adobe Photoshop 7.0) (Version: 7.0 - Adobe Systems, Inc.)
Adobe Photoshop CS3 (HKLM\...\Adobe_2ab305d4b0dea4a54f4852f3f5ed507) (Version: 10.0 - Adobe Systems Incorporated)
Adobe Photoshop CS3 (Version: 10 - Adobe Systems Incorporated) Hidden
Adobe Reader XI (11.0.03) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.03 - Adobe Systems Incorporated)
Adobe Setup (Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Stock Photos CS3 (Version: 1.5 - Adobe Systems Incorporated) Hidden
Adobe Type Support (Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe Update Manager CS3 (Version: 5.1.0 - Adobe Systems Incorporated) Hidden
Adobe Version Cue CS3 Client (Version: 3 - Adobe Systems Incorporated) Hidden
Adobe Video Profiles (Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe WinSoft Linguistics Plugin (Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe XMP DVA Panels CS3 (Version: 1.0 - Adobe Systems Incorporated) Hidden
Adobe XMP Panels CS3 (Version: 1.0 - Adobe Systems Incorporated) Hidden
Apple Application Support (HKLM\...\{122ADF8C-DDA1-480C-9936-C88F2825B265}) (Version: 2.1.9 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{8F1ADE4D-EFAC-4F5A-B346-23C2687FAF50}) (Version: 5.2.0.6 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Ask Toolbar (HKLM\...\{86D4B82A-ABED-442A-BE86-96357B70F4FE}) (Version: 1.12.5.0 - Ask.com) <==== ATTENTION
AutoUpdate (HKLM\...\{18D10072035C4515918F7E37EAFAACFC}) (Version: 1.1 - )
BoneLab (HKLM\...\{D16CBD59-07B3-4F98-A404-01B6D87A90F2}) (Version: 1.4.0.2 - Next Dimension Imaging)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
BufferChm (Version: 130.0.331.000 - Hewlett-Packard) Hidden
C309a (Version: 130.0.425.000 - Hewlett-Packard) Hidden
Destinations (Version: 140.0.77.000 - Hewlett-Packard) Hidden
DeviceDiscovery (Version: 130.0.372.000 - Hewlett-Packard) Hidden
DivX Codec (HKLM\...\{7B63B2922B174135AFC0E1377DD81EC2}) (Version: 6.9.1 - DivX, Inc.)
DivX Converter (HKLM\...\{13F3917B56CD4C25848BDC69916971BB}) (Version: 7.1.0 - DivX, Inc.)
DivX Converter (HKLM\...\{B13A7C41581B411290FBC0395694E2A9}) (Version: 7.1.0 - DivX, Inc.)
DivX Player (HKLM\...\{8ADFC4160D694100B5B8A22DE9DCABD9}) (Version: 7.2.0 - DivX, Inc.)
DivX Plus DirectShow Filters (HKLM\...\DivX Plus DirectShow Filters) (Version:  - DivX, Inc.)
DivX Plus Media Foundation Components (HKLM\...\{DA703982C580418795BF4001AA9D7061}) (Version: 1.0.0 - DivX, Inc.)
DivX Plus Web Player (HKLM\...\{B7050CBDB2504B34BC2A9CA0A692CC29}) (Version: 2.0.0 - DivX,Inc.)
DivX Version Checker (HKLM\...\{3FC7CBBC4C1E11DCA1A752EA55D89593}) (Version: 7.1.0.9 - DivX, Inc.)
DocProc (Version: 13.0.0.0 - Hewlett-Packard) Hidden
DriveImage XML (Private Edition) (HKLM\...\{F7E1CA14-B39D-452A-960B-39423DDDD933}) (Version: 2.44.000 - Runtime Software)
Dropbox (HKCU\...\Dropbox) (Version: 1.4.7 - Dropbox, Inc.)
DzSoft PHP Editor 4.2.6 (HKLM\...\DzSoftPhpEditor_is1) (Version: 4.2.6 - DzSoft Ltd)
EndNote X5 (HKLM\...\{86B3F2D6-AC2B-0015-8AE1-F2F77F781B0C}) (Version: 15.0.0.5478 - Thomson Reuters)
Fax (Version: 130.0.372.000 - Hewlett-Packard) Hidden
Foto-Mosaik-Edda 5.5.10 (HKLM\...\{BF962E1B-D17A-4713-A100-6531A132D83D}_is1) (Version:  - Steffen Schirmer)
Free Screen Video Recorder version 2.5.29.430 (HKLM\...\Free Screen Video Recorder_is1) (Version: 2.5.29.430 - DVDVideoSoft Ltd.)
Genesis 1.7.6 (HKLM\...\3511-9938-3696-8026) (Version: 1.7.6 - Institute for Genomics and Bioinformatics, Graz University of Technology)
Google Earth Plug-in (HKLM\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
GPBaseService2 (Version: 130.0.371.000 - Hewlett-Packard) Hidden
GTK+ Runtime 2.14.7 rev a (nur entfernen) (HKLM\...\GTK 2.0) (Version:  - )
H.264 Decoder (HKLM\...\{A96E97134CA649888820BCDE5E300BBD}) (Version: 1.1.0 - DivX, Inc.)
HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Photosmart C309a All-In-One Driver Software 13.0 Rel .5 (HKLM\...\{A9B54408-EF50-4821-B8A2-F597A657112A}) (Version: 13.0 - HP)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM\...\{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}) (Version: 5.003.001.001 - Hewlett-Packard)
HPPhotoGadget (Version: 130.0.282.000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabel_PaperLabel (Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabel_PrintOnDisc (Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabelContent1 (Version: 2.04.0000 - Hewlett-Packard) Hidden
hpphotosmartdisclabelplugin (Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotosmartEssential (Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (Version: 130.0.371.000 - Hewlett-Packard) Hidden
iTunes (HKLM\...\{6AD9F5F3-5BD0-4000-BD9C-B536CF86D988}) (Version: 10.6.3.25 - Apple Inc.)
Java 7 Update 45 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.450 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Junk Mail filter update (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
MarketResearch (Version: 130.0.374.000 - Hewlett-Packard) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Image Composite Editor (HKLM\...\{3D599ADA-65D9-4B51-898F-CE718DEC5DBB}) (Version: 1.4.4 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0015-0000-0000-0000000FF1CE}_Access_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0016-0000-0000-0000000FF1CE}_EXCEL_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0018-0000-0000-0000000FF1CE}_POWERPOINT_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-001B-0000-0000-0000000FF1CE}_WORD_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Access 2007 (HKLM\...\Access) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Access 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel 2007 (HKLM\...\EXCEL) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Excel 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office PowerPoint 2007 (HKLM\...\POWERPOINT) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office PowerPoint 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word 2007 (HKLM\...\WORD) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Word 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (HKLM\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MKV Splitter (HKLM\...\{AAC389499AEF40428987B3D30CFC76C9}) (Version: 1.0.1 - DivX, Inc.)
Mozilla Firefox 32.0 (x86 de) (HKLM\...\Mozilla Firefox 32.0 (x86 de)) (Version: 32.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
Mozilla Thunderbird 10.0 (x86 de) (HKLM\...\Mozilla Thunderbird 10.0 (x86 de)) (Version: 10.0 - Mozilla)
MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Namo WebEditor 8 Testversion (HKLM\...\{25B9FEB3-2E4C-4D66-A3C4-921FAE9A63DA}) (Version: 8.0 - Namo Interactive, Inc.)
Network (Version: 130.0.374.000 - Hewlett-Packard) Hidden
NVIDIA Grafiktreiber 307.83 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 307.83 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.109.706 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 307.83 (Version: 307.83 - NVIDIA Corporation) Hidden
NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.10.8 - NVIDIA Corporation) Hidden
OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)
OpenVPN 2.2.2 (HKLM\...\OpenVPN) (Version: 2.2.2 - )
PDF Settings (Version: 1.0 - Adobe Systems Incorporated) Hidden
Pidgin (HKLM\...\Pidgin) (Version: 2.6.5 - )
PS_AIO_05_C309_Software_Min (Version: 130.0.425.000 - Hewlett-Packard) Hidden
QuickTime (HKLM\...\{7BE15435-2D3E-4B58-867F-9C75BED0208C}) (Version: 7.71.80.42 - Apple Inc.)
Rapid PHP 2011 v11.4 (HKLM\...\Rapid PHP 2011_is1) (Version: Rapid PHP 2011 - Karlis Blumentals)
Samsung PC Studio 3 (HKLM\...\{C4A4722E-79F9-417C-BD72-8D359A090C97}) (Version: 3.2.2.80601 - Samsung Electronics Co., Ltd.)
Samsung PC Studio 3 (Version: 3.0.0.80601 - Samsung Electronics Co., Ltd.) Hidden
Scan (Version: 140.0.80.000 - Hewlett-Packard) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
Skype Toolbars (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.3.7555 - Skype Technologies S.A.)
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SmartWebPrinting (Version: 140.0.186.000 - Hewlett-Packard) Hidden
Snoopy (HKLM\...\{1F0E2B2E-068B-4B58-A360-816B81DB6EA9}) (Version: 3.01.01 - BTU-Cottbus)
SolutionCenter (Version: 130.0.373.000 - Hewlett-Packard) Hidden
Status (Version: 130.0.373.000 - Hewlett-Packard) Hidden
Toolbox (Version: 130.0.648.000 - Hewlett-Packard) Hidden
TrayApp (Version: 130.0.376.000 - Hewlett-Packard) Hidden
UnloadSupport (Version: 11.0.0 - Hewlett-Packard) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0015-0000-0000-0000000FF1CE}_Access_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0016-0000-0000-0000000FF1CE}_EXCEL_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0018-0000-0000-0000000FF1CE}_POWERPOINT_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-001B-0000-0000-0000000FF1CE}_WORD_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{90120000-0015-0000-0000-0000000FF1CE}_Access_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{90120000-0016-0000-0000-0000000FF1CE}_EXCEL_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{90120000-0018-0000-0000-0000000FF1CE}_POWERPOINT_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{90120000-001B-0000-0000-0000000FF1CE}_WORD_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{90120000-0015-0000-0000-0000000FF1CE}_Access_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{90120000-0016-0000-0000-0000000FF1CE}_EXCEL_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{90120000-0018-0000-0000-0000000FF1CE}_POWERPOINT_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{90120000-001B-0000-0000-0000000FF1CE}_WORD_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{90120000-0015-0000-0000-0000000FF1CE}_Access_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{90120000-0016-0000-0000-0000000FF1CE}_EXCEL_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{90120000-0018-0000-0000-0000000FF1CE}_POWERPOINT_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{90120000-001B-0000-0000-0000000FF1CE}_WORD_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_EXCEL_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_POWERPOINT_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_WORD_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
VC80CRTRedist - 8.0.50727.4053 (Version: 1.1.0 - DivX, Inc) Hidden
VLC media player 1.1.4 (HKLM\...\VLC media player) (Version: 1.1.4 - VideoLAN)
VO Package (HKLM\...\VOPackage) (Version: 1.0.0.0 - ) <==== ATTENTION
WebReg (Version: 130.0.132.017 - Hewlett-Packard) Hidden
Windows Live Anmelde-Assistent (HKLM\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Call (Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Communications Platform (Version: 14.0.8098.930 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 14.0.8093.805 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 14.0.8081.709 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 14.0.8091.0730 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Writer (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-923278769-240386288-3162056909-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Sarah\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-923278769-240386288-3162056909-1001_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-923278769-240386288-3162056909-1001_Classes\CLSID\{1AC77AE9-9EC6-405A-9F9B-C06AB3C10B71}\InprocServer32 -> C:\Program Files\Microsoft Research\Image Composite Editor\ShellExtension.dll No File
CustomCLSID: HKU\S-1-5-21-923278769-240386288-3162056909-1001_Classes\CLSID\{1EF21888-3BD8-4064-BAD3-4BF694952652}\InprocServer32 -> C:\Program Files\Microsoft Research\Image Composite Editor\WLPG.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-923278769-240386288-3162056909-1001_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-923278769-240386288-3162056909-1001_Classes\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-923278769-240386288-3162056909-1001_Classes\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-923278769-240386288-3162056909-1001_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-923278769-240386288-3162056909-1001_Classes\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-923278769-240386288-3162056909-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Sarah\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-923278769-240386288-3162056909-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Sarah\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-923278769-240386288-3162056909-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Sarah\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-923278769-240386288-3162056909-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Sarah\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-923278769-240386288-3162056909-1001_Classes\CLSID\{FBE88A10-FF53-11E0-AB2A-AE904824019B}\InprocServer32 -> C:\Users\Sarah\AppData\Local\ASKTOO~1\DOWNLO~1\AVIRAI~1.DLL No File

==================== Restore Points  =========================

21-04-2014 16:35:47 Windows-Sicherung
22-04-2014 16:43:29 Windows Update
28-04-2014 08:38:30 Windows Update
28-04-2014 08:41:42 Windows-Sicherung
29-04-2014 17:06:29 Windows Update
04-05-2014 13:13:30 Windows Update
04-05-2014 15:59:12 Windows Update
09-05-2014 10:13:40 Windows-Sicherung
09-05-2014 10:19:34 Windows Update
09-05-2014 11:54:38 Windows Update
27-08-2014 07:47:54 Windows-Sicherung
27-08-2014 08:11:23 Windows Update
27-08-2014 18:36:15 Windows Update
28-08-2014 22:23:21 Windows Update
08-09-2014 08:05:54 Windows-Sicherung
08-09-2014 08:15:16 Windows Update
08-09-2014 09:34:34 Removed Java(TM) 6 Update 33
08-09-2014 09:57:02 Removed MSXML 4.0 SP2 (KB954430)
08-09-2014 10:08:24 Removed J2SE Runtime Environment 5.0 Update 5
08-09-2014 10:34:42 Windows Update
12-09-2014 06:39:04 Windows Update
12-09-2014 12:37:08 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {4D73DFBF-6DC2-4155-8165-45CCF1548CA1} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {9659A0CC-B427-4A73-964B-8DA10E59EA67} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2009-12-13] (Google Inc.)
Task: {BBD5BB38-E411-4AFE-A7BD-840C16262706} - System32\Tasks\{C23B72EE-D449-498F-9C8E-FAF9CF76FA34} => C:\Program Files\Skype\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {CB929284-B38C-4764-86BD-2F22C4B6646F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2009-12-13] (Google Inc.)
Task: {EE493BEE-ED88-43B4-A431-E40E61B7C888} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2011-06-24 22:56 - 2011-06-24 22:56 - 00087328 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2011-06-24 22:56 - 2011-06-24 22:56 - 01241888 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2013-04-14 15:46 - 2013-01-31 11:00 - 00079648 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax.dll
2010-06-30 23:47 - 2009-02-27 16:39 - 00019968 _____ () C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.deu
2010-06-30 23:47 - 2009-02-27 16:32 - 00020480 _____ () C:\Program Files\Adobe\Acrobat 9.0\Acrobat\AcroTray.FRA
2014-09-08 11:23 - 2014-09-08 11:23 - 03715184 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============

Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Officejet 6500 E709a
Description: Officejet 6500 E709a
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service: 
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Photosmart B110 series
Description: Photosmart B110 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service: 
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (09/12/2014 04:57:39 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbam.exe, Version: 1.0.0.532, Zeitstempel: 0x53518532
Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e
Ausnahmecode: 0x40000015
Fehleroffset: 0x0008d6fd
ID des fehlerhaften Prozesses: 0xb8c
Startzeit der fehlerhaften Anwendung: 0xmbam.exe0
Pfad der fehlerhaften Anwendung: mbam.exe1
Pfad des fehlerhaften Moduls: mbam.exe2
Berichtskennung: mbam.exe3

Error: (09/12/2014 02:29:27 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mbam.exe, Version: 1.0.0.532, Zeitstempel: 0x53518532
Name des fehlerhaften Moduls: MSVCR100.dll, Version: 10.0.40219.325, Zeitstempel: 0x4df2be1e
Ausnahmecode: 0x40000015
Fehleroffset: 0x0008d6fd
ID des fehlerhaften Prozesses: 0x1278
Startzeit der fehlerhaften Anwendung: 0xmbam.exe0
Pfad der fehlerhaften Anwendung: mbam.exe1
Pfad des fehlerhaften Moduls: mbam.exe2
Berichtskennung: mbam.exe3

Error: (09/08/2014 11:52:39 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 32.0.0.5350, Zeitstempel: 0x53fc3d9f
Name des fehlerhaften Moduls: mozalloc.dll, Version: 32.0.0.5350, Zeitstempel: 0x53fc0a56
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0x15a0
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (09/08/2014 11:52:39 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 32.0.0.5350, Zeitstempel: 0x53fc3d9f
Name des fehlerhaften Moduls: mozalloc.dll, Version: 32.0.0.5350, Zeitstempel: 0x53fc0a56
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0x1368
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (09/08/2014 11:52:24 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: Mulch)
Description: Die Anwendung oder der Dienst "srptm" konnte nicht heruntergefahren werden.

Error: (09/08/2014 11:50:21 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: Mulch)
Description: Die Anwendung oder der Dienst "linmsl" konnte nicht heruntergefahren werden.

Error: (09/08/2014 11:49:59 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 32.0.0.5350, Zeitstempel: 0x53fc3d9f
Name des fehlerhaften Moduls: mozalloc.dll, Version: 32.0.0.5350, Zeitstempel: 0x53fc0a56
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0x14f0
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (05/04/2014 05:34:54 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.163"1".
Die abhängige Assemblierung "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.163"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (04/29/2014 05:19:16 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.163"1".
Die abhängige Assemblierung "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.163"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (04/19/2014 07:24:17 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 16734


System errors:
=============
Error: (09/12/2014 03:33:07 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (09/12/2014 03:31:33 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 6) (User: NT-AUTORITÄT)
Description: Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich an den Computerhersteller, um aktualisierte Firmware zu erhalten.

Error: (09/12/2014 03:30:26 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 6) (User: NT-AUTORITÄT)
Description: Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich an den Computerhersteller, um aktualisierte Firmware zu erhalten.

Error: (09/12/2014 08:32:40 AM) (Source: Microsoft-Windows-Application-Experience) (EventID: 205) (User: NT-AUTORITÄT)
Description: Der Dienst "Programmkompatibilitäts-Assistent" konnte Phase 2 nicht initialisieren.

Error: (09/12/2014 08:32:37 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (09/12/2014 08:31:19 AM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 6) (User: NT-AUTORITÄT)
Description: Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich an den Computerhersteller, um aktualisierte Firmware zu erhalten.

Error: (09/11/2014 07:59:36 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (09/11/2014 07:59:18 PM) (Source: DCOM) (EventID: 10016) (User: Mulch)
Description: AnwendungsspezifischLokalAktivierung{8BC3F05E-D86B-11D0-A075-00C04FB68820}{8BC3F05E-D86B-11D0-A075-00C04FB68820}MulchGastS-1-5-21-923278769-240386288-3162056909-501LocalHost (unter Verwendung von LRPC)

Error: (09/11/2014 07:58:15 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 6) (User: NT-AUTORITÄT)
Description: Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich an den Computerhersteller, um aktualisierte Firmware zu erhalten.

Error: (09/08/2014 09:28:30 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)


Microsoft Office Sessions:
=========================
Error: (02/14/2013 04:23:55 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 15589 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (10/12/2012 03:25:38 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 893530 seconds with 900 seconds of active time.  This session ended with a crash.

Error: (07/20/2012 11:59:57 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2300 seconds with 120 seconds of active time.  This session ended with a crash.

Error: (12/26/2011 05:10:07 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 23945 seconds with 120 seconds of active time.  This session ended with a crash.

Error: (08/12/2011 01:04:28 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 7011 seconds with 2820 seconds of active time.  This session ended with a crash.


==================== Memory info =========================== 

Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz
Percentage of memory in use: 67%
Total physical RAM: 2047.43 MB
Available physical RAM: 661.07 MB
Total Pagefile: 4094.86 MB
Available Pagefile: 2225.67 MB
Total Virtual: 2047.88 MB
Available Virtual: 1898.74 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.66 GB) (Free:318.53 GB) NTFS
Drive f: (VAIO) (Fixed) (Total:27.95 GB) (Free:9.73 GB) NTFS
Drive g: (VAIO) (Fixed) (Total:121.1 GB) (Free:5.97 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 149.1 GB) (Disk ID: 637AE7F4)
Partition 1: (Active) - (Size=27.9 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=121.1 GB) - (Type=OF Extended)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 72F3E2F6)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Alt 12.09.2014, 21:41   #5
M-K-D-B
/// TB-Ausbilder
 
Windows 7: Startseite in Browsern auf fremden Suchmaschinen + flackernder Browser - Standard

Windows 7: Startseite in Browsern auf fremden Suchmaschinen + flackernder Browser


Schritt 1
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).





Schritt 2
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.







Schritt 3
Bitte deaktiviere dein Anti-Viren-Programm, da es das Ergebnis beeinflussen oder ggf. die Bereinigung stören kann.
Bitte lade dir zoek.exe von hier: http://hijackthis.nl/smeenk/ und speichere die Datei auf deinem Desktop.
  • Starte Zoek.exe mit einem Doppelklick.
  • Achtung: Das folgende Skript wurde nur für diesen speziellen Fall geschrieben und könnte andere Computer beschädigen.
  • Kopiere den Text der folgenden Box in das Skriptfenster von zoek:
    Code:
    ATTFilter
    iedefaults;
resetIEproxy;
shortcutfix;
FFdefaults;
CHRdefaults;
emptyclsid;
  • Nun klicke auf "Run script" und sei geduldig bis das Skript durchgelaufen ist.
  • Wenn das Tool fertig ist, wird sich Notepad mit der Logdatei öffnen (ggf. erst nach einem Neustart). Das Log befindet sich aber auch noch unter c:\ .
  • Bitte poste mir das ZOEK-Log (möglichst in CODE-Tags - #-Symbol im Antwortfenster klicken).





Schritt 4
  • Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Scan.
  • FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
  • Poste mir beide Logdateien mit deiner nächsten Antwort.






Bitte poste mit deiner nächsten Antwort
  • die Logdatei von AdwCleaner,
  • die Logdatei von MBAM,
  • die Logdatei von Zoek,
  • die beiden neuen Logdateien von FRST.
Alt 16.09.2014, 11:37   #6
M-K-D-B
/// TB-Ausbilder
 
Windows 7: Startseite in Browsern auf fremden Suchmaschinen + flackernder Browser - Standard

Windows 7: Startseite in Browsern auf fremden Suchmaschinen + flackernder Browser


Fehlende Rückmeldung
Dieses Thema wurde aus den Abos gelöscht. Somit bekomme ich keine Benachrichtigung über neue Antworten.
PM an mich falls Du denoch weiter machen willst.

Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen!

Antwort

Themen zu Windows 7: Startseite in Browsern auf fremden Suchmaschinen + flackernder Browser
anti-malware, bildschirm flackert, computer, fehlercode 0x40000015, fehlercode 0x80000003, flackernder bildschirm/browser, internet explorer, malwarebytes, mobogenie, mobogenie entfernen, savefinder, spyhunter, spyhunter entfernen, startseite, suchmaschine, super, windows 7


« Pc öffnet bei start cmd und farmaster.net | Firefox wird von Werbung zugespammt ("Ads by ss8" und jetzt "Ads bei info") »


Ähnliche Themen: Windows 7: Startseite in Browsern auf fremden Suchmaschinen + flackernder Browser


  1. yahoo suche (startseite + neuer tab) in allen Browsern
    Plagegeister aller Art und deren Bekämpfung - 14.09.2015 (25)
  2. Windows 8.1: Startseite im Browser wird auf Yahoo umgeleitet, Webseiten blenden Werbung von Strong Signal ein
    Log-Analyse und Auswertung - 08.06.2015 (9)
  3. Plötzlich Software "picexa.exe" installiert, "delta-homes.com" als Startseite in sämtlichen Browsern
    Log-Analyse und Auswertung - 10.04.2015 (11)
  4. Ungewollte Startseite in den Browsern - http://www.default-search.net - wie entferne ich das?
    Plagegeister aller Art und deren Bekämpfung - 23.09.2014 (17)
  5. Windows Installer Version / RegCleanPro / Flackernder Bildschirm
    Plagegeister aller Art und deren Bekämpfung - 25.06.2014 (5)
  6. Windows xp: Pc ist langsam seit dem öffnen einer fremden Datei (Java/Dldr.Obfshlp.AQ)
    Log-Analyse und Auswertung - 05.06.2014 (19)
  7. Windows 7: Leerlauf Scan im BitDefender wird immer wieder ausgeschaltet und Browser Startseite "google" wird geändert
    Log-Analyse und Auswertung - 20.05.2014 (13)
  8. Windows 8: Browser öffnet unaufgefordert neue Fenster, Rückkehr zur Startseite
    Log-Analyse und Auswertung - 09.04.2014 (12)
  9. Windows 8: Sämtliche Browser starten mit 22find.com Startseite
    Log-Analyse und Auswertung - 08.04.2014 (8)
  10. Windows 7: Browser Startseite ist unveränderbar yahoo ...mit spigot
    Log-Analyse und Auswertung - 19.01.2014 (6)
  11. Windows 7, 64-bit, Browser-Startseite auf "wisersearch" geändert
    Plagegeister aller Art und deren Bekämpfung - 03.01.2014 (14)
  12. Windows 7: FBDownloaderSearch macht sich zur Startseite im Browser, popup-Fenster öffnen sich
    Log-Analyse und Auswertung - 17.12.2013 (9)
  13. VLC download - eröffnet in allen browsern Startseite.com
    Plagegeister aller Art und deren Bekämpfung - 09.10.2012 (1)
  14. 100 euro trojaner nach der neuaufsetzung von windows xp alle dateien fotos mp3 txt in fremden format
    Plagegeister aller Art und deren Bekämpfung - 29.06.2012 (1)
  15. ichanti.ru als Startseite in allen Browsern
    Log-Analyse und Auswertung - 25.03.2012 (4)
  16. Startseiten- und Suchmaschinen-Verbot | Kann PC Defender 2010 meinen Browser angreifen?
    Plagegeister aller Art und deren Bekämpfung - 03.08.2010 (11)
  17. Flackernder/Schwarzer Bildschirm, Virusverdacht
    Plagegeister aller Art und deren Bekämpfung - 13.04.2010 (0)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Windows 7: Startseite in Browsern auf fremden Suchmaschinen + flackernder Browser - Hi, ich habe seit einigen Wochen komische Suchseiten statt meiner Startseite (habe ich nie benutzt). Weil ich keine Zeit hatte, habe ich das ignoriert. Seit wenigen Tagen flackert nun mein - Windows 7: Startseite in Browsern auf fremden Suchmaschinen + flackernder Browser...
Archiv
Du betrachtest: Windows 7: Startseite in Browsern auf fremden Suchmaschinen + flackernder Browser auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54