| Lorenz_W | 08.09.2013 15:35 |
ZBot / ZeuS Trojaner Telekombrief; VISA-card Hack
Hallo Trojaner-Boardteam,
als ich gestern aus dem Urlaub gekommen bin habe ich einen Brief von der Telekom mit dem Betreff: Erneute Sicherheitswarnung zu Ihrem Internet-Zugang im Postkasten gesehen. Der Brief ist vom 22. August, die vorherige Warnung habe ich jedoch leider entweder nicht erhalten oder nicht registriert.
In dem Schreiben heißt es, dass Sicherheitsexperten der Telekom erkennen das sich ein Computer in unser Internet einwählt der mit dem Schadprogramm „ZeuS/ZBot“ (Online-Banking-Trojaner) infiziert wurde. Der Trojaner war wir feststellten auch schon vor ein paar Wochen tätig und hat mit der Visacard meiner Frau einen Einkauf getätigt.
Da ich das Programm natürlich schnellst möglich entfernt haben möchte habe ich über alle am Netz angeschlossenen PCs mit dem im Telekomschreiben empfohlen „DE-Cleaner“ „Hitman Pro“ von https://www.botfrei.de/telekom prüfen lassen. Dieser hat bei meinem PC die Malware SecondStepInstaller.exe gefunden und auch AVIRA hat den Virus oder das unerwünschte Programm 'TR/Crypt.XPACK.Gen3' [trojan] gefunden.
Außerdem habe ich die 3 Programm aus der „Anleitung für Hilfesuchende bei Trojaner- und Virenbefall“ heruntergeladen und den PC scannen lassen. Bei dem letzten Programm GMER erhielt ich jedoch schon beim Downloadversuch die Fehlermeldung „C:\Users\Lollo\AppData\Local\Temp konnte nicht gespeichert werden, weil Sie die Inhalte dieses Ordners nicht ändern können. Ändern Sie die Ordnereigenschaften und versuchen Sie es erneut oder versuchen Sie, an einem anderen Ort zu speichern.“
Leider ist es nicht möglich die Logfiles bei zu fügen da die Anzahl der Zeichen überschritten wird und beim Versuch 7-zip zu downloaden um die Dateien anzuhängen kommt die selbe Fehlermeldung wie beim Versuch GMER nämlich „C:\Users\Lollo\AppData\Local\Temp konnte nicht gespeichert werden, weil Sie die Inhalte dieses Ordners nicht ändern können. Ändern Sie die Ordnereigenschaften und versuchen Sie es erneut oder versuchen Sie, an einem anderen Ort zu speichern“
Deshalb der Anhang als rar Datei und hier immerhin die Logdatei mit dem Fund von HitmanPro. Code:
HitmanPro 3.7.7.205
www.hitmanpro.com
Computer name . . . . : LOLLO-PC
Windows . . . . . . . : 6.1.1.7601.X64/2
User name . . . . . . : Lollo-PC\Lollo
UAC . . . . . . . . . : Enabled
License . . . . . . . : Trial (30 days left)
Scan date . . . . . . : 2013-09-08 10:41:43
Scan mode . . . . . . : Normal
Scan duration . . . . : 25m 47s
Disk access mode . . : Direct disk access (SRB)
Cloud . . . . . . . . : Internet
Reboot . . . . . . . : Yes
Threats . . . . . . . : 2201
Traces . . . . . . . : 5898
Objects scanned . . . : 2.172.131
Files scanned . . . . : 104.712
Remnants scanned . . : 785.483 files / 1.281.936 keys
Miniport ____________________________________________________________________
Primary
DriverObject . . . : FFFFFA80047D54B0
DriverName . . . . : \Driver\atapi
DriverPath . . . . : \SystemRoot\system32\drivers\atapi.sys
StartIo . . . . . : 0000000000000000 +0
IRP_MJ_SCSI . . . : FFFFFA80046B22C0 +0
Solution
DriverObject . . . : FFFFFA80047D54B0
DriverName . . . . : \Driver\atapi
DriverPath . . . . : \SystemRoot\system32\drivers\atapi.sys
StartIo . . . . . : 0000000000000000 +0
IRP_MJ_SCSI . . . : FFFFF88000DC34D8 \SystemRoot\system32\drivers\ataport.SYS+29912
Malware _____________________________________________________________________
C:\Users\Lollo\AppData\Local\Temp\SecondStepInstaller.exe -> Quarantined
Size . . . . . . . : 2.824.352 bytes
Age . . . . . . . : 117.7 days (2013-05-13 17:26:44)
Entropy . . . . . : 8.0
SHA-256 . . . . . : 610387169AA53A5DEF2C07F2D6B692208AFD969125ECAC240780EED3CF1D9322
Product . . . . . : Search Protect
Publisher . . . . : Conduit
Description . . . : Search Protect by Conduit
Version . . . . . : 1.5.0.71
Copyright . . . . : 2012 (c) Conduit. All rights reserved.
RSA Key Size . . . : 2048
Authenticode . . . : Valid
> Kaspersky . . . . : not-a-virus:WebToolbar.Win32.Toolbar.w
Fuzzy . . . . . . : 101.0
Malware remnants ____________________________________________________________
C:\Program Files (x86)\FunWebProducts\ (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\ (Adware.MyWebSearch) -> PendingDelete
C:\Program Files (x86)\MyWebSearch\bar\1.bin\ (Adware.MyWebSearch) -> PendingDelete
C:\Program Files (x86)\MyWebSearch\bar\1.bin\CHROME.MANIFEST (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\1.bin\chrome\ (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\1.bin\chrome\M3FFXTBR.JAR (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\1.bin\F3BKGERR.JPG (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\1.bin\F3CJPEG.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 139.264 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 5.7
SHA-256 . . . . . : 3A52298814E576AE90C5108651E9871DD351FBFD29BFB9B32820FD80CF5C8B7D
Product . . . . . : Smiley Central
Publisher . . . . : FunWebProducts.com
Description . . . : JPEG Conversion DLL
Version . . . . . : 1.0.1.0
Copyright . . . . : Copyright © 2003, 2004, 2005
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\F3DTACTL.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 86.096 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 6.1
SHA-256 . . . . . : 3E5A4BA558F1DDD8AE007C4D7FC366159160D60090B0F818B7C6B7CBECBD5856
Product . . . . . : MyMailNotifier, Smotos, Webfetti, and Zwinky
Publisher . . . . : FunWebProducts.com
Description . . . : Fun Web Products Data Control
Version . . . . . : 1.0.0.8
Copyright . . . . : Copyright © 2004, 2005, 2006, 2007, 2008
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\F3HISTSW.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 278.610 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 6.5
SHA-256 . . . . . : C86A3E4E7531FFEFA5F8B858AF674FCF69460100E02209BD38462EE6A8C89621
Product . . . . . : History Swatter
Publisher . . . . : FunWebProducts.com
Description . . . : Fun Web Products History Swatter
Version . . . . . : 1.0.0.51
Copyright . . . . : Copyright © 2004, 2005, 2006, 2007, 2008, 2009
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\F3HKSTUB.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 24.684 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 2.2
SHA-256 . . . . . : 954DED69F8B4F332857DB05583F4E07F830BBBC682DF33D2325D2891C4E08E49
Product . . . . . : My Web Search Bar for Internet Explorer and FireFox
Publisher . . . . : MyWebSearch.com
Description . . . : MyWebSearch IE Search Box Protector
Version . . . . . : 1.0.0.0
Copyright . . . . : Copyright © 2009
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\F3HTMLMU.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 159.815 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 6.2
SHA-256 . . . . . : DCE3A95C0409FF765477E4E3F52D864A999901D96937A899CD24CCF2D5A3C7D3
Product . . . . . : Cursor Mania, Fun Buddy Icons, My Fun Cards, My Mail Signature, My Mail Stamp, My Mail Stationery, Smiley Central, and Zwinky
Publisher . . . . : FunWebProducts.com
Description . . . : Fun Web Products HTML Menu
Version . . . . . : 1,1,2,2
Copyright . . . . : Copyright © 2003-2008 Fun Web Products, Inc.
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\F3HTTPCT.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 77.906 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 5.1
SHA-256 . . . . . : 17EE69DD52249E727E8FFC8F02D8A14F5AB098B1A5846B290AF4615AEC969CAB
Product . . . . . : MyMailNotifier and Zwinky
Publisher . . . . : FunWebProducts.com
Description . . . : Fun Web Products" HTTP Control
Version . . . . . : 1.0.0.11
Copyright . . . . : Copyright © 2004-2009
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\F3IMSTUB.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 32.856 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 3.3
SHA-256 . . . . . : AF0C2F522DFDC4F6564CB78F1E47E07629D6C3615B18B6726E1B547592EAFDB9
Product . . . . . : Smiley Central
Publisher . . . . : FunWebProducts.com
Description . . . : Smiley Central MSN and IE GDI Ext DLL
Version . . . . . : 1.0.1.1
Copyright . . . . : Copyright © 2006, 2007, 2008, 2009, 2010
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\F3POPSWT.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 127.057 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 5.9
SHA-256 . . . . . : F8B3D92EC5FA8120B37BCBB1A328F55C2315FFFFB71A1EAFA4EDF653D1059463
Product . . . . . : PopSwatter
Publisher . . . . : FunWebProducts.com
Description . . . : Fun Web Products PopSwatter
Version . . . . . : 1.0.1.14
Copyright . . . . : Copyright © 2003, 2004, 2005, 2006, 2007, 2008
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\F3PSSAVR.SCR (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 32.768 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 3.6
SHA-256 . . . . . : 0FA040006582B5CE7EAE22BEEF2CB105BFBDBFFFB9696C08085505A1C0B84566
Product . . . . . : Popular Screensavers
Publisher . . . . : FunWebProducts.com
Description . . . : Popular Screensavers
Version . . . . . : 1.0.2.3
Copyright . . . . : Copyright © 2004, 2005, 2006, 2007, 2008, 2009, 2010
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\F3REGHK.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 28.776 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 2.8
SHA-256 . . . . . : 520B406CF957D3EE63DB16C2792F5FE16E5794C866F51013D85E17746E8481C8
Product . . . . . : My Web Search Bar for Internet Explorer and FireFox
Publisher . . . . : MyWebSearch.com
Description . . . : MyWebSearch IE Search Box Protector
Version . . . . . : 1.0.0.1
Copyright . . . . : Copyright © 2009
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\F3REPROX.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 184.320 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 6.5
SHA-256 . . . . . : 28387595FB003D10A5634D2AB2BBBC3B0877AC8D500545F6069A97B4200D8826
Product . . . . . : Smiley Central
Publisher . . . . : FunWebProducts.com
Description . . . : Smiley Central Rich Edit DLL
Version . . . . . : 1.0.3.6
Copyright . . . . : Copyright © 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\F3RESTUB.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 24.576 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 1.1
SHA-256 . . . . . : 76ADC93B3153CCD4AB6F692D78013CB75842F741168A6DE5ADEE56C23748B7A3
Product . . . . . : Smiley Central
Publisher . . . . : FunWebProducts.com
Description . . . : Smiley Central MSN Rich Edit DLL
Version . . . . . : 1.0.0.9
Copyright . . . . : Copyright © 2003,2004,2005
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\F3SCHMON.EXE (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 86.100 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 5.2
SHA-256 . . . . . : AEFAAF88E18813C1A1D8714FD9A31FFD4C5CA228ED304B6C31A5FB0BADE2BE7D
Product . . . . . : History Swatter
Publisher . . . . : FunWebProducts.com
Description . . . : Fun Web Products History Swatter
Version . . . . . : 1.0.0.51
Copyright . . . . : Copyright © 2004, 2005, 2006, 2007, 2008, 2009
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\F3SCRCTR.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 303.104 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 6.9
SHA-256 . . . . . : 3582FA25976B8BE26D5A0C0151E0CDABFD206395021118B2C653B91463E383BF
Product . . . . . : Popular Screensavers
Publisher . . . . : FunWebProducts.com
Description . . . : Popular Screensavers Tools
Version . . . . . : 1.0.2.15
Copyright . . . . : Copyright © 2004, 2005, 2006, 2007, 2008, 2009, 2010
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\F3SPACER.WMV (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\1.bin\F3WALLPP.DAT (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\1.bin\F3WPHOOK.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 20.480 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 2.0
SHA-256 . . . . . : 2CF54C47DDBC69EBC4E199E11C15C202844645AA97AED823AD2AC2DF54DF92F3
Fuzzy . . . . . . : -2.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\FWPBUDDY.PNG (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\1.bin\INSTALL.RDF (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\1.bin\M3AUXSTB.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 24.680 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 0.8
SHA-256 . . . . . : ACD573CCB17ECCB7D58286420CAB53FC3F91E73530F5EFC3CB2D8F83CDF20A41
Product . . . . . : My Web Search Bar
Publisher . . . . : MyWebSearch.com
Description . . . : My Web Search Bar
Version . . . . . : 1.0.0.0
Copyright . . . . : Copyright © 2009
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\M3DLGHK.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 36.970 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 4.5
SHA-256 . . . . . : CB2747522E06CBB60FB700529EFA8EA10E1BF3BE9F6A6AA9F34978430E14DA94
Product . . . . . : My Web Search Bar
Publisher . . . . : MyWebSearch.com
Description . . . : My Web Search Bar
Version . . . . . : 1.0.1.1
Copyright . . . . : Copyright © 2009, 2010
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\M3HIGHIN.EXE (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 16.501 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 1.9
SHA-256 . . . . . : 8FA7BF9398E65B478943853816C1F4D3BD68F5FF72B4E38C718522E60D001B19
Product . . . . . : My Web Search Bar
Publisher . . . . : MyWebSearch.com
Description . . . : Run a MyWebSearch DLL as an App
Version . . . . . : 1.0.0.1
Copyright . . . . : Copyright © 2007
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\M3HTML.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 86.078 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 6.1
SHA-256 . . . . . : CECF2B16A398141495764CE6CE4C507F37986E90D1F9705838962D879D446398
Product . . . . . : My Web Search Skin Tools
Publisher . . . . : MyWebSearch.com
Description . . . : MyWebSearch Html Player
Version . . . . . : 1.0.3.17
Copyright . . . . : Copyright © 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\M3IDLE.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 28.672 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 1.1
SHA-256 . . . . . : 08699111B161EB73BBDC3FB9DFF67B20047F439FEF42D9ACAF66CE058577E288
Product . . . . . : My Web Search Skin Tools
Publisher . . . . : MyWebSearch.com
Description . . . : MyWebSearch Idle Monitor
Version . . . . . : 1.0.3.3
Copyright . . . . : Copyright © 2000 - 2010
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\M3IMPIPE.EXE (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 16.479 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 0.9
SHA-256 . . . . . : 9D0E4B820EE29D405ED7C450584C5B3C402F612B53EAC5B99F152D0CCC8A9192
Product . . . . . : My Web Search Community Tools
Publisher . . . . : MyWebSearch.com
Description . . . : My Web Search Community Tools
Version . . . . . : 1.0.4.1
Copyright . . . . : Copyright © 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\M3MEDINT.EXE (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 16.500 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 1.9
SHA-256 . . . . . : 0FBB996ED580D44D9952FCD1960C8DDE4309EB69F10896D9EBF2A88C457F2999
Product . . . . . : My Web Search Bar
Publisher . . . . : MyWebSearch.com
Description . . . : Run a MyWebSearch DLL as an App
Version . . . . . : 1.0.0.1
Copyright . . . . : Copyright © 2007
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\M3MSG.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 155.738 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 6.2
SHA-256 . . . . . : 5E95CFA59DFE2AF356C6235C0576B3EA0C5CD2330C9F8EDD0553CE6E804A30EF
Product . . . . . : My Web Search Community Tools
Publisher . . . . : MyWebSearch.com
Description . . . : My Web Search Community Tools
Version . . . . . : 1.0.4.8
Copyright . . . . : Copyright © 2001-2009
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\M3OUTLCN.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 73.813 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 5.7
SHA-256 . . . . . : A4C483022C051C74424C510737AA4D013A5E87156DA3264411B70E67048B2308
Product . . . . . : My Web Search Bar
Publisher . . . . : MyWebSearch.com
Description . . . : My Web Search Outlook Container
Version . . . . . : 1.0.1.2
Copyright . . . . : Copyright © 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\M3PLUGIN.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 57.447 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 5.0
SHA-256 . . . . . : 0773E1C3C2E30185C07AAC09FFF4D78A5E7DA72550119EC533392D4FFEA049C1
Product . . . . . : My Web Search Plugin
Publisher . . . . : MyWebSearch.com
Description . . . : My Web Search Plugin for 32-bit Windows
Version . . . . . : 1.1.0.6
Copyright . . . . : Copyright © 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\M3SKIN.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 131.152 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 6.1
SHA-256 . . . . . : 88A55C0ADBB5F4E41FBC348D4A3B3BE327EE6E2237D18B356B7593A445BFBE17
Product . . . . . : My Mail Notifier, Smiley Central, and Zwinky
Publisher . . . . : MyWebSearch.com
Description . . . : My Web Search Skin Tools
Version . . . . . : 1.0.3.14
Copyright . . . . : Copyright © 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\M3SKPLAY.EXE (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 32.768 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 2.9
SHA-256 . . . . . : 05D73EF285F5313C00165CE00FDB6E355B54EBF8D25EE1F0E288950D0D227582
Product . . . . . : My Web Search Skin Tools
Publisher . . . . : MyWebSearch.com
Description . . . : MyWebSearch Skin Player
Version . . . . . : 1.0.3.13
Copyright . . . . : Copyright © 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\M3SLSRCH.EXE (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 24.685 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 4.0
SHA-256 . . . . . : 4DA75DD1538F42F78447E16478C5F1C54124270C705EDFDFED476A1D99E4FC87
Product . . . . . : My Web Search Bar for Internet Explorer and FireFox
Publisher . . . . : MyWebSearch.com
Description . . . : MyWebSearch SelectSearch Tool
Version . . . . . : 1.0.0.4
Copyright . . . . : Copyright © 2006, 2007, 2008, 2009, 2010
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\M3SRCHMN.EXE (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 28.783 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 3.5
SHA-256 . . . . . : 0FE2C1DDDBAC117F2F78BAC05914AE77E8B6E7308B82AD13DAEE293D9940130A
Product . . . . . : My Web Search Bar for Internet Explorer and FireFox
Publisher . . . . : MyWebSearch.com
Description . . . : MyWebSearch SearchScope Monitor
Version . . . . . : 1.0.0.5
Copyright . . . . : Copyright © 2006, 2007, 2008, 2009, 2010
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\MWSBAR.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 775.696 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 6.1
SHA-256 . . . . . : 3F1600C3037163CC499E832C7532CFEBFE481DB7AE30B26304F22F78DB022389
Product . . . . . : My Web Search Bar for Internet Explorer, FireFox, email clients, and messenger clients
Publisher . . . . : MyWebSearch.com
Description . . . : My Web Search Bar
Version . . . . . : 2.3.70.1
Copyright . . . . : Copyright © 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010
RSA Key Size . . . : 1024
Authenticode . . . : Valid
Fuzzy . . . . . . : -13.0
Startup
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\
References
HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\
HKU\S-1-5-21-3059642530-3758366382-3311971186-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\
C:\Program Files (x86)\MyWebSearch\bar\1.bin\MWSMLBTN.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 40.960 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 4.0
SHA-256 . . . . . : CB68434BA51FD83DE508EA0BC2D8896EFE168107DE268B33FB364C9DFADBDDCC
Product . . . . . : My Web Search Bar
Publisher . . . . : MyWebSearch.com
Description . . . : My Web Search Bar for Internet Explorer
Version . . . . . : 1.0.0.0
Copyright . . . . : Copyright © 2010
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\MWSOEMON.EXE (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 32.849 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 4.7
SHA-256 . . . . . : 882B0F2C2C66E6E9F06BF7461CE0C3A17BBA0CAD0730D6ED110521D8411B33CF
Product . . . . . : My Web Search Bar for Internet Explorer, email clients, and messenger clients
Publisher . . . . : MyWebSearch.com
Description . . . : My Web Search Plugin Loader
Version . . . . . : 1,2,2,7
Copyright . . . . : Copyright © 2003-2007 MyWebSearch.com
Running processes : 6616
Fuzzy . . . . . . : -2.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\MWSOEPLG.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 393.299 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 6.7
SHA-256 . . . . . : 43B4E0B2C61EE245949F5B0559C41EBE9C64B6501546FC78A412DD1A408AC1FD
Product . . . . . : My Web Search Bar, Fun Buddy Icons, and Smiley Central
Publisher . . . . : MyWebSearch.com
Description . . . : My Web Search Host Plugin
Version . . . . . : 1,4,1,1
Copyright . . . . : Copyright © 2003, 2004, 2005, 2006, 2007, 2008, 2009 MyWebSearch.com
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\MWSOESTB.DLL (Adware.MyWebSearch) -> PendingDelete
Size . . . . . . . : 45.134 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 4.9
SHA-256 . . . . . : 40122E18BA119092CD5D1D58C9FCB925512D7DD7CDF2E3066B4822B6895299B0
Product . . . . . : My Web Search Bar for Internet Explorer, email clients, and messenger clients
Publisher . . . . : MyWebSearch.com
Description . . . : My Web Search Plugin Loader
Version . . . . . : 1,2,4,0
Copyright . . . . : Copyright © 2003, 2004, 2005, 2006, 2007, 2008, 2009 MyWebSearch.com
Fuzzy . . . . . . : -6.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\MWSSRCAS.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 54.704 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 5.7
SHA-256 . . . . . : ACDB878B35F37835D44CA096D28DD22215E24A9729F14DC0F60593E3FDB0F5CD
Product . . . . . : MyWebSearch Search Assistant for Internet Explorer
Publisher . . . . : MyWebSearch.com
Description . . . : MyWebSearch Search Assistant
Version . . . . . : 1.2.0.1
Copyright . . . . : Copyright © 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010
RSA Key Size . . . : 1024
Authenticode . . . : Valid
Fuzzy . . . . . . : -13.0
Startup
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D}\
HKU\S-1-5-21-3059642530-3758366382-3311971186-1000\SOFTWARE\Microsoft\Internet Explorer\UrlSearchHooks\{00A6FAF6-072E-44cf-8957-5838F569A31D}
References
HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}\
HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}\
HKU\S-1-5-21-3059642530-3758366382-3311971186-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44cf-8957-5838F569A31D}\
C:\Program Files (x86)\MyWebSearch\bar\1.bin\MWSSVC.EXE (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 28.762 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 4.8
SHA-256 . . . . . : 8AFBD0A0705D4576EACC0017BD5367391FA16B011DB23DB839DD58C8127915F3
Product . . . . . : My Web Search Bar
Publisher . . . . : MyWebSearch.com
Description . . . : My Web Search Bar
Version . . . . . : 1.0.0.5
Copyright . . . . : Copyright © 2007, 2008
Service . . . . . : MyWebSearchService
Parent Name . . . : C:\Windows\system32\services.exe
Running processes : 4400
Fuzzy . . . . . . : -1.0
Startup
HKLM\SYSTEM\CurrentControlSet\Services\MyWebSearchService\
C:\Program Files (x86)\MyWebSearch\bar\1.bin\MWSUABTN.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 36.864 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 4.4
SHA-256 . . . . . : 9A61D4A30BA625F971524B30C367D9BEC9D449D2F8C2D2A0547887B837F538FE
Product . . . . . : My Web Search Bar
Publisher . . . . : MyWebSearch.com
Description . . . : My Web Search Bar for Internet Explorer
Version . . . . . : 1.0.0.0
Copyright . . . . : Copyright © 2010
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\1.bin\NPMYWEBS.DLL (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 24.683 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:26)
Entropy . . . . . : 1.7
SHA-256 . . . . . : 4207C7FBB27F1D3C6491B0CF7A52A9755672BEFDEBE410C9E899A51580DCD84C
Product . . . . . : My Web Search Plugin Stub
Publisher . . . . : MyWebSearch.com
Description . . . : My Web Search Plugin Stub for 32-bit Windows
Version . . . . . : 1.0.0.0
Copyright . . . . : Copyright © 2005
Fuzzy . . . . . . : -8.0
C:\Program Files (x86)\MyWebSearch\bar\Avatar\ (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Avatar\COMMON.F3S (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Game\ (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Game\CHECKERS.F3S (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Game\CHESS.F3S (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Game\REVERSI.F3S (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\icons\ (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\icons\CM.ICO (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\icons\MFC.ICO (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\icons\PSS.ICO (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\icons\SMILEY.ICO (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\icons\WB.ICO (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\icons\ZWINKY.ICO (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Message\ (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Message\COMMON.F3S (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Notifier\ (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Notifier\COMMON.F3S (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Notifier\DOG.F3S (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Notifier\FISH.F3S (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Notifier\KUNGFU.F3S (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Notifier\LIFEGARD.F3S (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Notifier\MAID.F3S (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Notifier\MAILBOX.F3S (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Notifier\OPERA.F3S (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Notifier\ROBOT.F3S (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Notifier\SEDUCT.F3S (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Notifier\SURFER.F3S (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Overlay\ (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Overlay\COMMON.F3S (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Settings\ (Adware.MyWebSearch) -> Deleted
C:\Program Files (x86)\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Deleted
C:\Windows\SysWOW64\f3PSSavr.scr (Adware.MyWebSearch) -> Deleted
Size . . . . . . . : 32.768 bytes
Age . . . . . . . : 1050.9 days (2010-10-23 13:22:27)
Entropy . . . . . : 3.6
SHA-256 . . . . . : 0FA040006582B5CE7EAE22BEEF2CB105BFBDBFFFB9696C08085505A1C0B84566
Product . . . . . : Popular Screensavers
Publisher . . . . : FunWebProducts.com
Description . . . : Popular Screensavers
Version . . . . . : 1.0.2.3
Copyright . . . . : Copyright © 2004, 2005, 2006, 2007, 2008, 2009, 2010
Fuzzy . . . . . . : 2.0
HKLM\SOFTWARE\Classes\FunWebProducts.DataControl.1\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\FunWebProducts.DataControl\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\FunWebProducts.HistoryKillerScheduler.1\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\FunWebProducts.HistoryKillerScheduler\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\FunWebProducts.HistorySwatterControlBar.1\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\FunWebProducts.HistorySwatterControlBar\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\FunWebProducts.HTMLMenu.1\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\FunWebProducts.HTMLMenu.2\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\FunWebProducts.HTMLMenu\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\FunWebProducts.IECookiesManager.1\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\FunWebProducts.IECookiesManager\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\FunWebProducts.KillerObjManager.1\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\FunWebProducts.KillerObjManager\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\FunWebProducts.PopSwatterBarButton.1\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\FunWebProducts.PopSwatterBarButton\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\FunWebProducts.PopSwatterSettingsControl.1\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\FunWebProducts.PopSwatterSettingsControl\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{1093995A-BA37-41D2-836E-091067C4AD17}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{120927BF-1700-43BC-810F-FAB92549B390}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{1F52A5FA-A705-4415-B975-88503B291728}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{247A115F-06C2-4FB3-967D-2D62D3CF4F0A}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{2E3537FC-CF2F-4F56-AF54-5A6A3DD375CC}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{3E720451-B472-4954-B7AA-33069EB53906}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{3E720453-B472-4954-B7AA-33069EB53906}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{819FFE21-35C7-4925-8CDA-4E0E2DB94302}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{8E9CF769-3D3B-40EB-9E2D-76E7A205E4D2}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{90449521-D834-4703-BB4E-D3AA44042FF8}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{991AAC62-B100-47CE-8B75-253965244F69}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{BBABDC90-F3D5-4801-863A-EE6AE529862D}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{D6FF3684-AD3B-48EB-BBB4-B9E6C5A355C1}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{DE38C398-B328-4F4C-A3AD-1B5E4ED93477}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25E}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25F}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{E79DFBC9-5697-4FBD-94E5-5B2A9C7C1612}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{E79DFBCB-5697-4FBD-94E5-5B2A9C7C1612}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{EB9E5C1C-B1F9-4C2B-BE8A-27D6446FDAF8}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Interface\{F87D7FB5-9DC5-4C8C-B998-D8DFE02E2978}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\MyWebSearch.ChatSessionPlugin.1\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\MyWebSearch.ChatSessionPlugin\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\MyWebSearch.HTMLPanel.1\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\MyWebSearch.HTMLPanel\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\MyWebSearch.MultipleButton.1\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\MyWebSearch.MultipleButton\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\MyWebSearch.OutlookAddin.1\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\MyWebSearch.OutlookAddin\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\MyWebSearch.PseudoTransparentPlugin.1\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\MyWebSearch.PseudoTransparentPlugin\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\MyWebSearch.UrlAlertButton.1\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\MyWebSearch.UrlAlertButton\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\MyWebSearchToolBar.SettingsPlugin.1\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\MyWebSearchToolBar.SettingsPlugin\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\MyWebSearchToolBar.ToolbarPlugin.1\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\MyWebSearchToolBar.ToolbarPlugin\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\ScreenSaverControl.ScreenSaverInstaller.1\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\ScreenSaverControl.ScreenSaverInstaller\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\TypeLib\{819FFE20-35C7-4925-8CDA-4E0E2DB94302}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}\ (Adware.MyWebSearch) -> PendingDelete
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}\ (Adware.MyWebSearch) -> PendingDelete
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\ (Adware.MyWebSearch) -> PendingDelete
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{25560540-9571-4D7B-9389-0F166788785A}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{7473D292-B7BB-4f24-AE82-7E2CE94BB6A9}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{7473D296-B7BB-4f24-AE82-7E2CE94BB6A9}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{799391D3-EB86-4bac-9BD3-CBFEA58A0E15}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{819FFE22-35C7-4925-8CDA-4E0E2DB94302}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{9AFB8248-617F-460d-9366-D71CDEDA3179}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{A9571378-68A1-443d-B082-284F960C6D17}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{D858DAFC-9573-4811-B323-7011A3AA7E61}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{1093995A-BA37-41D2-836E-091067C4AD17}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{120927BF-1700-43BC-810F-FAB92549B390}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{1F52A5FA-A705-4415-B975-88503B291728}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{247A115F-06C2-4FB3-967D-2D62D3CF4F0A}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{2E3537FC-CF2F-4F56-AF54-5A6A3DD375CC}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3E720451-B472-4954-B7AA-33069EB53906}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{3E720453-B472-4954-B7AA-33069EB53906}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{819FFE21-35C7-4925-8CDA-4E0E2DB94302}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{8E9CF769-3D3B-40EB-9E2D-76E7A205E4D2}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{90449521-D834-4703-BB4E-D3AA44042FF8}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{991AAC62-B100-47CE-8B75-253965244F69}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{BBABDC90-F3D5-4801-863A-EE6AE529862D}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{D6FF3684-AD3B-48EB-BBB4-B9E6C5A355C1}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{DE38C398-B328-4F4C-A3AD-1B5E4ED93477}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25E}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25F}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{E79DFBC9-5697-4FBD-94E5-5B2A9C7C1612}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{E79DFBCB-5697-4FBD-94E5-5B2A9C7C1612}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{EB9E5C1C-B1F9-4C2B-BE8A-27D6446FDAF8}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{F87D7FB5-9DC5-4C8C-B998-D8DFE02E2978}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{07B18EA0-A523-4961-B6BB-170DE4475CCA}\ (Adware.MyWebSearch) -> PendingDelete
HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{0D26BC71-A633-4E71-AD31-EADC3A1B6A3A}\ (Adware.MyWebSearch) -> PendingDelete
HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{29D67D3C-509A-4544-903F-C8C1B8236554}\ (Adware.MyWebSearch) -> PendingDelete
HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{3E720450-B472-4954-B7AA-33069EB53906}\ (Adware.MyWebSearch) -> PendingDelete
HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{7473D290-B7BB-4F24-AE82-7E2CE94BB6A9}\ (Adware.MyWebSearch) -> PendingDelete
HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{819FFE20-35C7-4925-8CDA-4E0E2DB94302}\ (Adware.MyWebSearch) -> PendingDelete
HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{8CA01F0E-987C-49C3-B852-2F1AC4A7094C}\ (Adware.MyWebSearch) -> PendingDelete
HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{8E6F1830-9607-4440-8530-13BE7C4B1D14}\ (Adware.MyWebSearch) -> PendingDelete
HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{C8CECDE3-1AE1-4C4A-AD82-6D5B00212144}\ (Adware.MyWebSearch) -> PendingDelete
HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\ (Adware.MyWebSearch) -> PendingDelete
HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D}\ (Adware.MyWebSearch) -> PendingDelete
HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{E79DFBC0-5697-4FBD-94E5-5B2A9C7C1612}\ (Adware.MyWebSearch) -> PendingDelete
HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C}\ (Adware.MyWebSearch) -> PendingDelete
HKLM\SOFTWARE\Wow6432Node\FocusInteractive\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Fun Web Products\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45dd-9B68-D6A12C30E5D7}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\f3ScrCtr.dll\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Multimedia\WMPlayer\Schemes\f3pss\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Media\WMSDK\sources\f3PopularScreensavers (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D}\ (Adware.MyWebSearch) -> PendingDelete
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\ (Adware.MyWebSearch) -> PendingDelete
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07B18EAB-A523-4961-B6BB-170DE4475CCA}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3E720452-B472-4954-B7AA-33069EB53906}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E79DFBCA-5697-4fbd-94E5-5B2A9C7C1612}\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\FunWebProducts (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\Mozilla\Firefox\Extensions\m3ffxtbr@mywebsearch.com (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@mywebsearch.com/Plugin\ (Adware.MyWebSearch) -> Deleted
HKLM\SOFTWARE\Wow6432Node\MyWebSearch\ (Adware.MyWebSearch) -> Deleted
HKLM\SYSTEM\ControlSet001\services\MyWebSearchService\ (Adware.MyWebSearch) -> PendingDelete
HKLM\SYSTEM\ControlSet002\services\MyWebSearchService\ (Adware.MyWebSearch) -> PendingDelete
HKLM\SYSTEM\CurrentControlSet\services\MyWebSearchService\ (Adware.MyWebSearch) -> PendingDelete
HKU\S-1-5-21-3059642530-3758366382-3311971186-1000\Software\FunWebProducts\ (Adware.MyWebSearch) -> Deleted
HKU\S-1-5-21-3059642530-3758366382-3311971186-1000\Software\InstalledBrowserExtensions\215 Apps\ (Adware.IWantThis) -> Deleted
HKU\S-1-5-21-3059642530-3758366382-3311971186-1000\Software\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}\ (Adware.MyWebSearch) -> Deleted
HKU\S-1-5-21-3059642530-3758366382-3311971186-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\{00A6FAF6-072E-44cf-8957-5838F569A31D} (Adware.MyWebSearch) -> PendingDelete
HKU\S-1-5-21-3059642530-3758366382-3311971186-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D}\ (Adware.MyWebSearch) -> PendingDelete
HKU\S-1-5-21-3059642530-3758366382-3311971186-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\ (Adware.MyWebSearch) -> PendingDelete
HKU\S-1-5-21-3059642530-3758366382-3311971186-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\ (Adware.MyWebSearch) -> Deleted
HKU\S-1-5-21-3059642530-3758366382-3311971186-1000\Software\MyWebSearch\ (Adware.MyWebSearch) -> Deleted
Potential Unwanted Programs _________________________________________________
C:\Program Files (x86)\Conduit\ (Conduit)
C:\Program Files (x86)\Conduit\Community Alerts\ (Conduit)
C:\Program Files (x86)\Conduit\Community Alerts\Alert.dll (Conduit)
Size . . . . . . . : 638.560 bytes
Age . . . . . . . : 186.8 days (2013-03-05 14:18:44)
Entropy . . . . . : 6.4
SHA-256 . . . . . : F22E58CDFE94D4A5FBBF2795A743B167ED9923E289E14654631E0077DD306C1D
Product . . . . . : Alert
Publisher . . . . : Conduit Ltd.
Description . . . : Alert
Version . . . . . : 1.1.4.1
Copyright . . . . : Copyright © Conduit Ltd. 2011.
RSA Key Size . . . : 1024
Authenticode . . . : Valid
Fuzzy . . . . . . : -15.0
C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml (Babylon)
C:\ProgramData\Babylon\ (Babylon)
C:\ProgramData\Babylon\BabAll.dat (Babylon)
C:\ProgramData\Babylon\Content\icons\ (Babylon)
C:\ProgramData\Babylon\Content\icons\64696AU7MP_glossary_icon.ico (Babylon) -> Deleted
C:\ProgramData\Babylon\Content\icons\6PR5580MEE_glossary_icon.ico (Babylon) -> Deleted
C:\ProgramData\Babylon\Content\icons\6RHZSDV3KE_glossary_icon.ico (Babylon) -> Deleted
C:\ProgramData\Babylon\Content\icons\7BZ95AEQPT_glossary_icon.ico (Babylon) -> Deleted
C:\ProgramData\Babylon\Content\icons\7BZ95AEQPT_glossary_icon2.ico (Babylon) -> Deleted
C:\ProgramData\Babylon\Content\icons\8Y3ADBYMTJ_glossary_icon.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\8Y3ADBYMTJ_glossary_icon2.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\9MNN3FNCUA_glossary_icon.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\9MNN3FNCUA_glossary_icon2.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\AVKMVPKAU6_glossary_icon.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\AVKMVPKAU6_glossary_icon2.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\B3UREHM8F6_glossary_icon.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\BEXGNJURCA_glossary_icon.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\BJKS8ZN2QJ_glossary_icon.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\BJKS8ZN2QJ_glossary_icon2.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\BTMJWKZGYE_glossary_icon.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\CDWYSD0KQA_glossary_icon.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\CDWYSD0KQA_glossary_icon2.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\D35ZVSJUGA_glossary_icon.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\D35ZVSJUGA_glossary_icon2.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\GXD7K8XNM6_glossary_icon.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\HCZ7J3Q8UA_glossary_icon.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\KVG0R4N8AE_glossary_icon.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\KVG0R4N8AE_glossary_icon2.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\M534MSC3GP_glossary_icon.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\QGDUSRR4JA_glossary_icon.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\RHFWM3WFXJ_glossary_icon.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\RYVU9J4Z0A_glossary_icon.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\RYVU9J4Z0A_glossary_icon2.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\UJAN48NM5P_glossary_icon.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\UJAN48NM5P_glossary_icon2.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\UWXWZCZR2A_glossary_icon.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\UWXWZCZR2A_glossary_icon2.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\WHBVH86TJX_glossary_icon.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\WZQV2X3J6E_glossary_icon.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\YC9EPB7CF2_glossary_icon.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\YC9EPB7CF2_glossary_icon2.ico (Babylon)
C:\ProgramData\Babylon\Content\icons\YPSR537K76_glossary_icon.ico (Babylon)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Babylon\ (Babylon)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Babylon\Babylon.lnk (Babylon)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Babylon\Uninstall.lnk (Babylon)
C:\Users\Lollo\AppData\Local\Babylon\ (Babylon)
C:\Users\Lollo\AppData\Local\Babylon\BabAll.bak (Babylon)
C:\Users\Lollo\AppData\Local\Conduit\ (Conduit)
C:\Users\Lollo\AppData\Local\Conduit\CT2269050\ (Conduit)
C:\Users\Lollo\AppData\Local\Conduit\CT2269050\DVDVideoSoftAutoUpdaterHelper.exe (Conduit)
Size . . . . . . . : 1.814.560 bytes
Age . . . . . . . : 548.6 days (2012-03-08 21:10:48)
Entropy . . . . . : 8.0
SHA-256 . . . . . : 047950EB6D6E98BB3FA44E5690172CECDEBAAD75B25D6EBFE9087DD150753194
RSA Key Size . . . : 1024
Authenticode . . . : Valid
Fuzzy . . . . . . : 7.0
C:\Users\Lollo\AppData\Local\Conduit\CT2269050\DVDVideoSoftTBAutoUpdateHelper.exe (Conduit)
Size . . . . . . . : 65.832 bytes
Age . . . . . . . : 494.7 days (2012-05-01 18:09:19)
Entropy . . . . . : 6.4
SHA-256 . . . . . : E152F6B71F0EA5825E243910D2F12F7493CB358833AA3BE83C8502F1F17A9B30
Product . . . . . : ToolbarH Application
Description . . . : ToolbarH Application
Version . . . . . : 1.0.1.0
Copyright . . . . : Copyright (C) 2009
RSA Key Size . . . : 1024
Authenticode . . . : Valid
Fuzzy . . . . . . : -6.0
C:\Users\Lollo\AppData\Local\Conduit\CT3279453\ (Conduit)
C:\Users\Lollo\AppData\Local\Conduit\CT3279453\DVDvideoSoft_2.0AutoUpdateHelper.exe (Conduit)
Size . . . . . . . : 2.179.480 bytes
Age . . . . . . . : 163.8 days (2013-03-28 15:45:50)
Entropy . . . . . : 8.0
SHA-256 . . . . . : CC1E699BB0956B557C71D143321952CFCBF939AF891022B0B31D1703A2C7EDB0
Product . . . . . : Conduit Toolbar Automatic Update
Publisher . . . . : Conduit Ltd.
Description . . . : Conduit Toolbar Automatic Update
Version . . . . . : 6.13.3.501
Copyright . . . . : Conduit (C) 2013 All Rights Reserved
RSA Key Size . . . : 2048
Authenticode . . . : Valid
Fuzzy . . . . . . : 1.0
C:\Users\Lollo\AppData\Local\OpenCandy\ (Conduit)
C:\Users\Lollo\AppData\LocalLow\BabylonToolbar\ (Babylon)
C:\Users\Lollo\AppData\LocalLow\BabylonToolbar\BabylonToolbar\Microsoft\Windows\IETldCache\ (Babylon)
C:\Users\Lollo\AppData\LocalLow\BabylonToolbar\BabylonToolbar\Microsoft\Windows\IETldCache\index.dat (Babylon)
C:\Users\Lollo\AppData\LocalLow\Conduit\ (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\ (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453.1000034.Settings.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453.1000082.currentList.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453.1000082.localStations.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453.1000082.nowPlaying.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453.1000082.publisherStations.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453.130029007934982115.search.selectedEngineId.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453.130029007934982115.search.settings.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453.appOptions.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453.installUsage.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453.installUsageEarly.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453.NOTIFICATION_ID.notifications-repository.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453.NOTIFICATION_ID.notifications-service_1764623.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453.NOTIFICATION_ID.notifications-servicemap.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453.NotificationSettings.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453.pg_conf_global.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453.searchProtectorData.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.15.0.62.serviceLayer_services_appsMetadata.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.15.0.62.serviceLayer_services_appTrackingFirstTime.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.15.0.62.serviceLayer_services_gottenAppsContextMenu.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.15.0.62.serviceLayer_services_location.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.15.0.62.serviceLayer_services_login.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.15.0.62.serviceLayer_services_otherAppsContextMenu.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.15.0.62.serviceLayer_services_searchAPI.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.15.0.62.serviceLayer_services_serviceMap.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.15.0.62.serviceLayer_services_toolbarContextMenu.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.15.0.62.serviceLayer_services_toolbarSettings.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.15.0.62.serviceLayer_services_translation.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.15.0.62.serviceLayer_services_userApps.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.16.1.521.serviceLayer_services_appsMetadata.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.16.1.521.serviceLayer_services_appTrackingFirstTime.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.16.1.521.serviceLayer_services_gottenAppsContextMenu.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.16.1.521.serviceLayer_services_location.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.16.1.521.serviceLayer_services_login.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.16.1.521.serviceLayer_services_otherAppsContextMenu.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.16.1.521.serviceLayer_services_searchAPI.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.16.1.521.serviceLayer_services_serviceMap.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.16.1.521.serviceLayer_services_toolbarContextMenu.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.16.1.521.serviceLayer_services_toolbarSettings.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_10.16.1.521.serviceLayer_services_translation.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_RAW.serviceLayer_services_appsMetadata.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_RAW.serviceLayer_services_appTrackingFirstTime.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_RAW.serviceLayer_services_gottenAppsContextMenu.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_RAW.serviceLayer_services_location.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_RAW.serviceLayer_services_login.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_RAW.serviceLayer_services_otherAppsContextMenu.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_RAW.serviceLayer_services_searchAPI.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_RAW.serviceLayer_services_serviceMap.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_RAW.serviceLayer_services_toolbarContextMenu.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_RAW.serviceLayer_services_toolbarSettings.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\CT3279453_RAW.serviceLayer_services_translation.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\serviceLayer_userApps_added.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\serviceLayer_userApps_removed.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\toolbar_initializing_logger.txt.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\uninstallData.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\ChromeExtData\oolkekjjhnaeaahibbnfebmogackofpf\Repository\uninstallUrl.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\ (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\ (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\AppNotification.js (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\ (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\close.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\ (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\close.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\closeBtn.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\Next.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\Next_hover.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\powered-by.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\Prev.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\Prev_hover.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\settings.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\dark\settingsBtn.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\ (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\close.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\closeBtn.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\Next.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\Next_hover.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\powered-by.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\Prev.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\Prev_hover.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\settings.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\settingsBtn.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\light\Thumbs.db (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\like.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Next.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Next_hover.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\powered-by.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Prev.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Prev_hover.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\settings.png (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\Images\Thumbs.db (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\initialNotification.html (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\main.html (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\NotificationDialogStyle.css (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\NotificationDialogStyleIE9.css (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\AppNotificationDialog\sampleNotification.html (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\DialogsAPI.js (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\PIE.htc (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\settings.js (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Dialogs\version.txt (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Feeds\ (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Feeds\http___alert_services_conduit_com_Alerts_AlertServices_asmx_GetHostedFeedRss_alertID=1004080&alertFeedId=999795.xml (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Feeds\http___alert_services_conduit_com_Alerts_AlertServices_asmx_GetHostedFeedRss_alertID=666138&alertFeedId=661999.xml (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Feeds\http___alerts_conduit-services_com__aid=1004080&fid=999795.xml (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Feeds\http___alerts_conduit-services_com__aid=10896&fid=10676.xml (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Feeds\http___alerts_conduit-services_com__aid=666138&fid=661999.xml (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Feeds\http___alerts_conduit-services_com_root_1004080_999795_DE.xml (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Feeds\http___alerts_conduit-services_com_root_10896_10676_DE.xml (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Feeds\http___alerts_conduit-services_com_root_1764623_1755164_DE.xml (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\Feeds\http___alerts_conduit-services_com_root_666138_661999_DE.xml (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\LanguagePacks\ (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Community Alerts\LanguagePacks\en.xml (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Toolbar\Facebook\ (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Toolbar\Facebook\http___facebook_conduit-services_com_Settings_ashx_locale=en&browserType=IE&toolbarVersion=5_3_6_2.xml (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Toolbar\Facebook\http___facebook_conduit-services_com_Settings_ashx_locale=en&browserType=IE&toolbarVersion=5_3_7_1.xml (Conduit)
C:\Users\Lollo\AppData\LocalLow\Conduit\Toolbar\Facebook\http___facebook_conduit-services_com_Settings_ashx_locale=en&browserType=IE&toolbarVersion=5_5_3_2.xml (Conduit)
C:\Users\Lollo\AppData\Roaming\Babylon\ (Babylon)
C:\Users\Lollo\AppData\Roaming\Babylon\except.txt (Babylon)
C:\Users\Lollo\AppData\Roaming\Babylon\FLStat.dat (Babylon)
C:\Users\Lollo\AppData\Roaming\Babylon\log_file.txt (Babylon)
C:\Users\Lollo\AppData\Roaming\Babylon\MyList.dat (Babylon)
C:\Users\Lollo\AppData\Roaming\Babylon\ocr_cache (Babylon)
C:\Users\Lollo\AppData\Roaming\Babylon\ocr_data (Babylon)
C:\Users\Lollo\AppData\Roaming\Babylon\updates\ (Babylon)
C:\Users\Lollo\AppData\Roaming\Babylon\updates\convert.dat (Babylon)
C:\Users\Lollo\AppData\Roaming\Babylon\updates\rates.dat (Babylon)
C:\Users\Lollo\AppData\Roaming\Babylon\user.dmp (Babylon)
C:\Users\Lollo\AppData\Roaming\OpenCandy\ (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\0635E01FC4104B0C987E0D236AE83F97\ (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\0635E01FC4104B0C987E0D236AE83F97\2175.ico (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\0635E01FC4104B0C987E0D236AE83F97\LatestDLMgr.exe (Conduit)
Size . . . . . . . : 302.888 bytes
Age . . . . . . . : 137.7 days (2013-04-23 17:45:34)
Entropy . . . . . : 7.8
SHA-256 . . . . . : 228374847C58007EF4F2B6DBDA86020C2A90DCB8BD1504CF4687C908C302BB2F
Product . . . . . : OpenCandy recommendation downloader
Publisher . . . . : OpenCandy
Description . . . : OpenCandy recommendation downloader p44
Version . . . . . : 3.2.5.247
Copyright . . . . : Copyright (c) 2008 - 2011 OpenCandy, Inc.
RSA Key Size . . . : 2048
Authenticode . . . : Valid
Fuzzy . . . . . . : 1.0
C:\Users\Lollo\AppData\Roaming\OpenCandy\0C73A714C660416DB63E24F53823849C\ (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\0C8213EBEE7A460CA1D495EF2762901F\ (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\0C8213EBEE7A460CA1D495EF2762901F\2175.ico (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\0C8213EBEE7A460CA1D495EF2762901F\LatestDLMgr.exe (Conduit)
Size . . . . . . . : 302.888 bytes
Age . . . . . . . : 180.6 days (2013-03-11 21:08:02)
Entropy . . . . . : 7.8
SHA-256 . . . . . : 228374847C58007EF4F2B6DBDA86020C2A90DCB8BD1504CF4687C908C302BB2F
Product . . . . . : OpenCandy recommendation downloader
Publisher . . . . : OpenCandy
Description . . . : OpenCandy recommendation downloader p44
Version . . . . . : 3.2.5.247
Copyright . . . . : Copyright (c) 2008 - 2011 OpenCandy, Inc.
RSA Key Size . . . : 2048
Authenticode . . . : Valid
Fuzzy . . . . . . : 1.0
C:\Users\Lollo\AppData\Roaming\OpenCandy\18A256152ECD472FBE6331C7D3D1B6B2\ (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\71907B81C0BA47C8A7C7D20B6FDD3686\ (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\95E2182941844F26AF23938705EBD66B\ (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\95E2182941844F26AF23938705EBD66B\setup.msi (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\95FAF3BED9554528AC477A87913D7F2E\ (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\B0DEC50518E643549D4C6995010783EA\ (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\B0DEC50518E643549D4C6995010783EA\avg_free_x64_de_2013_2899a6087_14.exe (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\B9ABE48D12EC4550A754AFC8E2CC5D23\ (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\C3E73432D38C4AC285B027B3CC3E5A9A\ (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\C3E73432D38C4AC285B027B3CC3E5A9A\3919.ico (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\C3E73432D38C4AC285B027B3CC3E5A9A\EBB77268-338F-4C6A-8590-AD88FED26F4A (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\C3E73432D38C4AC285B027B3CC3E5A9A\OCBrowserHelper_1.0.3.85.dll (Conduit)
Size . . . . . . . : 432.456 bytes
Age . . . . . . . : 330.0 days (2012-10-13 11:20:05)
Entropy . . . . . : 8.0
SHA-256 . . . . . : 46646CA562D8B108A9CCD6968D19320EC1EBEE9433E1CB9D8CF01D284A647925
Product . . . . . : OpenCandy Install Helper
Publisher . . . . : OpenCandy
Description . . . : OpenCandy Install Helper
Version . . . . . : 1.0.0.2
Copyright . . . . : (c) 2011 OpenCandy. All rights reserved.
RSA Key Size . . . : 2048
Authenticode . . . : Valid
Fuzzy . . . . . . : 1.0
C:\Users\Lollo\AppData\Roaming\OpenCandy\C3E73432D38C4AC285B027B3CC3E5A9A\setup_759.exe (Conduit)
Size . . . . . . . : 492.640 bytes
Age . . . . . . . : 330.0 days (2012-10-13 11:20:05)
Entropy . . . . . : 7.9
SHA-256 . . . . . : 9F86E9FA97E670423C6CB23DCD6766CFCA0686BF2B851E30CB3D1127AA592AE1
Product . . . . . : iNTERNET Turbo
Publisher . . . . : Clasys Ltd.
Description
Version . . . . . : 1.0.32.12
Copyright
RSA Key Size . . . : 2048
Authenticode . . . : Valid
Fuzzy . . . . . . : 2.0
C:\Users\Lollo\AppData\Roaming\OpenCandy\CDAC093687F546FFAE953EB5113BAE8B\ (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\CDAC093687F546FFAE953EB5113BAE8B\3919.ico (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\CDAC093687F546FFAE953EB5113BAE8B\EBB77268-338F-4C6A-8590-AD88FED26F4A (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\CDAC093687F546FFAE953EB5113BAE8B\OCBrowserHelper_1.0.3.85.dll (Conduit)
Size . . . . . . . : 432.456 bytes
Age . . . . . . . : 332.5 days (2012-10-10 22:39:12)
Entropy . . . . . : 8.0
SHA-256 . . . . . : 46646CA562D8B108A9CCD6968D19320EC1EBEE9433E1CB9D8CF01D284A647925
Product . . . . . : OpenCandy Install Helper
Publisher . . . . : OpenCandy
Description . . . : OpenCandy Install Helper
Version . . . . . : 1.0.0.2
Copyright . . . . : (c) 2011 OpenCandy. All rights reserved.
RSA Key Size . . . : 2048
Authenticode . . . : Valid
Fuzzy . . . . . . : 1.0
C:\Users\Lollo\AppData\Roaming\OpenCandy\CDAC093687F546FFAE953EB5113BAE8B\setup_759.exe (Conduit)
Size . . . . . . . : 492.640 bytes
Age . . . . . . . : 332.5 days (2012-10-10 22:39:13)
Entropy . . . . . : 7.9
SHA-256 . . . . . : 9F86E9FA97E670423C6CB23DCD6766CFCA0686BF2B851E30CB3D1127AA592AE1
Product . . . . . : iNTERNET Turbo
Publisher . . . . : Clasys Ltd.
Description
Version . . . . . : 1.0.32.12
Copyright
RSA Key Size . . . : 2048
Authenticode . . . : Valid
Fuzzy . . . . . . : 2.0
C:\Users\Lollo\AppData\Roaming\OpenCandy\E75C01614EAF4B0D8FF55252F00DDDE5\ (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\E75C01614EAF4B0D8FF55252F00DDDE5\PCSU_SL_3.1.2.exe (Conduit)
Size . . . . . . . : 2.682.336 bytes
Age . . . . . . . : 333.8 days (2012-10-09 15:01:52)
Entropy . . . . . : 8.0
SHA-256 . . . . . : 82B37F33E6DDE5DFE04ED42D772750E05B8D86E78992749B10998655623C5960
Product . . . . . : PC Speed Up
Publisher . . . . : Speedchecker Limited
Description . . . :
Version . . . . . : 3.1.2
Copyright . . . . : Copyright © Speedchecker Limited 2009-2011
RSA Key Size . . . : 2048
Authenticode . . . : Self-signed
Fuzzy . . . . . . : 11.0
C:\Users\Lollo\AppData\Roaming\OpenCandy\EDE8388735104B6EA65D6C89AEFA217C\ (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\EDE8388735104B6EA65D6C89AEFA217C\EBB77268-338F-4C6A-8590-AD88FED26F4A (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\EDE8388735104B6EA65D6C89AEFA217C\LinkuryInstaller.msi (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\EDE8388735104B6EA65D6C89AEFA217C\LinkuryInstaller_p1v5.exe (Conduit)
Size . . . . . . . : 4.103.096 bytes
Age . . . . . . . : 678.5 days (2011-10-30 23:13:39)
Entropy . . . . . : 8.0
SHA-256 . . . . . : 5FFB7AEF86B3E265D618B70FA419EBA2061B3F8DC54A29FFD2E0426B7F8183CD
RSA Key Size . . . : 2048
Authenticode . . . : Valid
Fuzzy . . . . . . : 7.0
C:\Users\Lollo\AppData\Roaming\OpenCandy\EDE8388735104B6EA65D6C89AEFA217C\OCBrowserHelper_1.0.2.72.dll (Conduit)
Size . . . . . . . : 834.888 bytes
Age . . . . . . . : 678.5 days (2011-10-30 23:13:44)
Entropy . . . . . : 6.7
SHA-256 . . . . . : D32B86222E410CEB067BC924FC81416E4A06C08B74A35BB0646C6BC38DCB2082
Product . . . . . : OpenCandy Install Helper
Publisher . . . . : OpenCandy
Description . . . : OpenCandy Install Helper
Version . . . . . : 1.0.0.2
Copyright . . . . : (c) 2011 OpenCandy. All rights reserved.
RSA Key Size . . . : 2048
Authenticode . . . : Valid
Fuzzy . . . . . . : -7.0
C:\Users\Lollo\AppData\Roaming\OpenCandy\OpenCandy_2454543630864686A5A7CEA17D8B1157\ (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\OpenCandy_2454543630864686A5A7CEA17D8B1157\1396.ico (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\OpenCandy_2454543630864686A5A7CEA17D8B1157\EBB77268-338F-4C6A-8590-AD88FED26F4A (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\OpenCandy_2454543630864686A5A7CEA17D8B1157\Gutscheinrausch_p11v1.exe (Conduit)
Size . . . . . . . : 476.736 bytes
Age . . . . . . . : 845.6 days (2011-05-16 19:44:41)
Entropy . . . . . : 8.0
SHA-256 . . . . . : 745F0B58092247ABFD19091AED6EF558C304AB54A4D83806322DCE745AB880A6
RSA Key Size . . . : 2048
Authenticode . . . : Valid
Fuzzy . . . . . . : 7.0
C:\Users\Lollo\AppData\Roaming\OpenCandy\OpenCandy_2454543630864686A5A7CEA17D8B1157\OC_Gutscheinrausch_-_2.6.1.xpi (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\OpenCandy_2454543630864686A5A7CEA17D8B1157\OCBrowserHelper_1.0.2.66.dll (Conduit)
Size . . . . . . . : 834.888 bytes
Age . . . . . . . : 845.6 days (2011-05-16 19:44:43)
Entropy . . . . . : 6.7
SHA-256 . . . . . : D6C9FAC9AA968813CCE6E6C1B88DF1FD8A2A1C7DD7953939E077B48B3A842553
Product . . . . . : OpenCandy Install Helper
Publisher . . . . : OpenCandy
Description . . . : OpenCandy Install Helper
Version . . . . . : 1.0.0.2
Copyright . . . . : (c) 2011 OpenCandy. All rights reserved.
RSA Key Size . . . : 2048
Authenticode . . . : Valid
Fuzzy . . . . . . : -7.0
C:\Users\Lollo\AppData\Roaming\OpenCandy\OpenCandy_8E3D36A543DA4F63905F9D9A4C41E5D5\ (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\OpenCandy_8E3D36A543DA4F63905F9D9A4C41E5D5\1273.ico (Conduit)
C:\Users\Lollo\AppData\Roaming\OpenCandy\OpenCandy_8E3D36A543DA4F63905F9D9A4C41E5D5\TuneUpInst-1.9.0-cmp132.exe (Conduit)
Size . . . . . . . : 27.218.976 bytes
Age . . . . . . . : 895.9 days (2011-03-27 14:09:51)
Entropy . . . . . : 8.0
SHA-256 . . . . . : 5A0E1A8A94143EA07CD6BBABB2E68523749E080E37E0BC005C7D643158474BC4
Product . . . . . : TuneUp Companion 1.9.0
Publisher . . . . : TuneUp Media, Inc.
Description . . . : TuneUp Companion 1.9.0
Version . . . . . : 1.0.37.0
Copyright . . . . : Copyright 2007-2010 by TuneUp Media, Inc.
RSA Key Size . . . : 1024
Authenticode . . . : Valid
Fuzzy . . . . . . : -4.0
HKLM\SOFTWARE\Classes\AppID\BabylonIEPI.DLL\ (Babylon)
HKLM\SOFTWARE\Classes\AppID\escort.DLL\ (Funmoods)
HKLM\SOFTWARE\Classes\AppID\escortApp.DLL\ (Funmoods)
HKLM\SOFTWARE\Classes\AppID\escortEng.DLL\ (Funmoods)
HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL\ (Funmoods)
HKLM\SOFTWARE\Classes\AppID\esrv.EXE\ (Funmoods)
HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}\ (Funmoods)
HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\ (Funmoods)
HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}\ (Funmoods)
HKLM\SOFTWARE\Classes\AppID\{B16632F1-24E0-4D99-A68D-70BFB6447C48}\ (Babylon)
HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}\ (Babylon)
HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\ (Funmoods)
HKLM\SOFTWARE\Classes\Babylon.dskBnd.1\ (Babylon)
HKLM\SOFTWARE\Classes\Babylon.dskBnd\ (Babylon)
HKLM\SOFTWARE\Classes\BabylonIEPI.BabylonIEBho.1\ (Babylon)
HKLM\SOFTWARE\Classes\BabylonIEPI.BabylonIEBho\ (Babylon)
HKLM\SOFTWARE\Classes\BabylonOfficeAddin.OfficeAddin.1\ (Babylon)
HKLM\SOFTWARE\Classes\BabylonOfficeAddin.OfficeAddin\ (Babylon)
HKLM\SOFTWARE\Classes\bbylnApp.appCore.1\ (Babylon)
HKLM\SOFTWARE\Classes\bbylnApp.appCore\ (Babylon)
HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1\ (Babylon)
HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr\ (Babylon)
HKLM\SOFTWARE\Classes\escort.escortIEPane.1\ (Funmoods)
HKLM\SOFTWARE\Classes\escort.escortIEPane\ (Funmoods)
HKLM\SOFTWARE\Classes\esrv.BabylonESrvc.1\ (Babylon)
HKLM\SOFTWARE\Classes\esrv.BabylonESrvc\ (Babylon)
HKLM\SOFTWARE\Classes\MIME\Database\Content Type\application/bdc\ (Babylon)
HKLM\SOFTWARE\Classes\MIME\Database\Content Type\application/bgl\ (Babylon)
HKLM\SOFTWARE\Classes\MIME\Database\Content Type\application/bof\ (Babylon)
HKLM\SOFTWARE\Classes\Prod.cap\ (Claro)
HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\ (Funmoods)
HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\ (Funmoods)
HKLM\SOFTWARE\Classes\Wow6432Node\AppID\BabylonIEPI.DLL\ (Babylon)
HKLM\SOFTWARE\Classes\Wow6432Node\AppID\escort.DLL\ (Funmoods)
HKLM\SOFTWARE\Classes\Wow6432Node\AppID\escortApp.DLL\ (Funmoods)
HKLM\SOFTWARE\Classes\Wow6432Node\AppID\escortEng.DLL\ (Funmoods)
HKLM\SOFTWARE\Classes\Wow6432Node\AppID\escorTlbr.DLL\ (Funmoods)
HKLM\SOFTWARE\Classes\Wow6432Node\AppID\esrv.EXE\ (Funmoods)
HKLM\SOFTWARE\Classes\Wow6432Node\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}\ (Funmoods)
HKLM\SOFTWARE\Classes\Wow6432Node\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\ (Funmoods)
HKLM\SOFTWARE\Classes\Wow6432Node\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}\ (Funmoods)
HKLM\SOFTWARE\Classes\Wow6432Node\AppID\{B16632F1-24E0-4D99-A68D-70BFB6447C48}\ (Babylon)
HKLM\SOFTWARE\Classes\Wow6432Node\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}\ (Babylon)
HKLM\SOFTWARE\Classes\Wow6432Node\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\ (Funmoods)
HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}\ (Funmoods)
HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\ (Funmoods)
HKLM\SOFTWARE\Wow6432Node\Babylon\ (Babylon)
HKLM\SOFTWARE\Wow6432Node\BabylonToolbar\ (Babylon)
HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb\ (Babylon)
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478}\ (Babylon)
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}\ (Babylon)
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{9CFACCB6-2F3F-4177-94EA-0D2B72D384C1}\ (Babylon)
HKU\S-1-5-21-3059642530-3758366382-3311971186-1000\Software\AppDataLow\Software\Smartbar\ (Conduit)
HKU\S-1-5-21-3059642530-3758366382-3311971186-1000\Software\Babylon\ (Babylon)
HKU\S-1-5-21-3059642530-3758366382-3311971186-1000\Software\BabylonToolbar\ (Babylon)
HKU\S-1-5-21-3059642530-3758366382-3311971186-1000\Software\Conduit\ (Conduit)
HKU\S-1-5-21-3059642530-3758366382-3311971186-1000\Software\Microsoft\Internet Explorer\MenuExt\Translate this web page with Babylon\ (Babylon)
HKU\S-1-5-21-3059642530-3758366382-3311971186-1000\Software\Microsoft\Internet Explorer\MenuExt\Translate with Babylon\ (Babylon)
HKU\S-1-5-21-3059642530-3758366382-3311971186-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ (Babylon)
HKU\S-1-5-21-3059642530-3758366382-3311971186-1000\Software\Microsoft\Office\PowerPoint\Addins\BabylonOfficeAddin.OfficeAddin\ (Babylon)
HKU\S-1-5-21-3059642530-3758366382-3311971186-1000\Software\Microsoft\Office\Word\Addins\BabylonOfficeAddin.OfficeAddin\ (Babylon)
HKU\S-1-5-21-3059642530-3758366382-3311971186-1000\Software\Softonic\ (Softonic)
Cookies _____________________________________________________________________
C:\Users\Lollo\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.ad-srv.net
C:\Users\Lollo\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.yieldmanager.com
C:\Users\Lollo\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.zanox.com
C:\Users\Lollo\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.adk2.com
C:\Users\Lollo\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.soliddeal.de
C:\Users\Lollo\AppData\Local\Google\Chrome\User Data\Default\Cookies:apmebf.com
C:\Users\Lollo\AppData\Local\Google\Chrome\User Data\Default\Cookies:atdmt.com
C:\Users\Lollo\AppData\Local\Google\Chrome\User Data\Default\Cookies:bs.serving-sys.com
C:\Users\Lollo\AppData\Local\Google\Chrome\User Data\Default\Cookies:doubleclick.net
C:\Users\Lollo\AppData\Local\Google\Chrome\User Data\Default\Cookies:invitemedia.com
C:\Users\Lollo\AppData\Local\Google\Chrome\User Data\Default\Cookies:mediaplex.com
C:\Users\Lollo\AppData\Local\Google\Chrome\User Data\Default\Cookies:pcworldcommunication.122.2o7.net
C:\Users\Lollo\AppData\Local\Google\Chrome\User Data\Default\Cookies:revsci.net
C:\Users\Lollo\AppData\Local\Google\Chrome\User Data\Default\Cookies:serving-sys.com
C:\Users\Lollo\AppData\Local\Google\Chrome\User Data\Default\Cookies:tradedoubler.com
C:\Users\Lollo\AppData\Local\Google\Chrome\User Data\Default\Cookies:www.etracker.de
C:\Users\Lollo\AppData\Roaming\Microsoft\Windows\Cookies\1CTK36XA.txt
C:\Users\Lollo\AppData\Roaming\Microsoft\Windows\Cookies\2DVK1ZUX.txt
C:\Users\Lollo\AppData\Roaming\Microsoft\Windows\Cookies\2RYT2Y0R.txt
C:\Users\Lollo\AppData\Roaming\Microsoft\Windows\Cookies\4QO6V6M3.txt
C:\Users\Lollo\AppData\Roaming\Microsoft\Windows\Cookies\4T28YZL2.txt
C:\Users\Lollo\AppData\Roaming\Microsoft\Windows\Cookies\6SN6XMYO.txt
C:\Users\Lollo\AppData\Roaming\Microsoft\Windows\Cookies\8FFKY4K6.txt
C:\Users\Lollo\AppData\Roaming\Microsoft\Windows\Cookies\A0S4LI05.txt
C:\Users\Lollo\AppData\Roaming\Microsoft\Windows\Cookies\C4XGEHPS.txt
C:\Users\Lollo\AppData\Roaming\Microsoft\Windows\Cookies\GB6416GS.txt
C:\Users\Lollo\AppData\Roaming\Microsoft\Windows\Cookies\OJG6PH33.txt
C:\Users\Lollo\AppData\Roaming\Microsoft\Windows\Cookies\QFELVHRZ.txt
C:\Users\Lollo\AppData\Roaming\Microsoft\Windows\Cookies\RPOP8Q76.txt
C:\Users\Lollo\AppData\Roaming\Microsoft\Windows\Cookies\VQU2OAU0.txt
C:\Users\Lollo\AppData\Roaming\Microsoft\Windows\Cookies\VSNZ0N05.txt
C:\Users\Lollo\AppData\Roaming\Microsoft\Windows\Cookies\W9BZYY9M.txt
C:\Users\Lollo\AppData\Roaming\Microsoft\Windows\Cookies\WX5QLTDM.txt
C:\Users\Lollo\AppData\Roaming\Microsoft\Windows\Cookies\WZRHKXCB.txt
C:\Users\Lollo\AppData\Roaming\Microsoft\Windows\Cookies\WZYO78A7.txt
C:\Users\Lollo\AppData\Roaming\Microsoft\Windows\Cookies\XB0Y2BJ2.txt
C:\Users\Lollo\AppData\Roaming\Microsoft\Windows\Cookies\YKY8IVQB.txt
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:122.2o7.net
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:ad.12mnkys.com
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:ad.yieldmanager.com
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:ad.zanox.com
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:atdmt.com
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:c.atdmt.com
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:centaurpublications.122.2o7.net
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:de.sitestat.com
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:dennispublishing.112.2o7.net
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:doubleclick.net
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:hearstdigital.122.2o7.net
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:in.getclicky.com
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:invitemedia.com
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:newsquestdigitalmedia.122.2o7.net
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:opodo.122.2o7.net
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:partypoker.com
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:paypal.112.2o7.net
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:statcounter.com
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:stats.paypal.com
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:survey.g.doubleclick.net
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:tradedoubler.com
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:wissende.122.2o7.net
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:www.etracker.de
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:www.googleadservices.com
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:xiti.com
C:\Users\Lollo\AppData\Roaming\Mozilla\Firefox\Profiles\utn6w5tt.default\cookies.sqlite:yadro.ru
Außerdem habe ich noch das im t-online Bericht über ZeuS (hxxp://www.t-online.de/computer/sicherheit/id_49713870/zeus-trojaner-ueberlistet-virenscanner.html) empfohlene Programm ThreatFire heruntergeladen jedoch einen Scan nicht vollständig durchgeführt da es schon in der Einführung hieß, dass das Programm vor einer Infizierung installiert werden sollte.
Ich bedanke mich jetzt schon einmal für die Unterstützung! Ich wäre wirklich sehr erleichtert wenn mir jemand bei dieser Sache helfen könnte da mich die Angelegenheit mit der Visacard schon etwas in Schwitzen bringt und ich deshalb das Programm so schnell wie möglich entfernt haben möchte.
Liebe Grüße,
Lorenz |
AdwCleaner auf deinen Desktop.
Farbar Service Scanner 
WARNUNG an die MITLESER: