Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Malware is causing problems with my web hosting account


  • This topic is locked This topic is locked
18 replies to this topic

#1 webdzyner

webdzyner

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:41 AM

Posted 26 July 2013 - 09:01 AM

I have run malwarebytes and I am clean, I also run AVG for anti-virus and firewall, I have run efix pro and it did not find any malicious software.  However, all my accounts on my shared server keep getting hacked and loaded with phishing materials.  I have changed all passwords and I am the only one who gets in via FTP.  I dont know how else to locate this supposed malware without help please.  The dds.txt file is below and I am attaching the attach.txt file.

 

Thank you

 

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 9.0.8112.16421  BrowserJavaVersion: 10.9.2
Run by Lori at 9:54:03 on 2013-07-26
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.3693.2022 [GMT -4:00]
.
AV: AVG Internet Security 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Internet Security 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: AVG Internet Security 2012 *Enabled* {621CC794-9486-F902-D092-0484E8EA828B}
.
============== Running Processes ===============
.
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\agent_x64.exe
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\system32\atiesrxx.exe
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\GFNEXSrv.exe
C:\windows\System32\spoolsv.exe
C:\windows\system32\atieclxx.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\AVG\AVG2012\avgfws.exe
C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\eFix\eFix Pro\ReiGuard.exe
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe
C:\windows\system32\svchost.exe -k imgsvc
C:\windows\system32\TODDSrv.exe
C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\AVG\AVG2012\avgnsa.exe
C:\Program Files (x86)\AVG\AVG2012\avgemca.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\windows\system32\wbem\unsecapp.exe
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\loggingserver.exe
C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe
C:\Program Files (x86)\AVG\AVG2012\avgrsa.exe
C:\Program Files (x86)\AVG\AVG2012\avgcsrva.exe
C:\windows\system32\taskhost.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\windows\system32\Dwm.exe
C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe
C:\windows\Explorer.EXE
C:\windows\system32\taskeng.exe
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\AVG\AVG PC Tuneup\BoostSpeed.exe
C:\Program Files (x86)\AVG\AVG2012\avgcsrva.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe
C:\Program Files\Toshiba\ReelTime\TosReelTimeMonitor.exe
C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\ToshibaServiceStation.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\AVG Secure Search\vprot.exe
C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
C:\windows\system32\SearchIndexer.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Ask.com\Updater\Updater.exe
C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE
C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MMLoadDrv.exe
C:\windows\System32\svchost.exe -k LocalServicePeerNet
C:\windows\splwow64.exe
C:\Program Files (x86)\Canon\Quick Menu\CNQMUPDT.EXE
C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\windows\system32\SearchProtocolHost.exe
C:\windows\system32\SearchFilterHost.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://myblock.hrblock.com/
uDefault_Page_URL = hxxp://start.toshiba.com/?cid=C001B2Y
uProxyOverride = <local>;*.local
uURLSearchHooks: UrlSearchHook Class: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
mWinlogon: Userinit = userinit.exe
BHO: MSS+ Identifier: {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll
BHO: Canon Easy-WebPrint EX BHO: {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll
BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live

\WindowsLiveLogin.dll
BHO: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.3.0.11\AVG Secure Search_toolbar.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
BHO: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.3.0.11\AVG Secure Search_toolbar.dll
TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
TB: Canon Easy-WebPrint EX: {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
EB: Canon Easy-WebPrint EX: {21347690-EC41-4F9A-8887-1F4AEE672439} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll
uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
uRun: [TomTomHOME.exe] "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"
uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
mRun: [ToshibaAppPlace] "C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe"
mRun: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe" UNATTENDED
mRun: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"
mRun: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [CanonQuickMenu] C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE /logon
mRun: [IJNetworkScannerSelectorEX] C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe /FORCE
dRunOnce: [KodakHomeCenter] "C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe"
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office

\Office14\ONBttnIELinkedNotes.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{9CCC4D28-A371-4BD3-B1B8-C188E5D35400} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{F9FC772F-013F-45A2-A91E-F5C28A7B4561} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{F9FC772F-013F-45A2-A91E-F5C28A7B4561}\130364850393137383234383 : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{F9FC772F-013F-45A2-A91E-F5C28A7B4561}\2416E676F627445607F647 : DHCPNameServer = 208.25.96.18 208.25.96.3
TCP: Interfaces\{F9FC772F-013F-45A2-A91E-F5C28A7B4561}\2516D6164616 : DHCPNameServer = 204.111.1.35 204.111.1.36
TCP: Interfaces\{F9FC772F-013F-45A2-A91E-F5C28A7B4561}\4616973794E6E60244 : DHCPNameServer = 24.247.15.53 66.189.0.100 24.178.162.3
TCP: Interfaces\{F9FC772F-013F-45A2-A91E-F5C28A7B4561}\D41696E63547D4164747167716E6D27657563747 : DHCPNameServer = 184.16.4.22 184.16.33.54 192.168.33.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller

\15.3.0\ViProtocol.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck - <orphaned>
mASetup: Neat ADF Scanner 2008 - reg copy "HKLM\Software\Wow6432Node\The Neat Company\Neat ADF Scanner 2008" "HKCU\Software\The Neat Company\Neat ADF Scanner

2008" /s /f
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.72\Installer\chrmstp.exe" --configure-user-

settings --verbose-logging --system-level --multi-install --chrome
x64-BHO: AVG Do Not Track: {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll
x64-BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live

\WindowsLiveLogin.dll
x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-Run: [TPwrMain] C:\Program Files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE
x64-Run: [TCrdMain] C:\Program Files (x86)\TOSHIBA\FlashCards\TCrdMain.exe
x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-Run: [RtHDVBg_Dolby] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE3
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe
x64-Run: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe
x64-Run: [TosNC] C:\Program Files (x86)\Toshiba\BulletinBoard\TosNcCore.exe
x64-Run: [TosReelTimeMonitor] C:\Program Files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
x64-IE: {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
x64-Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll
x64-Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - <orphaned>
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-SSODL: WebCheck - <orphaned>
x64-mASetup: Send To Neat - reg copy "HKLM\Software\The Neat Company\Send To Neat" "HKCU\Software\The Neat Company\Send To Neat" /s /f
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aolrt-chromesbox-en-

us&tb_uuid=20120616010147195&tb_oid=16-06-2012&tb_mrud=16-06-2012
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - plugin: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll
FF - plugin: C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll
FF - plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.3.0\npsitesafety.dll
FF - plugin: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMSS.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\6\NP_wtapp.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll
FF - ExtSQL: 2013-07-22 09:40; {e001c731-5e37-4538-a5cb-8168736a2360}; C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\extensions

\{e001c731-5e37-4538-a5cb-8168736a2360}
.
---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
FF - user.js: browser.sessionstore.resume_from_crash - false
.
FF - user.js: extensions.autoDisableScopes - 14
.
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHA;AVGIDSHA;C:\windows\System32\drivers\avgidsha.sys [2012-4-19 28480]
R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\windows\System32\drivers\avgrkx64.sys [2012-1-31 36944]
R1 Avgfwfd;AVG network filter service;C:\windows\System32\drivers\avgfwd6a.sys [2011-5-23 48992]
R1 Avgldx64;AVG AVI Loader Driver;C:\windows\System32\drivers\avgldx64.sys [2012-11-8 307040]
R1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\windows\System32\drivers\avgmfx64.sys [2011-12-23 47696]
R1 Avgtdia;AVG TDI Driver;C:\windows\System32\drivers\avgtdia.sys [2013-4-11 384800]
R1 avgtp;avgtp;C:\windows\System32\drivers\avgtpx64.sys [2012-11-9 45856]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2013-5-23 143120]
R2 Agent;Agent;C:\Windows\agent_x64.exe [2012-4-7 102912]
R2 AMD External Events Utility;AMD External Events Utility;C:\windows\System32\atiesrxx.exe [2012-1-27 204288]
R2 avgfws;AVG Firewall;C:\Program Files (x86)\AVG\AVG2012\avgfws.exe [2012-12-5 2321560]
R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe [2012-11-2 5174392]
R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe [2012-2-14 193288]
R2 eFixRealTimeProtection;eFix Real Time Protection;C:\Program Files\eFix\eFix Pro\ReiGuard.exe [2013-7-9 4249960]
R2 GFNEXSrv;GFNEX Service;C:\windows\System32\GFNEXSrv.exe [2012-1-27 162824]
R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-7-15 418376]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-7-15 701512]
R2 PCCUJobMgr;Common Client Job Manager Service;C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe [2012-1-27 126392]
R2 TomTomHOMEService;TomTomHOMEService;C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [2013-3-22 93072]
R2 vToolbarUpdater15.3.0;vToolbarUpdater15.3.0;C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [2013-6-26

1598128]
R3 AVGIDSDriver;AVGIDSDriver;C:\windows\System32\drivers\avgidsdrivera.sys [2012-12-10 127328]
R3 AVGIDSFilter;AVGIDSFilter;C:\windows\System32\drivers\avgidsfiltera.sys [2011-12-23 29776]
R3 MBAMProtector;MBAMProtector;C:\windows\System32\drivers\mbam.sys [2013-7-15 25928]
R3 PGEffect;Pangu effect driver;C:\windows\System32\drivers\PGEffect.sys [2012-1-27 38096]
R3 RTL8167;Realtek 8167 NT Driver;C:\windows\System32\drivers\Rt64win7.sys [2012-1-27 413800]
R3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;C:\windows\System32\drivers\rtl8192ce.sys [2012-1-27 1142376]
R3 TMachInfo;TMachInfo;C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\TMachInfo.exe [2012-1-27 57216]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2011-6-10 138152]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18

138576]
S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [2013-2-5 235216]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\windows\System32\drivers\RtsUStor.sys [2012-1-27 250984]
S3 TsUsbFlt;TsUsbFlt;C:\windows\System32\drivers\TsUsbFlt.sys [2010-11-20 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\windows\System32\drivers\TsUsbGD.sys [2010-11-20 31232]
S3 USBAAPL64;Apple Mobile USB Driver;C:\windows\System32\drivers\usbaapl64.sys [2012-4-25 52736]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\System32\Wat\WatAdminSvc.exe [2012-3-15 1255736]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2013-07-25 19:12:16    301568    ----a-w-    C:\Program Files\Microsoft Games\More Games\MoreGames.dll
2013-07-25 19:11:01    145792    ----a-w-    C:\windows\System32\drivers\E1G6032E.sys
2013-07-25 19:07:44    --------    d-----w-    C:\Recovery
2013-07-25 19:07:44    --------    d-----w-    C:\PerfLogs
2013-07-25 18:01:00    9728    ----a-w-    C:\windows\System32\Native.exe
2013-07-25 18:00:36    --------    d-----w-    C:\eFixUndo
2013-07-25 17:44:33    --------    d-----w-    C:\Program Files\eFix
2013-07-25 17:44:24    --------    d-----w-    C:\rei
2013-07-22 13:42:26    --------    d-----w-    C:\Users\Lori\AppData\Roaming\QuickScan
2013-07-16 01:21:58    --------    d-----w-    C:\Users\Lori\AppData\Roaming\Malwarebytes
2013-07-16 01:21:38    --------    d-----w-    C:\ProgramData\Malwarebytes
2013-07-16 01:21:36    25928    ----a-w-    C:\windows\System32\drivers\mbam.sys
2013-07-16 01:21:36    --------    d-----w-    C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-16 01:21:20    --------    d-----w-    C:\Users\Lori\AppData\Local\Programs
2013-07-09 13:06:54    --------    d-----w-    C:\Users\Lori\AppData\Roaming\SUPERAntiSpyware.com
2013-07-09 13:05:57    --------    d-----w-    C:\ProgramData\SUPERAntiSpyware.com
2013-07-09 13:05:57    --------    d-----w-    C:\Program Files\SUPERAntiSpyware
2013-07-08 18:21:08    --------    d-----w-    C:\Users\Lori\AppData\Local\{54B025F6-15E7-403F-82EB-26D993390C1D}
2013-07-08 14:47:40    39424    ----a-r-    C:\Users\Lori\AppData\Roaming\Microsoft\Installer\{88741A14-4C9D-469F-BA36-8FDF6037BB68}\Icon88741A14.exe
2013-07-08 14:46:39    --------    d-----w-    C:\Program Files (x86)\Common Files\Wise Installation Wizard
.
==================== Find3M  ====================
.
2013-06-26 13:10:11    45856    ----a-w-    C:\windows\System32\drivers\avgtpx64.sys
2013-06-12 15:35:46    71048    ----a-w-    C:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-12 15:35:46    692104    ----a-w-    C:\windows\SysWow64\FlashPlayerApp.exe
2013-06-12 15:35:30    9089416    ----a-w-    C:\windows\SysWow64\FlashPlayerInstaller.exe
.
============= FINISH:  9:55:00.74 ===============
 

 

Attached Files



BC AdBot (Login to Remove)

 


#2 HelpBot

HelpBot

    Bleepin' Binary Bot


  • Bots
  • 12,660 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:41 AM

Posted 31 July 2013 - 09:05 AM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

step1.gif In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/502304 <<< CLICK THIS LINK



If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

step2.gifIf you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new DDS log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from the following link if you no longer have it available and save it to your destop.

    DDS.com Download Link
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control can be found HERE.

As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#3 dev00790

dev00790

    Bleeping Chocoholic


  • Members
  • 5,037 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:05:41 AM

Posted 03 August 2013 - 04:34 AM

Hello,

I will be helping you with your problems. Please be patient while I assist you.

Some points for you to keep in mind while I am helping you to make things go easier and faster for both of us

  • Please do NOT run, install or uninstall any programs,  unless instructed to do so
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
          
  • Please do not attach logs or use code boxes, just copy and paste the text
    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
          
  • Please read every post completely before doing anything.
    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
          
  • Please provide feedback about your experience as we go.
    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.
          

NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of hartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

----------------------------------------------

Please do the following next:

:step1:

  • Double click on the DDS icon, and allow it to run.
  • DDS will now display a red window with an option screen called DDS: Settings
  • Mark the options dds.txt and attach.txt.
  • Click on Start.
  • If you did not disable a script-blocker that may be part of your antimalware program, you may receive a warning from your antimalware product asking if you would like DDS.com to run. Please allow it to do so.
  • DDS will automatically open both logfiles.
  • You can find them on your desktop as well.
  • Please post the content of those logfiles with your next answer.

Please note:  You may have to disable any script protection running if the scan fails to run.  After downloading the tool, disconnect from the internet and disable all antivirus protection.  Run the scan, enable your A/V and reconnect to the internet.  

Information on A/V control HERE


Regards, dev00790

---------------------------------------

Marge: "Homer, the plant called. They said if you don't show up tomorrow don't bother showing up on Monday." Homer: "Woo-hoo! Four-day weekend!"I do not reply to Private Messages (PMs) asking for assistance - please use the forums instead. If I have been helping you, and I have not replied to your latest post in 48 hours please send me a PM. My Blog


#4 dev00790

dev00790

    Bleeping Chocoholic


  • Members
  • 5,037 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:05:41 AM

Posted 07 August 2013 - 03:17 PM

Hi, are you still with us? The topic will be closed in 3 days unless we receive a response from you.


Regards, dev00790

---------------------------------------

Marge: "Homer, the plant called. They said if you don't show up tomorrow don't bother showing up on Monday." Homer: "Woo-hoo! Four-day weekend!"I do not reply to Private Messages (PMs) asking for assistance - please use the forums instead. If I have been helping you, and I have not replied to your latest post in 48 hours please send me a PM. My Blog


#5 webdzyner

webdzyner
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:41 AM

Posted 08 August 2013 - 12:42 PM

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 9.0.8112.16421  BrowserJavaVersion: 10.9.2
Run by Lori at 13:37:59 on 2013-08-08
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.3693.2049 [GMT -4:00]
.
AV: AVG Internet Security 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Internet Security 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: AVG Internet Security 2012 *Enabled* {621CC794-9486-F902-D092-0484E8EA828B}
.
============== Running Processes ===============
.
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\agent_x64.exe
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\system32\atiesrxx.exe
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\GFNEXSrv.exe
C:\windows\system32\atieclxx.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\AVG\AVG2012\avgfws.exe
C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe
C:\windows\system32\svchost.exe -k imgsvc
C:\windows\system32\TODDSrv.exe
C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\AVG\AVG2012\avgnsa.exe
C:\Program Files (x86)\AVG\AVG2012\avgemca.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\windows\system32\wbem\unsecapp.exe
C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe
C:\Program Files (x86)\AVG\AVG2012\avgrsa.exe
C:\Program Files (x86)\AVG\AVG2012\avgcsrva.exe
C:\windows\system32\taskhost.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\windows\system32\Dwm.exe
C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe
C:\windows\Explorer.EXE
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\AVG\AVG PC Tuneup\BoostSpeed.exe
C:\Program Files (x86)\AVG\AVG2012\avgcsrva.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe
C:\Program Files\Toshiba\ReelTime\TosReelTimeMonitor.exe
C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\ToshibaServiceStation.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
C:\windows\system32\SearchIndexer.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Ask.com\Updater\Updater.exe
C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE
C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MMLoadDrv.exe
C:\windows\System32\svchost.exe -k LocalServicePeerNet
C:\windows\splwow64.exe
C:\Program Files (x86)\Canon\Quick Menu\CNQMUPDT.EXE
C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\Program Files (x86)\KompoZer\kompozer.exe
C:\Users\Lori\Desktop\ColorPix.exe
C:\windows\SysWOW64\NOTEPAD.EXE
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe
C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\loggingserver.exe
C:\Program Files (x86)\AVG Secure Search\vprot.exe
C:\windows\System32\spoolsv.exe
C:\Program Files (x86)\MapsGalaxy_39\bar\1.bin\39HighIn.exe
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
C:\Program Files\eFix\eFix Pro\ReiGuard.exe
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
C:\windows\system32\taskeng.exe
C:\windows\system32\SearchProtocolHost.exe
C:\windows\system32\SearchFilterHost.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://myblock.hrblock.com/
uDefault_Page_URL = hxxp://start.toshiba.com/?cid=C001B2Y
uProxyOverride = <local>;*.local
uURLSearchHooks: UrlSearchHook Class: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
mWinlogon: Userinit = userinit.exe
BHO: MSS+ Identifier: {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll
BHO: Canon Easy-WebPrint EX BHO: {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll
BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.4.0.5\AVG Secure Search_toolbar.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
BHO: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.4.0.5\AVG Secure Search_toolbar.dll
TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
TB: Canon Easy-WebPrint EX: {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
EB: Canon Easy-WebPrint EX: {21347690-EC41-4F9A-8887-1F4AEE672439} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll
uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
uRun: [TomTomHOME.exe] "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"
uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
uRunOnce: [FlashPlayerUpdate] C:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_7_700_224_Plugin.exe -update plugin
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
mRun: [ToshibaAppPlace] "C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe"
mRun: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe" UNATTENDED
mRun: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe"
mRun: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [CanonQuickMenu] C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE /logon
mRun: [IJNetworkScannerSelectorEX] C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe /FORCE
mRunOnce: [MapsGalaxy_39bar Uninstall] rundll32 C:\PROGRA~2\39UNIN~1.DLL,O -3 uninstalltype="FF"
dRunOnce: [KodakHomeCenter] "C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe"
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~3\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~3\Office14\ONBttnIE.dll/105
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{9CCC4D28-A371-4BD3-B1B8-C188E5D35400} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{F9FC772F-013F-45A2-A91E-F5C28A7B4561} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{F9FC772F-013F-45A2-A91E-F5C28A7B4561}\130364850393137383234383 : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{F9FC772F-013F-45A2-A91E-F5C28A7B4561}\2416E676F627445607F647 : DHCPNameServer = 208.25.96.18 208.25.96.3
TCP: Interfaces\{F9FC772F-013F-45A2-A91E-F5C28A7B4561}\2516D6164616 : DHCPNameServer = 204.111.1.35 204.111.1.36
TCP: Interfaces\{F9FC772F-013F-45A2-A91E-F5C28A7B4561}\4616973794E6E60244 : DHCPNameServer = 24.247.15.53 66.189.0.100 24.178.162.3
TCP: Interfaces\{F9FC772F-013F-45A2-A91E-F5C28A7B4561}\D41696E63547D4164747167716E6D27657563747 : DHCPNameServer = 184.16.4.22 184.16.33.54 192.168.33.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.4.0\ViProtocol.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck - <orphaned>
mASetup: Neat ADF Scanner 2008 - reg copy "HKLM\Software\Wow6432Node\The Neat Company\Neat ADF Scanner 2008" "HKCU\Software\The Neat Company\Neat ADF Scanner 2008" /s /f
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-BHO: AVG Do Not Track: {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll
x64-BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-Run: [TPwrMain] C:\Program Files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE
x64-Run: [TCrdMain] C:\Program Files (x86)\TOSHIBA\FlashCards\TCrdMain.exe
x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-Run: [RtHDVBg_Dolby] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE3
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe
x64-Run: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe
x64-Run: [TosNC] C:\Program Files (x86)\Toshiba\BulletinBoard\TosNcCore.exe
x64-Run: [TosReelTimeMonitor] C:\Program Files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
x64-IE: {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
x64-Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll
x64-Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - <orphaned>
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-SSODL: WebCheck - <orphaned>
x64-mASetup: Send To Neat - reg copy "HKLM\Software\The Neat Company\Send To Neat" "HKCU\Software\The Neat Company\Send To Neat" /s /f
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aolrt-chromesbox-en-us&tb_uuid=20120616010147195&tb_oid=16-06-2012&tb_mrud=16-06-2012
FF - prefs.js: browser.search.selectedEngine - Ask Web Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - prefs.js: keyword.URL - hxxp://search.tb.ask.com/search/GGmain.jhtml?st=kwd&ptb=AC6F08AB-616C-48DE-BDBF-5DDB0C6A46DA&n=77fd2bc6&ind=2013080518&p2=^UX^xdm011^YYA^us&si=maps4pcFFboth&searchfor=
FF - plugin: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll
FF - plugin: C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll
FF - plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.4.0\npsitesafety.dll
FF - plugin: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMSS.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\6\NP_wtapp.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll
FF - ExtSQL: 2013-07-22 09:40; {e001c731-5e37-4538-a5cb-8168736a2360}; C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
.
---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
FF - user.js: browser.sessionstore.resume_from_crash - false
.
FF - user.js: extensions.autoDisableScopes - 14
.
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHA;AVGIDSHA;C:\windows\System32\drivers\avgidsha.sys [2012-4-19 28480]
R0 Avgrkx64;AVG Anti-Rootkit Driver;C:\windows\System32\drivers\avgrkx64.sys [2012-1-31 36944]
R1 Avgfwfd;AVG network filter service;C:\windows\System32\drivers\avgfwd6a.sys [2011-5-23 48992]
R1 Avgldx64;AVG AVI Loader Driver;C:\windows\System32\drivers\avgldx64.sys [2012-11-8 307040]
R1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;C:\windows\System32\drivers\avgmfx64.sys [2011-12-23 47696]
R1 Avgtdia;AVG TDI Driver;C:\windows\System32\drivers\avgtdia.sys [2013-4-11 384800]
R1 avgtp;avgtp;C:\windows\System32\drivers\avgtpx64.sys [2012-11-9 45856]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2013-5-23 143120]
R2 Agent;Agent;C:\Windows\agent_x64.exe [2012-4-7 102912]
R2 AMD External Events Utility;AMD External Events Utility;C:\windows\System32\atiesrxx.exe [2012-1-27 204288]
R2 avgfws;AVG Firewall;C:\Program Files (x86)\AVG\AVG2012\avgfws.exe [2012-12-5 2321560]
R2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe [2012-11-2 5174392]
R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe [2012-2-14 193288]
R2 eFixRealTimeProtection;eFix Real Time Protection;C:\Program Files\eFix\eFix Pro\ReiGuard.exe [2013-8-6 4388200]
R2 GFNEXSrv;GFNEX Service;C:\windows\System32\GFNEXSrv.exe [2012-1-27 162824]
R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-7-15 418376]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-7-15 701512]
R2 PCCUJobMgr;Common Client Job Manager Service;C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe [2012-1-27 126392]
R2 TomTomHOMEService;TomTomHOMEService;C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [2013-3-22 93072]
R2 vToolbarUpdater15.4.0;vToolbarUpdater15.4.0;C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe [2013-7-30 1616048]
R3 AVGIDSDriver;AVGIDSDriver;C:\windows\System32\drivers\avgidsdrivera.sys [2012-12-10 127328]
R3 AVGIDSFilter;AVGIDSFilter;C:\windows\System32\drivers\avgidsfiltera.sys [2011-12-23 29776]
R3 MBAMProtector;MBAMProtector;C:\windows\System32\drivers\mbam.sys [2013-7-15 25928]
R3 PGEffect;Pangu effect driver;C:\windows\System32\drivers\PGEffect.sys [2012-1-27 38096]
R3 RTL8167;Realtek 8167 NT Driver;C:\windows\System32\drivers\Rt64win7.sys [2012-1-27 413800]
R3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;C:\windows\System32\drivers\rtl8192ce.sys [2012-1-27 1142376]
R3 TMachInfo;TMachInfo;C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\TMachInfo.exe [2012-1-27 57216]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2011-6-10 138152]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [2013-2-5 235216]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\windows\System32\drivers\RtsUStor.sys [2012-1-27 250984]
S3 TsUsbFlt;TsUsbFlt;C:\windows\System32\drivers\TsUsbFlt.sys [2010-11-20 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\windows\System32\drivers\TsUsbGD.sys [2010-11-20 31232]
S3 USBAAPL64;Apple Mobile USB Driver;C:\windows\System32\drivers\usbaapl64.sys [2012-4-25 52736]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\System32\Wat\WatAdminSvc.exe [2012-3-15 1255736]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2013-08-06 13:22:22    712264    ----a-w-    C:\Program Files (x86)\39Uninstall MapsGalaxy.dll
2013-08-06 13:22:22    194944    ----a-w-    C:\Program Files (x86)\39res.dll
2013-08-05 22:01:53    --------    d---a-w-    C:\Users\Lori\AppData\Local\MapsGalaxy_39
2013-08-05 22:01:42    --------    d---a-w-    C:\Program Files (x86)\MapsGalaxy_39
2013-08-05 22:01:12    --------    d---a-w-    C:\Program Files (x86)\MapsGalaxy_39EI
2013-07-29 13:12:15    --------    d-----w-    C:\ProgramData\CDB
2013-07-28 17:26:23    --------    d-----w-    C:\Users\Lori\AppData\Roaming\kompozer.net
2013-07-28 17:26:23    --------    d-----w-    C:\Users\Lori\AppData\Local\kompozer.net
2013-07-28 17:26:09    --------    d-----w-    C:\Program Files (x86)\KompoZer
2013-07-25 19:12:16    301568    ----a-w-    C:\Program Files\Microsoft Games\More Games\MoreGames.dll
2013-07-25 19:11:01    145792    ----a-w-    C:\windows\System32\drivers\E1G6032E.sys
2013-07-25 19:07:44    --------    d-----w-    C:\Recovery
2013-07-25 19:07:44    --------    d-----w-    C:\PerfLogs
2013-07-25 18:01:00    9728    ----a-w-    C:\windows\System32\Native.exe
2013-07-25 18:00:36    --------    d-----w-    C:\eFixUndo
2013-07-25 17:44:33    --------    d-----w-    C:\Program Files\eFix
2013-07-25 17:44:24    --------    d-----w-    C:\rei
2013-07-22 13:42:26    --------    d-----w-    C:\Users\Lori\AppData\Roaming\QuickScan
2013-07-16 01:21:58    --------    d-----w-    C:\Users\Lori\AppData\Roaming\Malwarebytes
2013-07-16 01:21:38    --------    d-----w-    C:\ProgramData\Malwarebytes
2013-07-16 01:21:36    25928    ----a-w-    C:\windows\System32\drivers\mbam.sys
2013-07-16 01:21:36    --------    d-----w-    C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-16 01:21:20    --------    d-----w-    C:\Users\Lori\AppData\Local\Programs
.
==================== Find3M  ====================
.
2013-07-30 13:51:01    45856    ----a-w-    C:\windows\System32\drivers\avgtpx64.sys
2013-06-12 15:35:46    71048    ----a-w-    C:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-12 15:35:46    692104    ----a-w-    C:\windows\SysWow64\FlashPlayerApp.exe
2013-06-12 15:35:30    9089416    ----a-w-    C:\windows\SysWow64\FlashPlayerInstaller.exe
.
============= FINISH: 13:39:01.18 ===============
 



#6 webdzyner

webdzyner
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:41 AM

Posted 08 August 2013 - 12:44 PM

Here is the attach.txt

Attached Files



#7 dev00790

dev00790

    Bleeping Chocoholic


  • Members
  • 5,037 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:05:41 AM

Posted 10 August 2013 - 07:05 AM

Hi

Please do the following next:

:step1:

Online Gaming Warning!

Online gaming sites are a security risk which can make your computer susceptible to a large number of malware infections, remote attacks, exposure of personal information, and identity theft. They can lead to other sites containing malware which you can inadvertently download without knowledge. Users visiting such sites may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. Gaming sites can put you at risk to fraud, phishing and theft of personal data. Even if the gaming site is a clean site, there is always the potential of some type of malware making its way there and then onto your system. In some instances an infection may have caused so much damage to your system that it cannot be successfully cleaned or repaired. In those cases, recovery is not possible and the only option is to reformat/reinstall the OS.

More specifically, I noticed you had WildTangent on your computer.
WildTangent Program Warning

Wild Tangent is a video game software company specializing in online games. It has even made a partnership with AOL to include itself as part of the AOL Instant Messenger for their AIM games section. The WildTangent Web Driver is their technology that allows you to play 3D games over the Internet. Although its not technically considered spyware it does have built in components to update itself and gather information about the computer system including:

  • Operating System Version
  • CPU Type and Speed
  • Memory Amount
  • Video Card type and Driver Version
  • Sound Card type and Driver Version
  • DirectX Version
  • Location that the Web Driver was installed from

For that reason I would suggest you uninstalled it via Control Panel > Programs and Features.
Reboot after the uninstallation.<- Important.


:step2:

Please download AdwCleaner by Xplode onto your desktop.

  • Double click on AdwCleaner.exe to run the tool.
  • Click on Search.
  • A logfile will automatically open after the scan has finished.
  • Please post the contents of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[R1].txt as well.


:step3:

I see that you have a number of TCP interfaces with different IP addresses for the following:

Sprint SPRINTLINK-BLKS
Shentel
Charter Communications
Frontier Communications Solutions

- Do you know what these are for?


Regards, dev00790

---------------------------------------

Marge: "Homer, the plant called. They said if you don't show up tomorrow don't bother showing up on Monday." Homer: "Woo-hoo! Four-day weekend!"I do not reply to Private Messages (PMs) asking for assistance - please use the forums instead. If I have been helping you, and I have not replied to your latest post in 48 hours please send me a PM. My Blog


#8 webdzyner

webdzyner
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:41 AM

Posted 12 August 2013 - 02:39 PM

Frontier is my internet provider

Sprint is my cell phone provider

I dont know about Shentel or Charter

 

Here is the file from adware

 

# AdwCleaner v2.306 - Logfile created 08/12/2013 at 15:34:37
# Updated 19/07/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Lori - LORI-PC
# Boot Mode : Normal
# Running from : C:\Users\Lori\Downloads\AdwCleaner.exe
# Option [Search]


***** [Services] *****

Found : CltMngSvc

***** [Files / Folders] *****

File Found : C:\END
File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll
File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.xpt
File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll
File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.xpt
File Found : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml
File Found : C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\searchplugins\Askcom.xml
File Found : C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\searchplugins\Conduit.xml
Folder Found : C:\Program Files (x86)\Ask.com
Folder Found : C:\Program Files (x86)\AVG Secure Search
Folder Found : C:\Program Files (x86)\Common Files\AVG Secure Search
Folder Found : C:\Program Files (x86)\Common Files\Software Update Utility
Folder Found : C:\Program Files (x86)\Conduit
Folder Found : C:\Program Files (x86)\InternetHelper3.1
Folder Found : C:\Program Files (x86)\internethelper3.1
Folder Found : C:\Program Files (x86)\mapsgalaxy_39
Folder Found : C:\Program Files (x86)\MapsGalaxy_39EI
Folder Found : C:\Program Files (x86)\SearchProtect
Folder Found : C:\ProgramData\Ask
Folder Found : C:\ProgramData\AVG Secure Search
Folder Found : C:\ProgramData\Tarma Installer
Folder Found : C:\Users\Lori\AppData\Local\APN
Folder Found : C:\Users\Lori\AppData\Local\AVG Secure Search
Folder Found : C:\Users\Lori\AppData\Local\Conduit
Folder Found : C:\Users\Lori\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla
Folder Found : C:\Users\Lori\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Folder Found : C:\Users\Lori\AppData\Local\mapsgalaxy_39
Folder Found : C:\Users\Lori\AppData\Local\Temp\AirInstaller
Folder Found : C:\Users\Lori\AppData\Local\Temp\CT3289663
Folder Found : C:\Users\Lori\AppData\LocalLow\AskToolbar
Folder Found : C:\Users\Lori\AppData\LocalLow\AVG Secure Search
Folder Found : C:\Users\Lori\AppData\LocalLow\Conduit
Folder Found : C:\Users\Lori\AppData\LocalLow\InternetHelper3.1
Folder Found : C:\Users\Lori\AppData\LocalLow\internethelper3.1
Folder Found : C:\Users\Lori\AppData\LocalLow\MapsGalaxy_39EI
Folder Found : C:\Users\Lori\AppData\LocalLow\Playbryte
Folder Found : C:\Users\Lori\AppData\Roaming\iWin
Folder Found : C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\CT3289663
Folder Found : C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\extensions\{07cbf788-1359-421b-a4e3-5a8d041b90a3}
Folder Found : C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\extensions\playbryte@playbryte.com
Folder Found : C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\extensions\staged
Folder Found : C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\extensions\toolbar@ask.com
Folder Found : C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\Smartbar
Folder Found : C:\Users\Lori\AppData\Roaming\SearchProtect
Folder Found : C:\windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

***** [Registry] *****

Key Found : HKCU\Software\APN
Key Found : HKCU\Software\AppDataLow\Software\AskToolbar
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Found : HKCU\Software\AppDataLow\Software\InternetHelper3.1
Key Found : HKCU\Software\AppDataLow\Software\MapsGalaxy_39
Key Found : HKCU\Software\AppDataLow\Software\SmartBar
Key Found : HKCU\Software\AppDataLow\Toolbar
Key Found : HKCU\Software\Ask.com
Key Found : HKCU\Software\AVG Secure Search
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\MapsGalaxy_39
Key Found : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{07CBF788-1359-421B-A4E3-5A8D041B90A3}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{07CBF788-1359-421B-A4E3-5A8D041B90A3}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Found : HKCU\Software\SearchProtect
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKLM\Software\APN
Key Found : HKLM\Software\AskToolbar
Key Found : HKLM\Software\AVG Secure Search
Key Found : HKLM\Software\AVG Security Toolbar
Key Found : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Found : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}
Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Found : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Found : HKLM\SOFTWARE\Classes\AppID\dnu.EXE
Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Found : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Key Found : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Key Found : HKLM\SOFTWARE\Classes\dnUpdate
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Found : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Key Found : HKLM\SOFTWARE\Classes\S
Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Found : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3289663
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{13ABD093-D46F-40DF-A608-47E162EC799D}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Found : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Found : HKLM\Software\Conduit
Key Found : HKLM\Software\InternetHelper3.1
Key Found : HKLM\Software\MapsGalaxy_39
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6CE83F03-4DFD-4070-A0A7-C46C82E20971}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F0B76E1-4E46-427B-B55B-B90593468AC6}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Found : HKLM\Software\SearchProtect
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{07CBF788-1359-421B-A4E3-5A8D041B90A3}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{07CBF788-1359-421B-A4E3-5A8D041B90A3}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{6CE83F03-4DFD-4070-A0A7-C46C82E20971}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\aaaaojmikegpiepcfdkkjaplodkpfmlo
Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla
Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6A516BFF-C9CB-41A6-AEC1-DC76FA284CBD}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7207F91-F4E7-4D68-8CE3-65B97B54A2F9}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07CBF788-1359-421B-A4E3-5A8D041B90A3}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07CBF788-1359-421B-A4E3-5A8D041B90A3}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\InternetHelper3.1 Toolbar
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : HKLM\SOFTWARE\Classes\Interface\{23119123-0854-469D-807A-171568457991}
Key Found : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Found : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Found : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Software
Key Found : HKLM\SOFTWARE\Tarma Installer
Key Found : HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{07CBF788-1359-421B-A4E3-5A8D041B90A3}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{07CBF788-1359-421B-A4E3-5A8D041B90A3}]
Value Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [searchprotect]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{07CBF788-1359-421B-A4E3-5A8D041B90A3}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{07CBF788-1359-421B-A4E3-5A8D041B90A3}]
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SearchProtectAll]
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]
Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{07CBF788-1359-421B-A4E3-5A8D041B90A3}]
Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{07CBF788-1359-421B-A4E3-5A8D041B90A3}]
Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.conduit.com?SearchSource=10&CUI=UN73871753750523154&UM=2&ctid=CT3289663&SSPV=TB_CS7

-\\ Mozilla Firefox v22.0 (en-US)

File : C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\prefs.js

Found : user_pref("CT3289663.1000082.isPlayDisplay", "true");
Found : user_pref("CT3289663.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description[...]
Found : user_pref("CT3289663.1000234.TWC_TMP_city", "HARTFORD");
Found : user_pref("CT3289663.1000234.TWC_TMP_country", "US");
Found : user_pref("CT3289663.1000234.TWC_country", "UNITED STATES");
Found : user_pref("CT3289663.1000234.TWC_locId", "USMI0377");
Found : user_pref("CT3289663.1000234.TWC_location", "Hartford, MI");
Found : user_pref("CT3289663.1000234.TWC_region", "US");
Found : user_pref("CT3289663.1000234.TWC_temp_dis", "f");
Found : user_pref("CT3289663.1000234.TWC_wind_dis", "mph");
Found : user_pref("CT3289663.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Found : user_pref("CT3289663.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]
Found : user_pref("CT3289663.FF19Solved", "true");
Found : user_pref("CT3289663.FirstTime", "true");
Found : user_pref("CT3289663.FirstTimeFF3", "true");
Found : user_pref("CT3289663.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT328[...]
Found : user_pref("CT3289663.UserID", "UN12714428951325715");
Found : user_pref("CT3289663.addressBarTakeOverEnabledInHidden", "true");
Found : user_pref("CT3289663.autoDisableScopes", 14);
Found : user_pref("CT3289663.browser.search.defaultthis.engineName", "true");
Found : user_pref("CT3289663.countryCode", "US");
Found : user_pref("CT3289663.defaultSearch", "true");
Found : user_pref("CT3289663.embeddedsData", "[{\"appId\":\"130067724014616498\",\"apiPermissions\":{\"cross[...]
Found : user_pref("CT3289663.enableAlerts", "true");
Found : user_pref("CT3289663.enableSearchFromAddressBar", "true");
Found : user_pref("CT3289663.firstTimeDialogOpened", "true");
Found : user_pref("CT3289663.fixPageNotFoundError", "true");
Found : user_pref("CT3289663.fixPageNotFoundErrorByUser", "true");
Found : user_pref("CT3289663.fixPageNotFoundErrorInHidden", "true");
Found : user_pref("CT3289663.fixUrls", true);
Found : user_pref("CT3289663.fullUserID", "UN12714428951325715.IN.20130812152006");
Found : user_pref("CT3289663.homepageuserchanged", true);
Found : user_pref("CT3289663.installDate", "12/08/2013 15:20:04");
Found : user_pref("CT3289663.installId", "stub.exe");
Found : user_pref("CT3289663.installSessionId", "{4957FB43-329B-48F8-BD31-7374E47FFE27}");
Found : user_pref("CT3289663.installSp", "TRUE");
Found : user_pref("CT3289663.installType", "conduitnsisintegration");
Found : user_pref("CT3289663.installUsage", "2013-08-12T22:22:34.4127737+03:00");
Found : user_pref("CT3289663.installUsageEarly", "2013-08-12T22:21:50.9038159+03:00");
Found : user_pref("CT3289663.installerVersion", "1.5.4.5");
Found : user_pref("CT3289663.isCheckedStartAsHidden", true);
Found : user_pref("CT3289663.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Found : user_pref("CT3289663.isFirstTimeToolbarLoading", "false");
Found : user_pref("CT3289663.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Found : user_pref("CT3289663.keyword", "true");
Found : user_pref("CT3289663.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit[...]
Found : user_pref("CT3289663.lastVersion", "10.16.9.6");
Found : user_pref("CT3289663.mam_gk_installer_preapproved.enc", "ZmFsc2U=");
Found : user_pref("CT3289663.migrateAppsAndComponents", true);
Found : user_pref("CT3289663.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"\",\"EB_MAIN_FRAME_TITLE\":\"[...]
Found : user_pref("CT3289663.openThankYouPage", "false");
Found : user_pref("CT3289663.openUninstallPage", "true");
Found : user_pref("CT3289663.originalHomepage", "hxxp://www.google.com");
Found : user_pref("CT3289663.originalSearchAddressUrl", "hxxp://search.tb.ask.com/search/GGmain.jhtml?st=kwd[...]
Found : user_pref("CT3289663.originalSearchEngine", "Ask Web Search");
Found : user_pref("CT3289663.originalSearchEngineName", "Ask Web Search");
Found : user_pref("CT3289663.revertSettingsEnabled", "false");
Found : user_pref("CT3289663.search.searchAppId", "130067724014616498");
Found : user_pref("CT3289663.search.searchCount", "0");
Found : user_pref("CT3289663.searchFromAddressBarEnabledByUser", "true");
Found : user_pref("CT3289663.searchInNewTabEnabledByUser", "true");
Found : user_pref("CT3289663.searchInNewTabEnabledInHidden", "true");
Found : user_pref("CT3289663.searchRevert", "false");
Found : user_pref("CT3289663.searchSuggestEnabledByUser", "true");
Found : user_pref("CT3289663.searchUserMode", "2");
Found : user_pref("CT3289663.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Found : user_pref("CT3289663.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]
Found : user_pref("CT3289663.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]
Found : user_pref("CT3289663.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]
Found : user_pref("CT3289663.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]
Found : user_pref("CT3289663.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]
Found : user_pref("CT3289663.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]
Found : user_pref("CT3289663.serviceLayer_service_usage_toolbarUsageCount", "{\"dataType\":\"number\",\"data[...]
Found : user_pref("CT3289663.serviceLayer_services_Configuration_lastUpdate", "1376335310394");
Found : user_pref("CT3289663.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1376335352368");
Found : user_pref("CT3289663.serviceLayer_services_appsMetadata_lastUpdate", "1376335352382");
Found : user_pref("CT3289663.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1376335351296");
Found : user_pref("CT3289663.serviceLayer_services_installUsage_ToolbarInstallEarly_lastUpdate", "1376335311[...]
Found : user_pref("CT3289663.serviceLayer_services_installUsage_ToolbarInstall_lastUpdate", "1376335355777")[...]
Found : user_pref("CT3289663.serviceLayer_services_login_10.16.9.6_lastUpdate", "1376335432284");
Found : user_pref("CT3289663.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1376335351482");
Found : user_pref("CT3289663.serviceLayer_services_searchAPI_lastUpdate", "1376335311645");
Found : user_pref("CT3289663.serviceLayer_services_serviceMap_lastUpdate", "1376335308873");
Found : user_pref("CT3289663.serviceLayer_services_toolbarContextMenu_lastUpdate", "1376335351141");
Found : user_pref("CT3289663.serviceLayer_services_toolbarSettings_lastUpdate", "1376335310420");
Found : user_pref("CT3289663.serviceLayer_services_translation_lastUpdate", "1376335353301");
Found : user_pref("CT3289663.settingsINI", true);
Found : user_pref("CT3289663.shouldFirstTimeDialog", "false");
Found : user_pref("CT3289663.showToolbarPermission", "false");
Found : user_pref("CT3289663.smartbar.CTID", "CT3289663");
Found : user_pref("CT3289663.smartbar.Uninstall", "0");
Found : user_pref("CT3289663.smartbar.homepage", "true");
Found : user_pref("CT3289663.smartbar.isHidden", true);
Found : user_pref("CT3289663.smartbar.toolbarName", "InternetHelper3.1 ");
Found : user_pref("CT3289663.startPage", "true");
Found : user_pref("CT3289663.toolbarBornServerTime", "12-8-2013");
Found : user_pref("CT3289663.toolbarCurrentServerTime", "12-8-2013");
Found : user_pref("CT3289663.toolbarLoginClientTime", "Mon Aug 12 2013 15:22:34 GMT-0400 (Eastern Standard T[...]
Found : user_pref("CT3289663.versionFromInstaller", "10.16.9.6");
Found : user_pref("CT3289663.xpeMode", "3");
Found : user_pref("CT3289663_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]
Found : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3289663&octid=CT328966[...]
Found : user_pref("Smartbar.ConduitSearchEngineList", "InternetHelper3.1 Customized Web Search");
Found : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289663[...]
Found : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "hxxp://search.tb.ask.com/search/GGmain.jhtml?st=[...]
Found : user_pref("Smartbar.keywordURLSelectedCTID", "CT3289663");
Found : user_pref("avg.install.installDirPath", "C:\\ProgramData\\AVG Secure Search\\FireFoxExt\\15.4.0.5");
Found : user_pref("browser.search.defaultengine", "Ask.com");
Found : user_pref("browser.search.defaultenginename", "InternetHelper3.1 Customized Web Search");
Found : user_pref("browser.search.defaultthis.engineName", "InternetHelper3.1 Customized Web Search");
Found : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289663&CUI[...]
Found : user_pref("browser.search.order.1", "Ask.com");
Found : user_pref("browser.search.selectedEngine", "InternetHelper3.1 Customized Web Search");
Found : user_pref("extensions.asktb.InstallDir", "C:\\Program Files (x86)\\Ask.com\\");
Found : user_pref("extensions.asktb.abar-war-regex", "conduit\\.com");
Found : user_pref("extensions.asktb.apn_dbr", "ff_15.0.1");
Found : user_pref("extensions.asktb.autofill-competitor-query-enabled", true);
Found : user_pref("extensions.asktb.cbid", "TV");
Found : user_pref("extensions.asktb.clear-searches-on-exit", true);
Found : user_pref("extensions.asktb.config-updated", true);
Found : user_pref("extensions.asktb.cr-o", "100000031cr");
Found : user_pref("extensions.asktb.crumb", "2012.10.26+07.46.28-toolbar003iad-US-Um9jaGVzdGVyLE5ZLFVuaXRlZC[...]
Found : user_pref("extensions.asktb.default-channel-url-mask", "hxxp://www.ask.com/web?q={query}&o={o}&l={l}[...]
Found : user_pref("extensions.asktb.displaybehavior", "");
Found : user_pref("extensions.asktb.displaytext", "");
Found : user_pref("extensions.asktb.dtid", "YYYYYYYYUS");
Found : user_pref("extensions.asktb.dyn-weather-do-locid-lookup-weatherWidget", false);
Found : user_pref("extensions.asktb.dyn-weather-locid-weatherWidget", "49071");
Found : user_pref("extensions.asktb.dyn-weather-tempunit-weatherWidget", "F");
Found : user_pref("extensions.asktb.ff-original-keyword-url", "");
Found : user_pref("extensions.asktb.ff19-config-first-run", "true");
Found : user_pref("extensions.asktb.fresh-install", false);
Found : user_pref("extensions.asktb.guid", "C68E932A-D4C9-4A1F-B938-83BA1B3681CD");
Found : user_pref("extensions.asktb.hxxp-header-whitelist-hosts", "[\"static-dev.en.dev.ask.com\", \"ask.com[...]
Found : user_pref("extensions.asktb.if", "su");
Found : user_pref("extensions.asktb.keyword-toggled-in-session", false);
Found : user_pref("extensions.asktb.l", "dis");
Found : user_pref("extensions.asktb.last-config-req", "1376331262965");
Found : user_pref("extensions.asktb.last-search-timestamp", "1372606998566");
Found : user_pref("extensions.asktb.locale", "en_US");
Found : user_pref("extensions.asktb.location", "Rochester,NY,United States");
Found : user_pref("extensions.asktb.lstation", "");
Found : user_pref("extensions.asktb.new-tab-opt-out", true);
Found : user_pref("extensions.asktb.news-native-on", true);
Found : user_pref("extensions.asktb.o", "100000031");
Found : user_pref("extensions.asktb.overlay-reloaded-using-restart", true);
Found : user_pref("extensions.asktb.pstate", "");
Found : user_pref("extensions.asktb.qsrc", "2871");
Found : user_pref("extensions.asktb.r", "21");
Found : user_pref("extensions.asktb.sa", "YES");
Found : user_pref("extensions.asktb.saguid", "378A4EE9-8E5B-4B6C-A1AA-11578E8AE5F8");
Found : user_pref("extensions.asktb.save-searches", false);
Found : user_pref("extensions.asktb.search-history-queries", "bbq");
Found : user_pref("extensions.asktb.search-plugin-suggestions-url", "hxxp://ss.websearch.ask.com/query?qsrc=[...]
Found : user_pref("extensions.asktb.search-suggestions-enabled", true);
Found : user_pref("extensions.asktb.silent-upgrade", true);
Found : user_pref("extensions.asktb.silent-upgrade-from-pre-newtabs-build", false);
Found : user_pref("extensions.asktb.socialmini-first", true);
Found : user_pref("extensions.asktb.socialmini-interval", "1200000");
Found : user_pref("extensions.asktb.socialmini-max-char-ticker", "33");
Found : user_pref("extensions.asktb.socialmini-max-items", "30");
Found : user_pref("extensions.asktb.socialmini-native-on", true);
Found : user_pref("extensions.asktb.socialmini-speed", "10000");
Found : user_pref("extensions.asktb.socialmini-transition-first-open", false);
Found : user_pref("extensions.asktb.themeid", "");
Found : user_pref("extensions.asktb.timeinstalled", "2/1/2013 9:57:36 PM");
Found : user_pref("extensions.asktb.to", "");
Found : user_pref("extensions.asktb.v", "3.15.25.100013");
Found : user_pref("extensions.asktb.version", "5.15.25.36191");
Found : user_pref("extensions.asktb.volume", "");
Found : user_pref("extensions.enabledAddons", "save-as-pdf-ff%40pdfcrowd.com:1.5,%7Be001c731-5e37-4538-a5cb-[...]
Found : user_pref("extensions.mywebsearch.prevDefaultEngine", "Google");
Found : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
Found : user_pref("extensions.mywebsearch.prevSelectedEngine", "Ask.com");
Found : user_pref("extensions.toolbar.mindspark._39Members_.homepage", "hxxp://home.tb.ask.com/index.jhtml?p[...]
Found : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289663&SearchSource=2&CU[...]
Found : user_pref("smartbar.addressBarOwnerCTID", "CT3289663");
Found : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3289663&CUI=UN127144289[...]
Found : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT[...]
Found : user_pref("smartbar.defaultSearchOwnerCTID", "CT3289663");
Found : user_pref("smartbar.homePageOwnerCTID", "CT3289663");
Found : user_pref("smartbar.machineId", "JM+R4TNOJKQRFDDIPF9ROXT0OCGWXN2Q3NBWV3VRKFNKY96JTHDSWDWJC7+7ZYUQFZB[...]
Found : user_pref("smartbar.originalHomepage", "hxxp://search.conduit.com/?ctid=CT3289663&CUI=UN127144289513[...]

-\\ Google Chrome v28.0.1500.95

File : C:\Users\Lori\AppData\Local\Google\Chrome\User Data\Default\Preferences

Found [l.1] : icon_url ={"autofill":{"negative_upload_rate":1.0,"positive_upload_rate":1.0},"browser":{"check_default_browser":false,"clear_data":{"time_period":4},"clear_lso_data_enabled":true,"last_known_google_url":"hxxps://www.google.com/","last_prompted_google_url":"hxxps://www.google.com/","pepper_flash_settings_enabled":true,"window_placement":{"bottom":850,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":852,"work_area_left":0,"work_area_right":1600,"work_area_top":0}},"cloud_print":{"email":""},"countryid_at_install":21843,"default_apps_install_state":2,"default_search_provider":{"alternate_urls":["{google:baseURL}#q={searchTerms}","{google:baseURL}search#q={searchTerms}","{google:baseURL}webhp#q={searchTerms}"],"enabled":true,"encodings":"UTF-8","hxxp://www.google.com/favicon.ico","id":"2","instant_url":"{google:baseURL}webhp?sourceid=chrome-instant&{google:RLZ}{google:instantEnabledParameter}{google:instantExtendedEnabledParameter}{google:ntpIsThemedParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}","keyword":"google.com","name":"Google","prepopulate_id":"1","search_terms_replacement_key":"espv","search_url":"{google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}","suggest_url":"{google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}"},"distribution":{"alternate_shortcut_text":true,"create_all_shortcuts":false,"do_not_launch_chrome":true,"import_bookmarks":false,"import_bookmarks_from_file":"c:\\Programdata\\Toshiba\\Chrome\\bookmarks.html","import_history":false,"import_search_engine":false,"make_chrome_default":false,"require_eula":true,"show_welcome_page":true,"skip_first_run_ui":true,"system_level":true,"verbose_logging":false},"dns_prefetching":{"host_referral_list":[2,["hxxp://1435575.fls.doubleclick.net/",["hxxp://dw.com.com/",0.4384191783250059,"hxxp://googleads.g.doubleclick.net/",0.4384191950702952,"hxxp://www.googleadservices.com/",0.2211500126724028]],["hxxp://a.raasnet.com/",["hxxp://a2.raasnet.com/",0.4969355160652761]],["hxxp://a.rfihub.com/",["hxxp://a.rfihub.com/",0.7160126650558265,"hxxp://ad.doubleclick.net/",0.7160126650558265,"hxxp://b.scorecardresearch.com/",0.8200486933118014,"hxxp://c.betrad.com/",1.2361928063356988,"hxxp://cm.g.doubleclick.net/",0.7160126650558265,"hxxp://ib.adnxs.com/",0.8200486933118014,"hxxp://l.betrad.com/",0.7160126650558265,"hxxp://p.rfihub.com/",0.7160126650558265,"hxxp://s0.2mdn.net/",0.8200486933118014,"hxxp://secure-us.imrworldwide.com/",0.924084721567776]],["hxxp://a.tribalfusion.com/",["hxxp://b.scorecardresearch.com/",0.8764500978772353,"hxxp://secure-us.imrworldwide.com/",0.8764500978772353]],["hxxp://a1.interclick.com/",["hxxp://a1.interclick.com/",1.5617189435841374,"hxxp://ad.yieldmanager.com/",1.5617189435841374,"hxxp://cdn.interclick.com/",1.7886353712843974,"hxxp://mono.vizu.com/",1.7886353712843974,"hxxp://ohlone.vizu.com/",1.5617189435841374,"hxxp://osmsync.interclick.com/",1.5617189435841374]],["hxxp://a2.raasnet.com/",["hxxp://c.betrad.com/",0.37608127428615584,"hxxp://fw.adsafeprotected.com/",0.4969355160652761,"hxxp://l.betrad.com/",0.4451628349445719]],["hxxp://aax-us-east.amazon-adsystem.com/",["hxxp://d2o307dm5mqftz.cloudfront.net/",0.226476976459147]],["hxxp://ad-g.doubleclick.net/",["hxxp://a.scorecardresearch.com/",1.037258319266028,"hxxp://b.scorecardresearch.com/",1.037258319266028,"hxxp://b.voicefive.com/",0.803703465921359,"hxxp://googleads.g.doubleclick.net/",0.13393401829025095,"hxxp://pagead2.googlesyndication.com/",0.07898101070233197,"hxxp://s0.2mdn.net/",0.9204808925936931,"hxxp://www.youtube.com/",0.348697978240387]],["hxxp://ad.bnmla.com/",["hxxp://ad.bnmla.com/",0.6738334789997679,"hxxp://b.scorecardresearch.com/",0.6738334789997679,"hxxp://cdn1.bnmla.com/",0.3390071523836772,"hxxp://edge.quantserve.com/",0.3390071523836772,"hxxp://pixel.quantserve.com/",0.3390071523836772]],["hxxp://ad.doubleclick.net/",["hxxp://g-ecx.images-amazon.com/",0.08882686248960647,"hxxp://s0.2mdn.net/",0.10878529966801516]],["hxxp://ad.turn.com/",["hxxp://cdn.turn.com/",1.034155244698254]],["hxxp://ad.yieldmanager.com/",["hxxp://a1.interclick.com/",1.7886353712843974,"hxxp://ad.yieldmanager.com/",0.3450551671087876,"hxxp://bannerfarm.ace.advertising.com/",0.106531517036509,"hxxp://cookex.amp.yahoo.com/",0.07988500103095544,"hxxp://r1-ads.ace.advertising.com/",0.106531517036509]],["hxxp://adcontent.saymedia.com/",["hxxp://cdn.fastclick.net/",1.885660887297071,"hxxp://choices.truste.com/",1.5040390410583784,"hxxp://js.admeld.com/",1.3132281179390328,"hxxp://media.fastclick.net/",1.5040390410583784,"hxxp://rd.apmebf.com/",1.3132281179390328,"hxxp://tag.admeld.com/",1.3132281179390328]],["hxxp://admin.livefyre.com/",["hxxp://edge.quantserve.com/",0.7585920251023973,"hxxp://pixel.quantserve.com/",0.7585920251023973,"hxxp://www.google-analytics.com/",0.7585920251023973]],["hxxp://ads.pointroll.com/",["hxxp://ad.doubleclick.net/",0.37151424329427973,"hxxp://secure-us.imrworldwide.com/",0.37151424329427973,"hxxp://smq.pointroll.com/",0.830262230320536,"hxxp://spd.pointroll.com/",0.600888236807408,"hxxp://speed.pointroll.com/",4.355263071753814,"hxxp://t.pointroll.com/",0.7254208946473705]],["hxxp://ads.pubmatic.com/",["hxxp://ads.pubmatic.com/",0.8764500978772353,"hxxp://image3.pubmatic.com/",0.8764500978772353,"hxxp://image4.pubmatic.com/",1.0037975479961507,"hxxp://s.amazon-adsystem.com/",1.0037975479961507]],["hxxp://ads.tw.adsonar.com/",["hxxp://ads.tw.adsonar.com/",0.1904679347067428,"hxxp://cdn.tacoda.at.atwola.com/",0.1904679347067428,"hxxp://s.aolcdn.com/",0.34197922728845315,"hxxp://spe.atdmt.com/",0.16630409224394707,"hxxp://view.atdmt.com/",0.16630409224394707]],["hxxp://afe.specificclick.net/",["hxxp://a.scorecardresearch.com/",1.1311449981150654,"hxxp://b.scorecardresearch.com/",1.2584924482339785,"hxxp://cache.specificmedia.com/",1.1311449981150654,"hxxp://view.atdmt.com/",1.0037975479961507]],["hxxp://an.tacoda.net/",["hxxp://rt.legolas-media.com/",0.42853885197869346,"hxxp://s.thebrighttag.com/",0.9837898346618317,"hxxp://tags.bluekai.com/",0.12103788034993253]],["hxxp://aol.com/",["hxxp://www.aol.com/",0.9316044576970659]],["hxxp://as.chango.com/",["hxxp://aa.chango.com/",1.1042755784134999,"hxxp://bs.serving-sys.com/",1.1042755784134999,"hxxp://cm.g.doubleclick.net/",1.1042755784134999,"hxxp://ds.serving-sys.com/",1.2647258761316997,"hxxp://gcm.chango.com/",1.1042755784134999,"hxxps://aa.chango.com/",1.1042755784134999]],["hxxp://at.atwola.com/",["hxxp://aka-cdn-ns.adtechus.com/",1.0920295295822078,"hxxp://at.atwola.com/",1.9116543432291524,"hxxp://b.scorecardresearch.com/",1.0920295295822078,"hxxp://cmap.adt.ace.advertising.com/",0.1290822395020437,"hxxp://cmap.uac.ace.advertising.com/",0.3393888397038343,"hxxp://core.insightexpressai.com/",1.0920295295822078,"hxxp://imp.bid.ace.advertising.com/",0.3946084928444349,"hxxp://uac.advertising.com/",0.17213903259879876,"hxxp://ums.adtechus.com/",0.1290822395020437,"hxxp://view.atdmt.com/",1.3697912717608025]],["hxxp://axp.zedo.com/",["hxxp://axp.zedo.com/",1.6918222243929812,"hxxp://d3.zedo.com/",1.037786304249767]],["hxxp://b3.mookie1.com/",["hxxp://t.mookie1.com/",1.0126191004516922]],["hxxp://battlecreek.craigslist.org/",["hxxp://www.craigslist.org/",2.769335610733743]],["hxxp://bcp.crwdcntrl.net/",["hxxp://bcp.crwdcntrl.net/",1.9364535959999998,"hxxp://cm.g.doubleclick.net/",1.500430932,"hxxp://idsync.rlcdn.com/",1.7184422639999999,"hxxp://load.s3.amazonaws.com/",1.500430932,"hxxp://loadm.exelator.com/",1.7184422639999999,"hxxp://p.acxiom-online.com/",1.9364535959999998,"hxxp://pubads.g.doubleclick.net/",1.7184422639999999,"hxxp://r.nexac.com/",1.500430932,"hxxp://tags.bluekai.com/",1.500430932,"hxxp://tags.crwdcntrl.net/",1.7184422639999999]],["hxxp://bestloseweightdietreview.com/",["hxxp://bestloseweightdietreview.com/",7.234629636090622,"hxxp://trackmyactions.com/",2.2424682266849163,"hxxp://www.youtube.com/",1.7886353712843974]],["hxxp://bh.contextweb.com/",["hxxp://ads.adbrite.com/",1.4740605040145371,"hxxp://bh.contextweb.com/",1.4740605040145371,"hxxp://c.chango.com/",1.6882402353670762,"hxxp://matcher-cwb.bidder7.mookie1.com/",1.6882402353670762,"hxxp://px.owneriq.net/",1.4740605040145371,"hxxp://t.pswec.com/",1.4740605040145371,"hxxp://tags.bluekai.com/",1.4740605040145371,"hxxp://www.facebook.com/",1.4740605040145371,"hxxp://www.wtp101.com/",2.1165996980721546,"hxxps://www.facebook.com/",1.4740605040145371]],["hxxp://bunnymummy-jacquie.blogspot.com/",["hxxp://1.bp.blogspot.com/",2.2772720491852954,"hxxp://2.bp.blogspot.com/",2.659314399542039,"hxxp://3.bp.blogspot.com/",2.531966949423124,"hxxp://4.bp.blogspot.com/",2.7866618496609523,"hxxp://i295.photobucket.com/",0.8764500978772353,"hxxp://s07.flagcounter.com/",0.8764500978772353,"hxxp://www.blogblog.com/",0.8764500978772353,"hxxp://www.blogger.com/",1.1311449981150654,"hxxp://www.free-website-hit-counters.com/",0.8764500978772353,"hxxps://lh3.googleusercontent.com/",1.0037975479961507]],["hxxp://c.amazon-adsystem.com/",["hxxp://tap.rubiconproject.com/",0.48371046488762026]],["hxxp://c.betrad.com/",["hxxp://c.betrad.com/",1.2650204865441543]],["hxxp://c5.zedo.com/",["hxxp://c14.zedo.com/",0.8722163459836032,"hxxp://c5.zedo.com/",0.7740198037205483,"hxxp://c7.zedo.com/",0.6758232614574935,"hxxp://l2.zedo.com/",0.6758232614574935]],["hxxp://cdn.at.atwola.com/",["hxxp://2a86.v.fwmrm.net/",0.6433012900485977,"hxxp://an.tacoda.net/",0.8718282348602889,"hxxp://ar.atwola.com/",0.42647872940913994,"hxxp://cdn.at.atwola.com/",0.6021005831231844,"hxxp://js.adsonar.com/",0.9985012317028524,"hxxp://leadback.advertising.com/",0.5022703952146564,"hxxp://segments.adap.tv/",0.5454218045639573,"hxxp://tacoda.at.atwola.com/",0.6511198395034123]],["hxxp://cdn.atwola.com/",["hxxp://ad.yieldmanager.com/",1.2354256393570997,"hxxp://adadvisor.net/",0.31221082076187096,"hxxp://ar.atwola.com/",0.8511564872579559,"hxxp://cookex.amp.yahoo.com/",0.4130091941592493,"hxxp://googleads.g.doubleclick.net/",0.9985012317028524,"hxxp://ib.adnxs.com/",0.8239112515929197,"hxxp://leadback.advertising.com/",0.42647872940913994,"hxxp://r.nexac.com/",0.1704154194475757,"hxxp://www.googleadservices.com/",0.9985012317028524]],["hxxp://cdn.interclick.com/",["hxxp://cdn.interclick.com/",3.1501339374859523,"hxxp://d.agkn.com/",1.5617189435841374,"hxxp://osmsync.interclick.com/",1.5617189435841374,"hxxp://tags.bluekai.com/",1.5617189435841374]],["hxxp://cdn.tacoda.at.atwola.com/",["hxxp://js.adsonar.com/",1.0037975479961507]],["hxxp://cdn.turn.com/",["hxxp://ad.afy11.net/",0.7723189815757147,"hxxp://ads.adbrite.com/",0.18460139881723833,"hxxp://bh.contextweb.com/",0.18460139881723833,"hxxp://cdn.spotxchange.com/",0.18460139881723833,"hxxp://cookex.amp.yahoo.com/",0.18460139881723833,"hxxp://ib.adnxs.com/",0.18460139881723833,"hxxp://r.casalemedia.com/",0.18460139881723833,"hxxp://r.openx.net/",0.18460139881723833,"hxxp://r.turn.com/",0.2114238242864098,"hxxp://www.facebook.com/",0.18460139881723833]],["hxxp://cfiles.5min.com/",["hxxp://2a86.v.fwmrm.net/",2.1902761055198106]],["hxxp://cm.g.doubleclick.net/",["hxxp://ad.turn.com/",0.9080893693862425,"hxxp://adxhm.d.chango.com/",0.5656984108169677,"hxxp://cm.g.doubleclick.net/",1.2337376939011981,"hxxp://p.rfihub.com/",2.2733802,"hxxp://pixel.everesttech.net/",1.4162125553699314]],["hxxp://cmap.uac.ace.advertising.com/",["hxxp://ad.yieldmanager.com/",1.4506720782288272,"hxxp://cmap.an.ace.advertising.com/",1.1240306831309461,"hxxp://cmap.at.ace.advertising.com/",1.1240306831309461,"hxxp://cmap.dc.ace.advertising.com/",1.1240306831309461,"hxxp://cmap.rm.ace.advertising.com/",1.1240306831309461,"hxxp://cookex.amp.yahoo.com/",1.1240306831309461,"hxxp://ib.adnxs.com/",1.1240306831309461,"hxxp://r.openx.net/",1.2873513806798869,"hxxp://tacoda.at.atwola.com/",1.1240306831309461,"hxxp://www.facebook.com/",1.1240306831309461]],["hxxp://connect.charter.com/",["hxxp://b.scorecardresearch.com/",0.8154612961073356,"hxxp://c783459.r59.cf2.rackcdn.com/",0.6683286062981154,"hxxp://connect.charter.com/",2.0778597746704417,"hxxp://ct1.addthis.com/",1.4981569768221166,"hxxp://leapfrogonline.112.2o7.net/",0.9625939859165553,"hxxp://media.charter.com/",1.0597015611906404,"hxxp://metrics.charter.com/",0.9125688713814212,"hxxp://www.facebook.com/",1.0597015611906404,"hxxp://www.google-analytics.com/",0.9125688713814212,"hxxps://connect.charter.com/",0.6683286062981154]],["hxxp://connexity.net/",["hxxp://bh.contextweb.com/",1.4740605040145371,"hxxp://connexity.net/",1.6882402353670762,"hxxp://s.cxt.ms/",1.4740605040145371,"hxxp://t.cxt.ms/",1.4740605040145371,"hxxps://connexity.net/",1.6882402353670762]],["hxxp://content.newegg.com/",["hxxp://ad.doubleclick.net/",0.8514975635906711,"hxxp://content.newegg.com/",0.9752194318046993,"hxxp://dis.us.criteo.com/",0.1777952052694113,"hxxp://fls.doubleclick.net/",0.1870337238258258,"hxxp://images10.newegg.com/",0.5780917741820177,"hxxp://nm.newegg.com/",0.8514975635906711,"hxxp://pix.esm1.net/",0.18629729664428873,"hxxp://promotions.newegg.com/",0.8514975635906711,"hxxp://widget.criteo.com/",0.08889760263470863,"hxxp://www.google-analytics.com/",0.8514975635906711]],["hxxp://contextweb.pixel.invitemedia.com/",["hxxp://bh.contextweb.com/",1.4740605040145371]],["hxxp://core.videoegg.com/",["hxxp://b.scorecardresearch.com/",1.3132281179390328,"hxxp://pixel.quantserve.com/",1.3132281179390328]],["hxxp://craigslist.com/",["hxxp://craigslist.org/",0.8270460834948554,"hxxp://geo.craigslist.org/",0.8270460834948554,"hxxp://kalamazoo.craigslist.org/",0.3371630265006708,"hxxp://www.craigslist.org/",1.3169291404890395]],["hxxp://crochet.about.com/",["hxxp://0.tqn.com/",2.8121313396847367,"hxxp://ad.doubleclick.net/",2.440276785337507,"hxxp://b.scorecardresearch.com/",0.8739031488748572,"hxxp://googleads.g.doubleclick.net/",0.9172012819152886,"hxxp://pagead2.googlesyndication.com/",0.9146543329129095,"hxxp://z.about.com/",2.440276785337507]],["hxxp://ct1.addthis.com/",["hxxp://adadvisor.net/",0.09290557589995559,"hxxp://addthis.acxiom-online.com/",0.09290557589995559,"hxxp://addthis.mathtag.com/",0.09290557589995559,"hxxp://addthis.nexac.com/",0.09290557589995559,"hxxp://cspix.media6degrees.com/",0.10640467667174397,"hxxp://dpm.demdex.net/",0.10640467667174397,"hxxp://ds.reson8.com/",0.09290557589995559,"hxxp://m.addthisedge.com/",0.8084201986770824,"hxxp://segment-pixel.invitemedia.com/",0.09290557589995559,"hxxp://su.addthis.com/",0.2008983820742628]],["hxxp://dg.specificclick.net/",["hxxp://b.scorecardresearch.com/",1.3132281179390328]],["hxxp://extremeterrain.ugc.bazaarvoice.com/",["hxxp://ajax.googleapis.com/",0.1407660240908417]],["hxxp://facebook.com/",["hxxp://www.facebook.com/",1.7377129222639314]],["hxxp://forums.att.com/",["hxxp://att.com/",1.3399357447110898,"hxxp://cdn-static.zdnet.com/",1.169943896501473,"hxxp://cng.i.lithium.com/",6.09970749458033,"hxxp://ct1.addthis.com/",1.8499112893399363,"hxxp://forums.att.com/",5.419740101741867,"hxxp://s7.addthis.com/",1.169943896501473,"hxxp://sniff.visistat.com/",1.169943896501473,"hxxp://stats.visistat.com/",1.169943896501473,"hxxp://wls.wireless.att.com/",1.169943896501473,"hxxp://www.att.com/",2.0199031375495524]],["hxxp://fw.adsafeprotected.com/",["hxxp://ad.doubleclick.net/",0.18966307802629595,"hxxp://fw.adsafeprotected.com/",0.7004126872643973,"hxxp://static.adsafeprotected.com/",0.4451628349445719]],["hxxp://g-ec2.images-amazon.com/",["hxxp://www.staticamzn.com/",0.8764500978772353,"hxxp://z-ecx.images-amazon.com/",1.0037975479961507]],["hxxp://get.adobe.com/",["hxxp://stats.adobe.com/",2.367183600402047,"hxxp://www.adobetag.com/",1.7227763585477083,"hxxp://wwwimages.adobe.com/",12.905464098657934,"hxxps://verify.adobe.com/",1.5394536087098352]],["hxxp://google.com/",["hxxp://www.google.com/",1.076173935236899]],["hxxp://googleads.g.doubleclick.net/",["hxxp://cm.g.doubleclick.net/",0.18729803784647797,"hxxp://googleads.g.doubleclick.net/",0.18729803784647797,"hxxp://pagead2.googlesyndication.com/",0.36712516800554934]],["hxxp://grandrapids.craigslist.org/",["hxxp://images.craigslist.org/",4.640012645798919,"hxxp://www.craigslist.org/",5.2635716574873115]],["hxxp://guru.sitescout.com/",["hxxp://cdn2sitescout.edgesuite.net/",1.654590196336678]],["hxxp://horsepowerfreaks.com/",["hxxp://www.horsepowerfreaks.com/",1.6401760358661763]],["hxxp://images-ftp.extremeterrain.com/",["hxxp://1.cdn.lib.extremeterrain.com/",4.425088418438324,"hxxp://ajax.googleapis.com/",1.7030767926226447,"hxxp://feeds.extremeterrain.com/",1.7030767926226447,"hxxp://images-ftp.extremeterrain.com/",1.7030767926226447,"hxxp://photos.extremeterrain.com/",1.950532394969525,"hxxp://s7d4.scene7.com/",4.177632816091445]],["hxxp://img.mediaplex.com/",["hxxp://img-cdn.mediaplex.com/",1.1366355937680768]],["hxxp://imp.bid.ace.advertising.com/",["hxxp://ar.voicefive.com/",1.5617189435841374,"hxxp://b.scorecardresearch.com/",1.5617189435841374,"hxxp://b.voicefive.com/",1.7886353712843974,"hxxp://bannerfarm.ace.advertising.com/",1.7886353712843974,"hxxp://c.betrad.com/",1.2733535472626483,"hxxp://cdn.doubleverify.com/",0.9072011995255101,"hxxp://l.betrad.com/",0.6802847718252505,"hxxp://motifcdn2.doubleclick.net/",0.7791295677314836,"hxxp://o.aolcdn.com/",1.5617189435841374,"hxxp://view.atdmt.com/",1.5617189435841374]],["hxxp://ip.casalemedia.com/",["hxxp://ad.afy11.net/",1.5375510049352925]],["hxxp://kalamazoo.craigslist.org/",["hxxp://images.craigslist.org/",2.5644341194929363,"hxxp://www.craigslist.org/",2.6735429974871563]],["hxxp://leadback.advertising.com/",["hxxp://uac.advertising.com/",2.1457765990453503]],["hxxp://loadeu.exelator.com/",["hxxp://b.scorecardresearch.com/",2.1457765990453503,"hxxp://d.p-td.com/",2.1457765990453503,"hxxp://d.turn.com/",2.1457765990453503,"hxxp://e.nexac.com/",2.4575561048895467,"hxxp://loadus.exelator.com/",2.1457765990453503,"hxxp://r.nexac.com/",2.1457765990453503,"hxxp://segment-pixel.invitemedia.com/",2.1457765990453503]],["hxxp://login.dotomi.com/",["hxxp://cache.dtmpub.com/",0.05571960492328119]],["hxxp://lowes.com/",["hxxp://www.lowes.com/",0.7519834599086243]],["hxxp://mail.aol.com/",["hxxp://b.aol.com/",1.9116543432291524,"hxxp://mail.aol.com/",1.93825328642866,"hxxp://notifications.mail.aol.com/",1.9116543432291524,"hxxp://o.aolcdn.com/",5.433775444103039,"hxxp://todaypage.mail.aol.com/",1.6175672212946206]],["hxxp://media.charter.com/",["hxxp://ad.amgdgt.com/",1.0126191004516922,"hxxp://at.atwola.com/",0.6523205696468727,"hxxp://googleads.g.doubleclick.net/",0.5882295699659762,"hxxp://ib.adnxs.com/",0.4410968801567563,"hxxp://leadback.advertising.com/",1.0126191004516922,"hxxp://www.googleadservices.com/",0.6523205696468727,"hxxps://ad.yieldmanager.com/",0.569278879518549,"hxxps://cookex.amp.yahoo.com/",0.4410968801567563,"hxxps://googleads.g.doubleclick.net/",0.4410968801567563,"hxxps://www.googleadservices.com/",0.4410968801567563]],["hxxp://media.fastclick.net/",["hxxp://%3Cmpjs/",0.3817816626353238,"hxxp://altfarm.mediaplex.com/",0.43725421190712294,"hxxp://choices.truste.com/",0.43725421190712294,"hxxp://img-cdn.mediaplex.com/",0.43725421190712294,"hxxp://login.dotomi.com/",0.3817816626353238,"hxxp://usweb.dotomi.com/",0.3817816626353238,"hxxps://googleads.g.doubleclick.net/",0.43725421190712294,"hxxps://secure.fastclick.net/",0.43725421190712294,"hxxps://www.google.com/",0.3817816626353238,"hxxps://www.googleadservices.com/",0.3817816626353238]],["hxxp://mediaservices-d.openxenterprise.com/",["hxxp://d.audienceiq.com/",2.4575561048895467,"hxxp://d.p-td.com/",2.1457765990453503,"hxxp://idsync.rlcdn.com/",2.4575561048895467,"hxxp://m.xp1.ru4.com/",3.081115116577938,"hxxp://p.rfihub.com/",0.5827911755132116,"hxxp://pixel.quantserve.com/",2.1457765990453503,"hxxp://r.openx.net/",1.4850618701144547,"hxxp://r.turn.com/",0.5827911755132116,"hxxp://sync.mathtag.com/",0.06482283262108665,"hxxp://tags.bluekai.com/",2.1457765990453503]],["hxxp://menards.com/",["hxxp://cds.a9t2h4q7.hwcdn.net/",4.281816267987161,"hxxp://edge.quantserve.com/",0.6565825732037983,"hxxp://menards.com/",1.3243887801375764,"hxxp://pixel.quantserve.com/",0.7519834599086243,"hxxp://www.google-analytics.com/",0.7519834599086243]],["hxxp://mono.vizu.com/",["hxxp://hopa.vizu.com/",1.5617189435841374,"hxxp://ohlone.vizu.com/",1.5617189435841374,"hxxp://shasta.vizu.com/",1.7886353712843974]],["hxxp://msn.com/",["hxxp://www.msn.com/",1.804354218957534]],["hxxp://muskegon.craigslist.org/",["hxxp://images.craigslist.org/",1.0686094305097122,"hxxp://www.craigslist.org/",0.9704128882466564]],["hxxp://my.screenname.aol.com/",["hxxp://mail.aol.com/",1.0728368526960668,"hxxp://sent-confirmation.mail.aol.com/",1.2287191304382301,"hxxp://sns-static.aolcdn.com/",1.6963659636647208,"hxxp://todaypage.mail.aol.com/",1.0728368526960668,"hxxps://api.screenname.aol.com/",1.0728368526960668,"hxxps://my.screenname.aol.com/",1.2287191304382301]],["hxxp://newegg.com/",["hxxp://www.newegg.com/",0.8727639932516634]],["hxxp://nym1.ib.adnxs.com/",["hxxp://media1.ancestry.com/",2.2733802]],["hxxp://office.microsoft.com/",["hxxp://c.atdmt.com/",1.0422931874998107,"hxxp://c.msn.com/",1.1937374967946541,"hxxp://js.microsoft.com/",1.1937374967946541,"hxxp://m.webtrends.com/",1.3451818060894984,"hxxp://office.microsoft.com/",1.6480704246791873,"hxxp://officeimg.vo.msecnd.net/",8.463064342947172]],["hxxp://p4-bi27hpipkj34c-4e5wcax6ksiyyurs-if-v6exp3-v4.metric.gstatic.com/",["hxxp://p4-bi27hpipkj34c-4e5wcax6ksiyyurs-if-v6exp3-v4.metric.gstatic.com/",1.0037975479961507]],["hxxp://photos.extremeterrain.com/",["hxxp://1.cdn.photos.extremeterrain.com/",1.7030767926226447,"hxxp://2.cdn.photos.extremeterrain.com/",1.7030767926226447,"hxxp://4.cdn.photos.extremeterrain.com/",1.950532394969525,"hxxp://ajax.googleapis.com/",1.7030767926226447,"hxxp://cdn.jquerytools.org/",1.7030767926226447,"hxxp://de.tynt.com/",1.7030767926226447,"hxxp://ic.tynt.com/",1.7030767926226447,"hxxp://photos.extremeterrain.com/",4.919999623132085,"hxxp://sc.tynt.com/",1.7030767926226447,"hxxp://tcr.tynt.com/",1.7030767926226447]],["hxxp://pix.esm1.net/",["hxxp://ad.yieldmanager.com/",0.2088632961110137]],["hxxp://platform.twitter.com/",["hxxp://cdn.api.twitter.com/",0.1626165018098121,"hxxp://p.twitter.com/",0.42478763675192244,"hxxps://r.twimg.com/",0.42484737712859644]],["hxxp://plugin.xpon.us/",["hxxp://plugin.xpon.us/",1.9024199667196162]],["hxxp://pnc.com/",["hxxps://www.pnc.com/",1.5041053472163104]],["hxxp://progressive.com/",["hxxp://www.progressive.com/",1.619580838857716]],["hxxp://puma.vizu.com/",["hxxp://cheetah.vizu.com/",0.6378896673446867,"hxxp://puma.vizu.com/",0.6378896673446867]],["hxxp://r.turn.com/",["hxxp://cdn.turn.com/",2.2733802]],["hxxp://r1rk9np7bpcsfoeekl0khkd2juj27q3o-a-fc-opensocial.googleusercontent.com/",["hxxp://1.bp.blogspot.com/",0.21463177716953857,"hxxp://2.bp.blogspot.com/",0.21463177716953857,"hxxp://3.bp.blogspot.com/",0.16630409224394707,"hxxp://4.bp.blogspot.com/",0.21463177716953857,"hxxp://csi.gstatic.com/",0.29365154236286156,"hxxp://r1rk9np7bpcsfoeekl0khkd2juj27q3o-a-fc-opensocial.googleusercontent.com/",0.2387956196323342,"hxxp://www-fc-opensocial.googleusercontent.com/",0.29365154236286156,"hxxp://www.google.com/",1.8440356774956852]],["hxxp://re.progressive.com/",["hxxps://onlineservice-yourpolicy1.progressive.com/",1.8950007376847435,"hxxps://onlineservice3.progressive.com/",1.9323519385152725,"hxxps://onlineservice4.progressive.com/",1.9323519385152725]],["hxxp://resumegenius.com/",["hxxp://googleads.g.doubleclick.net/",1.1937374967946541,"hxxp://platform.twitter.com/",1.1937374967946541,"hxxp://resumegenius.com/",1.952054070561318,"hxxp://secure.livechatinc.com/",1.0877264802882627,"hxxp://static.ak.facebook.com/",1.525582267321516,"hxxp://www.facebook.com/",1.1937374967946541,"hxxp://www.google-analytics.com/",1.0422931874998107,"hxxp://www.hellobar.com/",1.0422931874998107,"hxxps://plusone.google.com/",1.1937374967946541,"hxxps://s-static.ak.facebook.com/",1.1937374967946541]],["hxxp://reviews.cnet.com/",["hxxp://gravatar.com/",1.8608197538836586,"hxxp://i.i.com.com/",1.9710425267617837,"hxxp://i215.photobucket.com/",0.7585920251023973,"hxxp://i3.ytimg.com/",0.7585920251023973,"hxxp://livefyre-avatar.s3.amazonaws.com/",5.49817125886182,"hxxp://static.ak.facebook.com/",1.0892603437367747,"hxxp://stream1.cnet.fyre.co/",0.7585920251023973,"hxxp://usea1l3lc42.livefyre.com:8080/",0.7585920251023973,"hxxp://www.facebook.com/",1.3097058894930278,"hxxp://zor.fyre.co/",1.5301514352492795]],["hxxp://s.amazon-adsystem.com/",["hxxp://c.amazon-adsystem.com/",0.48429121118560203]],["hxxp://s.ytimg.com/",["hxxp://googleads.g.doubleclick.net/",0.9159441377257034,"hxxp://o-o---preferred---ord12s09---v13---lscache3.c.youtube.com/",0.8232593142653649,"hxxp://o-o---preferred---ord12s13---v12---lscache3.c.youtube.com/",0.8232593142653649,"hxxp://pagead2.googlesyndication.com/",1.008628961186043,"hxxp://r5---iad23t08.c.youtube.com/",0.8232593142653649,"hxxp://s.youtube.com/",0.7305744908050257,"hxxp://s.ytimg.com/",0.7305744908050257,"hxxp://s0.2mdn.net/",1.1013137846463814,"hxxp://s2.youtube.com/",0.9159441377257034,"hxxp://www.youtube.com/",2.213531666170448]],["hxxp://s0.2mdn.net/",["hxxp://googleads.g.doubleclick.net/",0.27786473909534554,"hxxp://i2.ytimg.com/",0.31823824819466917,"hxxp://motifcdn2.doubleclick.net/",0.27786473909534554,"hxxp://o-o---preferred---ord12s09---v12---nonxt6.c.youtube.com/",0.27786473909534554,"hxxp://r13---ord12s15.c.youtube.com/",0.27786473909534554,"hxxp://s.youtube.com/",0.27786473909534554,"hxxp://s.ytimg.com/",0.31823824819466917,"hxxp://s0.2mdn.net/",0.27786473909534554,"hxxp://secure-us.imrworldwide.com/",0.27786473909534554,"hxxp://www.youtube.com/",0.4797322845919636]],["hxxp://secure.newegg.com/",["hxxp://ad.yieldmanager.com/",0.9752194318046993,"hxxp://cm.newegg.com/",1.0989413000187296,"hxxp://content.shoprunner.com/",1.3463850364467873,"hxxp://dis.us.criteo.com/",0.9752194318046993,"hxxp://images10.newegg.com/",4.068266137155425,"hxxp://pix.esm1.net/",0.9752194318046993,"hxxp://secure.newegg.com/",0.9752194318046993,"hxxp://widget.criteo.com/",0.8514975635906711,"hxxp://www.google-analytics.com/",0.8514975635906711,"hxxp://www.googlecommerce.com/",0.9752194318046993]],["hxxp://sent-confirmation.mail.aol.com/",["hxxp://b.scorecardresearch.com/",1.0728368526960668,"hxxp://cdn.at.atwola.com/",1.2287191304382301,"hxxp://cdn.atwola.com/",1.2287191304382301,"hxxp://d.audienceiq.com/",1.0728368526960668,"hxxp://mail.aol.com/",1.2287191304382301,"hxxp://o.aolcdn.com/",2.4757773523755384,"hxxp://pixel.adsafeprotected.com/",1.2287191304382301,"hxxp://s0.2mdn.net/",1.2287191304382301,"hxxp://sent-confirmation.mail.aol.com/",1.2287191304382301,"hxxp://www.facebook.com/",1.0728368526960668]],["hxxp://shasta.vizu.com/",["hxxp://cm.g.doubleclick.net/",0.6378896673446867,"hxxp://pixel.mathtag.com/",0.8232593142653649,"hxxp://sync.mathtag.com/",0.6378896673446867]],["hxxp://shop.advanceautoparts.com/",["hxxp://cts-log.channelintelligence.com/",0.8440796406820179,"hxxp://data.coremetrics.com/",1.058249101750589,"hxxp://sales.liveperson.net/",0.7369949101477321,"hxxp://shop.advanceautoparts.com/",9.08960389182203,"hxxp://siteintercept.qualtrics.com/",0.7369949101477321,"hxxp://tealium.hs.llnwd.net/",2.022011676559163,"hxxp://translate.googleapis.com/",0.9511643712163047,"hxxp://www.facebook.com/",0.8440796406820179,"hxxps://apis.google.com/",0.8440796406820179,"hxxps://plusone.google.com/",0.8440796406820179]],["hxxp://southbend.craigslist.org/",["hxxp://www.craigslist.org/",1.8572295440774185]],["hxxp://start.toshiba.com/",["hxxp://images.synacor.com/",2.2733802,"hxxp://loadm.exelator.com/",1.0705114392898865,"hxxp://mediaservices-d.openxenterprise.com/",0.9347002865441547,"hxxp://pagead2.googlesyndication.com/",2.2733802,"hxxp://partner.googleadservices.com/",2.2733802,"hxxp://service.maxymiser.net/",2.2733802,"hxxp://start.toshiba.com/",2.2733802,"hxxp://static.citrine.synacor.com/",12.430950081663383,"hxxp://web.citrine.synacor.com/",7.210231116383505,"hxxp://www.googletagservices.com/",2.2733802]],["hxxp://superuser.com/",["hxxp://cdn.sstatic.net/",0.8514975635906711,"hxxp://edge.quantserve.com/",0.8514975635906711,"hxxp://engine.adzerk.net/",1.3463850364467873,"hxxp://i.stack.imgur.com/",1.2226631682327578,"hxxp://pixel.quantserve.com/",0.8514975635906711,"hxxp://stackexchange.com/",0.8514975635906711,"hxxp://static.adzerk.net/",1.2226631682327578,"hxxp://superuser.com/",0.9752194318046993,"hxxp://www.gravatar.com/",2.21243811394499,"hxxps://stackauth.com/",0.9752194318046993]],["hxxp://support.verizonwireless.com/",["hxxp://analytics.verizonwireless.com/",1.169943896501473,"hxxp://b2b.vzw.com/",1.3399357447110898,"hxxp://businessportals.verizonwireless.com/",1.3399357447110898,"hxxp://cache.vzw.com/",2.0199031375495524,"hxxp://support.verizonwireless.com/",5.079756405322636,"hxxps://content.atomz.com/",1.169943896501473,"hxxps://ecache.vzw.com/",1.6799194411303213,"hxxps://scache.vzw.com/",3.7198216196457095,"hxxps://seal.verisign.com/",1.3399357447110898,"hxxps://www.verizonwireless.com/",1.8499112893399363]],["hxxp://swmric.rapmls.com/",["hxxp://dev.virtualearth.net/",2.0665253447889715,"hxxp://ecn.dev.virtualearth.net/",5.2125788547662095,"hxxp://ecn.t0.tiles.virtualearth.net/",4.688236603103335,"hxxp://ecn.t1.tiles.virtualearth.net/",4.688236603103335,"hxxp://ecn.t2.tiles.virtualearth.net/",4.688236603103335,"hxxp://ecn.t3.tiles.virtualearth.net/",4.688236603103335,"hxxp://jspelllax.rapmls.com/",2.0665253447889715,"hxxp://mediaec.rapmls.com/",29.070151305426975,"hxxp://swmric.rapmls.com/",2.0665253447889715]],["hxxp://tag.crsspxl.com/",["hxxp://a.collective-media.net/",2.1457765990453503,"hxxp://ad.yieldmanager.com/",2.4575561048895467,"hxxp://ib.mookie1.com/",2.1457765990453503,"hxxp://match.adsrvr.org/",2.4575561048895467,"hxxp://p.nexac.com/",2.1457765990453503,"hxxp://tag.crsspxl.com/",3.6128370231108677,"hxxps://ev.ib-ibi.com/",2.1457765990453503,"hxxps://ib.mookie1.com/",2.1457765990453503,"hxxps://t.mookie1.com/",2.4575561048895467,"hxxps://tag.crsspxl.com/",2.1457765990453503]],["hxxp://tags.bluekai.com/",["hxxp://at.amgdgt.com/",1.169943896501473,"hxxp://cdn.amgdgt.com/",1.169943896501473]],["hxxp://tags.mediaforge.com/",["hxxp://bh.contextweb.com/",1.1240306831309461,"hxxp://load.exelator.com/",0.3701083725399448,"hxxp://load.s3.amazonaws.com/",0.32315432527741444,"hxxp://pixel.mathtag.com/",0.5272716885450026,"hxxp://pixel.rubiconproject.com/",0.5486884696278442,"hxxp://r.casalemedia.com/",0.1407660240908417,"hxxp://tag.admeld.com/",0.09290557589995559,"hxxp://www.burstnet.com/",1.7030767926226447]],["hxxp://this.content.served.by.adshuffle.com/",["hxxp://media2.adshuffle.com/",2.2733802]],["hxxp://tipnut.com/",["hxxp://engine.tipnut.com/",0.5931784298327221,"hxxp://tipnut.com/",3.9173543897767735,"hxxp://tipnut1.com/",2.279615242267486,"hxxp://www.facebook.com/",0.8600477463019198,"hxxp://www.google-analytics.com/",0.7327002961830054]],["hxxp://todaypage.mail.aol.com/",["hxxp://aka-cdn-ns.adtechus.com/",1.9116543432291524,"hxxp://at.atwola.com/",1.9116543432291524,"hxxp://b.aol.com/",1.9116543432291524,"hxxp://js.moatads.com/",0.41452015756357036,"hxxp://o.aolcdn.com/",3.88950814478858,"hxxp://px.at.atwola.com/",1.9116543432291524,"hxxp://r1.ace.advertising.com/",1.9116543432291524,"hxxp://todaypage.mail.aol.com/",1.9116543432291524,"hxxp://uac.advertising.com/",1.9116543432291524,"hxxp://v3.moatads.com/",0.7121527806100675]],["hxxp://toshiba.siena1.syn-api.com/",["hxxp://ad.doubleclick.net/",0.8323188449227215,"hxxp://pagead2.googlesyndication.com/",1.0307345027655312]],["hxxp://ups.com/",["hxxp://www.ups.com/",1.029531857743543,"hxxps://www.ups.com/",1.126733656792182]],["hxxp://vestletrealty.com/",["hxxp://connect.facebook.net/",1.1240306831309461,"hxxp://vestletrealty.com/",3.0838790537182357]],["hxxp://view.atdmt.com/",["hxxp://cdn.atdmt.com/",1.0065312725983115,"hxxp://cdn.doubleverify.com/",2.2733802,"hxxp://ib.adnxs.com/",0.6769768100231462,"hxxps://choices.truste.com/",2.2733802]],["hxxp://walmart.com/",["hxxp://www.walmart.com/",0.8440796406820179]],["hxxp://wayback.archive.org/",["hxxp://static.web.archive.org/",1.0037975479961507,"hxxp://staticweb.archive.org/",0.8764500978772353]],["hxxp://weather.com/",["hxxp://www.weather.com/",2.2733802]],["hxxp://web.adblade.com/",["hxxp://b.scorecardresearch.com/",2.161383044517622,"hxxp://edge.quantserve.com/",0.7919777664330839,"hxxp://pixel.adblade.com/",0.9977522402902536,"hxxp://pixel.quantserve.com/",0.9977522402902536,"hxxp://static.cdn.adblade.com/",3.063279347949527]],["hxxp://web.archive.org/",["hxxp://staticweb.archive.org/",2.149924599066382,"hxxp://wayback.archive.org/",0.8764500978772353,"hxxp://web.archive.org/",1.2584924482339785]],["hxxp://wtags.bluekai.com/",["hxxp://cm.g.doubleclick.net/",0.7369949101477321,"hxxp://g-pixel.invitemedia.com/",0.7369949101477321,"hxxp://segment-pixel.invitemedia.com/",0.7369949101477321]],["hxxp://www.4wheelparts.com/",["hxxp://cdn.optimizely.com/",1.1240306831309461,"hxxp://d.yimg.com/",1.1240306831309461,"hxxp://ssl.gstatic.com/",1.1240306831309461,"hxxp://www.4wheelparts.com/",21.452100609094533,"hxxp://www.google-analytics.com/",1.1240306831309461,"hxxps://seal.networksolutions.com/",0.7418602508664244,"hxxps://www.paypal.com/",1.1240306831309461]],["hxxp://www.adobe.com/",["hxxp://fast.adobe.demdex.net/",1.2616918665312407,"hxxp://l.betrad.com/",1.9116543432291524,"hxxp://stats.adobe.com/",1.7227763585477083,"hxxp://use.typekit.com/",1.9116543432291524,"hxxp://www.adobe.com/",1.9116543432291524,"hxxp://www.adobetag.com/",1.9116543432291524,"hxxp://wwwimages.adobe.com/",8.055744080219668,"hxxps://1295336.fls.doubleclick.net/",1.5394536087098352,"hxxps://verify.adobe.com/",1.9116543432291524,"hxxps://wwwimages2.adobe.com/",1.9060991083855803]],["hxxp://www.akc.org/",["hxxp://altfarm.mediaplex.com/",1.63209213464134,"hxxp://images.akc.org/",1.9623964952235167,"hxxp://img.mediaplex.com/",1.3017877740591646,"hxxp://mp.apmebf.com/",1.3017877740591646,"hxxp://oascentral.akc.org/",2.4578530360967816,"hxxp://pixel.quantserve.com/",1.1366355937680768,"hxxp://secure.quantserve.com/",1.1366355937680768,"hxxp://www.akc.org/",6.751809723665065,"hxxp://www.google-analytics.com/",1.3017877740591646,"hxxps://si0.twimg.com/",2.127548675514605]],["hxxp://www.allconnect.com/",["hxxp://analytics.allconnect.com/",1.0126191004516922,"hxxp://platform.twitter.com/",1.206834250999861,"hxxp://static.ak.facebook.com/",1.4540171698793505,"hxxp://www.allconnect.com/",6.256428165252289,"hxxp://www.facebook.com/",1.1597517902609096,"hxxp://www.google-analytics.com/",1.0126191004516922,"hxxp://www.mongoosemetrics.com/",1.25391671173881,"hxxps://apis.google.com/",1.1597517902609096,"hxxps://plusone.google.com/",1.1597517902609096,"hxxps://s-static.ak.facebook.com/",1.1597517902609096]],["hxxp://www.allfreecrochet.com/",["hxxp://assets.pinterest.com/",0.5784570645989754,"hxxp://cdn4.picadmedia.com/",0.5784570645989754,"hxxp://cf2.primecp.com/",1.1311449981150654,"hxxp://connect.facebook.net/",0.8764500978772353,"hxxp://pagead2.googlesyndication.com/",0.8764500978772353,"hxxp://partner.googleadservices.com/",0.8764500978772353,"hxxp://pubads.g.doubleclick.net/",1.2584924482339785,"hxxp://static.ak.facebook.com/",1.0037975479961507,"hxxp://www.allfreecrochet.com/",1.5131873484718084,"hxxps://s-static.ak.facebook.com/",1.0037975479961507]],["hxxp://www.amazon.com/",["hxxp://a5b6be82fde04bb8ce7d81860cb563f47.profile.ind6.cloudfront.net/",0.5784570645989754,"hxxp://aax-us-east.amazon-adsystem.com/",0.6625063816774591,"hxxp://ad.doubleclick.net/",0.7465556987559429,"hxxp://ecx.images-amazon.com/",1.5029995524622954,"hxxp://fls-na.amazon.com/",0.7465556987559429,"hxxp://g-ecx.images-amazon.com/",2.595640674482582,"hxxp://s.amazon-adsystem.com/",0.6625063816774591,"hxxp://www.amazon.com/",0.9987036499913938,"hxxp://z-ecx.images-amazon.com/",2.595640674482582,"hxxps://images-na.ssl-images-amazon.com/",1.9232461378547132]],["hxxp://www.aol.com/",["hxxp://aka-cdn-ns.adtechus.com/",2.4575561048895467,"hxxp://at.atwola.com/",3.7046741282663302,"hxxp://b.aol.com/",3.3928946224221344,"hxxp://i.huffpost.com/",5.045582868394125,"hxxp://o.sa.aol.com/",2.4575561048895467,"hxxp://portal.aolcdn.com/",21.92872334599162,"hxxp://px.at.aol.com/",2.1457765990453503,"hxxp://px.at.atwola.com/",2.1457765990453503,"hxxp://www.aol.com/",4.305896162798427,"hxxps://www.aol.com/",2.1457765990453503]],["hxxp://www.aptuned.com/",["hxxp://0.gravatar.com/",4.152831235059313,"hxxp://1.gravatar.com/",6.078234807677725,"hxxp://c.statcounter.com/",1.1042755784134999,"hxxp://ct1.addthis.com/",1.2647258761316997,"hxxp://platform.twitter.com/",1.425176173849901,"hxxp://www.aptuned.com/",4.152831235059313,"hxxp://www.facebook.com/",1.2647258761316997,"hxxps://apis.google.com/",1.2647258761316997,"hxxps://plusone.google.com/",1.2647258761316997,"hxxps://ssl.gstatic.com/",1.1042755784134999]],["hxxp://www.ask.com/",["hxxp://ak.imgfarm.com/",0.7160126650558265,"hxxp://b.scorecardresearch.com/",0.924084721567776,"hxxp://sp.ask.com/",1.6523369193595985,"hxxp://tbr.ask.com/",0.8200486933118014,"hxxp://www.ask.com/",1.9644450041275223,"hxxp://www.google-analytics.com/",0.8200486933118014,"hxxp://www.google.com/",0.7160126650558265,"hxxp://wzpo1.ask.com/",0.924084721567776]],["hxxp://www.asklearnhire.com/",["hxxp://www.asklearnhire.com/",1.1597517902609096]],["hxxp://www.att.com/",["hxxp://1.ecom.attccc.com/",1.220941450964358,"hxxp://akamai.mathtag.com/",0.9965522113276646,"hxxp://attwireless-www.baynote.net/",0.6378716304749721,"hxxp://c647370.r70.cf2.rackcdn.com/",0.2587105051864632,"hxxp://cdnt.meteorsolutions.com/",0.5952943646415024,"hxxp://es.optimost.com/",0.7721629716909728,"hxxp://sales.liveperson.net/",0.9965522113276646,"hxxp://wls.wireless.att.com/",0.2587105051864632,"hxxp://www.att.com/",7.666743455913593,"hxxps://www.facebook.com/",0.8843575915093195]],["hxxp://www.attsavings.com/",["hxxp://attsavings.com/",0.6333698791994451,"hxxp://googleads.g.doubleclick.net/",0.6994030303858234,"hxxp://maps.google.com/",0.6683286062981154,"hxxp://maps.googleapis.com/",0.5382044554308417,"hxxp://maps.gstatic.com/",0.6994030303858234,"hxxp://swiftype-assets.a.ssl.fastly.net/",0.569278879518549,"hxxp://www.attsavings.com/",2.7172984445813126,"hxxp://www.google-analytics.com/",0.6683286062981154,"hxxp://www.googleadservices.com/",0.6683286062981154,"hxxps://ajax.googleapis.com/",0.6683286062981154]],["hxxp://www.bing.com/",["hxxp://c.atdmt.com/",1.804354218957534,"hxxp://c.bing.com/",1.804354218957534,"hxxp://www.bing.com/",1.804354218957534,"hxxp://www.msn.com/",1.804354218957534]],["hxxp://www.blogger.com/",["hxxp://img1.blogblog.com/",0.11780271761227368,"hxxp://www.blogger.com/",0.4665506767942165,"hxxp://www.google-analytics.com/",0.3107346112439763,"hxxp://www.google.com/",0.0692182393995866,"hxxps://apis.google.com/",0.06146017189146342,"hxxps://plusone.google.com/",0.11780271761227368]],["hxxp://www.cabelas.com/",["hxxp://assets.cabelas.com/",1.1029248031687142,"hxxp://clients1.google.com/",0.3817816626353238,"hxxp://googleads.g.doubleclick.net/",0.49272676117892233,"hxxp://login.dotomi.com/",0.43725421190712294,"hxxp://statse.webtrendslive.com/",0.3817816626353238,"hxxp://www.cabelas.com/",3.432771872584278,"hxxp://www.google-analytics.com/",0.49272676117892233,"hxxp://www.google.com/",0.7700895075379184,"hxxp://www.gstatic.com/",0.5481993104507213,"hxxps://www.googleapis.com/",0.3817816626353238]],["hxxp://www.cengagebrain.com/",["hxxp://assets.cengagebrain.com/",19.787694723463495,"hxxp://cengagelearninginc.tt.omtrdc.net/",1.3913222852435276,"hxxp://s.btstatic.com/",1.3913222852435276,"hxxp://www.cengagebrain.com/",4.423691368466599,"hxxp://www.trustlogo.com/",1.3913222852435276,"hxxps://www.googleadservices.com/",1.3913222852435276]],["hxxp://www.comcast.com/",["hxxp://ad.doubleclick.net/",0.6683286062981154,"hxxp://comcast.demdex.net/",0.6683286062981154,"hxxp://fls.doubleclick.net/",0.6683286062981154,"hxxp://integrate.112.2o7.net/",0.6683286062981154,"hxxp://serviceo.comcast.net/",0.7654361815722011,"hxxp://static.ak.facebook.com/",0.7654361815722011,"hxxp://www.comcast.com/",5.81503009582463,"hxxp://www.facebook.com/",0.7654361815722011,"hxxps://s-static.ak.facebook.com/",0.7654361815722011,"hxxps://www.facebook.com/",0.7654361815722011]],["hxxp://www.craigslist.org/",["hxxp://map0.craigslist.org/",1.1207886952443193,"hxxp://map1.craigslist.org/",1.5501165448475076,"hxxp://map2.craigslist.org/",1.1207886952443193,"hxxp://www.craigslist.org/",6.778733558411979]],["hxxp://www.crochetpatty.com/",["hxxp://counter.powweb.com/",2.531966949423124,"hxxp://pagead2.googlesyndication.com/",0.8764500978772353,"hxxp://pattyna.powweb.com/",0.8764500978772353,"hxxp://www.crochetpatty.com/",1.385839898352894,"hxxp://www.ftjcfx.com/",0.8764500978772353]],["hxxp://www.divinecaroline.com/",["hxxp://ggasset.divinecaroline.com/",0.8764500978772353,"hxxp://metrics.divinecaroline.com/",1.0037975479961507,"hxxp://partners.realgirlsmedia.com/",1.1311449981150654,"hxxp://www.divinecaroline.com/",1.1311449981150654]],["hxxp://www.dsw.com/",["hxxp://ak1.abmr.net/",1.1937374967946541,"hxxp://dsw.112.2o7.net/",1.1937374967946541,"hxxp://dsw.tt.omtrdc.net/",1.0422931874998107,"hxxp://googleads.g.doubleclick.net/",1.0422931874998107,"hxxp://s7d2.scene7.com/",3.011069208332783,"hxxp://www.dsw.com/",3.313957826922472,"hxxp://www.google-analytics.com/",1.6480704246791873,"hxxp://www.googleadservices.com/",1.1937374967946541,"hxxps://a248.e.akamai.net/",3.4654021362173166]],["hxxp://www.dswinc.com/",["hxxp://www.dswinc.com/",5.88851108493482]],["hxxp://www.esurance.com/",["hxxps://www.esurance.com/",1.7886353712843974]],["hxxp://www.extremeterrain.com/",["hxxp://lib.store.yahoo.net/",0.19335508456298753,"hxxp://live2.monitus.net/",0.052230085454402726,"hxxp://turn5.scene7.com/",0.3815217500411007,"hxxp://vector.nextopiasoftware.com/",0.052230085454402726]],["hxxp://www.facebook.com/",["hxxp://static.ak.fbcdn.net/",1.2373507315964598]],["hxxp://www.favecrafts.com/",["hxxp://cdn4.picadmedia.com/",0.8764500978772353,"hxxp://favecrafts.us.intellitxt.com/",0.8764500978772353,"hxxp://pagead2.googlesyndication.com/",1.385839898352894,"hxxp://partners.realgirlsmedia.com/",1.0037975479961507,"hxxp://pubads.g.doubleclick.net/",1.1311449981150654,"hxxp://sbtest.us.intellitxt.com/",1.0037975479961507,"hxxp://www.divinecaroline.com/",1.0037975479961507,"hxxp://www.favecrafts.com/",4.824221051563589,"hxxp://www.google-analytics.com/",1.0037975479961507,"hxxp://www.parents.com/",1.0037975479961507]],["hxxp://www.fedex.com/",["hxxp://images.fedex.com/",1.0449614119824953,"hxxp://metrics.fedex.com/",0.6770397367743334,"hxxp://s.xp1.ru4.com/",0.5036078951153471,"hxxp://www.fedex.com/",1.0568992172441867]],["hxxp://www.flickr.com/",["hxxp://geo.yahoo.com/",0.5091291127542382,"hxxp://l.yimg.com/",0.5091291127542382,"hxxp://www.flickr.com/",1.0037975479961507]],["hxxp://www.frontier.com/",["hxxp://dnn506yrbagrg.cloudfront.net/",0.8154612961073356,"hxxp://ips-invite.iperceptions.com/",0.6683286062981154,"hxxp://stats.g.doubleclick.net/",0.9125688713814212,"hxxp://trk.cetrk.com/",0.8154612961073356,"hxxp://www.frontier.com/",7.907256944911729,"hxxps://ajax.googleapis.com/",0.7654361815722011,"hxxps://ihelpu.frontiercorp.com/",0.6683286062981154]],["hxxp://www.getontherighttruck.com/",["hxxp://ajax.googleapis.com/",0.6565825732037983,"hxxp://www.getontherighttruck.com/",2.1829967604810054,"hxxp://www.google-analytics.com/",0.9427852333182741]],["hxxp://www.googlecommerce.com/",["hxxp://www.gstatic.com/",0.08416275731886874]],["hxxp://www.hoobly.com/",["hxxp://ajax.googleapis.com/",0.5456779130350229,"hxxp://assets.hoobly.com/",5.920986687650013,"hxxp://googleads.g.doubleclick.net/",0.3968832140867991,"hxxp://pagead2.googlesyndication.com/",0.7443726143269489,"hxxp://pics.hoobly.com/",8.243837824171509,"hxxp://www.google-analytics.com/",1.3317310074448898,"hxxp://www.google.com/",1.9776781824542065,"hxxp://www.hoobly.com/",0.32023139947710816]],["hxxp://www.horsepowerfreaks.com/",["hxxp://pagead2.googlesyndication.com/",1.4320940014652435,"hxxp://www.horsepowerfreaks.com/",5.385652655082964]],["hxxp://www.huffingtonpost.com/",["hxxp://at.atwola.com/",0.8764500978772353,"hxxp://i.huffpost.com/",1.2584924482339785,"hxxp://o.aolcdn.com/",1.1311449981150654,"hxxp://platform.twitter.com/",0.8764500978772353,"hxxp://s.huffpost.com/",6.225043002871651,"hxxp://static.ak.facebook.com/",1.0037975479961507,"hxxp://www.google-analytics.com/",1.0037975479961507,"hxxp://www.huffingtonpost.com/",1.6405347985907235,"hxxps://s-s.huffpost.com/",1.5131873484718084,"hxxps://s-static.ak.facebook.com/",1.0037975479961507]],["hxxp://www.ivestreo.com/",["hxxp://cdn.initial-website.com/",2.454540661240883,"hxxp://cms02.initial-website.com/",1.1338158738842725,"hxxp://fonts.googleapis.com/",0.6181777035990031,"hxxp://graph.facebook.com/",0.7859766977779021,"hxxp://mod02.initial-website.com/",1.0340102072472857,"hxxp://profile-a.xx.fbcdn.net/",1.048147823609338,"hxxp://static.ak.fbcdn.net/",0.7859766977779021,"hxxp://themes.googleusercontent.com/",0.7859766977779021,"hxxp://www.ivestreo.com/",6.744650768187262,"hxxps://graph.facebook.com/",1.1874131256509977]],["hxxp://www.iwsti.com/",["hxxp://adserve.postrelease.com/",0.7160126650558265,"hxxp://api.viglink.com/",0.7160126650558265,"hxxp://cdn.viglink.com/",0.7160126650558265,"hxxp://images.drivingrevenue.com/",0.7160126650558265,"hxxp://kona.kontera.com/",0.8200486933118014,"hxxp://rover.ebay.com/",0.7160126650558265,"hxxp://services.picadmedia.com/",0.7160126650558265,"hxxp://www.google-analytics.com/",1.444264862847649,"hxxp://www.google.com/",1.0281207498237515,"hxxp://www.iwsti.com/",9.975219179837577]],["hxxp://www.lowes.com/",["hxxp://ak1.abmr.net/",0.9427852333182741,"hxxp://clients1.google.com/",0.9427852333182741,"hxxp://fls.doubleclick.net/",0.7519834599086243,"hxxp://images.lowes.com/",2.0875958737761797,"hxxp://lowes.tt.omtrdc.net/",1.0381861200231006,"hxxp://www.google.com/",0.6565825732037983,"hxxp://www.lowes.com/",7.430045529246394,"hxxp://www7.lowes.com/",1.2289878934327518,"hxxps://www.google.com/",1.0381861200231006,"hxxps://www.googleapis.com/",0.6565825732037983]],["hxxp://www.maccosmetics.com/",["hxxp://c.maccosmetics.com/",0.9427852333182741,"hxxp://connect.facebook.net/",0.6565825732037983,"hxxp://files.shoptogether.com/",0.8473843466134499,"hxxp://fls.doubleclick.net/",0.7519834599086243,"hxxp://www.maccosmetics.com/",5.426626908445068]],["hxxp://www.mactools.com/",["hxxp://www.google-analytics.com/",0.644294938996217,"hxxp://www.mactools.com/",9.736838969769089,"hxxp://www.youtube.com/",1.0441391353534812]],["hxxp://www.mountainmods.com/",["hxxp://smarticon.geotrust.com/",0.6436448249911019,"hxxp://www.mountainmods.com/",4.8897793420965785]],["hxxp://www.msn.com/",["hxxp://col.stb01.s-msn.com/",3.099479580564831,"hxxp://col.stc.s-msn.com/",3.529440226928387,"hxxp://platform.twitter.com/",1.9773871620062822,"hxxp://static.ak.facebook.com/",2.0665253447889715,"hxxp://www.facebook.com/",1.804354218957534,"hxxp://www.msn.com/",1.804354218957534,"hxxps://platform.twitter.com/",1.804354218957534,"hxxps://s-static.ak.facebook.com/",1.804354218957534,"hxxps://secure.skype.com/",1.804354218957534,"hxxps://www.facebook.com/",1.804354218957534]],["hxxp://www.mybluedish.com/",["hxxp://flex.atdmt.com/",1.1597517902609096,"hxxp://js13.ringrevenue.com/",1.0126191004516922,"hxxp://stats.g.doubleclick.net/",1.1597517902609096,"hxxp://www.mybluedish.com/",2.6310786883531088,"hxxp://www.statichue.com/",1.8954152393070116]],["hxxp://www.newegg.com/",["hxxp://cm.newegg.com/",0.0599490139262956,"hxxp://content.newegg.com/",0.05319978719287163,"hxxp://content.shoprunner.com/",0.08019669412656766,"hxxp://images10.newegg.com/",0.5347577292451384,"hxxp://images17.newegg.com/",0.09567506560981609,"hxxp://promotions.newegg.com/",0.11081584711448234,"hxxp://www.google-analytics.com/",0.05319978719287163]],["hxxp://www.oreillyauto.com/",["hxxp://googleads.g.doubleclick.net/",0.486416640697503,"hxxp://images.oreillyauto.com/",1.5465554729869335,"hxxp://metrics.oreillyauto.com/",0.557092562850132,"hxxp://oreillyautomotivesto.tt.omtrdc.net/",0.7691203293080178,"hxxp://www.google-analytics.com/",0.557092562850132,"hxxp://www.googleadservices.com/",0.486416640697503,"hxxp://www.oreillyauto.com/",6.1404904129078,"hxxps://www.googleadservices.com/",0.486416640697503]],["hxxp://www.portagedetasseling.com/",["hxxp://banners.wunderground.com/",1.0422931874998107,"hxxp://www.portagedetasseling.com/",1.9509590432688761]],["hxxp://www.powertecfitness.com/",["hxxp://ct1.addthis.com/",2.775314279626398,"hxxp://i4.ytimg.com/",1.841050066682858,"hxxp://s.ytimg.com/",1.6074840134469741,"hxxp://s7.addthis.com/",2.3081821731546275,"hxxp://www.google-analytics.com/",2.3081821731546275,"hxxp://www.powertecfitness.com/",28.93471224204559,"hxxp://www.youtube.com/",1.6074840134469741]],["hxxp://www.progressive.com/",["hxxp://s.ytimg.com/",1.298664854951716,"hxxp://service.maxymiser.net/",2.56305530613033,"hxxp://stats.g.doubleclick.net/",1.8647495353152843,"hxxp://www.progressive.com/",15.73584417972237,"hxxp://www.youtube.com/",1.298664854951716]],["hxxp://www.quadratec.com/",["hxxp://server.iad.liveperson.net/",2.4454435996632853,"hxxp://www.quadratec.com/",2.1979879973164054]],["hxxp://www.rallysportdirect.com/",["hxxp://googleads.g.doubleclick.net/",1.1042755784134999,"hxxp://images.scanalert.com/",1.1042755784134999,"hxxp://www.googleadservices.com/",1.2647258761316997,"hxxp://www.rallysportdirect.com/",1.1140125930620273,"hxxps://server.iad.liveperson.net/",1.0055028676638604]],["hxxp://www.sears.com/",["hxxp://c.shld.net/",6.097695552752729,"hxxp://c2.shld.net/",1.6405347985907235,"hxxp://fls.doubleclick.net/",0.8764500978772353,"hxxp://media.richrelevance.com/",1.1311449981150654,"hxxp://netalpaca.com/",0.8764500978772353,"hxxp://recs.richrelevance.com/",0.8764500978772353,"hxxp://s.btstatic.com/",0.8764500978772353,"hxxp://s.shld.net/",1.0037975479961507,"hxxp://s.thebrighttag.com/",0.8764500978772353]],["hxxp://www.simplyrecipes.com/",["hxxp://ads.blogherads.com/",1.5040390410583784,"hxxp://c3365074.r74.cf0.rackcdn.com/",1.5040390410583784,"hxxp://catrg.peer39.net/",1.3132281179390328,"hxxp://i0.wp.com/",24.21053889226069,"hxxp://oascentral.blogher.org/",1.3132281179390328,"hxxp://partner.googleadservices.com/",1.3132281179390328,"hxxp://www.google-analytics.com/",1.3132281179390328,"hxxp://www.googletagservices.com/",1.3132281179390328,"hxxp://www.simplyrecipes.com/",2.4580936566551133,"hxxps://s-static.ak.facebook.com/",1.5040390410583784]],["hxxp://www.snapon.com/",["hxxp://cdn.shoutlet.com/",0.6565825732037983,"hxxp://images.scanalert.com/",0.6565825732037983,"hxxp://www.google-analytics.com/",0.7519834599086243,"hxxp://www.snapon.com/",5.426626908445068]],["hxxp://www.superpages.com/",["hxxp://ecn.dev.virtualearth.net/",1.1597517902609096,"hxxp://idearc.tt.omtrdc.net/",1.0126191004516922,"hxxp://img.superpages.com/",5.2794671049190685,"hxxp://jscss.superpages.com/",6.309395933583606,"hxxp://platform.twitter.com/",1.0126191004516922,"hxxp://r.ypcdn.com/",1.0126191004516922,"hxxp://video.superpages.com/",1.1597517902609096,"hxxp://www.superpages.com/",1.7482825494977903,"hxxps://apis.google.com/",1.1597517902609096,"hxxps://ssl.gstatic.com/",1.0126191004516922]],["hxxp://www.tomshardware.com/",["hxxp://ajax.googleapis.com/",2.1457765990453503,"hxxp://b.scorecardresearch.com/",2.1457765990453503,"hxxp://m.bestofmedia.com/",9.004925727617662,"hxxp://partner.googleadservices.com/",2.1457765990453503,"hxxp://tracking.tomsguide.com/",2.1457765990453503,"hxxp://tracking.tomshardware.co.uk/",2.1457765990453503,"hxxp://tracking.tomshardware.com/",2.1457765990453503,"hxxp://w.estat.com/",2.1457765990453503,"hxxp://www.googletagmanager.com/",2.1457765990453503,"hxxp://www.tomshardware.com/",2.1457765990453503]],["hxxp://www.ups.com/",["hxxp://ssdc.ups.com/",0.7280448489946119,"hxxp://www.ups.com/",17.352196728878067]],["hxxp://www.verizonwireless.com/",["hxxp://ak1.abmr.net/",1.169943896501473,"hxxp://b.monetate.net/",1.169943896501473,"hxxp://cache.vzw.com/",9.839528155191873,"hxxp://tcache.vzw.com/",1.169943896501473,"hxxp://verizonwireless.tt.omtrdc.net/",3.0398542268072464,"hxxp://verizonwireless.ugc.bazaarvoice.com/",1.169943896501473,"hxxp://www.verizonwireless.com/",1.169943896501473,"hxxps://seal.verisign.com/",1.169943896501473]],["hxxp://www.walmart.com/",["hxxp://beacon.walmart.com/",0.7369949101477321,"hxxp://cts.channelintelligence.com/",0.7369949101477321,"hxxp://fw.adsafeprotected.com/",0.8440796406820179,"hxxp://i.walmartimages.com/",2.87868952083345,"hxxp://i2.walmartimages.com/",2.985774251367735,"hxxp://oascentral.walmartwom.com/",0.7369949101477321,"hxxp://omniture.walmart.com/",0.8440796406820179,"hxxp://recs.richrelevance.com/",0.7369949101477321,"hxxp://search-cdn.walmart.com/",0.9511643712163047,"hxxp://www.walmart.com/",1.5936727544220202]],["hxxp://www.weather.com/",["hxxp://r0.ortho.tiles.virtualearth.net/",5.246261999999999,"hxxp://r1.ortho.tiles.virtualearth.net/",5.576582199999999,"hxxp://r2.ortho.tiles.virtualearth.net/",5.246261999999999,"hxxp://r3.ortho.tiles.virtualearth.net/",4.915941799999999,"hxxp://s.imwx.com/",43.23308500000011,"hxxp://t10.imwx.com/",15.155867999999995,"hxxp://t11.imwx.com/",12.182986199999997,"hxxp://t12.imwx.com/",11.192025599999996,"hxxp://t13.imwx.com/",10.531385199999997,"hxxp://wxdata.weather.com/",3.5946609999999994]],["hxxp://www.youtube.com/",["hxxp://csi.gstatic.com/",0.18135698563586192,"hxxp://i1.ytimg.com/",0.2867610456635422,"hxxp://i2.ytimg.com/",0.26041003065662227,"hxxp://i3.ytimg.com/",0.2867610456635422,"hxxp://o-o---preferred---sn-p5q7ynel---v4---lscache1.c.youtube.com/",0.26041003065662227,"hxxp://p2-f2kgkp4vyqsyo-ttjg76uobt655ca2-if-v6exp3-v4.metric.gstatic.com/",0.2077080006427821,"hxxp://s.youtube.com/",0.18135698563586192,"hxxp://s.ytimg.com/",1.889933289880193,"hxxp://s2.youtube.com/",0.2077080006427821,"hxxp://www.youtube-nocookie.com/",0.2077080006427821]],["hxxp://wwwapps.ups.com/",["hxxp://ssdc.ups.com/",1.2042282755051048,"hxxp://wwwapps.ups.com/",12.577495321942187]],["hxxp://youtube.com/",["hxxp://www.youtube.com/",0.7305744908050257]],["hxxp://zooivlooi.blogspot.com/",["hxxp://4.bp.blogspot.com/",1.1311449981150654,"hxxp://d3io1k5o0zdpqr.cloudfront.net/",0.8764500978772353,"hxxp://img1.blogblog.com/",1.0037975479961507,"hxxp://pagead2.googlesyndication.com/",0.8764500978772353,"hxxp://shabbyblogs.com/",0.8764500978772353,"hxxp://www.blogger.com/",1.8952296988285533,"hxxp://www.bloglovin.com/",0.8764500978772353,"hxxp://www.google.com/",0.8764500978772353,"hxxps://apis.google.com/",1.0037975479961507,"hxxps://ssl.gstatic.com/",0.8764500978772353]],["hxxps://1295336.fls.doubleclick.net/",["hxxps://d.adroll.com/",1.4413481613723558,"hxxps://secure.media6degrees.com/",1.0160393817484918,"hxxps://www.facebook.com/",1.0160393817484918]],["hxxps://1384245.fls.doubleclick.net/",["hxxps://r.turn.com/",1.0214115253651417]],["hxxps://1435575.fls.doubleclick.net/",["hxxps://dw.com.com/",0.9752194318046993,"hxxps://googleads.g.doubleclick.net/",1.2226631682327578,"hxxps://www.googleadservices.com/",1.3463850364467873]],["hxxps://2542116.fls.doubleclick.net/",["hxxps://ad.yieldmanager.com/",2.6195373902784613,"hxxps://cm.g.doubleclick.net/",1.7377129222639314,"hxxps://conversion-pixel.invitemedia.com/",1.5172568052602973,"hxxps://cookex.amp.yahoo.com/",1.7377129222639314,"hxxps://g-pixel.invitemedia.com/",1.7377129222639314,"hxxps://googleads.g.doubleclick.net/",1.322285415382284,"hxxps://segment-pixel.invitemedia.com/",1.5172568052602973,"hxxps://www.google.com/",0.6609170643713856,"hxxps://www.googleadservices.com/",1.4183160999490672]],["hxxps://685973.fls.doubleclick.net/",["hxxps://solutions.vzwshop.com/",1.3399357447110898]],["hxxps://a.gfx.ms/",["hxxps://a.gfx.ms/",3.6395520997775908]],["hxxps://account.login.aol.com/",["hxxps://account.login.aol.com/",1.5617189435841374,"hxxps://b.aol.com/",1.5617189435841374,"hxxps://captcha.aol.com/",1.5617189435841374,"hxxps://s.sa.aol.com/",1.5617189435841374,"hxxps://sb.scorecardresearch.com/",1.5617189435841374,"hxxps://sns-static.aolcdn.com/",4.284716075987249]],["hxxps://apis.google.com/",["hxxps://apis.google.com/",1.0295058713177692,"hxxps://ssl.gstatic.com/",1.500430932]],["hxxps://at.atwola.com/",["hxxps://ad.doubleclick.net/",0.2870985127331583,"hxxps://aka-cdn.adtechus.com/",0.4041818575968988,"hxxps://at.atwola.com/",0.9159408578318511,"hxxps://static.doubleclick.net/",0.2870985127331583]],["hxxps://blu162.mail.live.com/",["hxxps://a.gfx.ms/",12.553370378046427,"hxxps://ads1.msads.net/",2.8530387222832814,"hxxps://blu162.mail.live.com/",5.736921106429082,"hxxps://cid-49ddc647f06b2415.users.storage.live.com/",1.804354218957534,"hxxps://fd.rad.msn.com/",1.804354218957534,"hxxps://flex.atdmt.com/",2.0665253447889715,"hxxps://g.msn.com/",2.0665253447889715,"hxxps://h.atdmt.com/",2.328696470620408,"hxxps://h.live.com/",3.377380973946154,"hxxps://people.directory.live.com/",1.804354218957534]],["hxxps://centinel.cardinalcommerce.com/",["hxxps://centinel.cardinalcommerce.com/",0.8347190782469223,"hxxps://secure2.arcot.com/",0.7288218817529097,"hxxps://www.rallysportdirect.com/",1.7460767692863028]],["hxxps://chrome.google.com/",["hxxps://2542116.fls.doubleclick.net/",1.7377129222639314,"hxxps://apis.google.com/",1.7377129222639314,"hxxps://chrome.google.com/",1.7377129222639314,"hxxps://fls.doubleclick.net/",2.1786251562711962,"hxxps://fonts.googleapis.com/",1.5172568052602973,"hxxps://ssl.google-analytics.com/",1.7377129222639314,"hxxps://ssl.gstatic.com/",1.5172568052602973,"hxxps://www.google.com/",1.7377129222639314]],["hxxps://connect.charter.com/",["hxxps://ajax.googleapis.com/",0.6683286062981154,"hxxps://beacon-1.newrelic.com/",0.8154612961073356,"hxxps://c718669.ssl.cf2.rackcdn.com/",2.124942235409394,"hxxps://c783459.ssl.cf2.rackcdn.com/",0.6683286062981154,"hxxps://connect.charter.com/",1.1067840219295906,"hxxps://d1ros97qkrwjf5.cloudfront.net/",0.6683286062981154,"hxxps://media.charter.com/",1.0597015611906404,"hxxps://smetrics.charter.com/",0.8154612961073356]],["hxxps://d.shareaholic.com/",["hxxps://dtym7iokkjlif.cloudfront.net/",1.336721310666388,"hxxps://ib.adnxs.com/",1.336721310666388]],["hxxps://d3l3lkinz3f56t.cloudfront.net/",["hxxps://ad.doubleclick.net/",0.8764500978772353,"hxxps://altfarm.mediaplex.com/",0.8764500978772353,"hxxps://secure.img-cdn.mediaplex.com/",0.8764500978772353,"hxxps://static.doubleclick.net/",1.0037975479961507]],["hxxps://geo.gateway.messenger.live.com/",["hxxps://geo.gateway.messenger.live.com/",1.804354218957534,"hxxps://secure.shared.live.com/",1.804354218957534]],["hxxps://login.cengagebrain.com/",["hxxps://login.cengagebrain.com/",13.116482740372733,"hxxps://secure.eloqua.com/",1.3913222852435276,"hxxps://sstats.cengagebrain.com/",1.3913222852435276]],["hxxps://login.live.com/",["hxxps://auth.gfx.ms/",2.5908675964518446,"hxxps://login.live.com/",1.804354218957534,"hxxps://sc.imp.live.com/",2.0665253447889715]],["hxxps://maps.google.com/",["hxxps://cbks0.google.com/",0.7369949101477321,"hxxps://maps-api-ssl.google.com/",0.7369949101477321,"hxxps://maps.google.com/",1.5936727544220202,"hxxps://maps.gstatic.com/",6.305400897930598,"hxxps://mts0.google.com/",2.985774251367735,"hxxps://mts1.google.com/",2.2361811376277343,"hxxps://ssl.gstatic.com/",0.7369949101477321]],["hxxps://my.screenname.aol.com/",["hxxps://at.atwola.com/",5.925150693413949,"hxxps://b.aol.com/",2.9704761977413656,"hxxps://cdn.webmail.aol.com/",2.149277448030079,"hxxps://s.aolcdn.com/",16.58593088534165,"hxxps://s.sa.aol.com/",2.149277448030079,"hxxps://sb.scorecardresearch.com/",2.149277448030079,"hxxps://sns-static.aolcdn.com/",7.642244543568043]],["hxxps://onlineservice-yourpolicy1.progressive.com/",["hxxps://onlineservice-yourpolicy1.progressive.com/",13.640968240075985,"hxxps://ssl.google-analytics.com/",2.1809020914037167,"hxxps://www.progressive.com/",1.8950007376847435]],["hxxps://onlineservice-yourpolicy5.progressive.com/",["hxxps://onlineservice-yourpolicy5.progressive.com/",7.022396824295997,"hxxps://ssl.google-analytics.com/",2.2086570657060003]],["hxxps://onlineservice4.progressive.com/",["hxxps://onlineservice4.progressive.com/",14.513098094112891,"hxxps://siteserver.progressive.com/",0.8354943307799824,"hxxps://ssl.google-analytics.com/",2.058955135485256,"hxxps://www.progressive.com/",1.2012510743283342]],["hxxps://onlineservice7.progressive.com/",["hxxps://onlineservice7.progressive.com/",10.873388631167996,"hxxps://siteserver.progressive.com/",2.2086570657060003,"hxxps://ssl.google-analytics.com/",2.850489033518,"hxxps://www.progressive.com/",2.529573049612]],["hxxps://p1.kvcc.edu/",["hxxps://p1.kvcc.edu/",16.949537785016297,"hxxps://www.kvcc.edu/",1.3517113397826432]],["hxxps://people.directory.live.com/",["hxxps://people.directory.live.com/",2.0665253447889715]],["hxxps://performancemanager4.successfactors.com/",["hxxps://performancemanager4.successfactors.com/",20.730053395829614]],["hxxps://plus.google.com/",["hxxps://ad.doubleclick.net/",0.4143272001018218,"hxxps://apis.google.com/",0.36768109148108724,"hxxps://mts0.google.com/",0.36768109148108724,"hxxps://plus.google.com/",2.3547066433879418,"hxxps://ssl.gstatic.com/",1.2073110466543167]],["hxxps://plusone.google.com/",["hxxps://plusone.google.com/",0.8599457496529838]],["hxxps://pm.esurance.com/",["hxxps://pm.esurance.com/",14.495955322498911,"hxxps://sb.scorecardresearch.com/",1.7886353712843974]],["hxxps://resumegenius.com/",["hxxps://googleads.g.doubleclick.net/",1.3451818060894984,"hxxps://platform.twitter.com/",1.1937374967946541,"hxxps://plusone.google.com/",1.1937374967946541,"hxxps://resumegenius.com/",3.937908381217232,"hxxps://s-static.ak.facebook.com/",1.1937374967946541,"hxxps://s.adroll.com/",1.0422931874998107,"hxxps://secure.adnxs.com/",1.0422931874998107,"hxxps://secure.livechatinc.com/",2.6930361588136127,"hxxps://www.facebook.com/",1.1937374967946541,"hxxps://www.googleadservices.com/",1.0422931874998107]],["hxxps://s2.crm.xpon.us/",["hxxps://s2.crm.xpon.us/",4.162730209303894]],["hxxps://sc.imp.live.com/",["hxxps://s.imp.microsoft.com/",1.804354218957534,"hxxps://sc.imp.live.com/",3.377380973946154,"hxxps://windowslive.tt.omtrdc.net/",1.804354218957534]],["hxxps://scdn.uc.atwola.com/",["hxxps://ad.doubleclick.net/",0.8764500978772353,"hxxps://ping1.unicast.com/",0.8764500978772353,"hxxps://static.doubleclick.net/",0.8764500978772353]],["hxxps://secure.newegg.com/",["hxxps://1435575.fls.doubleclick.net/",0.9752194318046993,"hxxps://ad.doubleclick.net/",0.9752194318046993,"hxxps://cm.g.doubleclick.net/",0.8514975635906711,"hxxps://cm.newegg.com/",1.8412725093029028,"hxxps://pix.esm1.net/",0.8514975635906711,"hxxps://secure.newegg.com/",1.4701069046608155,"hxxps://ssl-images.newegg.com/",4.8105973464395975,"hxxps://ssl.google-analytics.com/",1.0989413000187296,"hxxps://tracking.deepsearch.adlucent.com/",0.9752194318046993,"hxxps://www.googlecommerce.com/",1.0989413000187296]],["hxxps://secure.shared.live.com/",["hxxps://geo.gateway.messenger.live.com/",1.804354218957534,"hxxps://sn1msg2010520.gateway.messenger.live.com/",1.804354218957534,"hxxps://storage.live.com/",1.804354218957534]],["hxxps://secure2.arcot.com/",["hxxps://centinel.cardinalcommerce.com/",1.1042755784134999,"hxxps://secure2.arcot.com/",3.1377808604340074]],["hxxps://servicing1.progressive.com/",["hxxps://1384245.fls.doubleclick.net/",2.1975556969481267,"hxxps://servicing1.progressive.com/",12.351631034644745,"hxxps://ssl.google-analytics.com/",2.7612187928456957]],["hxxps://servicing5.progressive.com/",["hxxps://1384245.fls.doubleclick.net/",2.2086570657060003,"hxxps://servicing5.progressive.com/",8.306060759919998]],["hxxps://sn1msg2010520.gateway.messenger.live.com/",["hxxps://sn1msg2010520.gateway.messenger.live.com/",3.901723225609027]],["hxxps://solutions.vzwshop.com/",["hxxps://cm.g.doubleclick.net/",1.3399357447110898,"hxxps://googleads.g.doubleclick.net/",1.3399357447110898,"hxxps://p.rfihub.com/",1.3399357447110898,"hxxps://pclick.yahoo.com/",1.169943896501473,"hxxps://pixel.mathtag.com/",1.169943896501473,"hxxps://s.tribalfusion.com/",1.169943896501473,"hxxps://secure.adnxs.com/",1.6799194411303213,"hxxps://secure.leadback.advertising.com/",1.169943896501473,"hxxps://tag.yieldoptimizer.com/",1.169943896501473,"hxxps://www.googleadservices.com/",1.169943896501473]],["hxxps://ssl.kaptcha.com/",["hxxps://images.chasepaymentech.com/",0.1615694147377621,"hxxps://ssl.kaptcha.com/",0.9659334622415224]],["hxxps://storage.live.com/",["hxxps://storage.live.com/",2.0665253447889715]],["hxxps://ups6.custhelp.com/",["hxxps://ssbcvipmw02.rightnowtech.com/",1.2696774789225345,"hxxps://ups6.custhelp.com/",3.699722455138508,"hxxps://www.rnengage.com/",1.8414527674439403]],["hxxps://www.amazon.com/",["hxxps://ad.doubleclick.net/",0.07244206258146339,"hxxps://fls-na.amazon.com/",0.48673143355224224,"hxxps://images-na.ssl-images-amazon.com/",7.212017703172333,"hxxps://www.amazon.com/",0.7104594581168758]],["hxxps://www.apps.akc.org/",["hxxps://images.akc.org/",1.4669399543502535,"hxxps://pixel.quantserve.com/",1.1366355937680768,"hxxps://s3.amazonaws.com/",1.1366355937680768,"hxxps://secure.quantserve.com/",1.1366355937680768,"hxxps://ssl.google-analytics.com/",1.3017877740591646,"hxxps://www.apps.akc.org/",7.412418444829428]],["hxxps://www.att.com/",["hxxps://www.att.com/",1.3399357447110898]],["hxxps://www.comcast.com/",["hxxps://ajax.googleapis.com/",1.0126191004516922,"hxxps://comcastresidentialservices.tt.omtrdc.net/",1.1538664826685414,"hxxps://connect.facebook.net/",0.7654361815722011,"hxxps://g-pixel.invitemedia.com/",0.6683286062981154,"hxxps://googleads.g.doubleclick.net/",0.6683286062981154,"hxxps://s-static.ak.facebook.com/",0.7654361815722011,"hxxps://s.ev.ads.pointroll.com/",0.6683286062981154,"hxxps://www.comcast.com/",9.672849222622384,"hxxps://www.facebook.com/",0.9596513321203712,"hxxps://www.google.com/",0.6683286062981154]],["hxxps://www.docusign.net/",["hxxps://rpxnow.com/",1.5617189435841374,"hxxps://s3.amazonaws.com/",1.5617189435841374,"hxxps://ssl.google-analytics.com/",1.7886353712843974,"hxxps://www.docusign.net/",4.965465359088027]],["hxxps://www.esurance.com/",["hxxps://apis.google.com/",1.7886353712843974,"hxxps://images.esurance.com/",3.1501339374859523,"hxxps://plusone.google.com/",1.7886353712843974,"hxxps://sb.scorecardresearch.com/",1.5617189435841374,"hxxps://ssl.google-analytics.com/",2.2424682266849163,"hxxps://ssl.gstatic.com/",1.5617189435841374,"hxxps://www.esurance.com/",9.503793913093224]],["hxxps://www.facebook.com/",["hxxps://fbstatic-a.akamaihd.net/",0.4234925064819806,"hxxps://s-static.ak.fbcdn.net/",0.24918156845670023]],["hxxps://www.factoryfive.com/",["hxxps://dtym7iokkjlif.cloudfront.net/",2.61389430083689,"hxxps://ssl.google-analytics.com/",3.202453282482282,"hxxps://www.factoryfive.com/",15.267912406212815]],["hxxps://www.google.com/",["hxxps://encrypted-tbn2.gstatic.com/",0.5822758029262788,"hxxps://id.google.com/",0.1407660240908417,"hxxps://ssl.gstatic.com/",1.6507028805840958,"hxxps://www.google.com/",6.46276554114639]],["hxxps://www.kvcc.edu/",["hxxps://ajax.googleapis.com/",0.1671040264835244,"hxxps://in.getclicky.com/",0.1813244314335051,"hxxps://ssl.google-analytics.com/",0.20647148826004785,"hxxps://static.getclicky.com/",0.10753605591890784,"hxxps://www.kvcc.edu/",2.9309981643588348]],["hxxps://www.mactools.com/",["hxxps://ssl.google-analytics.com/",0.3275639951361965,"hxxps://www.mactools.com/",4.082848178675578]],["hxxps://www.onlinebanking.pnc.com/",["hxxps://ad.doubleclick.net/",1.126733656792182,"hxxps://content.pncmc.com/",2.413228055965345,"hxxps://sales.liveperson.net/",4.557385387920617,"hxxps://www.onlinebanking.pnc.com/",12.848127071481015]],["hxxps://www.peopleanswers.com/",["hxxps://www.peopleanswers.com/",4.346364685281502]],["hxxps://www.pnc.com/",["hxxps://content.pncmc.com/",0.8669396639534999,"hxxps://statse.webtrendslive.com/",0.3838617718073579,"hxxps://view.atdmt.com/",0.32961534605227044,"hxxps://www.pnc.com/",3.533765798324734]],["hxxps://www.rallysportdirect.com/",["hxxps://images.scanalert.com/",0.15838574143898693,"hxxps://server.iad.liveperson.net/",0.2789480222358276,"hxxps://ssl.google-analytics.com/",0.15838574143898693,"hxxps://www.rallysportdirect.com/",0.7611971454231912]],["hxxps://www.ups.com/",["hxxps://bs.serving-sys.com/",0.42853885197869346,"hxxps://domdex.com/",0.42853885197869346,"hxxps://mpsnare.iesnare.com/",0.20446996624905,"hxxps://secure.adnxs.com/",0.42853885197869346,"hxxps://ssdc.ups.com/",1.1426698670630737,"hxxps://www.ups.com/",36.779735847581435]],["hxxps://wwwapps.ups.com/",["hxxps://ssdc.ups.com/",0.9837898346618317,"hxxps://wwwapps.ups.com/",7.8450932969187015]]],"startup_list":[1,"hxxp://image.vam.synacor.com.edgesuite.net/","hxxp://images.synacor.com/","hxxp://pagead2.googlesyndication.com/","hxxp://partner.googleadservices.com/","hxxp://service.maxymiser.net/","hxxp://start.toshiba.com/","hxxp://static.citrine.synacor.com/","hxxp://web.citrine.synacor.com/","hxxp://www.googletagservices.com/","hxxps://www.google.com/"]},"download":{"directory_upgrade":true,"extensions_to_open":""},"extensions":{"alerts":{"initialized":true},"autoupdate":{"last_check":"13018970485507000","next_check":"13019439937784469"},"blacklistupdate":{"lastpingday":"13018950029842000","version":"0.0.0.149"},"chrome_url_overrides":{"bookmarks":["chrome-extension://eemcgdkfndhakfknompkggombfjjjeno/main.html"]},"last_chrome_version":"28.0.1500.72","settings":{"aaaaojmikegpiepcfdkkjaplodkpfmlo":{"active_permissions":{"api":["bookmarks","contextMenus","cookies","geolocation","history","idle","management","notifications","plugin","tabs","unlimitedStorage"],"explicit_host":["chrome://favicon/*","hxxp://*/*","hxxps://*/*"],"scriptable_host":["*://*.ask.com/","*://*.bagsbuy.com/*","*://*.childrenschorus.org/*","*://*.csaa.com/*","*://*.facebook.com/*","*://*.google.com/*","*://*.google.com/imgres*","*://*.mercurynews.com/*","*://*.usnews.com/*","*://*.wikipedia.org/*","*://*/*","*://codesearch.google.com/*","*://images.google.com/*"]},"from_bookmark":false,"from_webstore":false,"install_time":"12996523501370412","location":3,"manifest":{"background_page":"background/background.html","browser_action":{"default_icon":"config/skin/images/ask_logo_19x.png","default_popup":"config/skin/options.html","default_title":"Control the Ask Toolbar"},"chrome_url_overrides":{"newtab":"config/skin/new-tab.html"},"content_scripts":[{"js":["lib/jquery.js","lib/constant.js","lib/default-config.js","config/tb-config.js","lib/tb-message.js","content_script/toolbar.js","content_script/widget.js","content_script/injector.js"],"matches":["*://*/*"],"run_at":"document_start"},{"css":["content_script/hack/facebook.css"],"matches":["*://*.facebook.com/*"]},{"css":["content_script/hack/relative.css"],"matches":["*://*.google.com/*","*://*.ask.com/","*://*.bagsbuy.com/*","*://*.csaa.com/*","*://*.childrenschorus.org/*","*://*.wikipedia.org/*","*://*.mercurynews.com/*","*://*.usnews.com/*"],"run_at":"document_start"},{"css":["content_script/hack/static.css"],"matches":["*://*.google.com/imgres*","*://images.google.com/*","*://codesearch.google.com/*"],"run_at":"document_start"}],"description":"Convenient tools and links to make your browsing more enjoyable","icons":{"128":"config/skin/images/ask_logo_128x.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDT32xKzABqBRk8r1bu10LUNPL8sfBI0fDK6l1xV3KfX4i3K0/8qx7ATbsryY93BKJFrYGDkL3JS5YU/N/gTQPRTBRhgF1PPu0H0BuRUN/+6Jdm8h+rTWKYsCf5TwZQtot9w1nLRJ2UgOc7IQi8ekWozdmNHaovixjA2ceGH0wonQIDAQAB","name":"Ask Toolbar","permissions":["bookmarks","contextMenus","cookies","geolocation","history","idle","management","notifications","tabs","unlimitedStorage","hxxp://*/*","hxxps://*/*","chrome://favicon/*","chrome-internal://newtab/"],"plugins":[{"path":"background/registryAccess.dll","public":false}],"update_url":"hxxp://apnmedia.ask.com/media/toolbar/supertoolbar/chrome/manifest.php","version":"7.15.9.29524"},"path":"aaaaojmikegpiepcfdkkjaplodkpfmlo\\7.15.9.29524_0","state":2},"aakhlmakppmkkmfkoibponkmmpgpmjgl":{"blacklist":true},"aandpgohbohmlknpjbblpmoladhoochg":{"blacklist":true},"aangdcfipmfploijfkoonkajgpdkfmbm":{"blacklist":true},"abciiempgohamehppammbkhkicmkgkob":{"blacklist":true},"abfclfmhaemoockhhinpplncjehfpdbd":{"blacklist":true},"abidmaanmbfeddegmapgpjhdmgjaloen":{"blacklist":true},"acchaoeabgiclhngknbkegekbfphgndl":{"blacklist":true},"acmpfcamncegnhjdeiodgilikjafcamg":{"blacklist":true},"acomnmbomlajgjbcijkflekoojdfcldj":{"blacklist":true},"aconhjfogglfnkjhkjipaifepjklolog":{"blacklist":true},"aebfkgcamgnimcbnbiopgdakknjgggnm":{"blacklist":true},"aemcjbfajnnmhblifaejadoecfoaebld":{"blacklist":true},"afenhmponmfmdmbmccbmglppcmjhmhmh":{"blacklist":true},"aglmapjbjphdidmnileogpjkgpdoliep":{"blacklist":true},"agmhonoepgcnakccfpidhjehlocaeaaj":{"blacklist":true},"agodbcffjkjcnceklapkjfcmkfepmbgm":{"blacklist":true},"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","webstorePrivate"]},"app_launcher_index":-2,"app_launcher_ordinal":"n","creation_flags":1,"from_bookmark":false,"from_webstore":false,"install_time":"13015098119479299","location":5,"manifest":{"app":{"launch":{"web_url":"hxxps://chrome.google.com/webstore"},"urls":["hxxps://chrome.google.com/webstore"]},"description":"Chrome Web Store","icons":{"128":"webstore_icon_128.png","16":"webstore_icon_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtl3tO0osjuzRsf6xtD2SKxPlTfuoy7AWoObysitBPvH5fE1NaAA1/2JkPWkVDhdLBWLaIBPYeXbzlHp3y4Vv/4XG+aN5qFE3z+1RU/NqkzVYHtIpVScf3DjTYtKVL66mzVGijSoAIwbFCC3LpGdaoe6Q1rSRDp76wR6jjFzsYwQIDAQAB","name":"Store","permissions":["webstorePrivate","management"],"version":"0.2"},"page_index":0,"page_ordinal":"n","path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\27.0.1453.110\\resources\\web_store","was_installed_by_default":false},"ahjfgnikolodijnpakeknpilnemojlhc":{"blacklist":true},"aieglpnmmhleoenpbmfaffppfomgjmba":{"blacklist":true},"aieihijcjcccdiepockaiekhpflicdii":{"blacklist":true},"aifmjmboebdkdelpjenakhaodgneempp":{"blacklist":true},"ajlkjjdbgcjdiklbcomhnfghjigfccoh":{"blacklist":true},"ajneiojjdhceikkgmhnjhgaacpfhldpi":{"blacklist":true},"akadaakimgegecohlifeejdnnjbnobop":{"blacklist":true},"akbdojiajlefghcdclgkgmbbljamgehd":{"blacklist":true},"alcbnnpmipohgdllkkglhkbncijplago":{"blacklist":true},"aldalonecchncedclgcndcndgilaclnk":{"blacklist":true},"alfahpoknocfdebmiclonikapcnljlob":{"blacklist":true},"aljdncnajablgppdcfbehhmidlmbndda":{"blacklist":true},"amfgdngndpfldigimkcindjalokfnmem":{"blacklist":true},"amoobcjlpgloocplpikcldcpjjdnoeii":{"blacklist":true},"anmjpohfnlopdfaojooicpemopnliimn":{"blacklist":true},"aofechiiopolnegcjcddgedjabmkemhf":{"blacklist":true},"aojicjocmihiopalnhjikigammkhgckb":{"blacklist":true},"aokenbhllkgpooaacldiamnpmmgkjblo":{"blacklist":true},"apdebchnkegjokdjplmfmepcdgneemhe":{"blacklist":true},"apdmgffkfhjfeejmbjidennfjdkmmmbl":{"blacklist":true},"aphncaagnlabkeipnbbicmcahnamibgb":{"blacklist":true},"bccdgfmbcjkfkinkkagaflgdaoaamogo":{"blacklist":true},"bcddmcejgphfgofbpoocakaeapfomlek":{"blacklist":true},"bckhfnghfdponbaldednpnljadgfjecj":{"blacklist":true},"bdgijcibmhjjccgbdohofncdjcophknj":{"blacklist":true},"benclngoadbppljglhphhnfknoppmjoa":{"blacklist":true},"bhdkpmneahdelgdgfhddianklldfoell":{"blacklist":true},"bhkdpodceenlocjmmgodpbbpkafkpljc":{"blacklist":true},"bhmahaiplmeodpakkcchmolaihbhkpdl":{"blacklist":true},"biiponhbbifajapmbggbgaepiedinifm":{"blacklist":true},"bilgncckogfgfipdlejkffnbkgjkmflh":{"blacklist":true},"bioeopenmokdgbekbgpgnacecjmpckbb":{"blacklist":true},"bjihddggcgnblgojnmhpnngonofbnkaj":{"blacklist":true},"bkhafliomebnpccanacmlfaemgfiofko":{"blacklist":true},"bkkchglolnigbfncnbnnbhhempjkdpkf":{"blacklist":true},"bkplhcigeaiiliajeehehiikokgocbhb":{"blacklist":true},"bldgnkigdcpgnbfehgbameigoohecdfl":{"blacklist":true},"bmjhmeeepkkbmjdajachipfgihmpokpd":{"blacklist":true},"bndahdijlcnncjbpammoedeapmlobllc":{"blacklist":true},"bnffnggkphadlnoopcoakdnkellnifjp":{"blacklist":true},"boaoagnmpennjoigkkmnjhecapibhfko":{"blacklist":true},"boclfockfmgcppbajihcgajhpggaakgl":{"blacklist":true},"bokkificjhapflinbdejegngffgkcgfe":{"blacklist":true},"bpfadpmhabiajakhgnaipdplkcjaklnj":{"blacklist":true},"canhmdgddepdjikkjhpmhcfdkkjdbppi":{"blacklist":true},"caphkimknlmnhpjoneddiaakmcaajagb":{"blacklist":true},"cbbbpmlnlpnjojeplppgeilanlihoojg":{"blacklist":true},"cbbjhegipokkofhhicbckicchjpcpeni":{"blacklist":true},"cbhhdkemlehgodemcigfabmcdnohhhef":{"blacklist":true},"cbjlfaogacjpkplebfbijaakaifoflno":{"blacklist":true},"cconecmbohgadkjghlfbchmjpgbobkaf":{"blacklist":true},"cdogaeccgljmkecjmoedambgiekkllij":{"blacklist":true},"cedclbokcakighlpbnbhfjffdjeihfdp":{"blacklist":true},"cekdjgnecpoooikhmceokdhojckkkhmh":{"blacklist":true},"cepfogmgfkddnllaopgknbdfkceejmhk":{"blacklist":true},"cfbdodejdeejbkffcmiaknpmojjeibpn":{"blacklist":true},"cfdedhfmaeiheeklgodcmcgfpedooocj":{"blacklist":true},"cfnfobbpdaccoljfahpmfjdmbfmmkeof":{"blacklist":true},"cfogpbanfnocakdckmgafapdlmclpiln":{"blacklist":true},"cgnegjfmdfenjojhjffejinpnpoglmlh":{"blacklist":true},"cgnkbnaiipmfbakpmhllalggoepniemh":{"blacklist":true},"chhniecmnighakmlnhkifeogjddhoajn":{"blacklist":true},"chlplighidmhpgmidehfmjfdlahakjog":{"blacklist":true},"cidnoinjdbalndcidafahfnoeehfblfl":{"blacklist":true},"cihlkpohodpdkdnfalhdkhhlhmhffmbe":{"blacklist":true},"cjhklhdjonhcohlacgggcbklpnldleck":{"blacklist":true},"cjohbbapkbkkhpohinffggbphnhoblea":{"blacklist":true},"ckckpgefkpjfopjppjfcikppehdhceah":{"blacklist":true},"ckphhghhpjbfddcgkpfbelfeojcciglo":{"blacklist":true},"clapnamcglekekmamicmbahkghdcjaeh":{"blacklist":true},"clfhanhcjmgjnbpjfopldmnabimhmcmp":{"blacklist":true},"cmjphjljejnfgdbkdgdlclaabimpknna":{"blacklist":true},"cmlokmkdolieoaoddlfhaidnlmiadhik":{"blacklist":true},"cmnfphnmpedeolmelllmgkghmjcnlajp":{"blacklist":true},"cnimdnlablahacgompaahbgohcokcclp":{"blacklist":true},"cniodhfhdiidogekcjkplecimemfocpn":{"blacklist":true},"coajchbkdbfhmhbgcjepiofllfjjcpfp":{"blacklist":true},"copjbedljgpkaakkmbhgkpoaadeahido":{"blacklist":true},"cpiiakoibaohkfoaijaigdnocfolnmll":{"blacklist":true},"dadcalgappognjbjpalfophhcfakoeac":{"blacklist":true},"danapgfidmepmcfbjjacceiaiiioieio":{"blacklist":true},"dbanhghadfmjndnjmmejdgfdmgidlbpm":{"blacklist":true},"dbiblcmlcgdjjbdpbmbcpineegngkiip":{"blacklist":true},"dbmdicehacbaohlockjgdglcobimmjkh":{"blacklist":true},"dcfefnkefopibnlcjhjcfegckhanekld":{"blacklist":true},"dcpjokbfgfnbaekphjgehhjaokkcifbj":{"blacklist":true},"dejippphmhbpgckbhdidnjmdcpfccbaj":{"blacklist":true},"deocpjmfifplhepinpkmpinpnbiemfje":{"blacklist":true},"deonbedlmakdddidplniclflladdjoep":{"blacklist":true},"dfafokiagoiocidlpglcanjkcdbdnioi":{"blacklist":true},"dfjhgoeofgmepmcngkhnaiphbhdbonhp":{"blacklist":true},"dfoegfajplmijblljfancdapbdaopebb":{"blacklist":true},"dgaehaeahdegbdlenicbmkbakhdgoeml":{"blacklist":true},"dgcfmgdfbfbgcpbendbhbkfjppboebed":{"blacklist":true},"dgkemngdheppgohkjjelnkjmdeimmfml":{"blacklist":true},"dhclobcklknojliojkkclgjndemadnig":{"blacklist":true},"dhdepfaagokllfmhfbcfmocaeigmoebo":{"blacklist":true},"dhmghpedmigfknfpolfmkihcaeiccjgf":{"blacklist":true},"dibljdngacjhpccjckmlmeklpgjeinjd":{"blacklist":true},"digmihafmlfkgdbjjdgbcojghcgcoeoa":{"blacklist":true},"diinokaoicgobepmadnmedlhdfnpehcj":{"blacklist":true},"dinhjcapnfbffhiihdlnbdfjdjjfhcbk":{"blacklist":true},"djjddbeligongockkakmbfdngdjdnagb":{"blacklist":true},"djnahdkbfgnhgpakidinfonfcjbagkgp":{"blacklist":true},"djpnjilhooodipllnjedjeiabkboakok":{"blacklist":true},"dkhkecikbdfpoiopnnpoeglbdphgflmf":{"blacklist":true},"dkpdmjefniplpkalcgnainfmmclllpnn":{"blacklist":true},"dlobhinihbmedmheccecfnkcadpehmbf":{"blacklist":true},"dlopielgodpjhkbapdlbbicpiefpaack":{"blacklist":true},"dmabikjmolgegjajdhmgpmgffajlmmkb":{"blacklist":true},"dmhgenmamfphbclmhdgmffajkfommkom":{"blacklist":true},"dmhjdbigobajgnfoabodjgmcdgoeoljm":{"blacklist":true},"dmkdhgkknhnfpdjeicefnpmhcpbimden":{"blacklist":true},"dnemhlkdpajbbniphgkgceplmnkfnhfo":{"blacklist":true},"doneghboglgnflpdicnkaojmmljgejkj":{"blacklist":true},"dpaphgcjeeochbiafgbochohgmpcmlbj":{"blacklist":true},"dpcdiabehkofdddfhdmkgkndjilfoppd":{"blacklist":true},"dpfanoongnoofcdhgijjdjmbnfekdejj":{"blacklist":true},"dpgenihgggagjjggfocjceeobjkadcbc":{"blacklist":true},"dpmloehicimdjkibmobhmpgdndgbcced":{"blacklist":true},"eagmciolnojfofmggkffclbonhleeank":{"blacklist":true},"ebdcdchjcndpjhehacedepnggfdbfkpn":{"blacklist":true},"ebhdpnhjbfkchfamjcpebpeddhhicnab":{"blacklist":true},"echjhfifjidfhoappglfmoffcpmpkigb":{"blacklist":true},"echngajnlpjeacbanjejlhcajjfoedcc":{"blacklist":true},"ecinfbhalenfhdhnljmkglajfjjfehoj":{"blacklist":true},"edmnikahahfkfilbbjbdoiabnghbkmjc":{"blacklist":true},"eemcgdkfndhakfknompkggombfjjjeno":{"active_permissions":{"api":["bookmarks","bookmarkManagerPrivate","metricsPrivate","systemPrivate","tabs"],"explicit_host":["chrome://favicon/*","chrome://resources/*"]},"creation_flags":1,"from_bookmark":false,"from_webstore":false,"install_time":"13009045149900947","location":5,"manifest":{"chrome_url_overrides":{"bookmarks":"main.html"},"content_security_policy":"object-src 'none'; script-src chrome://resources 'self'","description":"Bookmark Manager","incognito":"split","key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDQcByy+eN9jzazWF/DPn7NW47sW7lgmpk6eKc0BQM18q8hvEM3zNm2n7HkJv/R6fU+X5mtqkDuKvq5skF6qqUF4oEyaleWDFhd1xFwV7JV+/DU7bZ00w2+6gzqsabkerFpoP33ZRIw7OviJenP0c0uWqDWF8EGSyMhB3txqhOtiQIDAQAB","manifest_version":2,"name":"Bookmark Manager","permissions":["bookmarks","bookmarkManagerPrivate","systemPrivate","tabs","chrome://favicon/","chrome://resources/"],"version":"0.1"},"path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\25.0.1364.172\\resources\\bookmark_manager","was_installed_by_default":false},"efbeabpbbkahnnjalakldjfhljboclkf":{"blacklist":true},"efcnjdcimjmggfdkahncpoikhehcfgnh":{"blacklist":true},"efhjelcghjkfigiagdfbfilndaffpmdj":{"blacklist":true},"efnaljpgehfilpmkhobibbjceeeondmn":{"blacklist":true},"efonemhbokfedckpfpohpmcamfihnnlm":{"blacklist":true},"egljdhfnbjahogjahnigfnbpidlmdagi":{"blacklist":true},"ehgoiaffgjoinpkllmmnikghgpghnabc":{"blacklist":true},"ehmjnpjodmgeocfphkjjnheiheehcoid":{"blacklist":true},"ehomcoocpagnlcakcbecdaknmacmedld":{"blacklist":true},"eiflkkehgogioennialfbilppmegcpoa":{"blacklist":true},"eihjeehdobnpkonebmpanonopghepfle":{"blacklist":true},"eijbdinddjecmebnlienfoijpjjobkjh":{"blacklist":true},"einmhcleeonenkkldjlmhhcmgolhblhh":{"blacklist":true},"ejakhnjbomgngodiidgbkapjgbdckhnh":{"blacklist":true},"ejijgghlncnaphklndknkbkclebfboca":{"blacklist":true},"ejlekamipdcfcfpgfepjmklllbpeecaj":{"blacklist":true},"ekikoahmboikmmclhnijlmldpmleahnh":{"blacklist":true},"elcaigjcaijbfpjngaekbblphmfjdhfo":{"blacklist":true},"emcdpbapjmnjgoannclkongdfboaabho":{"blacklist":true},"ennkphjdgehloodpbhlhldgbnhmacadg":{"active_permissions":{"api":["app.currentWindowInternal","app.runtime","app.window"],"explicit_host":["chrome://settings-frame/*"]},"app_launcher_ordinal":"t","creation_flags":1,"events":["app.runtime.onLaunched"],"from_bookmark":false,"from_webstore":false,"install_time":"13015098119479299","location":5,"manifest":{"app":{"background":{"scripts":["settings_app.js"]}},"description":"Settings","display_in_launcher":false,"icons":{"128":"settings_app_icon_128.png","16":"settings_app_icon_16.png","32":"settings_app_icon_32.png","48":"settings_app_icon_48.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDoVDPGX6fvKPVVgc+gnkYlGqHuuapgFDyKhsy4z7UzRLO/95zXPv8h8e5EacqbAQJLUbP6DERH5jowyNEYVxq9GJyntJMwP1ejvoz/52hnY3CCGGCmttmKzzpp5zwLuq3iZf8bslwywfflNUYtaCFSDa0TtrBZz0aOPrAAd/AhNwIDAQAB","manifest_version":2,"name":"Settings","permissions":["chrome://settings-frame/"],"version":"0.2"},"page_ordinal":"n","path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\27.0.1453.110\\resources\\settings_app","running":false,"was_installed_by_default":false},"eofejpelggimkodeojpeojnbijgiglgh":{"blacklist":true},"eopmhecjnginkckggjmhombbopmkjpam":{"blacklist":true},"epbmnbdplhcomkedpjfceakddnbgfjmf":{"blacklist":true},"fafoohpbicgbcejffcplajonhhooddle":{"blacklist":true},"fakdahljemjliginkgdehfoocmjgloam":{"blacklist":true},"fbhiehmngojjcmljddjmgpmcockbccmo":{"blacklist":true},"fbjjhbijaiopkcdolheliknnjlkaekeb":{"blacklist":true},"fbmgoajoadbjhoachcdiplofcblaihdc":{"blacklist":true},"fbmimoidopbghbcmdmpkjaffffmcbmbg":{"blacklist":true},"fcfepemfihgibdacjlnlecebknaaepmj":{"blacklist":true},"fcijaeofmfihkldhkofkjoibdoeoflha":{"blacklist":true},"fclheclkknbgfndeahkfdomollhmfkcn":{"blacklist":true},"febmhchodibcbchcofonaamfglbjhggg":{"blacklist":true},"fekjidlkjnecepnlmdmjohmgpkdlbegi":{"blacklist":true},"ffgfbfakpcnngelphjnppokmoicdollk":{"blacklist":true},"fhlkffpjoajppmhcakbkjndbjfljccpi":{"blacklist":true},"fhpclkemjlhmbfbjakbmdjihocinkmim":{"blacklist":true},"fiapkdjniadkodmdibdnchoifkpfoiid":{"blacklist":true},"fibgploapkhokkbncddlkcmbmiengcfp":{"blacklist":true},"fihepkmlkmciffbhijldnpmifhbkiinp":{"blacklist":true},"fiiblakkkkgeljngobmpeljjapemenhi":{"blacklist":true},"fjhfnfakmfcejgmfkmnapemgblmehppf":{"blacklist":true},"fjjeecfjmgfnleghoellhldedkaocjfc":{"blacklist":true},"fjpofaghniailakahnhkjjfbfonpfglo":{"blacklist":true},"flalbhkmnijcnpialgakicllnabckmhi":{"blacklist":true},"fleljamdchegbjeiipbnmiebnhgheeld":{"blacklist":true},"flmmgcfcpbfddenepkfmgfpbaceolcoe":{"blacklist":true},"fmcccidacjgnfiafddkngmeolkoiihil":{"blacklist":true},"fmonlemffgbabjifjfaoamdflijecdbk":{"blacklist":true},"fngolbdmkneakeaoiieafkilnogbocda":{"blacklist":true},"fnhcgnmfccojojojacgeiaaeacefdohb":{"blacklist":true},"fnihpenllbnplcglabekelhhblcdndbb":{"blacklist":true},"fnkaadkanmfgpfbmdcllhjdgmdbgljpi":{"blacklist":true},"fnnmbghphdnmmjdapccfobgjemjadeli":{"blacklist":true},"fnoadkjdjfgafomgmablhmffooijcfbn":{"blacklist":true},"foenbafkkmajnmfnlcmejonkfaipdmme":{"blacklist":true},"folhciaicehdnoalhbkbgkakfcockopc":{"blacklist":true},"fomljmklmcefndkgpakgifbiiidgbjej":{"blacklist":true},"fommcgokigkhmnhlhlkckfjhefnmfohd":{"blacklist":true},"fopgndklnkecillfbdmfknhmadmenikm":{"blacklist":true},"fpbippbofbmgmbojjmgfcifpmdaelcmd":{"blacklist":true},"fpbkafpphnhlpakobppekmkebmbhkoco":{"blacklist":true},"fpjdackpllilinpkgmhkpidkanmccblc":{"blacklist":true},"fpmajanjndhgpifbcbnklbiehgnpkgmf":{"blacklist":true},"fpoajjnnpmledpmohlgpgbmlhbgkgahg":{"blacklist":true},"fpokembamndopkflopmplkklbdngnknd":{"blacklist":true},"gagalgomhifgcmeciklindhpaihmecgi":{"blacklist":true},"gaicmfjflflabagobdiodejfpjikheeo":{"blacklist":true},"gandihaiobadcggbfkhpbkocmiemjlnf":{"blacklist":true},"gbenikfjhilhpgagllmfgggdjaflbmbi":{"blacklist":true},"gchbiabnbdikkgfhnkclecjncojnkmhb":{"blacklist":true},"gdggdkkjecogagaffaemnbfmllcoihjp":{"blacklist":true},"gdlgbpbmiiagaikjbednkikinokbkbcb":{"blacklist":true},"geggofhlfbcmanadhknllmlajiafopoh":{"blacklist":true},"gekkhpjigmckhgmgngadbeknekgpgolb":{"blacklist":true},"gfjfhihpkmehdmblhfaikkipeplpdcla":{"blacklist":true},"gfmmoiakbmdohkgeoekiokjgljcminig":{"blacklist":true},"ggkpicnfnljflddbdoeeaajjgepapcbf":{"blacklist":true},"ghgphbmpcfgkfneodjpbdanmdoemklio":{"blacklist":true},"ghmaokcegalalefnhlfcnjhnpdbanjkj":{"blacklist":true},"gifglngcdbggmlgkcombebegdaoknkho":{"blacklist":true},"gjkbghdignnlcknknflbigpammebiolo":{"blacklist":true},"gjmhdmobkhfhkpfmfegnkkimlamjdldi":{"blacklist":true},"gkcfodgjdcijjlliehfhgohlkemcbobl":{"blacklist":true},"gkhbgnodbilglgholifcjdblbgdaieah":{"blacklist":true},"gkjeccpmibljcfpfapfljciimedljpnm":{"blacklist":true},"gkjmgdpdndoaiholejnmdbbpdaafahmm":{"blacklist":true},"gklphmokmaaepjgandocpneomjlidjag":{"blacklist":true},"glhhlafadlhkgbklgbjnmblfhnkfknbm":{"blacklist":true},"gmghjgfdialcnhadahmjefeflgnhcjeb":{"blacklist":true},"gnapdhmknipknfmhhnhdmhakdfhgeing":{"blacklist":true},"gncfgndgeoddelbfhlndhljnecoednaa":{"blacklist":true},"gngfmjidncdccdlfjcjbnngeaaclfgpl":{"blacklist":true},"gngmkbiihflpghldjnbpemaicedhdddk":{"blacklist":true},"gobjcjhhebpjbmjdgmejhebbleadnceo":{"blacklist":true},"goedioiidkokkbobdnopnlnaaalniegm":{"blacklist":true},"gomkbnfeifchddfokcicibjnlgbolhol":{"blacklist":true},"gompblemgafijijmlgbaepcijfgfgljf":{"blacklist":true},"gpdcodmabpgmncbkhpipakhehepmpopk":{"blacklist":true},"gpgehbjbkfhngdlfpfeokjgbkmmokjhe":{"blacklist":true},"gplgjmecjpbfcdikpbicknafcnfcidek":{"blacklist":true},"hbaajkahagmlkdekmbdabikbopdgpaac":{"blacklist":true},"hbdhabpmbbanaopgkbaondabkkepjfaf":{"blacklist":true},"hbmlheccjkodhfejcmblndjodllmnlnl":{"blacklist":true},"hcapokajkngndbglnfglpfdpoeidmpha":{"blacklist":true},"hcpndbchnlgojmnijaldkicigmihmdca":{"blacklist":true},"hdijkiondgomjpehfhopomicjbiodmcm":{"blacklist":true},"hdnbmmfjbblajkjkcaeofolgfnljpnim":{"blacklist":true},"hecijapnccjhonbmacmkmffooodfokoo":{"blacklist":true},"hefmoncdemhjembgbnkgglhlookbipdc":{"blacklist":true},"hfcgbiofoebieldldghfocjfnnajmpej":{"blacklist":true},"hfjpjodbolkmheaehcnmfhjakjileoof":{"blacklist":true},"hfpfbhnmbbigpmoodjemilggabklpopj":{"blacklist":true},"hgbaomphocgmdpmiohjclchaaljpaelp":{"blacklist":true},"hgboiaecclcbjphldpbgfgggcbihmnai":{"blacklist":true},"hgjgaeknhmidehalnmokomhpfhbfmpcm":{"blacklist":true},"hhbihfbjoifhhebcnchglobmkmapgjkm":{"blacklist":true},"hhfffemhgkginfafaoapljdllodppana":{"blacklist":true},"hhfiljkpjapjjphcocclhhaldpfkkjbi":{"blacklist":true},"hhjmkijkgojfifipdgmiemghfikbohcm":{"blacklist":true},"hhlgbfcfbkhlmajakkcjippgpcmejkko":{"blacklist":true},"hhommgjjeekpmpcbdmfnhpchijdkgaei":{"blacklist":true},"hilncbjbdpnfepdidfchmdclhpnlegpj":{"blacklist":true},"himgjpdejpikenoibmolgmfblolpahno":{"blacklist":true},"hjkhligcnpfjhjlapmejaiaiigibofif":{"blacklist":true},"hjnigaibahdeadcdnpnommdehajodlhc":{"blacklist":true},"hkbgccpdcpbdckohbknjlamamelcnlki":{"blacklist":true},"hkjcejgfmaanpncnpoidgbhoikcaeepd":{"blacklist":true},"hkjfdgjkgpbbdmadbglcgljjjddkcdha":{"blacklist":true},"hmmoglffhpmacaacfbbmbbkcbdkjphnc":{"blacklist":true},"hnbcdmfeoldeppcbnnjmjkdofohaljbn":{"blacklist":true},"hncomkjbbkchfjelocejkbbflmjhlhfp":{"blacklist":true},"hnipgljcblpgnnojcfldehpeknhakbgj":{"blacklist":true},"hnkcpoijaeegompjgbjjhkdmljldaccg":{"blacklist":true},"hnnebfeppcbhhbhiifeaajgcjnkljlld":{"blacklist":true},"hnonhhpgjnjcjfbkjdpfbkfpaodcmncb":{"blacklist":true},"hnpgphegniamplngojaffllhjahkgbfl":{"blacklist":true},"hpcdoodjfcmpcpkeendjnjkeinimhkih":{"blacklist":true},"hphibigbodkkohoglgfkddblldpfohjl":{"blacklist":true},"hpibmhghjndideebpackbdlpncgkcppp":{"blacklist":true},"iablioliielnhdianpbiijaoncbmfend":{"blacklist":true},"ibnhidklhjoopebonemhliklfbhndjjd":{"blacklist":true},"iccblehkchfmjgfafjcpjlkjcponhdhl":{"blacklist":true},"icihfeaofpcfehanhbnjigdlpfahjlee":{"blacklist":true},"idbdlnkdnaodonmgnimcfelpngbmcpjk":{"blacklist":true},"iedogbkombgmapifenoojnmpcnjighfm":{"blacklist":true},"iemfpgbdjfoihicbocpbjppipdbfimeh":{"blacklist":true},"ifbkndkaolfbjjhnnhfmkbkoclpdkpli":{"blacklist":true},"ifeijfpkjckedpclgncedmgdiaoeahmk":{"blacklist":true},"igaajdmlejbjcbmpmnigopikfdaccdcm":{"blacklist":true},"igbaoknfddliiaoimhehfbkfekpmmfll":{"blacklist":true},"igghanohiioehififjoalfkdoicafjof":{"blacklist":true},"iggjepemmdkieakihpomccndhdfcljdp":{"blacklist":true},"igjhgaoajaccjllfkfffboldnmncmhoh":{"blacklist":true},"igkdgkdiiolilocklmiolkpoohacojop":{"blacklist":true},"ihnembcpodnfgkafmiojebccomjekopm":{"blacklist":true},"iiiinekimabooeihccihfopoadcaaphn":{"blacklist":true},"ijecjbcgpblkacpijljpaienknanaloa":{"blacklist":true},"ijenlpgidnapbndonoinbkhekgjonojg":{"blacklist":true},"ijjmbbddenkbenbcfldgghhjgjmcnioo":{"blacklist":true},"ilhjicgcglhjigdehkcehjdokmkahbjl":{"blacklist":true},"iljfgjkppapinhcgonhjnipfppfmfedh":{"blacklist":true},"ilmknaabackgdbnkgbihgpgiopnlkjek":{"blacklist":true},"imfbomjbodpfgfhfahlgkkcllmhbelhk":{"blacklist":true},"imkffpjpdngdkpgadcmnlkhhmhdocijn":{"blacklist":true},"inbhlfpapeikbbgpfionabkigakepbbm":{"blacklist":true},"indfhnliadamglhalanplbajgenpjdml":{"blacklist":true},"iobnpmeeecphddicmhhmdjbnlbdhjlne":{"blacklist":true},"iomejadoamfilglofmeaffghddcgapmf":{"blacklist":true},"jabpdgllijbnknhkgjideeajfofafckp":{"blacklist":true},"jaejgaoiipdjjlbnapngknalafalbkej":{"blacklist":true},"jafnimahlamccccjbkhjjpeiipiedpik":{"blacklist":true},"janhdpmhnighonkkbkdpnljcoenpfkbh":{"blacklist":true},"jaoiiahdoamhobamdkmcmielddmnelko":{"blacklist":true},"jbfebbkjjmkcoldeaeelhpconkmgjhbg":{"blacklist":true},"jbmbiepnidbnhbbfdbgioomdkgnbcacj":{"blacklist":true},"jbnafcjbcfgejacaanogofkkehcomamp":{"blacklist":true},"jcmipejepoimfflnoapdmkdephgjinck":{"blacklist":true},"jddbdddmbfencninofcgnodekclofpaj":{"blacklist":true},"jdiakcmbpmcnniggjcmcjknnklpdlogc":{"blacklist":true},"jeehjhnmgohgpfpjneglogiholalkeip":{"blacklist":true},"jfalnphfjdoalcdhlnhdpekbmmopkgkj":{"blacklist":true},"jfhmafmjfdblceidmfdmoihamolaaeco":{"blacklist":true},"jfjagidcpadkoaonbogmbgfimmnefeie":{"blacklist":true},"jgdkappiifgomhgikcjbanhnmlekpeje":{"blacklist":true},"jgmpapdckakiohhebmeoemejibommimi":{"blacklist":true},"jgoljhcbgajhbhnchplgjdkknendhjnn":{"blacklist":true},"jhhabiomopkibeecgngiggmopkeofacl":{"blacklist":true},"jihmekmccilkocefjpejdebpapohlhjb":{"blacklist":true},"jiiccolbjkhpgockodneljpejdeaaodf":{"blacklist":true},"jindbcpkhnnnjgcjgmkjedbibibiojjf":{"blacklist":true},"jiofcofpcbijcnlpekdkpmgjdppajbjb":{"blacklist":true},"jjahldbngdicbnejidklgkienpkdcpba":{"blacklist":true},"jjhackoobdibnnndjopfjldbjmohkpdk":{"blacklist":true},"jjnkfllhcgkgnfbekpnmoikpfihpjfli":{"blacklist":true},"jkihmglffmfjedfbpbpdbbimcodjbmdh":{"blacklist":true},"jkkfmenldnihjkgnolhlakhaepomhoob":{"blacklist":true},"jkmhalpofmlfeglboejbchpoijnkmcgh":{"blacklist":true},"jljfnkmkkdkppfndippkedacgfkafped":{"blacklist":true},"jmbkhogpjgjpfjhpdikloblkbkljkgao":{"blacklist":true},"jmeanodbelbflfmnkfdjgpikmldgjjko":{"blacklist":true},"jmfkcklnlgedgbglfkkgedjfmejoahla":{"ack_external":true,"active_permissions":{"api":["plugin"],"scriptable_host":["hxxp://*/*","hxxps://*/*"]},"allowFileAccess":true,"disable_reasons":16,"from_bookmark":false,"from_webstore":false,"incognito":false,"install_time":"12992739489538502","lastpingday":"13018950029842000","location":3,"manifest":{"background_page":"background.html","content_scripts":[{"js":["content/jquery-1.4.4.min.js","content/avgls-inline.js","content/searchengine.js","content/searchshield.js"],"matches":["hxxp://*/*","hxxps://*/*"],"run_at":"document_start"}],"description":"Securing your clicks.","format_version":1,"icons":{"128":"content/Icons/128x128.png","16":"content/Icons/16x16.png","48":"content/Icons/48x48.png","64":"content/Icons/64x64.png"},"id":"881AC4EF96904f5fA0B49048C377CD59E8A84102","key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrH3sthUrxOpfC3hPSHs4tIWO24/z8ZQCH5oHRTRkwgdSZ7/ah1PgRHQeNkTYJT0bwLQoxsG1jBLvWLu4I9t3KCTXj0uanaCw7VJjmSIPQCip/1m7ewfS9XdPR9CSUkR2wwp8HeDryToyCINwP8Yg3Lws/FV0nGmF2IV8jpQ6OWQIDAQAB","minimum_chrome_version":"9","name":"AVG Safe Search","plugins":[{"path":"plugins/avgnpss.dll","public":true}],"version":"12.0.0.2210"},"path":"jmfkcklnlgedgbglfkkgedjfmejoahla\\12.0.0.2210_0","state":0},"jmifipgdcllamghkhdplfjffkciekbgo":{"blacklist":true},"jnehbnhjkefckoljkcmjfgkkeejhipgi":{"blacklist":true},"jokbafidjfknjbchmcakabjgdiiacgek":{"blacklist":true},"jolgdmpdhloiienhblmiimamomhdphlk":{"blacklist":true},"jpehgolpfgnknboibogccapmdcadjkbd":{"blacklist":true},"jpeijjbllejgmokmahkeommcodahoobm":{"blacklist":true},"jpgidahfcgiajlcbleeiaibpmmblcmnb":{"blacklist":true},"jpiedgcdjigcoeagojmlokclbljokpon":{"blacklist":true},"jpkdlckejfjidmplieobnhijmoiecbhl":{"blacklist":true},"kbipembkfhbdmkkkfbigmohilmknjnof":{"blacklist":true},"kbmkecfipofebpaikgifajmahdmadlnb":{"blacklist":true},"kcanfkmhccbaheheaackijegkclkaeic":{"blacklist":true},"kcfnnanmpghdnoompcfclakpacapnfbn":{"blacklist":true},"kcgplbmkmfcpngilmhjmebdgkkpbdemp":{"blacklist":true},"kcmnkpehkjhodoodchlmgnicaifckhdj":{"blacklist":true},"kdchmeaiapjkejkcbeclgjklemecieeg":{"blacklist":true},"kdcnnmifdmlmjffdgeieikcokcogpbej":{"blacklist":true},"kdfahjokahcbmecgaandpobmgiiknagf":{"blacklist":true},"kdicckonacionpoompfoopggkgimjpcb":{"blacklist":true},"kdjhalklkkcmodeicjiaekcgifkcepaf":{"blacklist":true},"kdpcgcpfnkolljkhgdbbgimplfkhakec":{"blacklist":true},"keknhkokjnjhgpcofobpcbelddppeolp":{"blacklist":true},"kelcbonmemlciepjdmfcifnhloeammhj":{"blacklist":true},"kelljdoinjlkmkncffgadbebgpmlcang":{"blacklist":true},"keoimpnicgbcjamfdgpcecihicnbmhej":{"blacklist":true},"kffhenjbibjnbnjhlkcdlmpeccpaohio":{"blacklist":true},"kfodnkhdfdgeaegehjjnkjkieloddelg":{"blacklist":true},"kgbkdabomfdpfoibliicpmibceaoohgh":{"blacklist":true},"kgbmmcjgkkecjcafigegjphkmkdpnggo":{"blacklist":true},"kgdhnhadbnpeibkghaebmhmngobdafag":{"blacklist":true},"kgdkcodealpfjolmiagcogfbgmaamegh":{"blacklist":true},"kgdmldjagfciieddcnlhampgkajkpanc":{"blacklist":true},"khgjomcpjblpoaipanicbfjfgcfbpegp":{"blacklist":true},"kibgmcdcfmcglajcfbecilngejnfppjp":{"blacklist":true},"kiipngoehgkgkackngaidmhmnchfbmio":{"blacklist":true},"kincjchfokkeneeofpeefomkikfkiedl":{"blacklist":true},"kinhljbhjmcmoddhdoodekeklmjapjff":{"blacklist":true},"kkhejjmlcfbcleolhadhekjbcanoopna":{"blacklist":true},"kkhomejdleoonmbdhcigkhkjcghngncf":{"blacklist":true},"kkkeikdkpjenmoiicggnnodbkebafgpc":{"blacklist":true},"kleaapgdkahaekcocmkbgfainbhihccj":{"blacklist":true},"kljhmdlkclaglodecegamnpioaflmage":{"blacklist":true},"kmlebjoghkhpapfhbdikannggmmffnco":{"blacklist":true},"kojkdbedffnppdoalcfkkeelbhbklhgp":{"blacklist":true},"kolbbghckjilleabphhgeggcgpfidofi":{"blacklist":true},"kpbfifeiomkhocgkkffocfinoedcjebg":{"blacklist":true},"laicaenbonaajhkmfhhbpiapobdieffm":{"blacklist":true},"lambangeielkjcnmioccboaphdfcffib":{"blacklist":true},"lbaddolhebpnhdcdkicpcflhnfamcemn":{"blacklist":true},"lbcmmpmjjaockhkcofljpakjcbmjmgla":{"blacklist":true},"lbficnmfealeidppcbgdcbemgfjodbkg":{"blacklist":true},"lcbfjcekjncehfbcimlogajbekmoeblm":{"blacklist":true},"lcccggoiffkhgfkefgbicjdgdnfpoihn":{"blacklist":true},"lceaiepehinnomgijphkmjccbigkljkj":{"blacklist":true},"lcfkojlnjnedeoepfemhdgkhiabkeadc":{"blacklist":true},"lcmpleboacinanffcdgenhhbkboclkjb":{"blacklist":true},"ldgfapfmnplpaohbbadnecegcpfkfall":{"blacklist":true},"ldmoahefokhfelhpbgfjpelcdbahdofk":{"blacklist":true},"leccghfplhenabeogpibljliijgapfgb":{"blacklist":true},"lfechjkgjjijfjoandhakaghdeimjcod":{"blacklist":true},"lfggokjjaanlfikbbapgnfemifmddalf":{"blacklist":true},"lgalokbapphhklmilicdefmgbjkcmldf":{"blacklist":true},"lgcnahanhlfpceencjmlehpfklokhojk":{"blacklist":true},"lhajoamjgchgljkdjigcgmmcehjkagan":{"blacklist":true},"lhgbajoidigcpmgbnnonllfkndhahmie":{"blacklist":true},"likifpgnijjfbdegfepoalpamlgnfofi":{"blacklist":true},"liomofjeffddiiccaolcnllbhnipbkhe":{"blacklist":true},"ljcicfibknpmlcmcecddjlbgkejehhpa":{"blacklist":true},"ljeihpebkahejeacdalhkhmckmggppif":{"blacklist":true},"ljlppmpjdogefnanekncklkjgpnhpcpd":{"blacklist":true},"ljmjoloiepllcndinchenhomcdcgbgef":{"blacklist":true},"lkdimamelhbiijkiljlnedmhnnkkmlbl":{"blacklist":true},"lkfdchejjogilmloogbbjlnlpbhgjfab":{"blacklist":true},"lkhcbijhgfchgdmklonlobkfbcadbokg":{"blacklist":true},"lljnngafekbnkpdfophmcdlbfebcbcld":{"blacklist":true},"lmhdacagnmfmomeodbgmlghejdbmldge":{"blacklist":true},"lnahlgmhpghkhmafjppdidhcoaomipfg":{"blacklist":true},"lnbeebaenahmkbffnimghceldeeihfak":{"blacklist":true},"lncjcfkpannmofmpgdfoonkniofdnaba":{"blacklist":true},"lndempehphjoeimfchjflohpmhamiamf":{"blacklist":true},"lnjgjionmhobdfdegbciceafphgemjnc":{"blacklist":true},"lnlaeblencbjjjeaanegaldcjfekeled":{"blacklist":true},"lodollblmkailkkdiijmoccefdfjohgk":{"blacklist":true},"loggadfheaoeabmkgolecncpfdfioefa":{"blacklist":true},"lojppnndedobolgfepahepphhloediji":{"blacklist":true},"loldehkdjdncebfnncknlkdchjclifbn":{"blacklist":true},"lookpbabilcplifjdeifacodednpacmk":{"blacklist":true},"lpgiafapdmlapiokjnmpbbfkomiceoml":{"blacklist":true},"lplmcpcnhpbffpcfiaddbeaplhhbengd":{"blacklist":true},"maakimnachffhlgdhfomaejeeaikgjap":{"blacklist":true},"mafccdbbhekjhemajjejkaidndokeena":{"blacklist":true},"magllcifjcllaafcdplnajmobccbcdlo":{"blacklist":true},"mamfageekafifnickhgkibkofcclfefe":{"blacklist":true},"mandondadnlimicalgkbkaohmeopdojj":{"blacklist":true},"mbifidpgmfiielflaipknojhpfcljmgo":{"blacklist":true},"mbmdaiddhfoljplpdhohimgieioblfif":{"blacklist":true},"mcbkimglepddodbiongpohpeidioafgk":{"blacklist":true},"mcknnlhkkdbcppajgefagceglahcafjd":{"blacklist":true},"mdiehnlecbjlppbpaaipmlnhhjgepfcg":{"blacklist":true},"mdngbiejioalifclonjepjjfppmbgned":{"blacklist":true},"megkcfpbmemnpkgadkoompnoajcolpni":{"blacklist":true},"mfehgcgbbipciphmccgaenjidiccnmng":{"active_permissions":{"api":["cloudPrintPrivate"]},"creation_flags":1,"from_bookmark":false,"from_webstore":false,"install_time":"13009045149932947","location":5,"manifest":{"app":{"launch":{"web_url":"hxxps://www.google.com/cloudprint"},"urls":["hxxps://www.google.com/cloudprint","hxxps://www.google.com/cloudprint/enable_chrome_connector"]},"description":"Cloud Print","display_in_launcher":false,"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDqOhnwk4+HXVfGyaNsAQdU/js1Na56diW08oF1MhZiwzSnJsEaeuMN9od9q9N4ZdK3o1xXOSARrYdE+syV7Dl31nf6qz3A6K+D5NHe6sSB9yvYlIiN37jdWdrfxxE0pRYEVYZNTe3bzq3NkcYJlOdt1UPcpJB+isXpAGUKUvt7EQIDAQAB","name":"Cloud Print","permissions":["cloudPrintPrivate"],"version":"0.1"},"path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\25.0.1364.172\\resources\\cloud_print","was_installed_by_default":false},"mfffdpnblflpobcnekhekiahepofaane":{"blacklist":true},"mfgkkephjfnkggbmahehnjhdcmkioaff":{"blacklist":true},"mfhfkclojmdocagbmecgcnlofppebebd":{"blacklist":true},"mfncimdpmknolnnnccdmkpnpkaofonkc":{"blacklist":true},"mfooalpniplhaaealemjpchkchmmgdko":{"blacklist":true},"mgdgiplcofghdmpekdeeceolepakodcb":{"blacklist":true},"mgndgikekgjfcpckkfioiadnlibdjbkf":{"app_launcher_ordinal":"t","creation_flags":1,"from_bookmark":false,"from_webstore":false,"install_time":"13009228196902240","location":5,"manifest":{"app":{"launch":{"web_url":"hxxp://THIS-WILL-BE-REPLACED"}},"description":"Chrome as an app","display_in_launcher":true,"display_in_new_tab_page":false,"icons":{"128":"product_logo_128.png","16":"product_logo_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDNuYLEQ1QPMcc5HfWI/9jiEf6FdJWqEtgRmIeI7qtjPLBM5oje+Ny2E2mTAhou5qdJiO2CHWdU1DQXY2F7Zu2gZaKZgHLfK4WimHxUT5Xd9/aro/R9PCzjguM1BLusiWYc9xlj1IsZpyiN1hcjU7SCnBhv1feQlv2WSB5KRiXwhQIDAQAB","name":"Chrome","version":"0.1"},"page_ordinal":"n","path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\26.0.1410.43\\resources\\chrome_app","was_installed_by_default":false},"mhbffdldpckobeihgebaamjalehefnia":{"blacklist":true},"mhldlgmggplfkkjgpgjjpebflplpgekg":{"blacklist":true},"mickhiflmjglhpdpfigpkpjiipfdlphj":{"blacklist":true},"mikpklndmiopinkkmalgoophegfnmmfh":{"blacklist":true},"mjalegijammcloleihdmooifidcjggjp":{"blacklist":true},"mjgobkikdipfikmaoakdcdbicpioljgg":{"blacklist":true},"mjheggmdlcjcpogghlofgpmgdfpigpia":{"active_permissions":{"api":["cookies","tabs"],"explicit_host":["hxxps://*.xpon.us/*"]},"creation_flags":9,"events":["browserAction.onClicked","runtime.onInstalled"],"from_bookmark":false,"from_webstore":true,"granted_permissions":{"api":["cookies","tabs"],"explicit_host":["hxxps://*.xpon.us/*"]},"install_time":"13012857417734817","lastpingday":"13018950029842000","location":1,"manifest":{"background":{"persistent":false,"scripts":["js/jquery-1.8.2.min.js","js/jquery.iframe-transport.js","background.js"]},"browser_action":{"default_icon":"HRB_16x16.png"},"content_security_policy":"script-src 'self' 'unsafe-eval' hxxps://*.xpon.us/; object-src 'self'","description":"powered by Expion","icons":{"128":"HRB_128x128.png","16":"HRB_16x16.png","48":"HRB_48x48.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCexUe9JQ3IAwvDNOkuCivczen7CRVu5oxTQbrM5lbHKaxhaFbyCvQe82pjsRK08aJJWe8kfhUIMDDSw7VSfDJEpAHmqoBfbaYMByX9/OAf09FW5fRTfatrkKer5mNl5kAFfo+oC5AIaIXtU3hQ1gcCGvB+XUf4UWMAG/SX0v9WEQIDAQAB","manifest_version":2,"name":"H&R Block Publisher","permissions":["tabs","cookies","hxxps://*.xpon.us/"],"update_url":"hxxps://clients2.google.com/service/update2/crx","version":"2.0.2"},"path":"mjheggmdlcjcpogghlofgpmgdfpigpia\\2.0.2_0","state":1,"was_installed_by_default":false},"mjhlngjakabhonjagnlimeicooahajpl":{"blacklist":true},"mjolnadmlahbpepjaemohnkhpjkbhmef":{"blacklist":true},"mknjbohhleiicbpagpgmhoaigbblmnic":{"blacklist":true},"mkobblpffgbncfhijabakfafmkjdmmnm":{"blacklist":true},"mlmegahemifabfmdnndafagnncfbnahn":{"blacklist":true},"mlmmbepkgelpbenpobinockmiehdahai":{"blacklist":true},"mlnndjkcclbekgoebkenkdgiggaomaed":{"blacklist":true},"mlnoedbhndgbjcbeadjfnmjloejlgojk":{"blacklist":true},"mmjodihhmnpkldljaifiajmlnpflfhpm":{"blacklist":true},"mndoohjdoechinpkfbkolflbonciahfo":{"blacklist":true},"mnhcgaghminpdabllkbkecahjfkdiabk":{"blacklist":true},"mnichagcickblneeijmfnmoiakigmmhf":{"blacklist":true},"mnllienogacopjnkmhgnniopjpgjpopp":{"blacklist":true},"mogepbcllienegdibkfpmombhefhcoic":{"blacklist":true},"mokdlfbphidpiopnlfejpcmadcbomckn":{"blacklist":true},"mpcglemopeoeapmagdbeenepkdbajape":{"blacklist":true},"mpgehpkneknbopplhmmkfijfiniddipf":{"blacklist":true},"mplhbhmkccidaokcelbcbcmhhedebcng":{"blacklist":true},"mplpabdbfbloeiboikmdbnggfnjbjmlh":{"blacklist":true},"naopgnjebjeeedbbhcadkhkmeefmloho":{"blacklist":true},"nbfcehkihbmpebblmfkihadebllgfmgl":{"blacklist":true},"nbieffehfdniifkgdckbndjhojohbfjj":{"blacklist":true},"nbjnehjmelkfjggedillcpjeelfnempb":{"blacklist":true},"nckmikohoilfkcoahbjpbgbpegcjgngm":{"blacklist":true},"ncpdanjmicnihdlijomcggnnekloephc":{"blacklist":true},"ndhkiimgbjnendpcfbiadlifmangejoa":{"blacklist":true},"ndibdjnfmopecpmkdieinmbadjfpblof":{"ack_external":true,"active_permissions":{"api":["browsingData","cookies","history","management","plugin","tabs","unlimitedStorage","webNavigation","webRequest","webRequestBlocking","webRequestInternal"],"explicit_host":["\u003Call_urls\u003E","chrome://favicon/*","hxxp://dnt.cloud.avg.com/*","hxxp://dntf.cloud.avg.com/*"],"scriptable_host":["\u003Call_urls\u003E","hxxp://toolbar.avg.com/*"]},"creation_flags":1,"disable_reasons":16,"from_bookmark":false,"from_webstore":false,"install_time":"13018718289201494","lastpingday":"13018950029842000","location":3,"manifest":{"background":{"page":"content/background.html"},"browser_action":{"default_icon":"content/icons/logoAVG.png","default_title":"AVG Do Not Track"},"content_scripts":[{"all_frames":false,"js":["content/js/content.js"],"matches":["\u003Call_urls\u003E"],"run_at":"document_end"},{"js":["content/js/ntinject.js"],"matches":["hxxp://toolbar.avg.com/*"]},{"all_frames":true,"js":["content/bho/bho-content.js"],"matches":["\u003Call_urls\u003E"],"run_at":"document_end"}],"content_security_policy":"script-src 'self' 'unsafe-eval'; object-src 'self'","current_locale":"en_US","default_locale":"en","description":"AVG Security Toolbar","icons":{"128":"content/icons/128-AVG-logo.png","16":"content/icons/16-AVG-logo.png","48":"content/icons/48-AVG-logo.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDaBhCcd8V6V8SwALoaT+A51wnypeg3PtHPFZ6/1OKPFykl5ejJUJj4iBdO6hwupZS9r69OFb9AF0NPAxXqMfuh/mVqguifgJiqVV7tLaQ5tGAIy0pACKYaTICVePngldEIu1VNSf8A+YoQIt0LL7arZL5E/0iIoqX4Yd04Q8X2HwIDAQAB","manifest_version":2,"name":"AVG Security Toolbar","options_page":"content/options.html","permissions":["\u003Call_urls\u003E","tabs","webNavigation","unlimitedStorage","cookies","management","plugin","webRequest","webRequestBlocking","hxxp://dnt.cloud.avg.com/","hxxp://dntf.cloud.avg.com/","browsingData","history"],"sandbox":{"pages":["content/bho/bho-sandbox.html"]},"version":"15.3.0.11"},"path":"ndibdjnfmopecpmkdieinmbadjfpblof\\15.3.0.11_0","state":0,"was_installed_by_default":false},"ndiogongcmocdgjciemhagfhpjamehpe":{"blacklist":true},"negkalblfongjbphdcbbhddlickhlamd":{"blacklist":true},"nepfiodmbijheamafkiglonfkjebdjmf":{"blacklist":true},"nfecfkjnlkbphobjbcnphimihniieehc":{"blacklist":true},"nhbfbnmmdjkjahhfdeklgphihfodfgnb":{"blacklist":true},"nhboiakpmibkbkbeehchlfkggmhphpnk":{"blacklist":true},"nhkmojkfnknbbmhbnacjdlodokeophkl":{"blacklist":true},"nhooocacdhkpbmoocdclodjlddcebfoe":{"blacklist":true},"nibohffepnilngkecenfdgnokfhmnkod":{"blacklist":true},"nidmbljkkcbdfklgdkklgjgmhejmbojn":{"blacklist":true},"nidodbfomffkfabciljelkbdiabkeehe":{"blacklist":true},"nifbebeekindefklojhchehidpikbjfc":{"blacklist":true},"nihhbeikpchdddoillfdcdinnnnllmna":{"blacklist":true},"nlefocohkhlgmjdhgkjgdodobmffjbod":{"blacklist":true},"nlgapikcofpablcmfgaoodlhiejiehhh":{"blacklist":true},"nloaaepkhcnmoakooihnefhhggbmemed":{"blacklist":true},"nmgpbidjnaebdlbdbpjggenmbaolmfoi":{"blacklist":true},"nmmnodocfckpoddcgihiihcdinaonckb":{"blacklist":true},"nmphbnbmgfccfhcmibikmhcgajjpelpf":{"blacklist":true},"nnioepmjbjjlflmdgjanlcmbjahljeeo":{"blacklist":true},"nochkknnbahbhmmknnmdhagelcnfagom":{"blacklist":true},"noefghcilkpcabnhhilojimkkjplhcnd":{"blacklist":true},"npadaghbcdejfngcjpbnoikajdnongca":{"blacklist":true},"npfpmgjnfcklmaipcffpjhapedmpjggj":{"blacklist":true},"npolaghondefgiomhkbiiompikfjneep":{"blacklist":true},"oafccdmmjdpialdmgenjfhijoondgncj":{"blacklist":true},"oakhllhnbcpgagdafgbninlpjdemdmjk":{"blacklist":true},"oanjogmonneelfpnfmdlalfddkeckdej":{"blacklist":true},"obfnipbbnnhkbafmdbbfpgfgbjmmkgpm":{"blacklist":true},"obgljnmbldahelaakfdbjkplokjoneip":{"blacklist":true},"obhplmafmpmelgapjjbfhcdkicnhakhf":{"blacklist":true},"oblicopoaionpjoapgjmmoncjadpdioh":{"blacklist":true},"ochmdkhojipfibbplgpeeggeimnagcfd":{"blacklist":true},"ocmhjnhildbnglmlfimkjnnfgddelacb":{"blacklist":true},"ocnlnkjmfnolmbclblfhfhcakldceiec":{"blacklist":true},"odeckaficnaplobiiaomegfbokokehhb":{"blacklist":true},"odefpckfdnfkeandbeccopcpncnbkonn":{"blacklist":true},"odnamglmogfldajnhkfodmloofeokcmm":{"blacklist":true},"oebmjchahlpmalnjpeagiibojcbfmema":{"blacklist":true},"oelhhkgiajkjfbccafjgggcpkbkjgpij":{"blacklist":true},"oghphhcagopecifjblgdcfihjnlcbcfc":{"blacklist":true},"ogjbodghhojomghbdfnlkppdagkfjede":{"blacklist":true},"oidjdpbndkjhmhmgdoggibcjnippkcgo":{"blacklist":true},"oilfokmpgejhjhecdjjpikloibggpenf":{"blacklist":true},"oimplfccampifgkgndlamabnkcibkngc":{"blacklist":true},"ojglppmhgfohhfeinlhklglifnbfebak":{"blacklist":true},"ojmdhklabgbnnkkilmkcfcemdhognifc":{"blacklist":true},"omceiakkomngangmllpgbjcoeloglald":{"blacklist":true},"omnicnmbagoinlpamknknbcgopadcoci":{"blacklist":true},"oncmkbmjpjlihkpbohlpmjghiiogmoie":{"blacklist":true},"onfbaaifbbahonepmednhkjbhdgogkbl":{"blacklist":true},"onjaecbdddgibdijafoemfiachlbcgkj":{"blacklist":true},"onpnpccdagncipgnoofbhchlbajcjnkd":{"blacklist":true},"oocfbmollajebjjpkahmlnclfhkjijea":{"blacklist":true},"ookcgejbfhcmcanfkfmmmpahflnlajbl":{"blacklist":true},"oomelpjfeldbopnleifpjibbpekflhlg":{"blacklist":true},"opnnngnphijodjhemhdafpnnpdjggofe":{"blacklist":true},"painakdmkedalbggbejpphgjikkmafhc":{"blacklist":true},"pajgiddgjidlcajihkjoacjbplimkgfe":{"blacklist":true},"pbdgmppmccanplobanhfkjndjkmmabgk":{"blacklist":true},"pbekednmpdekknlffkiopooofokfmkla":{"blacklist":true},"pbglijbamgmlcpnnpbfjkbdeheejjloj":{"blacklist":true},"pbipaboekjdfhkfifpkofbfnpbnlolji":{"blacklist":true},"pcaedgdgamlfffkfblocmakhgieggoak":{"blacklist":true},"pcojpoljjgnicbhaffkiphphplijgbcc":{"blacklist":true},"pdhjoamffhjhlkiiminjhmihalkfjaee":{"blacklist":true},"peahabnpipmmfiajjjhgfggbeigbmbgp":{"blacklist":true},"peiijdmlgbelnnmnkighhkpeihmmamio":{"blacklist":true},"pfaooklcbjnkgconjjepimkohgcjmdji":{"blacklist":true},"pfcelnbmkeoaeicedjomcjkcammlkdbk":{"blacklist":true},"pfckhplmfbblecglndaigpojefidapai":{"blacklist":true},"pfgmgcnbngcnhjddppmnloflcidemopc":{"blacklist":true},"pfhlnanelpgjbhndafjamnpfhkjadoip":{"blacklist":true},"pfoiaildicnbcjojocjlpcibenphhbln":{"blacklist":true},"pfonklmafadkmcedjlodommcoipgbcde":{"blacklist":true},"pgelifedkjaohmjehecojkfldinjlamn":{"blacklist":true},"pgjpnfpidejcmjibaaohcmehfohacckf":{"blacklist":true},"pgkcfihepeihdlfphbndagmompiakeci":{"blacklist":true},"pgldfhecfiofkhnbgcncepnkjkeoahlk":{"blacklist":true},"pgmfkblbflahhponhjmkcnpjinenhlnc":{"blacklist":true},"pgmpnhbchhaningbkefchpdalnimjijd":{"blacklist":true},"phkpgooenaonkpnabopdbjjfmphclela":{"blacklist":true},"pihcfdffalbcnmbghijdfcaanagapelf":{"blacklist":true},"pjdhkkcnlbfebiokpeghfffajaabahfo":{"blacklist":true},"pjgbfgdpkbfimabdalhjmmeeelbmkcac":{"blacklist":true},"pjloefkigphblpjminnlpbhjchjafcfc":{"blacklist":true},"pkbbbncikcipejaiiiioboongndhmjgl":{"blacklist":true},"pkbkgagehkkoajkpgnmjegibihpalfdk":{"blacklist":true},"pkbkkendemaimikinaefldfljliecapm":{"blacklist":true},"pkcbihpffghlanbclfmkegjmbijcpobj":{"blacklist":true},"pkdlpbfmpolnhligegklimbccminkioc":{"blacklist":true},"pkhidkonipdjidjglnkfcfhnkfnlefbk":{"blacklist":true},"plfijddblbcdcnammpdmfccchkbdekmm":{"blacklist":true},"pmbjemmaclljifpmnlagkcgpbcipdldb":{"blacklist":true},"pnaaalnkbgjaphhmahecamecmaldknkc":{"blacklist":true},"pnaiiipilbpcceggeanphcpkkihnojan":{"blacklist":true},"pndadpldhngimdmhnajebjldbmcbpjol":{"blacklist":true},"pnnbdjcjeiobikdfikegpclkcimgafpp":{"blacklist":true},"pnpfkfanlgljpkpilhgiimfadggfmhcd":{"blacklist":true},"pnpgiaejfbdapllkchhgchjpdbcpiooa":{"blacklist":true},"pobponmhkpmphbnfhpjdagklbkmjhked":{"blacklist":true},"ppmfajacidhcjbddpgmcmigffpppcadd":{"blacklist":true},"nemfjadlboooiffmcelkafilagddogim":{"ack_external":true}},"sideload_wipeout_bubble_shown":3,"sideload_wipeout_done":true,"toolbar":["mjheggmdlcjcpogghlofgpmgdfpigpia"],"toolbarsize":-1},"google":{"services":{"username":""}},"homepage":"hxxp://search.conduit.com/?ctid=CT3289663&SearchSource=48&CUI=UN29274371401431325&UM=2","homepage_is_newtabpage":false,"hxxp_throttling":{"enabled":true},"instant":{"enabled_time":"12976112049190585"},"net":{"hxxp_server_properties":{"servers":{"1295336.fls.doubleclick.net:443":{"supports_spdy":true},"1384245.fls.doubleclick.net:443":{"supports_spdy":true},"accounts.google.com:443":{"supports_spdy":true},"ad.doubleclick.net:443":{"supports_spdy":true},"ajax.googleapis.com:443":{"supports_spdy":true},"apis.google.com:443":{"settings":{"4":100},"supports_spdy":true},"chrome.google.com:443":{"supports_spdy":true},"clients1.google.com:443":{"supports_spdy":true},"clients2.google.com:443":{"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"clients2.googleusercontent.com:443":{"supports_spdy":true},"cm.g.doubleclick.net:443":{"supports_spdy":true},"csi.gstatic.com:443":{"supports_spdy":true},"encrypted-tbn2.gstatic.com:443":{"supports_spdy":true},"fls.doubleclick.net:443":{"supports_spdy":true},"fonts.googleapis.com:443":{"supports_spdy":true},"googleads.g.doubleclick.net:443":{"supports_spdy":true},"graph.facebook.com:443":{"supports_spdy":true},"id.google.com:443":{"supports_spdy":true},"lh3.googleusercontent.com:443":{"supports_spdy":true},"lh4.googleusercontent.com:443":{"supports_spdy":true},"lh5.googleusercontent.com:443":{"supports_spdy":true},"maps.gstatic.com:443":{"supports_spdy":true},"plus.google.com:443":{"supports_spdy":true},"plusone.google.com:443":{"supports_spdy":true},"profile-a.xx.fbcdn.net:443":{"supports_spdy":true},"r.twimg.com:443":{"supports_spdy":true},"ssl.google-analytics.com:443":{"supports_spdy":true},"ssl.gstatic.com:443":{"settings":{"4":100},"supports_spdy":true},"static.getclicky.com:443":{"supports_spdy":true},"themes.googleusercontent.com:443":{"supports_spdy":true},"tpc.googlesyndication.com:443":{"supports_spdy":true},"twitter.com:443":{"supports_spdy":true},"www.facebook.com:443":{"supports_spdy":true},"www.google-analytics.com:443":{"supports_spdy":true},"www.google.com:443":{"settings":{"4":100,"5":32,"6":0},"supports_spdy":true},"www.googleadservices.com:443":{"supports_spdy":true},"www.googleapis.com:443":{"supports_spdy":true},"www.googlecommerce.com:443":{"supports_spdy":true},"www.gstatic.com:443":{"supports_spdy":true}},"version":1}},"ntp":{"app_page_names":["Apps"],"pref_version":3,"shown_sections":64,"sign_in_promo":{"group":83,"group_max":100},"webstore_last_promo_id":"1257606"},"plugins":{"enabled_internal_pdf3":true,"enabled_nacl":true,"last_internal_directory":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\28.0.1500.72","migrated_to_pepper_flash":true,"plugins_list":[{"enabled":true,"name":"Remoting Viewer","path":"internal-remoting-viewer","version":""},{"enabled":true,"name":"Remoting Viewer"},{"enabled":true,"name":"Native Client","path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\28.0.1500.72\\ppGoogleNaClPluginChrome.dll","version":""},{"enabled":true,"name":"Native Client"},{"enabled":true,"name":"Chrome PDF Viewer","path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\28.0.1500.72\\pdf.dll","version":""},{"enabled":true,"name":"Chrome PDF Viewer"},{"enabled":true,"name":"Shockwave Flash","path":"C:\\Program Files (x86)\\Google\\Chrome\\Application\\28.0.1500.72\\gcswf32.dll","version":"11,1,102,63"},{"enabled":true,"name":"Shockwave Flash","path":"C:\\windows\\SysWOW64\\Macromed\\Flash\\NPSWF32.dll","version":"10,3,181,34"},{"enabled":true,"name":"Flash"},{"enabled":true,"name":"AVG Internet Security","path":"C:\\Users\\Lori\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\jmfkcklnlgedgbglfkkgedjfmejoahla\\12.0.0.1901_0\\plugins/avgnpss.dll","version":"12.0.0.1901"},{"enabled":true,"name":"AVG Internet Security"},{"enabled":true,"name":"Norton Confidential","path":"C:\\Users\\Lori\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\mkfokfffehpeedafpekjeddnmnjhmcmk\\2012.1.0.30_0\\npcoplgn.dll","version":"2012.1.0.30"},{"enabled":true,"name":"Norton Confidential"},{"enabled":false,"name":"Adobe Acrobat","path":"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.dll","version":"10.0.0.396"},{"enabled":false,"name":"Adobe Acrobat"},{"enabled":true,"name":"Java Deployment Toolkit 6.0.250.6","path":"C:\\Program Files (x86)\\Java\\jre6\\bin\\new_plugin\\npdeployJava1.dll","version":"6.0.250.6"},{"enabled":true,"name":"Java™ Platform SE 6 U25","path":"C:\\Program Files (x86)\\Java\\jre6\\bin\\new_plugin\\npjp2.dll","version":"6.0.250.6"},{"enabled":true,"name":"Java"},{"enabled":true,"name":"Microsoft Office 2010","path":"C:\\PROGRA~2\\MICROS~3\\Office14\\NPAUTHZ.DLL","version":"14.0.4730.1010"},{"enabled":true,"name":"Microsoft Office 2010","path":"C:\\PROGRA~2\\MICROS~3\\Office14\\NPSPWRAP.DLL","version":"14.0.4761.1000"},{"enabled":true,"name":"Microsoft Office"},{"enabled":true,"name":"Google Update","path":"C:\\Program Files (x86)\\Google\\Update\\1.3.21.99\\npGoogleUpdate3.dll","version":"1.3.21.99"},{"enabled":true,"name":"Google Update"},{"enabled":true,"name":"WildTangent Games App Presence Detector","path":"C:\\Program Files (x86)\\WildTangent Games\\App\\BrowserIntegration\\Registered\\0\\NP_wtapp.dll","version":"4.0.5.4"},{"enabled":true,"name":"WildTangent Games App Presence Detector"},{"enabled":true,"name":"Windows Live Photo Gallery","path":"C:\\Program Files (x86)\\Windows Live\\Photo Gallery\\NPWLPG.dll","version":"15.4.3538.0513_ship.wlx.w4m4 (ship)"},{"enabled":true,"name":"Windows Live Photo Gallery"},{"enabled":true,"name":"Silverlight Plug-In","path":"c:\\Program Files (x86)\\Microsoft Silverlight\\4.0.50401.0\\npctrl.dll","version":"4.0.50401.0"},{"enabled":true,"name":"Silverlight"},{"enabled":true,"name":"Default Plug-in","path":"default_plugin","version":"1"},{"enabled":true,"name":"Default Plug-in"}],"removed_old_component_pepper_flash_settings":true},"printing":{"print_preview_sticky_settings":{"appState":"{\"version\":2,\"selectedDestinationId\":\"KODAK ESP 5 AiO\",\"isSelectedDestinationLocal\":true,\"marginsType\":null,\"isColorEnabled\":null,\"isDuplexEnabled\":null,\"isHeaderFooterEnabled\":null,\"isLandscapeEnabled\":null,\"isCollateEnabled\":null}"}},"profile":{"avatar_index":0,"clear_site_data_on_exit":true,"content_settings":{"clear_on_exit_migrated":true,"pattern_pairs":{"*,*":{"per_plugin":{"npsitesafety.dll":1}},"[*.]www.hoobly.com,*":{"fullscreen":1}},"plugin_whitelist":{"npsitesafety":{"dll":true}},"pref_version":1},"default_content_settings":{"cookies":4},"exit_type":"Normal","exited_cleanly":true,"is_managed":false,"name":"First user","per_host_zoom_levels":{"menards.com":0.5227587223052979,"www.aol.com":-0.5778829455375671,"www.apps.akc.org":0.5227587223052979,"www.docusign.net":-0.5778829455375671,"www.google.com":-0.5778829455375671,"www.pnc.com":0.5227587223052979,"www.ups.com":1.223901033401489}},"selectfile":{"last_directory":"C:\\Users\\Lori\\Downloads"},"session":{"restore_on_startup":4,"restore_on_startup_migrated":true,"urls_to_restore_on_startup":["hxxp://search.conduit.com/?ctid=CT3289663&SearchSource=48&CUI=UN29274371401431325&UM=2"]},"sync":{"suppress_start":true},"tabs":{"use_vertical_tabs":false},"webkit":{"webprefs":{"allow_running_insecure_content":true}}}

*************************

AdwCleaner[R1].txt - [153098 octets] - [12/08/2013 15:34:37]

########## EOF - C:\AdwCleaner[R1].txt - [153160 octets] ##########




 



#9 dev00790

dev00790

    Bleeping Chocoholic


  • Members
  • 5,037 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:05:41 AM

Posted 13 August 2013 - 11:39 AM

Hi Please do the following next:
 
:step1:

  • Please use the following link and scroll down to ERUNT and download it.
  • http://aumha.org/freeware/freeware.php
  • For version with the Installer:
    Use the setup program to install ERUNT on your computer
  • For the zipped version:
    Unzip all the files into a folder of your choice.
  • Right click on Erunt.exe and click "Run as Adminstrator" (use the shortcut on your desktop if you used the installer).
  • If you get a message box with the title "Welcome", click on "OK"
  • Follow the subsequent prompts, leaving the values at default, and click on "OK"
  • If you get asked whether to create a folder please click "Yes".

 

:step2:

  • Close all open programs and internet browsers.
  • Double click on adwcleaner.exe to run the tool.
  • Click on Delete.
  • Confirm each time with Ok.
  • You will be prompted to restart your computer. A text file will open after the restart.
  • Please post the contents of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.

 

:step3:
 
We need to create an OTL Report

  • Please download OTL from one of the following mirrors:
  • Save it to your desktop.
  • Double click on the otlicon.png icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Push the runscan.png button.
  • Two reports will open, copy and paste them in a reply here:
    • OTL.txt <-- Will be opened
    • Extra.txt <-- Will be minimized

Regards, dev00790

---------------------------------------

Marge: "Homer, the plant called. They said if you don't show up tomorrow don't bother showing up on Monday." Homer: "Woo-hoo! Four-day weekend!"I do not reply to Private Messages (PMs) asking for assistance - please use the forums instead. If I have been helping you, and I have not replied to your latest post in 48 hours please send me a PM. My Blog


#10 dev00790

dev00790

    Bleeping Chocoholic


  • Members
  • 5,037 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:05:41 AM

Posted 15 August 2013 - 12:31 PM

Hi Are you still with us? The topic will be closed in 3 days if we get no response from you.


Regards, dev00790

---------------------------------------

Marge: "Homer, the plant called. They said if you don't show up tomorrow don't bother showing up on Monday." Homer: "Woo-hoo! Four-day weekend!"I do not reply to Private Messages (PMs) asking for assistance - please use the forums instead. If I have been helping you, and I have not replied to your latest post in 48 hours please send me a PM. My Blog


#11 webdzyner

webdzyner
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:41 AM

Posted 15 August 2013 - 03:05 PM

OTL logfile created on: 8/15/2013 3:47:05 PM - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Lori\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
3.61 Gb Total Physical Memory | 1.94 Gb Available Physical Memory | 53.71% Memory free
7.21 Gb Paging File | 4.81 Gb Available in Paging File | 66.64% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 449.55 Gb Total Space | 387.65 Gb Free Space | 86.23% Space Free | Partition Type: NTFS
 
Computer Name: LORI-PC | User Name: Lori | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013/08/15 15:22:02 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Lori\Desktop\OTL.exe
PRC - [2013/08/15 08:49:59 | 002,314,416 | ---- | M] () -- C:\Program Files (x86)\AVG Secure Search\vprot.exe
PRC - [2013/08/15 08:49:59 | 001,643,184 | ---- | M] (AVG Secure Search) -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe
PRC - [2013/08/15 08:49:59 | 000,161,968 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\loggingserver.exe
PRC - [2013/07/23 19:09:28 | 000,283,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
PRC - [2013/07/01 01:46:26 | 004,411,440 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgui.exe
PRC - [2013/06/26 10:55:45 | 000,920,472 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2013/05/11 06:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013/04/25 17:36:14 | 001,648,264 | ---- | M] (Ask) -- C:\Program Files (x86)\Ask.com\Updater\Updater.exe
PRC - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2013/04/04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2013/03/22 06:07:18 | 000,093,072 | ---- | M] (TomTom) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
PRC - [2013/03/22 06:07:16 | 000,248,208 | ---- | M] (TomTom) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
PRC - [2013/02/05 11:48:44 | 000,272,248 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
PRC - [2012/04/03 13:33:00 | 000,940,168 | ---- | M] (CANON INC.) -- C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.EXE
PRC - [2012/04/03 13:27:16 | 001,087,608 | ---- | M] (CANON INC.) -- C:\Program Files (x86)\Canon\Quick Menu\CNQMUPDT.EXE
PRC - [2012/04/03 13:26:14 | 001,273,448 | ---- | M] (CANON INC.) -- C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE
PRC - [2012/03/26 17:35:16 | 000,449,168 | ---- | M] (CANON INC.) -- C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
PRC - [2011/11/03 17:20:58 | 000,803,144 | ---- | M] (AVG) -- C:\Program Files (x86)\AVG\AVG PC Tuneup\BoostSpeed.exe
PRC - [2011/09/06 07:02:20 | 000,140,456 | ---- | M] () -- C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
PRC - [2011/09/01 17:47:26 | 000,090,448 | ---- | M] (Research In Motion Limited) -- C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
PRC - [2011/07/19 11:59:30 | 000,126,392 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013/08/15 08:49:59 | 002,314,416 | ---- | M] () -- C:\Program Files (x86)\AVG Secure Search\vprot.exe
MOD - [2013/08/15 08:49:59 | 000,521,904 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\log4cplusU.dll
MOD - [2013/08/15 08:49:59 | 000,144,560 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.5.0\SiteSafety.dll
MOD - [2013/06/26 10:55:44 | 003,285,912 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2012/05/30 20:06:48 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/05/30 20:06:30 | 001,242,512 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2012/03/19 11:12:04 | 000,096,768 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\UIAutomationProvider\1c177e9aa7a1661ddec16c2f9f30947c\UIAutomationProvider.ni.dll
MOD - [2012/03/19 11:11:51 | 012,079,104 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\System.Web\3420481899719b86b8bb597ad0cf0db0\System.Web.ni.dll
MOD - [2012/03/19 11:11:30 | 000,771,584 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\9eb937785d5a8bc2767ae7efcdd29d43\System.Runtime.Remoting.ni.dll
MOD - [2012/03/19 11:10:10 | 001,782,272 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\b74e1ad9110a39851b12cb46b3954163\System.Xaml.ni.dll
MOD - [2012/03/19 11:09:46 | 000,044,544 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\Accessibility\06ac8d640d2dfa7d4bb23c03584304ef\Accessibility.ni.dll
MOD - [2012/03/16 17:08:43 | 013,138,432 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\edfa0f31cc4950e16011ecb549f553f7\System.Windows.Forms.ni.dll
MOD - [2012/03/16 17:08:01 | 001,652,736 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\9d5b252266a6084a611b2be84fac9e1c\System.Drawing.ni.dll
MOD - [2012/03/16 17:07:59 | 018,000,384 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\bdf555b4cfed144a3b0b60e0308cbf2b\PresentationFramework.ni.dll
MOD - [2012/03/16 17:07:45 | 000,595,968 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\9dbdf77b1208ccfea1b67b50084c3f1a\PresentationFramework.Aero.ni.dll
MOD - [2012/03/16 17:07:13 | 011,450,880 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\37cfa5ae8473995db30414fa29167c28\PresentationCore.ni.dll
MOD - [2012/03/16 17:07:10 | 005,617,664 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\System.Xml\a588133985ef7510d4cc8cc7924f8ec3\System.Xml.ni.dll
MOD - [2012/03/16 17:07:00 | 000,982,528 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\1702c5e18cdd96c022d87c38561f19c9\System.Configuration.ni.dll
MOD - [2012/03/16 17:06:56 | 007,069,696 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\System.Core\b6ac99f2787a9a672d7a696ef25588ee\System.Core.ni.dll
MOD - [2012/03/16 17:06:44 | 003,857,920 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\6be8cdc102f384653338279eff1f78fd\WindowsBase.ni.dll
MOD - [2012/03/16 17:06:35 | 009,091,584 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\System\9c4788acc8f93c33214865395cee2e1c\System.ni.dll
MOD - [2012/03/16 17:01:25 | 014,407,680 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll
MOD - [2011/11/03 17:21:06 | 000,350,024 | ---- | M] () -- C:\Program Files (x86)\AVG\AVG PC Tuneup\madExcept_.bpl
MOD - [2011/11/03 17:21:06 | 000,184,136 | ---- | M] () -- C:\Program Files (x86)\AVG\AVG PC Tuneup\madBasic_.bpl
MOD - [2011/11/03 17:21:06 | 000,050,504 | ---- | M] () -- C:\Program Files (x86)\AVG\AVG PC Tuneup\madDisAsm_.bpl
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2013/08/13 05:22:04 | 004,390,760 | ---- | M] (Reimage®) [Auto | Running] -- C:\Program Files\eFix\eFix Pro\ReiGuard.exe -- (eFixRealTimeProtection)
SRV:64bit: - [2011/06/10 01:10:00 | 000,138,152 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)
SRV:64bit: - [2011/06/08 01:54:56 | 000,204,288 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2011/05/17 18:34:18 | 000,574,896 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV:64bit: - [2010/10/20 18:41:00 | 000,138,656 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)
SRV:64bit: - [2010/09/22 21:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2010/09/09 21:26:34 | 000,162,824 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\GFNEXSrv.exe -- (GFNEXSrv)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/08/15 08:49:59 | 001,643,184 | ---- | M] (AVG Secure Search) [Auto | Running] -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe -- (vToolbarUpdater15.5.0)
SRV - [2013/07/25 13:40:02 | 001,432,080 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Stopped] -- C:\Program Files (x86)\AVG\AVG2013\avgfws.exe -- (avgfws)
SRV - [2013/07/23 19:09:28 | 000,283,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe -- (avgwd)
SRV - [2013/07/04 15:53:10 | 004,939,312 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Stopped] -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2013/06/26 10:55:44 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/06/12 11:35:47 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/05/11 06:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2013/03/22 06:07:18 | 000,093,072 | ---- | M] (TomTom) [Auto | Running] -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2013/02/05 11:48:00 | 000,235,216 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe -- (McComponentHostService)
SRV - [2011/09/06 07:02:20 | 000,140,456 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC)
SRV - [2011/08/24 13:59:58 | 000,102,912 | ---- | M] () [Auto | Running] -- C:\Windows\agent_x64.exe -- (Agent)
SRV - [2011/07/19 11:59:30 | 000,126,392 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe -- (PCCUJobMgr)
SRV - [2011/07/11 21:16:06 | 000,057,216 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)
SRV - [2010/10/12 13:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013/08/15 08:49:59 | 000,045,856 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtpx64.sys -- (avgtp)
DRV:64bit: - [2013/07/20 01:51:00 | 000,311,608 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgloga.sys -- (Avgloga)
DRV:64bit: - [2013/07/20 01:50:56 | 000,246,072 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avgidsdrivera.sys -- (AVGIDSDriver)
DRV:64bit: - [2013/07/20 01:50:56 | 000,071,480 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgidsha.sys -- (AVGIDSHA)
DRV:64bit: - [2013/07/20 01:50:50 | 000,206,648 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)
DRV:64bit: - [2013/07/10 01:32:38 | 000,045,880 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:64bit: - [2013/07/01 01:45:28 | 000,116,536 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:64bit: - [2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2013/03/21 03:08:24 | 000,240,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)
DRV:64bit: - [2012/09/04 10:39:32 | 000,050,296 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgfwd6a.sys -- (Avgfwfd)
DRV:64bit: - [2012/04/25 12:11:36 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011/07/25 17:44:46 | 000,074,752 | ---- | M] (Research In Motion Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RimUsb_AMD64.sys -- (RimUsb)
DRV:64bit: - [2011/07/20 14:58:22 | 000,044,032 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RimSerial_AMD64.sys -- (RimVSerPort)
DRV:64bit: - [2011/06/08 02:42:26 | 009,360,896 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011/06/08 01:16:14 | 000,309,760 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011/03/11 02:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/02/23 21:14:44 | 001,142,376 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192ce.sys -- (RTL8192Ce)
DRV:64bit: - [2011/02/08 23:07:00 | 000,038,096 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PGEffect.sys -- (PGEffect)
DRV:64bit: - [2011/02/03 23:59:06 | 001,413,680 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2011/01/13 23:58:30 | 000,413,800 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010/11/20 23:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 23:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 23:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010/11/20 19:23:48 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/10/29 20:11:42 | 000,250,984 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2009/07/31 00:22:04 | 000,027,784 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV:64bit: - [2009/07/14 19:31:18 | 000,026,840 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TVALZ_O.SYS -- (TVALZ)
DRV:64bit: - [2009/07/13 21:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 21:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 21:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2009/07/13 21:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 20:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rootmdm.sys -- (ROOTMODEM)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 16:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2009/07/13 21:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {{67A2568C-7A0A-4EED-AECC-B5405DE63B64}}
IE:64bit: - HKLM\..\SearchScopes\{{67A2568C-7A0A-4EED-AECC-B5405DE63B64}}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNO
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\URLSearchHook: {07cbf788-1359-421b-a4e3-5a8d041b90a3} - C:\Program Files (x86)\InternetHelper3.1\prxtbInte.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {08816A35-CD1C-465B-AE04-EBAA98D3E40F}
IE - HKLM\..\SearchScopes\{{67A2568C-7A0A-4EED-AECC-B5405DE63B64}}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNO
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {{67A2568C-7A0A-4EED-AECC-B5405DE63B64}}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {{67A2568C-7A0A-4EED-AECC-B5405DE63B64}}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.toshiba.com/?cid=C001B2Y
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\..\URLSearchHook: {07cbf788-1359-421b-a4e3-5a8d041b90a3} - C:\Program Files (x86)\InternetHelper3.1\prxtbInte.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\..\SearchScopes,DefaultScope = {08816A35-CD1C-465B-AE04-EBAA98D3E40F}
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\..\SearchScopes\{{67A2568C-7A0A-4EED-AECC-B5405DE63B64}}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNO
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\..\SearchScopes\{08816A35-CD1C-465B-AE04-EBAA98D3E40F}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3289663&CUI=UN73871753750523154&UM=2&SSPV=TB_CS7
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\..\SearchScopes\{183005AB-3C05-4F7B-A138-6B14B031F557}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000031&src=kw&q={searchTerms}&locale=&apn_ptnrs=TV&apn_dtid=YYYYYYYYUS&apn_uid=C68E932A-D4C9-4A1F-B938-83BA1B3681CD&apn_sauid=378A4EE9-8E5B-4B6C-A1AA-11578E8AE5F8
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\..\SearchScopes\{91607fa7-3c2f-4f90-93e3-d5337a6b0ac2}: "URL" = Playbryte-fa/search/redirect/?type=default&user_id=cd51f4cb-364c-4024-bee9-e95021886bb6&query={searchTerms}
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={F59C4912-49D7-4319-8E37-1D2EA3FC0027}&mid=b50b5ebda29747d0b61c3909b4d156a3-1b2fa05dbeebed80508d5f9beb0f6ccbde36a866&lang=en&ds=AVG&pr=pr&d=2012-03-12 17:43:45&v=15.2.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\..\SearchScopes\{A5FF1B30-197E-4C1A-955C-BD4CA91AB119}: "URL" = http://www.google.com/search?sourceid=ie9&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNO_enUS475
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
 
========== FireFox ==========
 
FF - prefs.js..CT3289663.browser.search.defaultthis.engineName: "true"
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "InternetHelper3.1 Customized Web Search"
FF - prefs.js..browser.search.defaultthis.engineName: "InternetHelper3.1 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT3289663&CUI=UN12714428951325715&UM=2&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "InternetHelper3.1 Customized Web Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com"
FF - prefs.js..extensions.enabledAddons: save-as-pdf-ff%40pdfcrowd.com:1.5
FF - prefs.js..extensions.enabledAddons: %7Be001c731-5e37-4538-a5cb-8168736a2360%7D:0.9.9.119
FF - prefs.js..extensions.enabledAddons: avg%40toolbar:15.5.0.2
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT3289663&SearchSource=2&CUI=UN12714428951325715&UM=2&q="
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\15.5.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\6\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\FireFoxExt\15.5.0.2 [2013/08/15 08:50:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/06/26 10:55:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.5\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2013/04/30 11:31:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.5\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/06/26 10:55:33 | 000,000,000 | ---D | M]
 
[2013/05/12 11:46:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lori\AppData\Roaming\Mozilla\Extensions
[2013/05/12 11:46:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lori\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com
[2013/08/12 18:05:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\extensions
[2013/08/12 18:05:26 | 000,000,000 | ---D | M] (InternetHelper3.1) -- C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\extensions\{07cbf788-1359-421b-a4e3-5a8d041b90a3}
[2013/07/22 09:40:49 | 000,000,000 | ---D | M] (Bitdefender QuickScan) -- C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2012/06/10 16:30:45 | 000,000,000 | ---D | M] (PlayBryte) -- C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\extensions\playbryte@playbryte.com
[2013/05/22 17:51:11 | 000,000,000 | ---D | M] ("Ask Toolbar") -- C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\extensions\toolbar@ask.com
[2013/05/25 11:54:42 | 002,168,615 | ---- | M] () (No name found) -- C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\extensions\firebug@software.joehewitt.com.xpi
[2013/04/09 08:44:34 | 000,057,194 | ---- | M] () (No name found) -- C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\extensions\save-as-pdf-ff@pdfcrowd.com.xpi
[2012/06/15 21:01:51 | 000,002,556 | ---- | M] () -- C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\searchplugins\aol-search.xml
[2013/08/05 18:01:53 | 000,009,611 | ---- | M] () -- C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\searchplugins\ask-web-search.xml
[2013/08/13 17:03:04 | 000,002,580 | ---- | M] () -- C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\searchplugins\askcom.xml
[2013/08/12 15:20:09 | 000,001,011 | ---- | M] () -- C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\searchplugins\conduit.xml
[2013/06/26 10:55:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2013/06/26 10:55:46 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/08/15 08:50:46 | 000,000,000 | ---D | M] (AVG Security Toolbar) -- C:\PROGRAMDATA\AVG SECURE SEARCH\FIREFOXEXT\15.5.0.2
[2013/05/20 19:28:46 | 000,003,714 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml
 
========== Chrome  ==========
 
CHR - Extension: No name found = C:\Users\Lori\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\12.0.0.2210_0\
CHR - Extension: No name found = C:\Users\Lori\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjheggmdlcjcpogghlofgpmgdfpigpia\2.0.2_0\
CHR - Extension: No name found = C:\Users\Lori\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof\15.3.0.11_0\
 
O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll File not found
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (InternetHelper3.1 Toolbar) - {07cbf788-1359-421b-a4e3-5a8d041b90a3} - C:\Program Files (x86)\InternetHelper3.1\prxtbInte.dll (Conduit Ltd.)
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll File not found
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.5.0.2\AVG Secure Search_toolbar.dll (AVG Secure Search)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (InternetHelper3.1 Toolbar) - {07cbf788-1359-421b-a4e3-5a8d041b90a3} - C:\Program Files (x86)\InternetHelper3.1\prxtbInte.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\15.5.0.2\AVG Secure Search_toolbar.dll (AVG Secure Search)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: []  File not found
O4:64bit: - HKLM..\Run: [RtHDVBg_Dolby] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [TCrdMain] C:\Program Files\Toshiba\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosNC] C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosReelTimeMonitor] C:\Program Files\Toshiba\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosSENotify] C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosVolRegulator] C:\Program Files\Toshiba\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CanonQuickMenu] C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [IJNetworkScannerSelectorEX] C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (CANON INC.)
O4 - HKLM..\Run: [NortonOnlineBackupReminder] C:\Program Files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe (Toshiba)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [ToshibaAppPlace] C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe (Toshiba)
O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [vProt] C:\Program Files (x86)\AVG Secure Search\vprot.exe ()
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001..\Run: [ConduitFloatingPlugin_nemfjadlboooiffmcelkafilagddogim] C:\Program Files (x86)\Conduit\CT3289663\plugins\TBVerifier.dll (Conduit Ltd.)
O4 - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001..\Run: [TomTomHOME.exe] C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O4 - HKU\.DEFAULT..\RunOnce: [KodakHomeCenter] "C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe" File not found
O4 - HKU\S-1-5-18..\RunOnce: [KodakHomeCenter] "C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe" File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 10.9.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9CCC4D28-A371-4BD3-B1B8-C188E5D35400}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F9FC772F-013F-45A2-A91E-F5C28A7B4561}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll File not found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\viprotocol - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll File not found
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\15.5.0\ViProtocol.dll (AVG Secure Search)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{54090621-8977-11e1-ae47-e840f235bf50}\Shell - "" = AutoRun
O33 - MountPoints2\{54090621-8977-11e1-ae47-e840f235bf50}\Shell\AutoRun\command - "" = E:\videoconvert.exe
O33 - MountPoints2\{d232b7e6-6c02-11e2-a058-e840f235bf50}\Shell - "" = AutoRun
O33 - MountPoints2\{d232b7e6-6c02-11e2-a058-e840f235bf50}\Shell\AutoRun\command - "" = C:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL TL-Bootstrap.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\videoconvert.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/08/15 15:21:58 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Lori\Desktop\OTL.exe
[2013/08/15 10:07:45 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Roaming\AVG2013
[2013/08/15 10:03:18 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Roaming\TuneUp Software
[2013/08/15 10:00:44 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2013
[2013/08/15 09:11:46 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Local\MFAData
[2013/08/15 09:11:46 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Local\Avg2013
[2013/08/12 15:23:02 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Local\Conduit
[2013/08/12 15:23:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\InternetHelper3.1
[2013/08/12 15:21:47 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Local\CRE
[2013/08/12 15:21:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Conduit
[2013/08/12 15:20:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SearchProtect
[2013/08/12 15:20:10 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Roaming\SearchProtect
[2013/08/10 12:26:12 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonIJMyPrinter
[2013/08/08 13:37:08 | 000,688,992 | R--- | C] (Swearware) -- C:\Users\Lori\Desktop\dds.com
[2013/07/29 09:12:15 | 000,000,000 | ---D | C] -- C:\ProgramData\CDB
[2013/07/28 13:26:23 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Roaming\kompozer.net
[2013/07/28 13:26:23 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Local\kompozer.net
[2013/07/28 13:26:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KompoZer
[2013/07/28 13:26:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\KompoZer
[2013/07/25 15:07:44 | 000,000,000 | ---D | C] -- C:\Recovery
[2013/07/25 15:07:44 | 000,000,000 | ---D | C] -- C:\PerfLogs
[2013/07/25 14:00:36 | 000,000,000 | ---D | C] -- C:\eFixUndo
[2013/07/25 13:44:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eFix Pro
[2013/07/25 13:44:33 | 000,000,000 | ---D | C] -- C:\Program Files\eFix
[2013/07/25 13:44:24 | 000,000,000 | ---D | C] -- C:\rei
[2013/07/22 09:42:26 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Roaming\QuickScan
[2013/07/20 01:51:00 | 000,311,608 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\drivers\avgloga.sys
[2013/07/20 01:50:56 | 000,246,072 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\drivers\avgidsdrivera.sys
[2013/07/20 01:50:56 | 000,071,480 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\drivers\avgidsha.sys
[2013/07/20 01:50:50 | 000,206,648 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\drivers\avgldx64.sys
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
[1 C:\Users\Lori\Documents\*.tmp files -> C:\Users\Lori\Documents\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013/08/15 15:36:00 | 000,000,912 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/08/15 15:35:45 | 000,000,904 | ---- | M] () -- C:\windows\SysNative\ScanResults.xml
[2013/08/15 15:35:00 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2013/08/15 15:34:10 | 000,001,056 | ---- | M] () -- C:\windows\SysNative\SettingsFile
[2013/08/15 15:22:02 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Lori\Desktop\OTL.exe
[2013/08/15 15:10:25 | 000,672,950 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
[2013/08/15 15:10:25 | 000,125,618 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
[2013/08/15 15:10:24 | 000,796,230 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
[2013/08/15 15:06:21 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2013/08/15 10:36:00 | 000,000,908 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/08/15 10:03:19 | 000,000,936 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk
[2013/08/15 08:50:58 | 000,003,715 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefoxavg-secure-search.xml
[2013/08/15 08:49:59 | 000,045,856 | ---- | M] (AVG Technologies) -- C:\windows\SysNative\drivers\avgtpx64.sys
[2013/08/14 09:30:54 | 000,897,024 | ---- | M] () -- C:\Users\Lori\AppData\Roaming\SharedSettings.ccs
[2013/08/14 09:06:11 | 000,024,608 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/08/14 09:06:11 | 000,024,608 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/08/14 08:59:07 | 000,000,354 | ---- | M] () -- C:\windows\tasks\ROC_JAN2013_TB_rmv.job
[2013/08/14 08:59:04 | 000,000,350 | ---- | M] () -- C:\windows\tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
[2013/08/14 08:58:05 | 2904,616,960 | -HS- | M] () -- C:\hiberfil.sys
[2013/08/13 14:55:06 | 000,000,102 | ---- | M] () -- C:\Users\Lori\Desktop\cPix.ini
[2013/08/12 15:23:50 | 000,000,009 | ---- | M] () -- C:\END
[2013/08/08 13:37:11 | 000,688,992 | R--- | M] (Swearware) -- C:\Users\Lori\Desktop\dds.com
[2013/08/05 21:32:29 | 000,081,546 | ---- | M] () -- C:\Users\Lori\Documents\David Reed resume.pdf
[2013/07/28 13:26:18 | 000,000,918 | ---- | M] () -- C:\Users\Public\Desktop\KompoZer.lnk
[2013/07/26 14:03:45 | 006,221,721 | ---- | M] () -- C:\Users\Lori\Documents\multiple-sclerosis-treatment-guide.pdf
[2013/07/25 15:29:58 | 000,417,672 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT
[2013/07/25 15:29:29 | 000,001,532 | ---- | M] () -- C:\windows\SysNative\reimage.rep
[2013/07/25 15:07:41 | 000,000,171 | ---- | M] () -- C:\windows\efix.ini
[2013/07/25 15:07:04 | 000,001,425 | ---- | M] () -- C:\Users\Lori\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/07/25 14:01:00 | 000,009,728 | ---- | M] () -- C:\windows\SysNative\Native.exe
[2013/07/25 13:44:43 | 000,001,751 | ---- | M] () -- C:\Users\Public\Desktop\eFix Pro.lnk
[2013/07/22 20:22:24 | 000,185,710 | ---- | M] () -- C:\Users\Lori\Documents\1040_book.pdf
[2013/07/22 10:36:13 | 000,206,072 | ---- | M] () -- C:\Users\Lori\Documents\scans.pdf
[2013/07/20 01:51:00 | 000,311,608 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\drivers\avgloga.sys
[2013/07/20 01:50:56 | 000,246,072 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\drivers\avgidsdrivera.sys
[2013/07/20 01:50:56 | 000,071,480 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\drivers\avgidsha.sys
[2013/07/20 01:50:50 | 000,206,648 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\drivers\avgldx64.sys
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
[1 C:\Users\Lori\Documents\*.tmp files -> C:\Users\Lori\Documents\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/08/15 10:03:19 | 000,000,936 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2013.lnk
[2013/08/12 15:19:00 | 000,000,009 | ---- | C] () -- C:\END
[2013/08/12 14:14:24 | 000,001,056 | ---- | C] () -- C:\windows\SysNative\SettingsFile
[2013/08/05 21:32:28 | 000,081,546 | ---- | C] () -- C:\Users\Lori\Documents\David Reed resume.pdf
[2013/07/29 09:15:43 | 000,000,904 | ---- | C] () -- C:\windows\SysNative\ScanResults.xml
[2013/07/28 13:26:18 | 000,000,918 | ---- | C] () -- C:\Users\Public\Desktop\KompoZer.lnk
[2013/07/26 14:03:43 | 006,221,721 | ---- | C] () -- C:\Users\Lori\Documents\multiple-sclerosis-treatment-guide.pdf
[2013/07/25 15:29:27 | 000,001,532 | ---- | C] () -- C:\windows\SysNative\reimage.rep
[2013/07/25 15:12:12 | 000,001,391 | ---- | C] () -- C:\Users\Lori\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2013/07/25 14:01:00 | 000,009,728 | ---- | C] () -- C:\windows\SysNative\Native.exe
[2013/07/25 13:44:43 | 000,001,751 | ---- | C] () -- C:\Users\Public\Desktop\eFix Pro.lnk
[2013/07/25 13:43:20 | 000,000,171 | ---- | C] () -- C:\windows\efix.ini
[2013/07/22 20:22:23 | 000,185,710 | ---- | C] () -- C:\Users\Lori\Documents\1040_book.pdf
[2013/07/22 10:36:11 | 000,206,072 | ---- | C] () -- C:\Users\Lori\Documents\scans.pdf
[2013/06/26 09:09:13 | 000,003,715 | ---- | C] () -- C:\Program Files (x86)\Mozilla Firefoxavg-secure-search.xml
[2013/06/10 17:03:33 | 000,007,609 | ---- | C] () -- C:\Users\Lori\AppData\Local\Resmon.ResmonCfg
[2012/06/07 20:02:26 | 000,039,095 | ---- | C] () -- C:\windows\iccsigs.dat
[2012/06/07 20:02:23 | 000,112,688 | ---- | C] () -- C:\windows\SysWow64\shw32.dll
[2012/05/29 14:52:53 | 000,006,144 | ---- | C] () -- C:\Users\Lori\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/05/13 19:31:56 | 000,000,080 | ---- | C] () -- C:\windows\mapforms.ini
[2012/04/26 16:28:53 | 000,001,569 | ---- | C] () -- C:\Users\Lori\.recently-used.xbel
[2012/04/20 18:32:54 | 000,897,024 | ---- | C] () -- C:\Users\Lori\AppData\Roaming\SharedSettings.ccs
[2012/04/07 15:41:50 | 000,102,912 | ---- | C] () -- C:\windows\agent_x64.exe
[2012/03/12 23:09:16 | 000,773,050 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI
[2012/03/12 21:35:00 | 000,000,659 | ---- | C] () -- C:\windows\fpexplor.ini
[2012/01/27 22:32:59 | 000,451,072 | ---- | C] () -- C:\windows\SysWow64\ISSRemoveSP.exe
[2012/01/27 22:28:06 | 000,128,312 | ---- | C] () -- C:\windows\SysWow64\GFNEX.dll
[2012/01/27 22:27:06 | 000,000,000 | ---- | C] () -- C:\windows\ativpsrm.bin
[2012/01/27 22:24:06 | 000,003,929 | ---- | C] () -- C:\windows\SysWow64\atipblag.dat
 
========== ZeroAccess Check ==========
 
[2009/07/14 00:55:00 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2010/11/20 19:23:56 | 014,174,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2010/11/20 19:24:04 | 012,872,192 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 21:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 23:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 21:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:0B4227B4

< End of report >
 



#12 dev00790

dev00790

    Bleeping Chocoholic


  • Members
  • 5,037 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:05:41 AM

Posted 15 August 2013 - 05:14 PM

HI did you run AdwCleaner - Delete?


Regards, dev00790

---------------------------------------

Marge: "Homer, the plant called. They said if you don't show up tomorrow don't bother showing up on Monday." Homer: "Woo-hoo! Four-day weekend!"I do not reply to Private Messages (PMs) asking for assistance - please use the forums instead. If I have been helping you, and I have not replied to your latest post in 48 hours please send me a PM. My Blog


#13 webdzyner

webdzyner
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:41 AM

Posted 16 August 2013 - 09:48 AM

I did here is results text file

 

# AdwCleaner v2.306 - Logfile created 08/16/2013 at 10:39:56
# Updated 19/07/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Lori - LORI-PC
# Boot Mode : Normal
# Running from : C:\Users\Lori\Downloads\AdwCleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Deleted on reboot : C:\Program Files (x86)\Common Files\AVG Secure Search
File Deleted : C:\END
File Deleted : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll
File Deleted : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.xpt
File Deleted : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll
File Deleted : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.xpt
File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\avg-secure-search.xml
File Deleted : C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\searchplugins\Askcom.xml
File Deleted : C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\searchplugins\Conduit.xml
Folder Deleted : C:\Program Files (x86)\Ask.com
Folder Deleted : C:\Program Files (x86)\AVG Secure Search
Folder Deleted : C:\Program Files (x86)\Common Files\Software Update Utility
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\internethelper3.1
Folder Deleted : C:\Program Files (x86)\SearchProtect
Folder Deleted : C:\ProgramData\Ask
Folder Deleted : C:\ProgramData\AVG Secure Search
Folder Deleted : C:\Users\Lori\AppData\Local\APN
Folder Deleted : C:\Users\Lori\AppData\Local\AVG Secure Search
Folder Deleted : C:\Users\Lori\AppData\Local\Conduit
Folder Deleted : C:\Users\Lori\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla
Folder Deleted : C:\Users\Lori\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Folder Deleted : C:\Users\Lori\AppData\Local\Temp\AirInstaller
Folder Deleted : C:\Users\Lori\AppData\Local\Temp\CT3289663
Folder Deleted : C:\Users\Lori\AppData\LocalLow\AskToolbar
Folder Deleted : C:\Users\Lori\AppData\LocalLow\AVG Secure Search
Folder Deleted : C:\Users\Lori\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Lori\AppData\LocalLow\internethelper3.1
Folder Deleted : C:\Users\Lori\AppData\LocalLow\Playbryte
Folder Deleted : C:\Users\Lori\AppData\Roaming\iWin
Folder Deleted : C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\CT3289663
Folder Deleted : C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\extensions\{07cbf788-1359-421b-a4e3-5a8d041b90a3}
Folder Deleted : C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\extensions\playbryte@playbryte.com
Folder Deleted : C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\extensions\toolbar@ask.com
Folder Deleted : C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\Smartbar
Folder Deleted : C:\Users\Lori\AppData\Roaming\SearchProtect
Folder Deleted : C:\windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

***** [Registry] *****

Key Deleted : HKCU\Software\APN
Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\InternetHelper3.1
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\AppDataLow\Toolbar
Key Deleted : HKCU\Software\Ask.com
Key Deleted : HKCU\Software\AVG Secure Search
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{07CBF788-1359-421B-A4E3-5A8D041B90A3}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKCU\Software\SearchProtect
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\Software\APN
Key Deleted : HKLM\Software\AskToolbar
Key Deleted : HKLM\Software\AVG Secure Search
Key Deleted : HKLM\Software\AVG Security Toolbar
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\dnu.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdate
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController
Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Deleted : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3289663
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{13ABD093-D46F-40DF-A608-47E162EC799D}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\InternetHelper3.1
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6CE83F03-4DFD-4070-A0A7-C46C82E20971}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F0B76E1-4E46-427B-B55B-B90593468AC6}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Deleted : HKLM\Software\SearchProtect
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{07CBF788-1359-421B-A4E3-5A8D041B90A3}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{6CE83F03-4DFD-4070-A0A7-C46C82E20971}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\aaaaojmikegpiepcfdkkjaplodkpfmlo
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6A516BFF-C9CB-41A6-AEC1-DC76FA284CBD}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7207F91-F4E7-4D68-8CE3-65B97B54A2F9}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07CBF788-1359-421B-A4E3-5A8D041B90A3}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\InternetHelper3.1 Toolbar
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23119123-0854-469D-807A-171568457991}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Software
Key Deleted : HKLM\SOFTWARE\Tarma Installer
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{07CBF788-1359-421B-A4E3-5A8D041B90A3}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{07CBF788-1359-421B-A4E3-5A8D041B90A3}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]
Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{07CBF788-1359-421B-A4E3-5A8D041B90A3}]
Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v22.0 (en-US)

File : C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\prefs.js

C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\user.js ... Deleted !

Deleted : user_pref("CT3289663.1000082.isPlayDisplay", "true");
Deleted : user_pref("CT3289663.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description[...]
Deleted : user_pref("CT3289663.1000234.TWC_TMP_city", "HARTFORD");
Deleted : user_pref("CT3289663.1000234.TWC_TMP_country", "US");
Deleted : user_pref("CT3289663.1000234.TWC_country", "UNITED STATES");
Deleted : user_pref("CT3289663.1000234.TWC_locId", "USMI0377");
Deleted : user_pref("CT3289663.1000234.TWC_location", "Hartford, MI");
Deleted : user_pref("CT3289663.1000234.TWC_region", "US");
Deleted : user_pref("CT3289663.1000234.TWC_temp_dis", "f");
Deleted : user_pref("CT3289663.1000234.TWC_wind_dis", "mph");
Deleted : user_pref("CT3289663.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Deleted : user_pref("CT3289663.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]
Deleted : user_pref("CT3289663.FF19Solved", "true");
Deleted : user_pref("CT3289663.FirstTime", "true");
Deleted : user_pref("CT3289663.FirstTimeFF3", "true");
Deleted : user_pref("CT3289663.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT328[...]
Deleted : user_pref("CT3289663.UserID", "UN12714428951325715");
Deleted : user_pref("CT3289663.addressBarTakeOverEnabledInHidden", "true");
Deleted : user_pref("CT3289663.autoDisableScopes", 14);
Deleted : user_pref("CT3289663.browser.search.defaultthis.engineName", "true");
Deleted : user_pref("CT3289663.countryCode", "US");
Deleted : user_pref("CT3289663.defaultSearch", "true");
Deleted : user_pref("CT3289663.embeddedsData", "[{\"appId\":\"130067724014616498\",\"apiPermissions\":{\"cross[...]
Deleted : user_pref("CT3289663.enableAlerts", "true");
Deleted : user_pref("CT3289663.enableSearchFromAddressBar", "true");
Deleted : user_pref("CT3289663.firstTimeDialogOpened", "true");
Deleted : user_pref("CT3289663.fixPageNotFoundError", "true");
Deleted : user_pref("CT3289663.fixPageNotFoundErrorByUser", "true");
Deleted : user_pref("CT3289663.fixPageNotFoundErrorInHidden", "true");
Deleted : user_pref("CT3289663.fixUrls", true);
Deleted : user_pref("CT3289663.fullUserID", "UN12714428951325715.IN.20130812152006");
Deleted : user_pref("CT3289663.homepageuserchanged", true);
Deleted : user_pref("CT3289663.installDate", "12/08/2013 15:20:04");
Deleted : user_pref("CT3289663.installId", "stub.exe");
Deleted : user_pref("CT3289663.installSessionId", "{4957FB43-329B-48F8-BD31-7374E47FFE27}");
Deleted : user_pref("CT3289663.installSp", "TRUE");
Deleted : user_pref("CT3289663.installType", "conduitnsisintegration");
Deleted : user_pref("CT3289663.installUsage", "2013-08-12T22:22:34.4127737+03:00");
Deleted : user_pref("CT3289663.installUsageEarly", "2013-08-12T22:21:50.9038159+03:00");
Deleted : user_pref("CT3289663.installerVersion", "1.5.4.5");
Deleted : user_pref("CT3289663.isCheckedStartAsHidden", true);
Deleted : user_pref("CT3289663.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Deleted : user_pref("CT3289663.isFirstTimeToolbarLoading", "false");
Deleted : user_pref("CT3289663.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Deleted : user_pref("CT3289663.keyword", "true");
Deleted : user_pref("CT3289663.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit[...]
Deleted : user_pref("CT3289663.lastVersion", "10.16.9.506");
Deleted : user_pref("CT3289663.mam_gk_installer_preapproved.enc", "ZmFsc2U=");
Deleted : user_pref("CT3289663.migrateAppsAndComponents", true);
Deleted : user_pref("CT3289663.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"\",\"EB_MAIN_FRAME_TITLE\":\"[...]
Deleted : user_pref("CT3289663.openThankYouPage", "false");
Deleted : user_pref("CT3289663.openUninstallPage", "true");
Deleted : user_pref("CT3289663.originalHomepage", "hxxp://www.google.com");
Deleted : user_pref("CT3289663.originalSearchAddressUrl", "hxxp://search.tb.ask.com/search/GGmain.jhtml?st=kwd[...]
Deleted : user_pref("CT3289663.originalSearchEngine", "Ask Web Search");
Deleted : user_pref("CT3289663.originalSearchEngineName", "Ask Web Search");
Deleted : user_pref("CT3289663.revertSettingsEnabled", "false");
Deleted : user_pref("CT3289663.search.searchAppId", "130067724014616498");
Deleted : user_pref("CT3289663.search.searchCount", "0");
Deleted : user_pref("CT3289663.searchFromAddressBarEnabledByUser", "true");
Deleted : user_pref("CT3289663.searchInNewTabEnabledByUser", "true");
Deleted : user_pref("CT3289663.searchInNewTabEnabledInHidden", "true");
Deleted : user_pref("CT3289663.searchRevert", "false");
Deleted : user_pref("CT3289663.searchSuggestEnabledByUser", "true");
Deleted : user_pref("CT3289663.searchUserMode", "2");
Deleted : user_pref("CT3289663.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Deleted : user_pref("CT3289663.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]
Deleted : user_pref("CT3289663.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]
Deleted : user_pref("CT3289663.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]
Deleted : user_pref("CT3289663.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]
Deleted : user_pref("CT3289663.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]
Deleted : user_pref("CT3289663.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]
Deleted : user_pref("CT3289663.serviceLayer_service_usage_toolbarUsageCount", "{\"dataType\":\"number\",\"data[...]
Deleted : user_pref("CT3289663.serviceLayer_services_Configuration_lastUpdate", "1376335310394");
Deleted : user_pref("CT3289663.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1376335352368");
Deleted : user_pref("CT3289663.serviceLayer_services_appsMetadata_lastUpdate", "1376335352382");
Deleted : user_pref("CT3289663.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1376335351296");
Deleted : user_pref("CT3289663.serviceLayer_services_installUsage_ToolbarInstallEarly_lastUpdate", "1376335311[...]
Deleted : user_pref("CT3289663.serviceLayer_services_installUsage_ToolbarInstall_lastUpdate", "1376335355777")[...]
Deleted : user_pref("CT3289663.serviceLayer_services_login_10.16.9.506_lastUpdate", "1376405562389");
Deleted : user_pref("CT3289663.serviceLayer_services_login_10.16.9.6_lastUpdate", "1376335432284");
Deleted : user_pref("CT3289663.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1376335351482");
Deleted : user_pref("CT3289663.serviceLayer_services_searchAPI_lastUpdate", "1376335311645");
Deleted : user_pref("CT3289663.serviceLayer_services_serviceMap_lastUpdate", "1376335308873");
Deleted : user_pref("CT3289663.serviceLayer_services_toolbarContextMenu_lastUpdate", "1376335351141");
Deleted : user_pref("CT3289663.serviceLayer_services_toolbarSettings_lastUpdate", "1376405562444");
Deleted : user_pref("CT3289663.serviceLayer_services_translation_lastUpdate", "1376335353301");
Deleted : user_pref("CT3289663.settingsINI", true);
Deleted : user_pref("CT3289663.shouldFirstTimeDialog", "false");
Deleted : user_pref("CT3289663.showToolbarPermission", "false");
Deleted : user_pref("CT3289663.smartbar.CTID", "CT3289663");
Deleted : user_pref("CT3289663.smartbar.Uninstall", "0");
Deleted : user_pref("CT3289663.smartbar.homepage", "true");
Deleted : user_pref("CT3289663.smartbar.isHidden", true);
Deleted : user_pref("CT3289663.smartbar.toolbarName", "InternetHelper3.1 ");
Deleted : user_pref("CT3289663.startPage", "true");
Deleted : user_pref("CT3289663.toolbarBornServerTime", "12-8-2013");
Deleted : user_pref("CT3289663.toolbarCurrentServerTime", "13-8-2013");
Deleted : user_pref("CT3289663.toolbarLoginClientTime", "Mon Aug 12 2013 15:22:34 GMT-0400 (Eastern Standard T[...]
Deleted : user_pref("CT3289663.versionFromInstaller", "10.16.9.6");
Deleted : user_pref("CT3289663.xpeMode", "3");
Deleted : user_pref("CT3289663_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]
Deleted : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3289663&octid=CT328966[...]
Deleted : user_pref("Smartbar.ConduitSearchEngineList", "InternetHelper3.1 Customized Web Search");
Deleted : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289663[...]
Deleted : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "hxxp://search.tb.ask.com/search/GGmain.jhtml?st=[...]
Deleted : user_pref("Smartbar.keywordURLSelectedCTID", "CT3289663");
Deleted : user_pref("avg.install.installDirPath", "C:\\ProgramData\\AVG Secure Search\\FireFoxExt\\15.5.0.2");
Deleted : user_pref("browser.search.defaultengine", "Ask.com");
Deleted : user_pref("browser.search.defaultenginename", "InternetHelper3.1 Customized Web Search");
Deleted : user_pref("browser.search.defaultthis.engineName", "InternetHelper3.1 Customized Web Search");
Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289663&CUI[...]
Deleted : user_pref("browser.search.order.1", "Ask.com");
Deleted : user_pref("browser.search.selectedEngine", "InternetHelper3.1 Customized Web Search");
Deleted : user_pref("extensions.asktb.InstallDir", "C:\\Program Files (x86)\\Ask.com\\");
Deleted : user_pref("extensions.asktb.abar-war-regex", "conduit\\.com");
Deleted : user_pref("extensions.asktb.apn_dbr", "ff_15.0.1");
Deleted : user_pref("extensions.asktb.autofill-competitor-query-enabled", true);
Deleted : user_pref("extensions.asktb.cbid", "TV");
Deleted : user_pref("extensions.asktb.clear-searches-on-exit", true);
Deleted : user_pref("extensions.asktb.config-updated", true);
Deleted : user_pref("extensions.asktb.cr-o", "100000031cr");
Deleted : user_pref("extensions.asktb.crumb", "2012.10.26+07.46.28-toolbar003iad-US-Um9jaGVzdGVyLE5ZLFVuaXRlZC[...]
Deleted : user_pref("extensions.asktb.default-channel-url-mask", "hxxp://www.ask.com/web?q={query}&o={o}&l={l}[...]
Deleted : user_pref("extensions.asktb.displaybehavior", "");
Deleted : user_pref("extensions.asktb.displaytext", "");
Deleted : user_pref("extensions.asktb.dtid", "YYYYYYYYUS");
Deleted : user_pref("extensions.asktb.dyn-weather-do-locid-lookup-weatherWidget", false);
Deleted : user_pref("extensions.asktb.dyn-weather-locid-weatherWidget", "49071");
Deleted : user_pref("extensions.asktb.dyn-weather-tempunit-weatherWidget", "F");
Deleted : user_pref("extensions.asktb.ff-original-keyword-url", "");
Deleted : user_pref("extensions.asktb.ff19-config-first-run", "true");
Deleted : user_pref("extensions.asktb.first-restart-after-config-update", true);
Deleted : user_pref("extensions.asktb.fresh-install", false);
Deleted : user_pref("extensions.asktb.guid", "C68E932A-D4C9-4A1F-B938-83BA1B3681CD");
Deleted : user_pref("extensions.asktb.hxxp-header-whitelist-hosts", "[\"static-dev.en.dev.ask.com\", \"ask.com[...]
Deleted : user_pref("extensions.asktb.if", "su");
Deleted : user_pref("extensions.asktb.keyword-toggled-in-session", false);
Deleted : user_pref("extensions.asktb.l", "dis");
Deleted : user_pref("extensions.asktb.last-config-req", "1376427784603");
Deleted : user_pref("extensions.asktb.last-search-timestamp", "1372606998566");
Deleted : user_pref("extensions.asktb.locale", "en_US");
Deleted : user_pref("extensions.asktb.location", "Rochester,NY,United States");
Deleted : user_pref("extensions.asktb.lstation", "");
Deleted : user_pref("extensions.asktb.new-tab-opt-out", true);
Deleted : user_pref("extensions.asktb.news-native-on", true);
Deleted : user_pref("extensions.asktb.o", "100000031");
Deleted : user_pref("extensions.asktb.overlay-reloaded-using-restart", true);
Deleted : user_pref("extensions.asktb.pstate", "");
Deleted : user_pref("extensions.asktb.qsrc", "2871");
Deleted : user_pref("extensions.asktb.r", "21");
Deleted : user_pref("extensions.asktb.sa", "YES");
Deleted : user_pref("extensions.asktb.saguid", "378A4EE9-8E5B-4B6C-A1AA-11578E8AE5F8");
Deleted : user_pref("extensions.asktb.save-searches", false);
Deleted : user_pref("extensions.asktb.search-history-queries", "bbq");
Deleted : user_pref("extensions.asktb.search-plugin-suggestions-url", "hxxp://ss.websearch.ask.com/query?qsrc=[...]
Deleted : user_pref("extensions.asktb.search-suggestions-enabled", true);
Deleted : user_pref("extensions.asktb.silent-upgrade", true);
Deleted : user_pref("extensions.asktb.silent-upgrade-from-pre-newtabs-build", false);
Deleted : user_pref("extensions.asktb.socialmini-first", true);
Deleted : user_pref("extensions.asktb.socialmini-interval", "1200000");
Deleted : user_pref("extensions.asktb.socialmini-max-char-ticker", "33");
Deleted : user_pref("extensions.asktb.socialmini-max-items", "30");
Deleted : user_pref("extensions.asktb.socialmini-native-on", true);
Deleted : user_pref("extensions.asktb.socialmini-speed", "10000");
Deleted : user_pref("extensions.asktb.socialmini-transition-first-open", false);
Deleted : user_pref("extensions.asktb.themeid", "");
Deleted : user_pref("extensions.asktb.timeinstalled", "2/1/2013 9:57:36 PM");
Deleted : user_pref("extensions.asktb.to", "");
Deleted : user_pref("extensions.asktb.v", "3.15.25.100013");
Deleted : user_pref("extensions.asktb.version", "5.15.25.36191");
Deleted : user_pref("extensions.asktb.volume", "");
Deleted : user_pref("extensions.mywebsearch.prevDefaultEngine", "Google");
Deleted : user_pref("extensions.mywebsearch.prevKwdEnabled", true);
Deleted : user_pref("extensions.mywebsearch.prevSelectedEngine", "Ask.com");
Deleted : user_pref("extensions.toolbar.mindspark._39Members_.homepage", "hxxp://home.tb.ask.com/index.jhtml?p[...]
Deleted : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289663&SearchSource=2&CU[...]
Deleted : user_pref("smartbar.addressBarOwnerCTID", "CT3289663");
Deleted : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3289663&CUI=UN127144289[...]
Deleted : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT[...]
Deleted : user_pref("smartbar.defaultSearchOwnerCTID", "CT3289663");
Deleted : user_pref("smartbar.homePageOwnerCTID", "CT3289663");
Deleted : user_pref("smartbar.machineId", "JM+R4TNOJKQRFDDIPF9ROXT0OCGWXN2Q3NBWV3VRKFNKY96JTHDSWDWJC7+7ZYUQFZB[...]
Deleted : user_pref("smartbar.originalHomepage", "hxxp://search.conduit.com/?ctid=CT3289663&CUI=UN127144289513[...]

-\\ Google Chrome v28.0.1500.95

File : C:\Users\Lori\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.1] : icon_url ={"autofill":{"negative_upload_rate":1.0,"positive_upload_rate":1.0},"browser":{"check_default_browse[...]

*************************

AdwCleaner[R1].txt - [153195 octets] - [12/08/2013 15:34:37]
AdwCleaner[R2].txt - [152283 octets] - [16/08/2013 10:39:26]
AdwCleaner[S1].txt - [31001 octets] - [16/08/2013 10:39:56]

########## EOF - C:\AdwCleaner[S1].txt - [31062 octets] ##########
 



#14 dev00790

dev00790

    Bleeping Chocoholic


  • Members
  • 5,037 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:05:41 AM

Posted 16 August 2013 - 11:04 AM

Please run OTL again now as per below:
 
We need to create a New FULL OTL Report

  • Double click on the otlicon.png icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Change the "Extra Registry" option to "SafeList"
  • Push the runscan.png button.
  • Two reports will open, copy and paste them in a reply here:
  • OTL.txt <-- Will be opened
  • Extra.txt <-- Will be minimized

Regards, dev00790

---------------------------------------

Marge: "Homer, the plant called. They said if you don't show up tomorrow don't bother showing up on Monday." Homer: "Woo-hoo! Four-day weekend!"I do not reply to Private Messages (PMs) asking for assistance - please use the forums instead. If I have been helping you, and I have not replied to your latest post in 48 hours please send me a PM. My Blog


#15 webdzyner

webdzyner
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:41 AM

Posted 16 August 2013 - 01:33 PM

OTL logfile created on: 8/16/2013 1:58:40 PM - Run 3
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Lori\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
3.61 Gb Total Physical Memory | 2.15 Gb Available Physical Memory | 59.71% Memory free
7.21 Gb Paging File | 5.16 Gb Available in Paging File | 71.60% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 449.55 Gb Total Space | 387.69 Gb Free Space | 86.24% Space Free | Partition Type: NTFS
 
Computer Name: LORI-PC | User Name: Lori | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013/08/15 15:22:02 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Lori\Desktop\OTL.exe
PRC - [2013/08/15 08:49:59 | 001,643,184 | ---- | M] (AVG Secure Search) -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe
PRC - [2013/07/25 13:40:02 | 001,432,080 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgfws.exe
PRC - [2013/07/23 19:09:28 | 000,283,136 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe
PRC - [2013/07/04 15:53:10 | 004,939,312 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe
PRC - [2013/07/01 01:46:26 | 004,411,440 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgui.exe
PRC - [2013/05/11 06:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2013/04/04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2013/03/22 06:07:18 | 000,093,072 | ---- | M] (TomTom) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
PRC - [2013/03/22 06:07:16 | 000,248,208 | ---- | M] (TomTom) -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
PRC - [2013/02/05 11:48:44 | 000,272,248 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
PRC - [2012/04/03 13:33:00 | 000,940,168 | ---- | M] (CANON INC.) -- C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.EXE
PRC - [2012/04/03 13:27:16 | 001,087,608 | ---- | M] (CANON INC.) -- C:\Program Files (x86)\Canon\Quick Menu\CNQMUPDT.EXE
PRC - [2012/04/03 13:26:14 | 001,273,448 | ---- | M] (CANON INC.) -- C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE
PRC - [2012/03/26 17:35:16 | 000,449,168 | ---- | M] (CANON INC.) -- C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
PRC - [2011/11/03 17:20:58 | 000,803,144 | ---- | M] (AVG) -- C:\Program Files (x86)\AVG\AVG PC Tuneup\BoostSpeed.exe
PRC - [2011/09/06 07:02:20 | 000,140,456 | ---- | M] () -- C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
PRC - [2011/09/01 17:47:26 | 000,090,448 | ---- | M] (Research In Motion Limited) -- C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
PRC - [2011/07/19 11:59:30 | 000,126,392 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012/05/30 20:06:48 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012/05/30 20:06:30 | 001,242,512 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2012/03/19 11:11:51 | 012,079,104 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\System.Web\3420481899719b86b8bb597ad0cf0db0\System.Web.ni.dll
MOD - [2012/03/19 11:11:30 | 000,771,584 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\9eb937785d5a8bc2767ae7efcdd29d43\System.Runtime.Remoting.ni.dll
MOD - [2012/03/19 11:10:10 | 001,782,272 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\b74e1ad9110a39851b12cb46b3954163\System.Xaml.ni.dll
MOD - [2012/03/16 17:08:43 | 013,138,432 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\edfa0f31cc4950e16011ecb549f553f7\System.Windows.Forms.ni.dll
MOD - [2012/03/16 17:08:01 | 001,652,736 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\9d5b252266a6084a611b2be84fac9e1c\System.Drawing.ni.dll
MOD - [2012/03/16 17:07:59 | 018,000,384 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\bdf555b4cfed144a3b0b60e0308cbf2b\PresentationFramework.ni.dll
MOD - [2012/03/16 17:07:45 | 000,595,968 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\9dbdf77b1208ccfea1b67b50084c3f1a\PresentationFramework.Aero.ni.dll
MOD - [2012/03/16 17:07:13 | 011,450,880 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\37cfa5ae8473995db30414fa29167c28\PresentationCore.ni.dll
MOD - [2012/03/16 17:07:10 | 005,617,664 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\System.Xml\a588133985ef7510d4cc8cc7924f8ec3\System.Xml.ni.dll
MOD - [2012/03/16 17:07:00 | 000,982,528 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\1702c5e18cdd96c022d87c38561f19c9\System.Configuration.ni.dll
MOD - [2012/03/16 17:06:56 | 007,069,696 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\System.Core\b6ac99f2787a9a672d7a696ef25588ee\System.Core.ni.dll
MOD - [2012/03/16 17:06:44 | 003,857,920 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\6be8cdc102f384653338279eff1f78fd\WindowsBase.ni.dll
MOD - [2012/03/16 17:06:35 | 009,091,584 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\System\9c4788acc8f93c33214865395cee2e1c\System.ni.dll
MOD - [2012/03/16 17:01:25 | 014,407,680 | ---- | M] () -- C:\windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll
MOD - [2011/11/03 17:21:06 | 000,350,024 | ---- | M] () -- C:\Program Files (x86)\AVG\AVG PC Tuneup\madExcept_.bpl
MOD - [2011/11/03 17:21:06 | 000,184,136 | ---- | M] () -- C:\Program Files (x86)\AVG\AVG PC Tuneup\madBasic_.bpl
MOD - [2011/11/03 17:21:06 | 000,050,504 | ---- | M] () -- C:\Program Files (x86)\AVG\AVG PC Tuneup\madDisAsm_.bpl
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2013/08/13 05:22:04 | 004,390,760 | ---- | M] (Reimage®) [Auto | Running] -- C:\Program Files\eFix\eFix Pro\ReiGuard.exe -- (eFixRealTimeProtection)
SRV:64bit: - [2011/06/10 01:10:00 | 000,138,152 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosSmartSrv.exe -- (TOSHIBA HDD SSD Alert Service)
SRV:64bit: - [2011/06/08 01:54:56 | 000,204,288 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2011/05/17 18:34:18 | 000,574,896 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe -- (TosCoSrv)
SRV:64bit: - [2010/10/20 18:41:00 | 000,138,656 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\SysNative\TODDSrv.exe -- (TODDSrv)
SRV:64bit: - [2010/09/22 21:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2010/09/09 21:26:34 | 000,162,824 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\GFNEXSrv.exe -- (GFNEXSrv)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/08/15 08:49:59 | 001,643,184 | ---- | M] (AVG Secure Search) [Auto | Running] -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.5.0\ToolbarUpdater.exe -- (vToolbarUpdater15.5.0)
SRV - [2013/07/25 13:40:02 | 001,432,080 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgfws.exe -- (avgfws)
SRV - [2013/07/23 19:09:28 | 000,283,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe -- (avgwd)
SRV - [2013/07/04 15:53:10 | 004,939,312 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2013/06/26 10:55:44 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/06/12 11:35:47 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/05/11 06:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2013/03/22 06:07:18 | 000,093,072 | ---- | M] (TomTom) [Auto | Running] -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2013/02/05 11:48:00 | 000,235,216 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe -- (McComponentHostService)
SRV - [2011/09/06 07:02:20 | 000,140,456 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC)
SRV - [2011/08/24 13:59:58 | 000,102,912 | ---- | M] () [Auto | Running] -- C:\Windows\agent_x64.exe -- (Agent)
SRV - [2011/07/19 11:59:30 | 000,126,392 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe -- (PCCUJobMgr)
SRV - [2011/07/11 21:16:06 | 000,057,216 | ---- | M] (TOSHIBA Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\TMachInfo.exe -- (TMachInfo)
SRV - [2010/10/12 13:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013/08/15 08:49:59 | 000,045,856 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtpx64.sys -- (avgtp)
DRV:64bit: - [2013/07/20 01:51:00 | 000,311,608 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgloga.sys -- (Avgloga)
DRV:64bit: - [2013/07/20 01:50:56 | 000,246,072 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avgidsdrivera.sys -- (AVGIDSDriver)
DRV:64bit: - [2013/07/20 01:50:56 | 000,071,480 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgidsha.sys -- (AVGIDSHA)
DRV:64bit: - [2013/07/20 01:50:50 | 000,206,648 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64)
DRV:64bit: - [2013/07/10 01:32:38 | 000,045,880 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:64bit: - [2013/07/01 01:45:28 | 000,116,536 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:64bit: - [2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2013/03/21 03:08:24 | 000,240,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia)
DRV:64bit: - [2012/09/04 10:39:32 | 000,050,296 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgfwd6a.sys -- (Avgfwfd)
DRV:64bit: - [2012/04/25 12:11:36 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011/07/25 17:44:46 | 000,074,752 | ---- | M] (Research In Motion Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RimUsb_AMD64.sys -- (RimUsb)
DRV:64bit: - [2011/07/20 14:58:22 | 000,044,032 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RimSerial_AMD64.sys -- (RimVSerPort)
DRV:64bit: - [2011/06/08 02:42:26 | 009,360,896 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011/06/08 01:16:14 | 000,309,760 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011/03/11 02:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/02/23 21:14:44 | 001,142,376 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rtl8192ce.sys -- (RTL8192Ce)
DRV:64bit: - [2011/02/08 23:07:00 | 000,038,096 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\PGEffect.sys -- (PGEffect)
DRV:64bit: - [2011/02/03 23:59:06 | 001,413,680 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2011/01/13 23:58:30 | 000,413,800 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010/11/20 23:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 23:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 23:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010/11/20 19:23:48 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/10/29 20:11:42 | 000,250,984 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2009/07/31 00:22:04 | 000,027,784 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV:64bit: - [2009/07/14 19:31:18 | 000,026,840 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\TVALZ_O.SYS -- (TVALZ)
DRV:64bit: - [2009/07/13 21:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 21:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 21:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2009/07/13 21:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/13 20:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rootmdm.sys -- (ROOTMODEM)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 16:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV - [2009/07/13 21:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{{67A2568C-7A0A-4EED-AECC-B5405DE63B64}}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNO
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{{67A2568C-7A0A-4EED-AECC-B5405DE63B64}}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNO
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
 
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.toshiba.com/?cid=C001B2Y
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\..\SearchScopes\{{67A2568C-7A0A-4EED-AECC-B5405DE63B64}}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNO
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\..\SearchScopes\{08816A35-CD1C-465B-AE04-EBAA98D3E40F}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3289663&CUI=UN73871753750523154&UM=2&SSPV=TB_CS7
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\..\SearchScopes\{183005AB-3C05-4F7B-A138-6B14B031F557}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000031&src=kw&q={searchTerms}&locale=&apn_ptnrs=TV&apn_dtid=YYYYYYYYUS&apn_uid=C68E932A-D4C9-4A1F-B938-83BA1B3681CD&apn_sauid=378A4EE9-8E5B-4B6C-A1AA-11578E8AE5F8
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\..\SearchScopes\{91607fa7-3c2f-4f90-93e3-d5337a6b0ac2}: "URL" = Playbryte-fa/search/redirect/?type=default&user_id=cd51f4cb-364c-4024-bee9-e95021886bb6&query={searchTerms}
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\..\SearchScopes\{A5FF1B30-197E-4C1A-955C-BD4CA91AB119}: "URL" = http://www.google.com/search?sourceid=ie9&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSNO_enUS475
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>;*.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com"
FF - prefs.js..extensions.enabledAddons: save-as-pdf-ff%40pdfcrowd.com:1.5
FF - prefs.js..extensions.enabledAddons: %7Be001c731-5e37-4538-a5cb-8168736a2360%7D:0.9.9.119
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\6\NP_wtapp.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/08/16 10:40:33 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.5\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2013/04/30 11:31:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.5\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/08/16 10:40:33 | 000,000,000 | ---D | M]
 
[2013/05/12 11:46:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lori\AppData\Roaming\Mozilla\Extensions
[2013/05/12 11:46:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lori\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com
[2013/08/16 10:40:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\extensions
[2013/07/22 09:40:49 | 000,000,000 | ---D | M] (Bitdefender QuickScan) -- C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2013/05/25 11:54:42 | 002,168,615 | ---- | M] () (No name found) -- C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\extensions\firebug@software.joehewitt.com.xpi
[2013/04/09 08:44:34 | 000,057,194 | ---- | M] () (No name found) -- C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\extensions\save-as-pdf-ff@pdfcrowd.com.xpi
[2012/06/15 21:01:51 | 000,002,556 | ---- | M] () -- C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\searchplugins\aol-search.xml
[2013/08/05 18:01:53 | 000,009,611 | ---- | M] () -- C:\Users\Lori\AppData\Roaming\Mozilla\Firefox\Profiles\dnz2vh1q.default\searchplugins\ask-web-search.xml
[2013/06/26 10:55:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2013/06/26 10:55:46 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
 
========== Chrome  ==========
 
CHR - Extension: No name found = C:\Users\Lori\AppData\Local\Google\Chrome\User Data\Default\Extensions\mjheggmdlcjcpogghlofgpmgdfpigpia\2.0.2_0\
 
O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: []  File not found
O4:64bit: - HKLM..\Run: [RtHDVBg_Dolby] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [TCrdMain] C:\Program Files\Toshiba\FlashCards\TCrdMain.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosNC] C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosReelTimeMonitor] C:\Program Files\Toshiba\ReelTime\TosReelTimeMonitor.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosSENotify] C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TosVolRegulator] C:\Program Files\Toshiba\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation)
O4:64bit: - HKLM..\Run: [TPwrMain] C:\Program Files\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CanonQuickMenu] C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [IJNetworkScannerSelectorEX] C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (CANON INC.)
O4 - HKLM..\Run: [NortonOnlineBackupReminder] C:\Program Files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe (Toshiba)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [ToshibaAppPlace] C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe (Toshiba)
O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001..\Run: [ConduitFloatingPlugin_nemfjadlboooiffmcelkafilagddogim] "C:\windows\SysWOW64\Rundll32.exe" "C:\Program Files (x86)\Conduit\CT3289663\plugins\TBVerifier.dll",RunConduitFloatingPlugin nemfjadlboooiffmcelkafilagddogim File not found
O4 - HKU\S-1-5-21-3520010411-1014150396-3825380658-1001..\Run: [TomTomHOME.exe] C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O4 - HKU\.DEFAULT..\RunOnce: [KodakHomeCenter] "C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe" File not found
O4 - HKU\S-1-5-18..\RunOnce: [KodakHomeCenter] "C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe" File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 10.9.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9CCC4D28-A371-4BD3-B1B8-C188E5D35400}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F9FC772F-013F-45A2-A91E-F5C28A7B4561}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll File not found
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{54090621-8977-11e1-ae47-e840f235bf50}\Shell - "" = AutoRun
O33 - MountPoints2\{54090621-8977-11e1-ae47-e840f235bf50}\Shell\AutoRun\command - "" = E:\videoconvert.exe
O33 - MountPoints2\{d232b7e6-6c02-11e2-a058-e840f235bf50}\Shell - "" = AutoRun
O33 - MountPoints2\{d232b7e6-6c02-11e2-a058-e840f235bf50}\Shell\AutoRun\command - "" = C:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL TL-Bootstrap.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\videoconvert.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/08/15 15:21:58 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Lori\Desktop\OTL.exe
[2013/08/15 10:07:45 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Roaming\AVG2013
[2013/08/15 10:03:18 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Roaming\TuneUp Software
[2013/08/15 10:00:44 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2013
[2013/08/15 09:11:46 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Local\MFAData
[2013/08/15 09:11:46 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Local\Avg2013
[2013/08/12 15:21:47 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Local\CRE
[2013/08/10 12:26:12 | 000,000,000 | -H-D | C] -- C:\ProgramData\CanonIJMyPrinter
[2013/08/08 13:37:08 | 000,688,992 | R--- | C] (Swearware) -- C:\Users\Lori\Desktop\dds.com
[2013/07/29 09:12:15 | 000,000,000 | ---D | C] -- C:\ProgramData\CDB
[2013/07/28 13:26:23 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Roaming\kompozer.net
[2013/07/28 13:26:23 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Local\kompozer.net
[2013/07/28 13:26:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KompoZer
[2013/07/28 13:26:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\KompoZer
[2013/07/25 15:07:44 | 000,000,000 | ---D | C] -- C:\Recovery
[2013/07/25 15:07:44 | 000,000,000 | ---D | C] -- C:\PerfLogs
[2013/07/25 14:00:36 | 000,000,000 | ---D | C] -- C:\eFixUndo
[2013/07/25 13:44:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eFix Pro
[2013/07/25 13:44:33 | 000,000,000 | ---D | C] -- C:\Program Files\eFix
[2013/07/25 13:44:24 | 000,000,000 | ---D | C] -- C:\rei
[2013/07/22 09:42:26 | 000,000,000 | ---D | C] -- C:\Users\Lori\AppData\Roaming\QuickScan
[2013/07/20 01:51:00 | 000,311,608 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\drivers\avgloga.sys
[2013/07/20 01:50:56 | 000,246,072 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\drivers\avgidsdrivera.sys
[2013/07/20 01:50:56 | 000,071,480 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\drivers\avgidsha.sys
[2013/07/20 01:50:50 | 000,206,648 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\drivers\avgldx64.sys
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
[1 C:\Users\Lori\Documents\*.tmp files -> C:\Users\Lori\Documents\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013/08/16 13:57:07 | 000,000,912 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/08/16 13:57:07 | 000,000,830 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job
[2013/08/16 13:56:53 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2013/08/16 12:20:33 | 000,024,608 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/08/16 12:20:33 | 000,024,608 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/08/16 10:49:24 | 000,796,230 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
[2013/08/16 10:49:24 | 000,672,950 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
[2013/08/16 10:49:24 | 000,125,618 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
[2013/08/16 10:43:12 | 000,000,908 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/08/16 10:43:03 | 000,000,350 | ---- | M] () -- C:\windows\tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
[2013/08/16 10:43:02 | 000,000,354 | ---- | M] () -- C:\windows\tasks\ROC_JAN2013_TB_rmv.job
[2013/08/16 10:42:27 | 2904,616,960 | -HS- | M] () -- C:\hiberfil.sys
[2013/08/16 10:40:50 | 000,000,121 | ---- | M] () -- C:\windows\DeleteOnReboot.bat
[2013/08/15 15:35:45 | 000,000,904 | ---- | M] () -- C:\windows\SysNative\ScanResults.xml
[2013/08/15 15:34:10 | 000,001,056 | ---- | M] () -- C:\windows\SysNative\SettingsFile
[2013/08/15 15:22:02 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Lori\Desktop\OTL.exe
[2013/08/15 10:03:19 | 000,000,936 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk
[2013/08/15 08:50:58 | 000,003,715 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefoxavg-secure-search.xml
[2013/08/15 08:49:59 | 000,045,856 | ---- | M] (AVG Technologies) -- C:\windows\SysNative\drivers\avgtpx64.sys
[2013/08/14 09:30:54 | 000,897,024 | ---- | M] () -- C:\Users\Lori\AppData\Roaming\SharedSettings.ccs
[2013/08/13 14:55:06 | 000,000,102 | ---- | M] () -- C:\Users\Lori\Desktop\cPix.ini
[2013/08/08 13:37:11 | 000,688,992 | R--- | M] (Swearware) -- C:\Users\Lori\Desktop\dds.com
[2013/08/05 21:32:29 | 000,081,546 | ---- | M] () -- C:\Users\Lori\Documents\David Reed resume.pdf
[2013/07/28 13:26:18 | 000,000,918 | ---- | M] () -- C:\Users\Public\Desktop\KompoZer.lnk
[2013/07/26 14:03:45 | 006,221,721 | ---- | M] () -- C:\Users\Lori\Documents\multiple-sclerosis-treatment-guide.pdf
[2013/07/25 15:29:58 | 000,417,672 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT
[2013/07/25 15:29:29 | 000,001,532 | ---- | M] () -- C:\windows\SysNative\reimage.rep
[2013/07/25 15:07:41 | 000,000,171 | ---- | M] () -- C:\windows\efix.ini
[2013/07/25 15:07:04 | 000,001,425 | ---- | M] () -- C:\Users\Lori\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/07/25 14:01:00 | 000,009,728 | ---- | M] () -- C:\windows\SysNative\Native.exe
[2013/07/25 13:44:43 | 000,001,751 | ---- | M] () -- C:\Users\Public\Desktop\eFix Pro.lnk
[2013/07/22 20:22:24 | 000,185,710 | ---- | M] () -- C:\Users\Lori\Documents\1040_book.pdf
[2013/07/22 10:36:13 | 000,206,072 | ---- | M] () -- C:\Users\Lori\Documents\scans.pdf
[2013/07/20 01:51:00 | 000,311,608 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\drivers\avgloga.sys
[2013/07/20 01:50:56 | 000,246,072 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\drivers\avgidsdrivera.sys
[2013/07/20 01:50:56 | 000,071,480 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\drivers\avgidsha.sys
[2013/07/20 01:50:50 | 000,206,648 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\windows\SysNative\drivers\avgldx64.sys
[1 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
[1 C:\Users\Lori\Documents\*.tmp files -> C:\Users\Lori\Documents\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/08/16 10:40:21 | 000,000,121 | ---- | C] () -- C:\windows\DeleteOnReboot.bat
[2013/08/15 10:03:19 | 000,000,936 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2013.lnk
[2013/08/12 14:14:24 | 000,001,056 | ---- | C] () -- C:\windows\SysNative\SettingsFile
[2013/08/05 21:32:28 | 000,081,546 | ---- | C] () -- C:\Users\Lori\Documents\David Reed resume.pdf
[2013/07/29 09:15:43 | 000,000,904 | ---- | C] () -- C:\windows\SysNative\ScanResults.xml
[2013/07/28 13:26:18 | 000,000,918 | ---- | C] () -- C:\Users\Public\Desktop\KompoZer.lnk
[2013/07/26 14:03:43 | 006,221,721 | ---- | C] () -- C:\Users\Lori\Documents\multiple-sclerosis-treatment-guide.pdf
[2013/07/25 15:29:27 | 000,001,532 | ---- | C] () -- C:\windows\SysNative\reimage.rep
[2013/07/25 15:12:12 | 000,001,391 | ---- | C] () -- C:\Users\Lori\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2013/07/25 14:01:00 | 000,009,728 | ---- | C] () -- C:\windows\SysNative\Native.exe
[2013/07/25 13:44:43 | 000,001,751 | ---- | C] () -- C:\Users\Public\Desktop\eFix Pro.lnk
[2013/07/25 13:43:20 | 000,000,171 | ---- | C] () -- C:\windows\efix.ini
[2013/07/22 20:22:23 | 000,185,710 | ---- | C] () -- C:\Users\Lori\Documents\1040_book.pdf
[2013/07/22 10:36:11 | 000,206,072 | ---- | C] () -- C:\Users\Lori\Documents\scans.pdf
[2013/06/26 09:09:13 | 000,003,715 | ---- | C] () -- C:\Program Files (x86)\Mozilla Firefoxavg-secure-search.xml
[2013/06/10 17:03:33 | 000,007,609 | ---- | C] () -- C:\Users\Lori\AppData\Local\Resmon.ResmonCfg
[2012/06/07 20:02:26 | 000,039,095 | ---- | C] () -- C:\windows\iccsigs.dat
[2012/06/07 20:02:23 | 000,112,688 | ---- | C] () -- C:\windows\SysWow64\shw32.dll
[2012/05/29 14:52:53 | 000,006,144 | ---- | C] () -- C:\Users\Lori\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/05/13 19:31:56 | 000,000,080 | ---- | C] () -- C:\windows\mapforms.ini
[2012/04/26 16:28:53 | 000,001,569 | ---- | C] () -- C:\Users\Lori\.recently-used.xbel
[2012/04/20 18:32:54 | 000,897,024 | ---- | C] () -- C:\Users\Lori\AppData\Roaming\SharedSettings.ccs
[2012/04/07 15:41:50 | 000,102,912 | ---- | C] () -- C:\windows\agent_x64.exe
[2012/03/12 23:09:16 | 000,773,050 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI
[2012/03/12 21:35:00 | 000,000,659 | ---- | C] () -- C:\windows\fpexplor.ini
[2012/01/27 22:32:59 | 000,451,072 | ---- | C] () -- C:\windows\SysWow64\ISSRemoveSP.exe
[2012/01/27 22:28:06 | 000,128,312 | ---- | C] () -- C:\windows\SysWow64\GFNEX.dll
[2012/01/27 22:27:06 | 000,000,000 | ---- | C] () -- C:\windows\ativpsrm.bin
[2012/01/27 22:24:06 | 000,003,929 | ---- | C] () -- C:\windows\SysWow64\atipblag.dat
 
========== ZeroAccess Check ==========
 
[2009/07/14 00:55:00 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2010/11/20 19:23:56 | 014,174,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2010/11/20 19:24:04 | 012,872,192 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 21:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 23:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 21:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:0B4227B4

< End of report >
 

 

Extra.txt file

 

OTL Extras logfile created on: 8/16/2013 1:58:40 PM - Run 3
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Lori\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
3.61 Gb Total Physical Memory | 2.15 Gb Available Physical Memory | 59.71% Memory free
7.21 Gb Paging File | 5.16 Gb Available in Paging File | 71.60% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 449.55 Gb Total Space | 387.69 Gb Free Space | 86.24% Space Free | Partition Type: NTFS
 
Computer Name: LORI-PC | User Name: Lori | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-3520010411-1014150396-3825380658-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03431340-DB60-43F3-98AE-AF5476AE6343}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{04698A2E-43E6-49F0-949C-AD752C7AFF6A}" = lport=4481 | protocol=6 | dir=in | name=blackberry desktop software wireless music sync data transfer |
"{065CFB33-98BD-4BCA-B6D7-A62ABA138D1D}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe |
"{077E4298-3F6E-4A6C-90B1-8D41CB48478E}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{173FED1B-5308-42CD-8940-C68235FC4CC8}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{1E986DE8-1A6D-4BE8-89D5-11F6B7151130}" = lport=9322 | protocol=6 | dir=in | name=ekdiscovery |
"{2123E100-8862-4D9A-BA43-A3B43AD726CE}" = lport=4482 | protocol=6 | dir=in | name=blackberry desktop software wireless music sync data transfer |
"{2BB12153-28CF-4AB4-BFB1-341E836B8A29}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2F82C531-4986-406E-97BC-C51A8BB4B1DB}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{4890F0B9-E254-4A49-8160-63C970F40501}" = lport=445 | protocol=6 | dir=in | app=system |
"{4ED04A13-EEFF-4E1B-9DB3-91B2822DC871}" = lport=139 | protocol=6 | dir=in | app=system |
"{5031B5D8-7CD4-46A7-A098-79E59691AEAE}" = lport=4481 | protocol=17 | dir=in | name=blackberry desktop software wireless music sync discovery |
"{6901F3B9-F41C-40D1-8A20-1A365AD117B6}" = rport=139 | protocol=6 | dir=out | app=system |
"{84BEAD2D-71DA-48E3-A0E8-AC78CA89226F}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{86921185-FBBA-421C-A7A1-BDEA7DCE797B}" = lport=2869 | protocol=6 | dir=in | app=system |
"{8865D75C-3A3C-4978-88BF-ED61C711E162}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8A5E42A6-D909-4455-9A9D-B9F007D9B2E9}" = lport=137 | protocol=17 | dir=in | app=system |
"{950C4564-581E-406F-887D-0FB24BC5B5D1}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A0F967AE-A67D-4FA1-B8A8-55C029B26ACF}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A154014A-1C4F-4827-B557-33FE701E0CC1}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AA7BA581-8BEB-414C-B7A9-D69F5ABF775C}" = rport=138 | protocol=17 | dir=out | app=system |
"{AB94CA42-BD8C-4972-AB17-E09AC1EB1747}" = lport=5353 | protocol=17 | dir=in | name=bonjour port 5353 |
"{B20F29C0-6772-474D-915D-ED26F9680973}" = lport=4482 | protocol=17 | dir=in | name=blackberry desktop software wireless music sync discovery |
"{C51DBD11-22A9-4961-A27E-7AD3C13A0608}" = lport=5353 | protocol=17 | dir=in | name=bonjour port 5353 |
"{D8729888-884A-45BE-8F69-261A7F78E3D8}" = rport=10243 | protocol=6 | dir=out | app=system |
"{D9C6B7EC-D09B-4720-BF8D-2E06EE4EFB13}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{E104B90E-381C-4CB4-8141-59913E51E5C7}" = lport=10243 | protocol=6 | dir=in | app=system |
"{EC67B51C-4916-4FEE-BF14-E7FF7D303835}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{EEB7D876-3B68-48C2-92D4-F56C01521692}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F24A55FB-3D52-471C-9B65-6F9A071B4F9D}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{FB8D17F1-4C7C-4C88-A558-4B0845CC322F}" = rport=137 | protocol=17 | dir=out | app=system |
"{FC68EE82-EA78-4FEA-8E7C-0613B2FF7B40}" = rport=445 | protocol=6 | dir=out | app=system |
"{FE6419F5-C314-423E-A82D-24D97B935B8D}" = lport=138 | protocol=17 | dir=in | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{089712CF-E923-49D7-8A56-AF86EA07957B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{12EBBD52-1628-4C96-86BB-FCE80D389E50}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{18F467E7-80CC-4F29-B9A7-87549BE23776}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{21907ED3-5D08-4812-9ECA-2CBF742B63A1}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{24EC0F09-8EB6-4036-BC27-8A65859A3725}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{28E4DBE9-DA24-416E-9EF9-392861AB3DB4}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{29E78D6F-6D06-4E60-B9BC-28DAA93E32CC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{29FF6FAB-F56C-4A15-A4B5-EC06E7B16B95}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgnsa.exe |
"{2B136440-B4E7-45E7-88D0-A7D6CE08F00D}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2012\avgmfapx.exe |
"{380233EB-DA34-438B-8B2C-E1F5B6E94F26}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{44B447DE-6461-4052-965D-31A43C42A3B5}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{46BB3C57-14BD-4DBF-B7B6-27B2DFF325A1}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{46DDC5BD-F451-4E60-A340-40FA46074860}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2012\avgmfapx.exe |
"{4E43340C-D138-45D8-AEDF-DA91CC85F553}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{50B8EEDB-8326-4246-A20A-B0A123698178}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{564BAC63-1640-4125-BAD0-99E0F82EE883}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgdiagex.exe |
"{58AF9F77-9567-40C3-AEFF-483DB31609E5}" = protocol=17 | dir=in | app=c:\program files (x86)\research in motion\blackberry desktop\rim.desktop.exe |
"{5C926C0C-45A8-4667-88AA-8A4DCE22A182}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgemca.exe |
"{5E169A3A-162D-4FDD-838A-20C2E4B28416}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgdiagex.exe |
"{602D0160-3D9B-45B8-8C9B-F7CA259AFA57}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{604D209E-F74A-459D-893C-59AF8DF375A0}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{77A3C253-D323-44E4-9F90-B5B3D3333C3B}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe |
"{95D213B4-E884-49CC-B200-DE69E6020B69}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgemca.exe |
"{97839BF1-3A7A-48CE-B87D-15D4556CBD55}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{97BA9A74-056E-4822-9AAA-3324A8F47FBC}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe |
"{A011F677-2C1C-4826-BC79-14C6D807958E}" = protocol=6 | dir=out | app=system |
"{A50FC5C7-A148-4FB0-ACF8-ADD450472D2D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A5BDC013-D8B2-4A94-BD7B-C8D843ACACFF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AA957EF3-A683-4887-A276-D5E7947C3307}" = protocol=6 | dir=in | app=c:\program files (x86)\research in motion\blackberry desktop\rim.desktop.exe |
"{B94D950E-7C5C-4827-A706-200791816017}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C09AD2EE-8D3A-4738-9FB2-A50BCD5EEA31}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{C56908CC-3124-4461-A0CC-F4ECD889CD72}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D567EFE1-59B4-4D6B-AFC6-7A9D8B9E011B}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{D6CB9C3A-02C3-4C0B-A070-650DB983E9D7}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{DFB95548-9832-41D9-92BF-E4268BA39E4C}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{E11951FC-0186-4F9D-8F92-853885ACCD89}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E74C3EE3-7283-45D3-BB6B-025F812B3FD6}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgnsa.exe |
"{EF580852-AC1D-45C8-8D7A-A8D0A6E0AA2D}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{EFD07E73-91BB-4FD3-BE86-D4E92E7543D9}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{F654AE64-7B06-4FC3-81D6-FDC68DA75F66}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{F65EF4AF-134D-4EBC-BC5C-686D3CBFC1EA}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{FEBCA0A1-4BD8-400D-8AC7-52A1E3C623AD}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG3200_series" = Canon MG3200 series MP Drivers
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1C8C049A-145F-4A6E-8290-B5C245EBE39D}" = TOSHIBA Bulletin Board
"{21B133D6-5979-47F0-BE1C-F6A6B304693F}" = Visual Studio 2010 x64 Redistributables
"{237E305C-B625-466A-88CE-1E121BF4FDB1}" = Send To Neat
"{24811C12-F4A9-4D0F-8494-A7B8FE46123C}" = TOSHIBA ReelTime
"{4ACA5AE7-E68C-5A48-F8E6-D67946267506}" = ATI Catalyst Install Manager
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4FF9E8AA-D554-4CE7-89F9-B69DAA5A1E98}" = AVG 2013
"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6316805C-2485-2FF5-974C-750E3BE1DF65}" = AMD Media Foundation Decoders
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}" = Apple Mobile Device Support
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{7EA2D88A-C8B7-4102-8644-0A437B6FC143}" = Neat Mobile Scanner Driver
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{840A3BAA-4C68-4581-9C7A-6F8D6CF531B9}" = iTunes
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{8A2BC7D4-A7D3-45D5-B3D2-394718C53C41}" = Neat ADF Scanner 2008 Driver
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010
"{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A34D9B7F-8453-DA02-DC98-EEEE085411C6}" = ccc-utility64
"{A55F1206-BFA7-4027-92B8-CE4EFDBC3CF2}" = Neat ADF Scanner Driver
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{D1108D4B-72F8-419F-88C5-ABB8DC09B3C7}" = Neat Mobile Scanner (Silver) Driver
"{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
"{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}" = Microsoft SQL Server Compact 3.5 SP2 x64 ENU
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
"{DDE25FC9-892D-4D24-9325-3BAA5C15ACA9}" = Neat Mobile Scanner 2008 Driver
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{E74BF83C-2CA5-48EF-901F-959309E7D9EC}" = AVG 2013
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F67FA545-D8E5-4209-86B1-AEE045D1003F}" = TOSHIBA Face Recognition
"AVG" = AVG 2013
"eFix Pro" = eFix Pro
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"SynTPDeinstKey" = Synaptics Pointing Device Driver
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0146E330-EEE7-B924-B347-B399460893ED}" = CCC Help Czech
"{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
"{09927C92-A652-057A-3A7B-153F23175C58}" = CCC Help Dutch
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D795777-9D60-4692-8386-F2B3F2B5E5BF}" = Label@Once 1.0
"{109CBCC5-7151-1CC6-DAD6-6F7DD3162A8A}" = Catalyst Control Center InstallProxy
"{1111706F-666A-4037-7777-210328764D10}" = JavaFX 2.1.0
"{119826A8-4EF6-4BE5-A88B-D2D81FA7CEE2}" = TOSHIBA Supervisor Password
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{19E40731-8E1A-07FB-DA7D-8A54603F6408}" = CCC Help English
"{1B97813D-74A7-25EB-4837-792413507E82}" = CCC Help Danish
"{1CF94211-A7BB-8151-44B8-6618C5A162F8}" = CCC Help Portuguese
"{1D7FEEAC-6CEE-5B5F-A8B0-9BE7A6BCB7FB}" = CCC Help Chinese Traditional
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20aa4150-b5f4-11de-8a39-0800200c9a66}_is1" = KompoZer 0.8b3
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{247E03D2-485B-7A70-BF5C-AB9BDF6AFB44}" = CCC Help Polish
"{26A24AE4-039D-4CA4-87B4-2F83216025FF}" = Java™ 6 Update 25
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2EEFB3C4-4706-C2B5-DF69-CF914D87BCE4}" = CCC Help Swedish
"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App
"{2FD5D2C5-A7A1-4065-89BA-90542BF7CCD3}" = TOSHIBA Hardware Setup
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{337FDED7-D27B-E476-E888-3674E1C01C69}" = CCC Help Spanish
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3A9FC03D-C685-4831-94CF-4EDFD3749497}" = Microsoft SQL Server Compact 3.5 SP2 ENU
"{3E2D9049-CB69-11D2-94EC-00A0C90683DA}" = VBA (2720)
"{4485C9D0-A742-F1BB-C0B0-58FC61960D99}" = CCC Help Korean
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50316C0A-CC2A-460A-9EA5-F486E54AC17D}_is1" = AVG PC Tuneup
"{553C904F-57A2-4113-888E-BA0C3D1C69C0}" = Microsoft VC9 runtime libraries
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5AF550B4-BB67-4E7E-82F1-2C4300279050}" = TOSHIBARegistration
"{666E35A7-A224-E3E9-48C2-C641837535D9}" = Catalyst Control Center Localization All
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6F3C8901-EBD3-470D-87F8-AC210F6E5E02}" = TOSHIBA Web Camera Application
"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-toshiba" = WildTangent Games App (Toshiba Games)
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{8064A378-46F4-4A4E-8AF5-153D0D4018DD}" = Catalyst Control Center - Branding
"{83601916-2E71-F1C7-EE5F-A1C985BC9217}" = CCC Help German
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{88741A14-4C9D-469F-BA36-8FDF6037BB68}" = CoffeeCup Direct FTP
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A34A135-D405-DD03-9B2E-0EB99238A312}" = CCC Help Finnish
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0015-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.SingleImage_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0409-1000-0000000FF1CE}_Office14.SingleImage_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-002C-0409-0000-0000000FF1CE}_Office14.SingleImage_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-006E-0409-0000-0000000FF1CE}_Office14.SingleImage_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}_Office14.SingleImage_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0116-0409-1000-0000000FF1CE}_Office14.SingleImage_{D6C6B46A-6CE1-4561-84A0-EFD58B8AB979}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}_Office14.SingleImage_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{9550EA6C-4CBE-C1F3-1E1C-5E87F2C645ED}" = CCC Help French
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{970472D0-F5F9-4158-A6E3-1AE49EFEF2D3}" = TOSHIBA Application Installer
"{97F67013-3076-4261-DC10-808409655042}" = AMD VISION Engine Control Center
"{986BB897-C295-2FED-8DCA-4ADE3AFCEF84}" = CCC Help Russian
"{99432E4C-1189-4887-9D75-DAA796015FFD}" = Neat Core Files
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D318C86-AF4C-409F-A6AC-7183FF4CF424}" = Internet TV for Windows Media Center
"{9D3D8C60-A55F-4fed-B2B9-173001290E16}" = Realtek WLAN Driver
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A4FF8F4E-D665-712B-07EE-F03ED360E9BE}" = CCC Help Italian
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC6569FA-6919-442A-8552-073BE69E247A}" = TOSHIBA Service Station
"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.03)
"{ADB50F70-98FF-067F-DF39-47DD83E32D58}" = CCC Help Chinese Standard
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Media Creator
"{B83FCE14-53D5-CBF8-87E9-59B8968ADB4C}" = CCC Help Norwegian
"{C2A276E3-154E-44DC-AAF1-FFDD7FD30E35}" = TOSHIBA Assist
"{C31337DE-0CDC-45A9-9A32-F099AC78D557}" = Toshiba Book Place
"{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}" = Toshiba Online Backup
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C779648B-410E-4BBA-B75B-5815BCEFE71D}" = Safari
"{C78E3449-4F24-839B-5F7A-6911C67A5BE9}" = Catalyst Control Center Graphics Previews Common
"{C7A4F26F-F9B0-41B2-8659-99181108CDE3}" = TOSHIBA Media Controller
"{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}" = PlayReady PC Runtime x86
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D6E90970-BA9C-51AA-EFA2-9F80A7AE0956}" = CCC Help Thai
"{D826A52E-0AC9-5A55-61B8-0E088477A1B0}" = CCC Help Greek
"{DA5BDB2A-12F0-4343-8351-21AAEB293990}" = PreReq
"{DA84ECBF-4B79-47F2-B34C-95C38484C058}" = Skype Launcher
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E69540AC-FFC3-5519-F925-5ACC8D20DED5}" = CCC Help Hungarian
"{E69992ED-A7F6-406C-9280-1C156417BC49}" = TOSHIBA Quality Application
"{E9D96BD5-7D33-7ED3-0A8E-229FA2524487}" = CCC Help Turkish
"{EC5F4C1B-F838-4CB7-8561-8F809296428B}" = TomTom HOME
"{ED3CBA78-488F-4E8C-B33F-8E3BF4DDB4D2}" = Toshiba App Place
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F909BB1B-3FC1-4EDA-AF1F-8F1A89163591}" = BlackBerry Desktop Software 6.1
"{F931F27F-A967-982A-9226-494787D5FBBB}" = CCC Help Japanese
"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.15
"BlackBerry_Desktop" = BlackBerry Desktop Software 6.1
"Canon MG3200 series On-screen Manual" = Canon MG3200 series On-screen Manual
"Canon MG3200 series User Registration" = Canon MG3200 series User Registration
"Canon MX450 series On-screen Manual" = Canon MX450 series On-screen Manual
"Canon My Image Garden" = Canon My Image Garden
"Canon My Image Garden Design Files" = Canon My Image Garden Design Files
"Canon_IJ_Network_Scanner_Selector_EX" = Canon IJ Network Scanner Selector EX
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"Canon_IJ_Scan_Utility" = Canon IJ Scan Utility
"CANONIJPLM100" = Canon Inkjet Printer/Scanner/Fax Extended Survey Program
"CanonMyPrinter" = Canon My Printer
"CanonQuickMenu" = Canon Quick Menu
"CoffeeCup Flash FireStarter" = CoffeeCup Flash FireStarter
"CoffeeCup Image Mapper" = CoffeeCup Image Mapper
"Corel Applications" = Corel Applications
"Easy-WebPrint EX" = Canon Easy-WebPrint EX
"FileZilla Client" = FileZilla Client 3.5.3
"Google Chrome" = Google Chrome
"Image Composer" = Microsoft Image Composer 1.5
"InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}" = TOSHIBA Value Added Package
"InstallShield_{1C8C049A-145F-4A6E-8290-B5C245EBE39D}" = TOSHIBA Bulletin Board
"InstallShield_{24811C12-F4A9-4D0F-8494-A7B8FE46123C}" = TOSHIBA ReelTime
"InstallShield_{6F3C8901-EBD3-470D-87F8-AC210F6E5E02}" = TOSHIBA Web Camera Application
"InstallShield_{F67FA545-D8E5-4209-86B1-AEE045D1003F}" = TOSHIBA Face Recognition
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"McAfee Security Scan" = McAfee Security Scan Plus
"Mozilla Firefox 22.0 (x86 en-US)" = Mozilla Firefox 22.0 (x86 en-US)
"Mozilla Thunderbird 17.0.5 (x86 en-US)" = Mozilla Thunderbird 17.0.5 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Neat" = Neat
"NortonPCCheckup" = Toshiba Laptop Checkup
"Office14.SingleImage" = Microsoft Office Home and Student 2010
"PrintProjects" = PrintProjects
"WildTangent toshiba Master Uninstall" = WildTangent Games
"WildTangent wildgames Master Uninstall" = WildTangent Games
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinLiveSuite" = Windows Live Essentials
"WTA-06f2ba5f-f4b5-4f20-af7c-028a19a83ff2" = RollerCoaster Tycoon 3: Platinum
"WTA-16526fe9-bf90-4c4c-8050-b007191835c9" = FATE - The Traitor Soul
"WTA-2bc79d7c-a86c-4daa-8a37-05da08291913" = Bejeweled 3
"WTA-4a8991fd-8827-42f5-9842-9a76baf77470" = Plants vs. Zombies - Game of the Year
"WTA-4d4735fb-8fd3-439e-aee5-ae82d620f36e" = Zuma's Revenge
"WTA-764c186e-f649-48fb-aaaf-a1584b94358a" = Tales of Lagoona
"WTA-d996f850-3894-4ce5-a0f9-8b211fee697a" = Jewel Quest Solitaire 2
"WTA-df3228af-b82c-4751-9acb-2c0b87a5fc6c" = Polar Bowler
"WTA-e02dcfbb-419b-4cee-8ab1-668e36c27a53" = Letters from Nowhere 2
"WTA-e853c907-028a-4e33-94c6-0d8c230070e6" = Penguins!
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-3520010411-1014150396-3825380658-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"CoffeeCup Animation Studio" = CoffeeCup Animation Studio
"CoffeeCup HTML Editor" = CoffeeCup HTML Editor
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 8/2/2013 6:06:03 PM | Computer Name = Lori-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 3354
 
Error - 8/2/2013 6:06:03 PM | Computer Name = Lori-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 3354
 
Error - 8/2/2013 6:06:04 PM | Computer Name = Lori-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 8/2/2013 6:06:04 PM | Computer Name = Lori-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 4493
 
Error - 8/2/2013 6:06:04 PM | Computer Name = Lori-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 4493
 
Error - 8/3/2013 12:06:03 AM | Computer Name = Lori-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 8/3/2013 12:06:03 AM | Computer Name = Lori-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 21603752
 
Error - 8/3/2013 12:06:04 AM | Computer Name = Lori-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 21603752
 
Error - 8/3/2013 12:06:14 AM | Computer Name = Lori-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 8/3/2013 12:06:14 AM | Computer Name = Lori-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1685
 
Error - 8/3/2013 12:06:14 AM | Computer Name = Lori-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1685
 
[ Media Center Events ]
Error - 6/25/2012 7:21:17 AM | Computer Name = Lori-PC | Source = MCUpdate | ID = 0
Description = 7:20:41 AM - Failed to retrieve SportsSchedule-2.enc (Error: HTTP
status 404: The requested URL does not exist on the server.  )  
 
Error - 7/2/2012 8:27:05 AM | Computer Name = Lori-PC | Source = MCUpdate | ID = 0
Description = 8:26:42 AM - Failed to retrieve SportsSchedule.enc (Error: HTTP status
 404: The requested URL does not exist on the server.  )  
 
Error - 7/9/2012 7:50:22 AM | Computer Name = Lori-PC | Source = MCUpdate | ID = 0
Description = 7:49:47 AM - Failed to retrieve SportsSchedule-2.enc (Error: HTTP
status 404: The requested URL does not exist on the server.  )  
 
Error - 7/12/2012 7:32:27 AM | Computer Name = Lori-PC | Source = MCUpdate | ID = 0
Description = 7:31:52 AM - Failed to retrieve SportsSchedule.enc (Error: HTTP status
 404: The requested URL does not exist on the server.  )  
 
Error - 7/16/2012 4:50:02 PM | Computer Name = Lori-PC | Source = MCUpdate | ID = 0
Description = 4:49:56 PM - Failed to retrieve Directory (Error: The remote name
could not be resolved: 'data.tvdownload.microsoft.com')  
 
Error - 7/21/2012 11:03:35 AM | Computer Name = Lori-PC | Source = MCUpdate | ID = 0
Description = 11:03:34 AM - Failed to retrieve SportsSchedule (Error: The operation
 has timed out)  
 
Error - 7/26/2012 7:34:50 AM | Computer Name = Lori-PC | Source = MCUpdate | ID = 0
Description = 7:34:50 AM - Error connecting to the internet.  7:34:50 AM -     Unable
 to contact server..  
 
Error - 7/26/2012 7:35:13 AM | Computer Name = Lori-PC | Source = MCUpdate | ID = 0
Description = 7:34:55 AM - Error connecting to the internet.  7:34:55 AM -     Unable
 to contact server..  
 
Error - 8/6/2012 7:25:17 AM | Computer Name = Lori-PC | Source = MCUpdate | ID = 0
Description = 7:24:28 AM - Failed to retrieve SportsSchedule.enc (Error: HTTP status
 404: The requested URL does not exist on the server.  )  
 
Error - 2/2/2013 8:20:08 PM | Computer Name = Lori-PC | Source = MCUpdate | ID = 0
Description = 7:20:05 PM - Failed to retrieve Directory (Error: The operation has
 timed out)  
 
[ System Events ]
Error - 8/15/2013 6:28:15 PM | Computer Name = Lori-PC | Source = Service Control Manager | ID = 7024
Description = The AVGIDSAgent service terminated with service-specific error %%-536753630.
 
Error - 8/15/2013 6:28:17 PM | Computer Name = Lori-PC | Source = Service Control Manager | ID = 7024
Description = The AVGIDSAgent service terminated with service-specific error %%-536753630.
 
Error - 8/15/2013 6:28:17 PM | Computer Name = Lori-PC | Source = Service Control Manager | ID = 7024
Description = The AVGIDSAgent service terminated with service-specific error %%-536753630.
 
Error - 8/15/2013 6:28:18 PM | Computer Name = Lori-PC | Source = Service Control Manager | ID = 7024
Description = The AVGIDSAgent service terminated with service-specific error %%-536753630.
 
Error - 8/15/2013 6:28:19 PM | Computer Name = Lori-PC | Source = Service Control Manager | ID = 7024
Description = The AVGIDSAgent service terminated with service-specific error %%-536753630.
 
Error - 8/15/2013 6:28:20 PM | Computer Name = Lori-PC | Source = Service Control Manager | ID = 7024
Description = The AVGIDSAgent service terminated with service-specific error %%-536753630.
 
Error - 8/15/2013 6:28:31 PM | Computer Name = Lori-PC | Source = Service Control Manager | ID = 7024
Description = The AVGIDSAgent service terminated with service-specific error %%-536753630.
 
Error - 8/15/2013 6:40:17 PM | Computer Name = Lori-PC | Source = DCOM | ID = 10010
Description =
 
Error - 8/16/2013 10:41:27 AM | Computer Name = Lori-PC | Source = DCOM | ID = 10010
Description =
 
Error - 8/16/2013 10:41:32 AM | Computer Name = Lori-PC | Source = Service Control Manager | ID = 7006
Description = The ScRegSetValueExW call failed for FailureActions with the following
 error:   %%5
 
 
< End of report >
 






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users