Controle Hijackthis

ricardo425 · 12 november 2013

Hallo beste vrienden,

Ik krijg steeds maar reclame op mijn pc. Daarom deze controle om er me vanaf te helpen.

Dank bij voorbaat

[ATTACH]28936[/ATTACH]

hijackthis.log

Jion · 12 november 2013

Dag ricardo425,

Download Zoek.zip naar het bureaublad.

Wanneer Internet Explorer of een andere browser of virusscanner melding geeft dat dit bestand onveilig zou zijn kun je negeren, dit is namelijk een onterechte waarschuwing.
Schakel je antivirus- en antispywareprogramma's uit, mogelijk kunnen ze conflicteren met zoek.exe (hier en hier) kan je lezen hoe je dat doet.
Klik met de rechtermuisknop op Zoek.zip en klik op de optie "Alles uitpakken".
Dubbelklik op Zoek.exe om de tool te starten.
Windows Vista, 7 en 8 gebruikers dienen de tool als "administrator" uit te voeren door middel van de rechtermuisknop en kiezen voor Als Administrator uitvoeren.
Kopieer nu onderstaande code en plak die in het grote invulvenster:
Note: Dit script is speciaal bedoeld voor deze PC, gebruik dit dan ook niet op andere PC's met een gelijkaardig probleem.

{2A5A2A90-3B30-4E6E-A955-2F232C6EF517};c
C:\Program Files (x86)\WebCake;fs
{C1AF5FA5-852C-4C90-812E-A7F75E011D87};c
C:\Program Files (x86)\Delta;fs
{dd000e12-c224-49a5-899e-0b37dbd95f15};c
C:\Program Files (x86)\ViewPassword;fs
{EE932B49-D5C0-4D19-A3DA-CE0849258DE6};c
{82E1477C-B154-48D3-9891-33D83C26BCD3};c
emptyclsid;
iedefaults;
autoclean;
startupall; 
filesrcm;

Klik nu op de knop "Run script".
Wacht nu geduldig af tot er een logje opent (dit kan na een herstart zijn als deze benodigd is).
Mocht na de herstart geen logje verschijnen, start zoek.exe dan opnieuw, de log verschijnt dan alsnog.
Post het geopende logje in het volgende bericht.

ricardo425 · 12 november 2013

Zoek.exe Version 4.0.0.5 Updated 09-November-2013

Tool run by Richard on di 12/11/2013 at 15:47:13,96.

Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\Richard\Desktop\zoek.pif [script inserted]

==== Older Logs ======================

C:\zoek-results2013-11-12-131206.log 39665 bytes

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== Deleting Files \ Folders ======================

C:\Program Files (x86)\WebCake not found

C:\Program Files (x86)\Delta not found

C:\Program Files (x86)\ViewPassword not found

==== Files Recently Created / Modified ======================

====== C:\Windows ====

====== C:\Users\Richard\AppData\Local\Temp ====

====== Java Cache =====

====== C:\Windows\SysWOW64 =====

====== C:\Windows\SysWOW64\drivers =====

====== C:\Windows\Sysnative =====

====== C:\Windows\Sysnative\drivers =====

====== C:\Windows\Tasks ======

2013-11-12 12:43:51 B30E7E95792522EBA7107E997E1F29F6 3124 ----a-w- C:\Windows\Sysnative\Tasks\{7828E54C-9E27-415E-A17F-75BE1A3C4140}

====== C:\Windows\Temp ======

======= C:\Program Files =====

======= C:\PROGRA~2 =====

2013-11-07 21:14:29 -------- d-----w- C:\PROGRA~2\DVDVideoSoft

2013-11-05 09:33:13 -------- d-----w- C:\PROGRA~2\HP

======= C: =====

====== C:\Users\Richard\AppData\Roaming ======

2013-11-12 13:12:06 -------- d-----w- C:\Users\Richard\AppData\Local\Temp

====== C:\Users\Richard ======

2013-11-07 21:05:54 -------- d-----w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2013-11-07 21:03:32 284B423971432349F83D7B18859564A8 100400976 ----a-w- C:\Users\Richard\Downloads\iTunes64Setup.exe

2013-11-07 19:06:48 -------- d-----w- C:\ProgramData\TEMP

2013-11-07 19:05:10 B393C56849599BF0B8F27900BBEE7882 165176 ----a-w- C:\Users\Richard\Downloads\AVG%20Anti-Virus%20Free%20Edition.exe

2013-11-05 09:30:56 4B940426C620D256D95832107F0FD271 29851432 ----a-w- C:\Users\Richard\Downloads\CPE_SCAN_DESTINATION_UPDATE_hpcom_001_003.exe

2013-10-21 08:04:32 -------- d-----w- C:\ProgramData\Oracle

2013-10-21 08:03:33 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

====== C: exe-files ==

2013-11-07 21:14:41 7D7C3AD829DFCF0115E9F1AADF98E36B 2599992 ----a-w- C:\Program Files (x86)\DVDVideoSoft\Free YouTube to MP3 Converter\FreeYouTubeToMP3Converter.exe

2013-11-07 21:14:41 164CCE0C3BDD7AA31C1149BA0C612A6E 83000 ----a-w- C:\Program Files (x86)\DVDVideoSoft\Free YouTube to MP3 Converter\ytgroovlc.exe

2013-11-07 21:14:40 EA21AD0A797FAA1752DC9ABECFA8EE80 6473616 ----a-w- C:\Program Files (x86)\Common Files\DVDVideoSoft\FreeStudioManager.exe

2013-11-07 21:14:29 BB9432BE9908C95355B62A4B0CC6D68B 1176256 ----a-w- C:\Program Files (x86)\DVDVideoSoft\unins000.exe

2013-11-07 21:03:32 284B423971432349F83D7B18859564A8 100400976 ----a-w- C:\Users\Richard\Downloads\iTunes64Setup.exe

2013-11-07 19:05:10 B393C56849599BF0B8F27900BBEE7882 165176 ----a-w- C:\Users\Richard\Downloads\AVG%20Anti-Virus%20Free%20Edition.exe

=== C: other files ==

2013-11-12 13:13:29 94018008136C7E5E1F4EFFC48190CFBA 6513466 ----a-w- C:\ProgramData\AVG2014\IDS\quarantine\d5bdc94a-ece2-444a-9866-786701e8847b.zip

2013-11-12 13:13:28 81190455E95F8514C35ACBB8F51BE813 649689 ----a-w- C:\ProgramData\AVG2014\IDS\outbox\ng\6c766a6e-7da6-47d3-b96e-d16c2263183e.zip

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-21-810726386-2924154629-2946816220-1000\Software\Microsoft\Windows\CurrentVersion\Run]

"Facebook Update"="C:\Users\Richard\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Dell DataSafe Online"="C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe /m"

"PDVDDXSrv"="C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"

"Desktop Disc Tool"="c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"

"NBAgent"="C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe /WinStart"

"APSDaemon"="C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

"mcui_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey"

"Adobe ARM"="C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"QuickTime Task"="C:\Program Files (x86)\QuickTime\QTTask.exe -atboottime"

"AVG_UI"="C:\Program Files (x86)\AVG\AVG2014\avgui.exe /TRAYONLY"

"SunJavaUpdateSched"="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"Facebook Update"="C:\Users\Richard\AppData\Local\Facebook\Update\FacebookUpdate.exe /c /nocrashserver"

==== Startup Registry Enabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAAnotif"="C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe"

"AdobeAAMUpdater-1.0"="C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"

"IgfxTray"="C:\Windows\system32\igfxtray.exe"

"HotKeysCmds"="C:\Windows\system32\hkcmd.exe"

"Persistence"="C:\Windows\system32\igfxpers.exe"

"RtHDVCpl"="C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s"

"Windows Mobile Device Center"="%windir%\WindowsMobile\wmdc.exe "

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"=" "

==== Startup Registry Disabled ======================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run-]

"QuickTime Task"="\"C:\\Program Files (x86)\\QuickTime\\QTTask.exe\" -atboottime"

"Adobe ARM"="\"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\""

"SunJavaUpdateSched"="\"C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\jusched.exe\""

==== Startup Folders ======================

2010-06-07 10:38:53 2000 ----a-w- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk

2010-06-07 10:38:53 2000 ----a-w- C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk

==== Task Scheduler Jobs ======================

C:\Windows\tasks\Adobe Flash Player Updater.job --a------ C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [09/10/2013 20:00]

C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-810726386-2924154629-2946816220-1000Core.job --a------ C:\Users\Richard\AppData\Local\Facebook\Update\FacebookUpdate.exe [19/06/2013 17:51]

C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-810726386-2924154629-2946816220-1000UA.job --a------ C:\Users\Richard\AppData\Local\Facebook\Update\FacebookUpdate.exe [19/06/2013 17:51]

C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job --a------ C:\Program Files\Dell Support Center\uaclauncher.exe [29/03/2012 00:04]

C:\Windows\tasks\SystemToolsDailyTest.job --a------ C:\Program Files\Dell Support Center\uaclauncher.exe [29/03/2012 00:04]

==== Other Scheduled Tasks ======================

"C:\Windows\SysNative\tasks\Adobe Flash Player Updater" [C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe]

"C:\Windows\SysNative\tasks\Adobe-online actualiseringsprogramma" [C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe]

"C:\Windows\SysNative\tasks\AdobeAAMUpdater-1.0-Richard-PC-Richard" [C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe]

"C:\Windows\SysNative\tasks\CCleanerSkipUAC" ["C:\Program Files (x86)\CCleaner\CCleaner.exe"]

"C:\Windows\SysNative\tasks\FacebookUpdateTaskUserS-1-5-21-810726386-2924154629-2946816220-1000Core" [C:\Users\Richard\AppData\Local\Facebook\Update\FacebookUpdate.exe]

"C:\Windows\SysNative\tasks\FacebookUpdateTaskUserS-1-5-21-810726386-2924154629-2946816220-1000UA" [C:\Users\Richard\AppData\Local\Facebook\Update\FacebookUpdate.exe]

"C:\Windows\SysNative\tasks\Java Update Scheduler" [C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe]

"C:\Windows\SysNative\tasks\PCDEventLauncher" ["C:\Program Files\Dell Support Center\sessionchecker.exe"]

"C:\Windows\SysNative\tasks\PCDoctorBackgroundMonitorTask" [C:\Program Files\Dell Support Center\uaclauncher.exe]

"C:\Windows\SysNative\tasks\Richard Local Autobackup 5 4" [C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBCore.exe]

"C:\Windows\SysNative\tasks\Richard NBAgent 5 4" ["C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe"]

"C:\Windows\SysNative\tasks\SidebarExecute" [C:\Program Files\Windows Sidebar\sidebar.exe]

"C:\Windows\SysNative\tasks\SystemToolsDailyTest" [C:\Program Files\Dell Support Center\uaclauncher.exe]

"C:\Windows\SysNative\tasks\{0D1F5378-CE5F-4070-A060-8C3F15A7F9CF}" [C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe]

"C:\Windows\SysNative\tasks\{1110D5EC-E363-45ED-89C5-920752F24C5D}" [C:\Program Files (x86)\Webteh\BSplayer\bsplayer.exe]

"C:\Windows\SysNative\tasks\{1D821C4C-874D-4298-B939-A66C634E60BB}" ["c:\program files (x86)\mozilla firefox\firefox.exe"]

"C:\Windows\SysNative\tasks\{49D6CC22-8EF2-4D0C-89F8-3B2F592BC7E5}" [C:\Program Files (x86)\Mozilla Firefox\firefox.exe]

"C:\Windows\SysNative\tasks\{755BF4F0-5808-4C54-9202-B114B124B895}" [C:\Program Files (x86)\Webteh\BSplayer\bsplayer.exe]

"C:\Windows\SysNative\tasks\{85500AFC-EC88-438B-985D-6B002A97E5C4}" [C:\Users\Richard\Videos\TETRIS.EXE]

"C:\Windows\SysNative\tasks\{A3B3BB82-1528-4018-96B0-E85CFC970F1B}" [C:\Program Files (x86)\Mozilla Firefox\firefox.exe]

"C:\Windows\SysNative\tasks\{DEA86D37-B63B-4EA6-B545-3589D3C3AB5A}" [C:\Program Files (x86)\Mozilla Firefox\firefox.exe]

"C:\Windows\SysNative\tasks\Apple\AppleSoftwareUpdate" [C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe]

==== Firefox Extensions ======================

ProfilePath: C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\7q1clh8g.default-1344866302137

- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

ProfilePath: C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default

- Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}

- Undetermined - C:\Program Files\Web Assistant\Firefox

- Undetermined - C:\Program Files (x86)\McAfee\SiteAdvisor

AppDir: C:\Program Files (x86)\Mozilla Firefox

- Java Console - %AppDir%\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}

- Java Console - %AppDir%\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}

- Java Console - %AppDir%\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}

- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\7q1clh8g.default-1344866302137

4BF70B35B943BD73BD6E13EB7C1BA4B3 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll - Shockwave Flash

341B3AE026B143DBC17BA1E1E0BAE3D6 - C:\Users\Richard\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll - Unity Player

CF25FDD7CA6BC88442A58F74DBB6CFA6 - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1200112.dll - Shockwave for Director / Shockwave for Director

0B31B0F8FA99CFD009C8FBEA9E20C9DE - C:\Users\Richard\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll - Facebook Video Calling Plugin

045084E4F10D31E71057FE741D87FDB0 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll - Shockwave Flash

99F97C9FE748C37528C338A423577FCB - C:\Users\Richard\AppData\Roaming\Mozilla\plugins\np-mswmp.dll - Microsoft® Windows Media Player Firefox Plugin

Profilepath: C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default

045084E4F10D31E71057FE741D87FDB0 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll - Shockwave Flash

99F97C9FE748C37528C338A423577FCB - C:\Users\Richard\AppData\Roaming\Mozilla\plugins\np-mswmp.dll - Microsoft® Windows Media Player Firefox Plugin

15E298B5EC5B89C5994A59863969D9FF - C:\Windows\SysWOW64\npmproxy.dll - Microsoft® Windows® Operating System

==== Set IE to Default ======================

Old Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

New Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"

{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Richard\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Richard\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully

C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully

C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\Richard\AppData\Local\Mozilla\Firefox\Profiles\7q1clh8g.default-1344866302137\Cache emptied successfully

==== Empty Chrome Cache ======================

No Chrome Cache found

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied

C:\Users\Richard\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\Richard\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PYAML5K9\27961.pix-cdn.org" not found

==== EOF on di 12/11/2013 at 16:12:15,12 ======================

Dit zou het logje moeten zijn

Jion · 12 november 2013

Dit is een logje van een tweede scan die blijkbaar per ongeluk gedaan is.

Wil je het eerste logje eens posten a.u.b?

Je vindt dit hier: C:\zoek-results2013-11-12-131206.log

ricardo425 · 12 november 2013

Zoek.exe Version 4.0.0.5 Updated 09-November-2013

Tool run by Richard on di 12/11/2013 at 13:43:35,99.

Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\Richard\Desktop\zoek.pif [script inserted]

==== System Restore Info ======================

12/11/2013 13:45:31 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-810726386-2924154629-2946816220-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully

HKEY_USERS\S-1-5-21-810726386-2924154629-2946816220-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully

HKEY_USERS\S-1-5-21-810726386-2924154629-2946816220-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} deleted successfully

HKEY_USERS\S-1-5-21-810726386-2924154629-2946816220-1000\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} deleted successfully

HKEY_USERS\S-1-5-21-810726386-2924154629-2946816220-1000\Software\Microsoft\Internet Explorer\SearchScopes\{62E8729B-91A2-4E38-A32A-F80E24AE512C} deleted successfully

HKEY_USERS\S-1-5-21-810726386-2924154629-2946816220-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} deleted successfully

HKEY_USERS\S-1-5-21-810726386-2924154629-2946816220-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} deleted successfully

HKEY_USERS\S-1-5-21-810726386-2924154629-2946816220-1000\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE} deleted successfully

HKEY_USERS\S-1-5-21-810726386-2924154629-2946816220-1000\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A} deleted successfully

HKEY_USERS\S-1-5-21-810726386-2924154629-2946816220-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BA14329E-9550-4989-B3F2-9732E92D17CC} deleted successfully

HKEY_USERS\S-1-5-21-810726386-2924154629-2946816220-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} deleted successfully

HKEY_USERS\S-1-5-21-810726386-2924154629-2946816220-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} deleted successfully

HKEY_USERS\S-1-5-21-810726386-2924154629-2946816220-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B164E929-A1B6-4A06-B104-2CD0E90A88FF} deleted successfully

HKEY_USERS\S-1-5-21-810726386-2924154629-2946816220-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B164E929-A1B6-4A06-B104-2CD0E90A88FF} deleted successfully

HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{2A5A2A90-3B30-4E6E-A955-2F232C6EF517} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2A5A2A90-3B30-4E6E-A955-2F232C6EF517} deleted successfully

HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} deleted successfully

HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{dd000e12-c224-49a5-899e-0b37dbd95f15} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dd000e12-c224-49a5-899e-0b37dbd95f15} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} deleted successfully

HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{82E1477C-B154-48D3-9891-33D83C26BCD3} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Approved Extensions\{d28c7e56-2cc6-415c-8727-d71334085926} deleted successfully

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Approved Extensions\{1d970ed5-3eda-438d-bffd-715931e2775b} deleted successfully

HKEY_USERS\S-1-5-21-810726386-2924154629-2946816220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{BA14329E-9550-4989-B3F2-9732E92D17CC} deleted successfully

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Approved Extensions\{336D0C35-8A85-403a-B9D2-65C292C39087} deleted successfully

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Approved Extensions\{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} deleted successfully

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\URLSearchHooks\{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} deleted successfully

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Approved Extensions\{B164E929-A1B6-4A06-B104-2CD0E90A88FF} deleted successfully

HKEY_USERS\S-1-5-21-810726386-2924154629-2946816220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully

HKEY_USERS\S-1-5-21-810726386-2924154629-2946816220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{82E1477C-B154-48D3-9891-33D83C26BCD3} deleted successfully

HKEY_LOCAL_MACHINE\software\Wow6432Node\microsoft\internet explorer\urlsearchhooks\{BA14329E-9550-4989-B3F2-9732E92D17CC} deleted successfully

HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\{336D0C35-8A85-403a-B9D2-65C292C39087} deleted successfully

HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\{336D0C35-8A85-403a-B9D2-65C292C39087} deleted successfully

HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\crossriderapp498@crossrider.com deleted successfully

HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} deleted successfully

==== Deleting Services ======================

==== FireFox Fix ======================

ProfilePath: C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\0

---- Lines incredibar removed from prefs.js ----

user_pref("browser.newtab.url", "http://mystart.incredibar.com/mb128?a=6OyJP4gQoy&loc=FF_NT");

---- FireFox user.js and prefs.js backups ----

user_20131211_1358_.backup

prefs_20131211_1358_.backup

ProfilePath: C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\7q1clh8g.default-1344866302137

---- Lines delta removed from prefs.js ----

user_pref("browser.newtab.url", "http://www1.delta-search.com/?babsrc=NT_ss&mntrId=A0CD00256487F1CD&affID=121564&tt=070813_wc1&tsp=4970");

user_pref("browser.search.defaultenginename", "Delta Search");

user_pref("browser.search.selectedEngine", "Delta Search");

user_pref("extensions.delta.admin", false);

user_pref("extensions.delta.aflt", "babsst");

user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");

user_pref("extensions.delta.autoRvrt", "false");

user_pref("extensions.delta.dfltLng", "nl");

user_pref("extensions.delta.excTlbr", false);

user_pref("extensions.delta.ffxUnstlRst", true);

user_pref("extensions.delta.id", "a0cd090000000000000000256487f1cd");

user_pref("extensions.delta.instlDay", "15927");

user_pref("extensions.delta.instlRef", "sst");

user_pref("extensions.delta.newTab", false);

user_pref("extensions.delta.prdct", "delta");

user_pref("extensions.delta.prtnrId", "delta");

user_pref("extensions.delta.rvrt", "false");

user_pref("extensions.delta.smplGrp", "none");

user_pref("extensions.delta.tlbrId", "base");

user_pref("extensions.delta.tlbrSrchUrl", "");

user_pref("extensions.delta.vrsn", "1.8.22.0");

user_pref("extensions.delta.vrsni", "1.8.22.0");

user_pref("extensions.delta.vrsnTs", "1.8.22.012:07:41");

user_pref("extensions.delta_i.babExt", "");

user_pref("extensions.delta_i.babTrack", "affID=121564&tt=070813_wc1&tsp=4970");

user_pref("extensions.delta_i.srcExt", "ss");

---- Lines delta modified from prefs.js ----

user_pref("extensions.installCache", "[{\"name\":\"app-global\",\"addons\":{\"{972ce4c6-7e08-4474-a285-3208198ce6fd}\":{\"descriptor\":\"C:\\\\Program

---- Lines delta removed from user.js ----

user_pref("extensions.delta.tlbrSrchUrl", "");

user_pref("extensions.delta.id", "a0cd090000000000000000256487f1cd");

user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");

user_pref("extensions.delta.instlDay", "15927");

user_pref("extensions.delta.vrsn", "1.8.22.0");

user_pref("extensions.delta.vrsni", "1.8.22.0");

user_pref("extensions.delta.vrsnTs", "1.8.22.012:07:41");

user_pref("extensions.delta.prtnrId", "delta");

user_pref("extensions.delta.prdct", "delta");

user_pref("extensions.delta.aflt", "babsst");

user_pref("extensions.delta.smplGrp", "none");

user_pref("extensions.delta.tlbrId", "base");

user_pref("extensions.delta.instlRef", "sst");

user_pref("extensions.delta.dfltLng", "nl");

user_pref("extensions.delta.excTlbr", false);

user_pref("extensions.delta.ffxUnstlRst", true);

user_pref("extensions.delta.admin", false);

user_pref("extensions.delta_i.babTrack", "affID=121564&tt=070813_wc1&tsp=4970");

user_pref("extensions.delta_i.babExt", "");

user_pref("extensions.delta_i.srcExt", "ss");

user_pref("extensions.delta.autoRvrt", "false");

user_pref("extensions.delta.rvrt", "false");

user_pref("extensions.delta.newTab", false);

---- Lines CT2269050 removed from prefs.js ----

user_pref("CT2269050_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1372005055481,\"isWithState\":\"\",\"timeFromStar

---- Lines babsrc removed from prefs.js ----

user_pref("browser.startup.homepage", "http://isearch.babylon.com/?babsrc=HP_ss_Btisdt3&mntrId=A0CD00256487F1CD&affID=121564&tt=070813_wc1&tsp=4970");

---- Lines Search-Results removed from prefs.js ----

user_pref("keyword.URL", "http://dts.search-results.com/sr?src=ffb&gct=ds&appid=464&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&apn_uid=152031358112472

---- Lines smartbar removed from prefs.js ----

user_pref("smartbar.machineId", "7SGOR2YCANS9N/ZANPAC4GXRGH12UYHUDY7VM7WRFOG8L3KR4IB+PRPC0XY3STLRHW6KC5GK69BYX+IFREZDEW");

---- FireFox user.js and prefs.js backups ----

user_20131211_1358_.backup

prefs_20131211_1358_.backup

ProfilePath: C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default

---- Lines delta removed from user.js ----

user_pref("extensions.delta.tlbrSrchUrl", "");

user_pref("extensions.delta.id", "a0cd090000000000000000256487f1cd");

user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");

user_pref("extensions.delta.instlDay", "15927");

user_pref("extensions.delta.vrsn", "1.8.22.0");

user_pref("extensions.delta.vrsni", "1.8.22.0");

user_pref("extensions.delta.vrsnTs", "1.8.22.012:07:34");

user_pref("extensions.delta.prtnrId", "delta");

user_pref("extensions.delta.prdct", "delta");

user_pref("extensions.delta.aflt", "babsst");

user_pref("extensions.delta.smplGrp", "none");

user_pref("extensions.delta.tlbrId", "base");

user_pref("extensions.delta.instlRef", "sst");

user_pref("extensions.delta.dfltLng", "nl");

user_pref("extensions.delta.excTlbr", false);

user_pref("extensions.delta.ffxUnstlRst", true);

user_pref("extensions.delta.admin", false);

user_pref("extensions.delta_i.babTrack", "affID=121564&tt=070813_wc1&tsp=4970");

user_pref("extensions.delta_i.babExt", "");

user_pref("extensions.delta_i.srcExt", "ss");

user_pref("extensions.delta.autoRvrt", "false");

user_pref("extensions.delta.rvrt", "false");

user_pref("extensions.delta.newTab", false);

---- Lines incredibar removed from user.js ----

user_pref("extensions.incredibar_i.newTab", false);

user_pref("extensions.incredibar_i.tlbrSrchUrl", "http://mystart.Incredibar.com/?a=6OyJP4gQoy&loc=IB_TB&i=26&search=");

user_pref("extensions.incredibar_i.id", "a0cd090000000000000000256487f1cd");

user_pref("extensions.incredibar_i.instlDay", "15554");

user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");

user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");

user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1418:02:33");

user_pref("extensions.incredibar_i.prtnrId", "Incredibar");

user_pref("extensions.incredibar_i.prdct", "incredibar");

user_pref("extensions.incredibar_i.aflt", "orgnl");

user_pref("extensions.incredibar_i.smplGrp", "none");

user_pref("extensions.incredibar_i.tlbrId", "base");

user_pref("extensions.incredibar_i.instlRef", "");

user_pref("extensions.incredibar_i.dfltLng", "");

user_pref("extensions.incredibar_i.excTlbr", false);

user_pref("extensions.incredibar_i.ms_url_id", "");

user_pref("extensions.incredibar_i.upn2", "6OyJP4gQoy");

user_pref("extensions.incredibar_i.upn2n", "92261862249932898");

user_pref("extensions.incredibar_i.productid", "26");

user_pref("extensions.incredibar_i.installerproductid", "26");

user_pref("extensions.incredibar_i.did", "10658");

user_pref("extensions.incredibar_i.ppd", "");

---- FireFox user.js and prefs.js backups ----

user_20131211_1358_.backup

prefs_20131211_1358_.backup

==== Deleting Files \ Folders ======================

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} not found

C:\Program Files (x86)\WebCake deleted

C:\Program Files (x86)\Delta deleted

C:\Program Files (x86)\ViewPassword deleted

C:\ProgramData\Codecv deleted

C:\PROGRA~2\Mozilla Firefox\searchplugins\BearShareWebSearch.xml deleted

C:\PROGRA~2\Mozilla Firefox\searchplugins\Search_Results.xml deleted

C:\PROGRA~2\Mozilla Firefox\extensions\ffxtlbr@babylon.com deleted

C:\PROGRA~2\DVDVideoSoftTB deleted

C:\PROGRA~2\COMMON~1\DVDVideoSoft\bin deleted

C:\PROGRA~2\BearShare Applications\MediaBar deleted

C:\PROGRA~2\Vuze_Remote deleted

C:\PROGRA~2\Optimizer Pro deleted

C:\PROGRA~2\Conduit deleted

C:\PROGRA~2\ConduitEngine deleted

C:\Users\Richard\AppData\Roaming\Betcat deleted

C:\Users\Richard\AppData\Roaming\DVDVideoSoftIEHelpers deleted

C:\Users\Richard\AppData\Roaming\WebCake deleted

C:\Users\Richard\AppData\Roaming\BabSolution deleted

C:\Users\Richard\AppData\Roaming\Babylon deleted

C:\Users\Richard\AppData\Roaming\Delta deleted

C:\Users\Richard\AppData\Roaming\OpenCandy deleted

C:\Users\Richard\Music\Qtrax Media Library deleted

C:\ProgramData\GBox deleted

C:\ProgramData\InstallMate deleted

C:\ProgramData\Tarma Installer deleted

C:\ProgramData\Premium deleted

C:\ProgramData\Babylon deleted

C:\Users\Richard\AppData\Local\Ilivid Player deleted

C:\Users\Richard\AppData\Local\BearShare deleted

C:\Users\Richard\AppData\Local\PackageAware deleted

C:\Users\Richard\AppData\Local\Conduit deleted

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Codecv deleted

C:\Users\Richard\Downloads\iLividSetup(1).exe deleted

C:\Users\Richard\Downloads\iLividSetup.exe deleted

C:\Users\Richard\Downloads\iLividSetupV1.exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMP3Converter(1).exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMP3Converter(10).exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMP3Converter(11).exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMP3Converter(12).exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMP3Converter(13).exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMP3Converter(14).exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMP3Converter(15).exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMP3Converter(16).exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMP3Converter(17).exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMP3Converter(18).exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMP3Converter(19).exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMp3Converter(2).exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMP3Converter(20).exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMp3Converter(3).exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMp3Converter(4).exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMP3Converter(5).exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMP3Converter(6).exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMP3Converter(7).exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMP3Converter(8).exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMP3Converter(9).exe deleted

C:\Users\Richard\Downloads\FreeYouTubeToMp3Converter.exe deleted

C:\Users\Richard\Downloads\SoftonicDownloader_voor_avg-antivirus-free-2013.exe deleted

C:\Users\Richard\Downloads\SoftonicDownloader_voor_business-card-designer-plus.exe deleted

C:\Users\Richard\Downloads\SoftonicDownloader_voor_cheat-engine.exe deleted

C:\Users\Richard\Downloads\SoftonicDownloader_voor_dvd-flick(1).exe deleted

C:\Users\Richard\Downloads\SoftonicDownloader_voor_dvd-flick(2).exe deleted

C:\Users\Richard\Downloads\SoftonicDownloader_voor_dvd-flick.exe deleted

C:\Users\Richard\Downloads\SoftonicDownloader_voor_fastest-free-youtube-downloader-to-mp3-converter.exe deleted

C:\Users\Richard\Downloads\SoftonicDownloader_voor_windows-live-messenger-2012.exe deleted

C:\Users\Richard\Downloads\bs_AviSub.exe deleted

C:\Users\Richard\AppData\LocalLow\DVDVideoSoftTB deleted

C:\Users\Richard\AppData\LocalLow\Vuze_Remote deleted

C:\Users\Richard\AppData\LocalLow\AskToolbar deleted

C:\Users\Richard\AppData\LocalLow\microsoft\silverlight\outofbrowser\index\portal.qtrax.com deleted

C:\Users\Richard\AppData\LocalLow\Conduit deleted

C:\Users\Richard\AppData\LocalLow\ConduitEngine deleted

C:\windows\SysNative\Tasks\EPUpdater deleted

C:\windows\SysNative\tasks\QtraxPlayer deleted

C:\windows\SysNative\tasks\ViewPassword Update deleted

C:\Windows\tasks\ViewPassword Update.job deleted

C:\END deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\7q1clh8g.default-1344866302137\searchplugins\babylon.xml deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\searchplugins\askcom.xml deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\searchplugins\BearShareWebSearch.xml deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\searchplugins\MyStart Search.xml deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\searchplugins\mywebsearch.xml deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\searchplugins\Search_Results.xml deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\jetpack deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\extensions\staged deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\CT1750559 deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\CT2269050 deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\CT2405280 deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\CT2504091 deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\bearsharemediabartb deleted

C:\Users\Richard\Desktop\avg_free_stb_all_2013_3343_softonic.exe deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\7q1clh8g.default-1344866302137\extensions\ffxtlbr@delta.com deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\extensions\ffxtlbr@delta.com deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\extensions\ffxtlbr@incredibar.com deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\conduit deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\conduitCommon deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\ConduitEngine deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\smartbar deleted

C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc} deleted

"C:\ProgramData\{AB072820-F316-1E92-378A-00006D58C85E}" deleted

"C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\7q1clh8g.default-1344866302137\searchplugins\conduit.xml" deleted

"C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\searchplugins\conduit.xml" deleted

"C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\searchplugins\GadgetBox.xml" deleted

"C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433}" deleted

"C:\Users\Richard\AppData\Roaming\GrabPro" deleted

"C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\abp9obje.default\extensions\OneClickDownload@OneClickDownload.com" deleted

==== Files Recently Created / Modified ======================

====== C:\Windows ====

====== C:\Users\Richard\AppData\Local\Temp ====

2013-11-07 19:06:21 4791AE5E215984C67A8FA972EDB7A240 6565456 ----a-w- C:\Users\Richard\AppData\Local\Temp\ins7850\OptimizerPro.exe

2013-10-29 18:40:45 0E771375445E13429E68CAE720A48B72 35224 ----a-w- C:\Users\Richard\AppData\Local\Temp\e4j2E42.tmp_dir1383072045\i4jdel.exe