start
CloseProcesses:
HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG Secure Search\vprot.exe [2640408 2014-08-29] ()
HKU\S-1-5-21-668500880-791981439-1033418225-1000\...\Run: [PriceMeterW] => C:\Users\pascal\AppData\Local\PriceMeter\pricemeterw.exe [287232 2014-04-30] (PriceMeter)
IFEO\bitguard.exe: [Debugger] tasklist.exe
IFEO\bprotect.exe: [Debugger] tasklist.exe
IFEO\bpsvc.exe: [Debugger] tasklist.exe
IFEO\browserdefender.exe: [Debugger] tasklist.exe
IFEO\browserprotect.exe: [Debugger] tasklist.exe
IFEO\browsersafeguard.exe: [Debugger] tasklist.exe
IFEO\dprotectsvc.exe: [Debugger] tasklist.exe
IFEO\jumpflip: [Debugger] tasklist.exe
IFEO\protectedsearch.exe: [Debugger] tasklist.exe
IFEO\searchinstaller.exe: [Debugger] tasklist.exe
IFEO\searchprotection.exe: [Debugger] tasklist.exe
IFEO\searchprotector.exe: [Debugger] tasklist.exe
IFEO\searchsettings.exe: [Debugger] tasklist.exe
IFEO\searchsettings64.exe: [Debugger] tasklist.exe
IFEO\snapdo.exe: [Debugger] tasklist.exe
IFEO\stinst32.exe: [Debugger] tasklist.exe
IFEO\stinst64.exe: [Debugger] tasklist.exe
IFEO\umbrella.exe: [Debugger] tasklist.exe
IFEO\utiljumpflip.exe: [Debugger] tasklist.exe
IFEO\volaro: [Debugger] tasklist.exe
IFEO\vonteera: [Debugger] tasklist.exe
IFEO\websteroids.exe: [Debugger] tasklist.exe
IFEO\websteroidsservice.exe: [Debugger] tasklist.exe
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:49363;https=127.0.0.1:49363
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://istart.webssearches.com/?type=hp&ts=1406194726&from=tugs&uid=WDCXWD5000BEVT-22A0RT0_WD-WXG1A304310943109
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hp&ts=1406194726&from=tugs&uid=WDCXWD5000BEVT-22A0RT0_WD-WXG1A304310943109
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://istart.webssearches.com/web/?type=ds&ts=1406194726&from=tugs&uid=WDCXWD5000BEVT-22A0RT0_WD-WXG1A304310943109&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hp&ts=1406194726&from=tugs&uid=WDCXWD5000BEVT-22A0RT0_WD-WXG1A304310943109
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://istart.webssearches.com/?type=hp&ts=1406194726&from=tugs&uid=WDCXWD5000BEVT-22A0RT0_WD-WXG1A304310943109
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://istart.webssearches.com/web/?type=ds&ts=1406194726&from=tugs&uid=WDCXWD5000BEVT-22A0RT0_WD-WXG1A304310943109&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://istart.webssearches.com/web/?type=ds&ts=1406194726&from=tugs&uid=WDCXWD5000BEVT-22A0RT0_WD-WXG1A304310943109&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hp&ts=1406194726&from=tugs&uid=WDCXWD5000BEVT-22A0RT0_WD-WXG1A304310943109
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://istart.webssearches.com/?type=hp&ts=1406194726&from=tugs&uid=WDCXWD5000BEVT-22A0RT0_WD-WXG1A304310943109
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://istart.webssearches.com/web/?type=ds&ts=1406194726&from=tugs&uid=WDCXWD5000BEVT-22A0RT0_WD-WXG1A304310943109&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://istart.webssearches.com/?type=sc&ts=1406194726&from=tugs&uid=WDCXWD5000BEVT-22A0RT0_WD-WXG1A304310943109
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1406194726&from=tugs&uid=WDCXWD5000BEVT-22A0RT0_WD-WXG1A304310943109&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1406194726&from=tugs&uid=WDCXWD5000BEVT-22A0RT0_WD-WXG1A304310943109&q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=563&systemid=406&v=a13251-115&apn_uid=0952810207124505&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1406194726&from=tugs&uid=WDCXWD5000BEVT-22A0RT0_WD-WXG1A304310943109&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1406194726&from=tugs&uid=WDCXWD5000BEVT-22A0RT0_WD-WXG1A304310943109&q={searchTerms}
SearchScopes: HKLM-x32 - {56256A51-B582-467e-B8D4-7786EDA79AE0} URL = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=GRxdm227YYPF&ptb=RiRwqx5PXavANOGUgIgMJw&psa=&ind=2010120621&ptnrS=GRxdm227YYPF&si=&st=sb&n=77d001ad&searchfor={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=563&systemid=406&v=a13251-115&apn_uid=0952810207124505&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A59} URL = http://search.imesh.com/web?src=ieb&systemid=1&q={searchTerms}
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1406194726&from=tugs&uid=WDCXWD5000BEVT-22A0RT0_WD-WXG1A304310943109&q={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=563&systemid=406&v=a13251-115&apn_uid=0952810207124505&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
BHO: MediaPlayerplus -> {11111111-1111-1111-1111-110511421146} -> C:\Program Files (x86)\MediaPlayerplus\MediaPlayerplus-bho64.dll (Freeven)
BHO: downlOadditkeeep -> {EB2FCB43-EB9B-08F6-1C9F-1D9E3CB63BD9} -> C:\ProgramData\downlOadditkeeep\R2E.x64.dll ()
BHO-x32: MyWebSearch Search Assistant BHO -> {00A6FAF1-072E-44cf-8957-5838F569A31D} -> No File
BHO-x32: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File
BHO-x32: MediaPlayerplus -> {11111111-1111-1111-1111-110511421146} -> C:\Program Files (x86)\MediaPlayerplus\MediaPlayerplus-bho.dll (Freeven)
BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\SupTab\SupTab.dll (Thinknice Co. Limited)
BHO-x32: AVG Security Toolbar -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG Secure Search\18.1.9.799\AVG Secure Search_toolbar.dll (AVG Secure Search)
BHO-x32: MediaBar -> {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} -> C:\Program Files (x86)\iMesh Applications\MediaBar\ToolBar\iMeshMediaBarDx.dll ()
BHO-x32: downlOadditkeeep -> {EB2FCB43-EB9B-08F6-1C9F-1D9E3CB63BD9} -> No File
Toolbar: HKLM-x32 - MediaBar - {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} - C:\Program Files (x86)\iMesh Applications\MediaBar\ToolBar\iMeshMediaBarDx.dll ()
Toolbar: HKLM-x32 - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\18.1.9.799\AVG Secure Search_toolbar.dll (AVG Secure Search)
Toolbar: HKLM-x32 - No Name - {377e5d4d-77e5-476a-8716-7e70a9272da0} - No File
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.9\ViProtocol.dll (AVG Secure Search)
FF SearchEngineOrder.1: Ask.com
FF user.js: detected! => C:\Users\pascal\AppData\Roaming\Mozilla\Firefox\Profiles\bfz0uru8.default\user.js
FF SearchPlugin: C:\Users\pascal\AppData\Roaming\Mozilla\Firefox\Profiles\bfz0uru8.default\searchplugins\Ask.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\Ask.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\webssearches.xml
FF Extension: MediaPlayerplus - C:\Users\pascal\AppData\Roaming\Mozilla\Firefox\Profiles\bfz0uru8.default\Extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com [2014-07-11]
FF Extension: Cinema-Plus-1.2c - C:\Users\pascal\AppData\Roaming\Mozilla\Firefox\Profiles\bfz0uru8.default\Extensions\caseyvelez@aol.com [2014-08-29]
FF Extension: Fast Start - C:\Users\pascal\AppData\Roaming\Mozilla\Firefox\Profiles\bfz0uru8.default\Extensions\faststartff@gmail.com [2014-07-24]
FF Extension: realdeal - C:\Users\pascal\AppData\Roaming\Mozilla\Firefox\Profiles\bfz0uru8.default\Extensions\toxioaeo@ao-.edu [2014-08-18]
FF HKLM-x32\...\Firefox\Extensions: [m3ffxtbr@mywebsearch.com] - C:\Program Files (x86)\MyWebSearch\bar\1.bin
FF HKLM-x32\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG Secure Search\FireFoxExt\18.1.9.799
FF Extension: AVG Security Toolbar - C:\ProgramData\AVG Secure Search\FireFoxExt\18.1.9.799 [2014-08-29]
FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\pascal\AppData\Roaming\Mozilla\Firefox\Profiles\bfz0uru8.default\extensions\faststartff@gmail.com
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction
CHR HKLM-x32\...\Chrome\Extension: [jbajpeofkjjeiamcglnmldoboonfkiol] - C:\Program Files (x86)\Search Results Toolbar\Datamngr\chromeExtension.crx []
CHR HKLM-x32\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\ProgramData\AVG Secure Search\ChromeExt\18.1.0.443\avg.crx [2014-04-29]
S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [1050904 2013-12-11] () [File not signed]
R2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [3427208 2014-07-24] (Cherished Technololgy LIMITED)
S2 NewPlayerUpdaterService; C:\Program Files (x86)\NewPlayer\NewPlayerUpdaterService.exe [11776 2014-07-16] () [File not signed]
R2 vToolbarUpdater18.1.9; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe [1820184 2014-08-12] (AVG Secure Search)
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [535936 2014-07-24] (Fuyu LIMITED)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-08-12] (AVG Technologies)
R1 {b8a90375-3b37-4954-86de-f96c458c4ce2}Gw64; C:\Windows\System32\drivers\{b8a90375-3b37-4954-86de-f96c458c4ce2}Gw64.sys [61120 2014-05-09] (StdLib)
R1 {b8a90375-3b37-4954-86de-f96c458c4ce2}w64; C:\Windows\System32\drivers\{b8a90375-3b37-4954-86de-f96c458c4ce2}w64.sys [61120 2014-06-13] (StdLib)
2014-08-30 13:01 - 2014-08-30 13:01 - 00004144 ____C () C:\Windows\System32\Tasks\RocketTab Update Task
2014-08-30 13:01 - 2014-08-30 13:01 - 00003358 ____C () C:\Windows\System32\Tasks\RocketTab
2014-08-30 13:01 - 2014-08-30 13:01 - 00000000 ___DC () C:\Program Files (x86)\RocketTab
2014-08-29 09:52 - 2014-08-29 09:52 - 00000000 ___DC () C:\Program Files (x86)\predm
2014-08-27 10:09 - 2014-08-27 10:09 - 00000000 ___DC () C:\ProgramData\WorldWideCoupon
2014-08-27 09:51 - 2014-08-27 09:51 - 00000000 ___DC () C:\ProgramData\Avg_Update_0814tb
2014-08-27 09:51 - 2014-08-27 09:51 - 00000000 ___DC () C:\Program Files (x86)\AVG Security Toolbar
2014-08-15 03:31 - 2014-09-07 08:32 - 00000000 ___DC () C:\ProgramData\downlOadditkeeep
2014-08-15 03:31 - 2014-08-15 03:31 - 00000000 ___DC () C:\Users\pascal\AppData\Local\Packages
2014-08-12 05:16 - 2014-08-12 05:16 - 00000000 ___DC () C:\Users\pascal\AppData\Roaming\File Type Helper
C:\Program Files\KMSpico
C:\Program Files (x86)\Optimizer Pro
C:\Program Files (x86)\MediaPlayerplus
C:\Program Files (x86)\Activeris AntiMalware
C:\Program Files (x86)\SupTab
C:\Program Files (x86)\AVG Secure Search
C:\Program Files (x86)\Common Files\AVG Secure Search
C:\Program Files (x86)\iMesh Applications
C:\Program Files (x86)\NewPlayer
C:\ProgramData\IePluginServices
C:\ProgramData\WindowsMangerProtect
C:\Users\pascal\AppData\Local\PriceMeter
C:\Windows\system32\drivers\avgtpx64.sys
C:\Windows\System32\drivers\{b8a90375-3b37-4954-86de-f96c458c4ce2}Gw64.sys
C:\Windows\System32\drivers\{b8a90375-3b37-4954-86de-f96c458c4ce2}w64.sys
Task: {7361348C-379F-4F14-8624-44A3DEE0AC19} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe [2013-12-11] ()
Task: {153443C4-4320-4EEE-81B0-D0456C1F06E2} - System32\Tasks\pricemetertask => C:\Users\pascal\AppData\Local\PriceMeter\TEMP\pricemeter.exe
Task: {253C8628-06EB-414D-9BA3-0C5C79B55F67} - System32\Tasks\pricemeterwatcher => C:\Users\pascal\AppData\Local\PriceMeter\pricemeterw.exe [2014-04-30] (PriceMeter)
Task: {450C3BD7-96E0-4EC0-9DCD-9338BD3B6355} - System32\Tasks\Optimizer Pro Schedule => C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe
Task: {73096295-0FAB-436F-969F-14B5A7B8641F} - System32\Tasks\ccb43658-9f62-4ad7-853c-5340efb3f693-2 => C:\Program Files (x86)\MediaPlayerplus\ccb43658-9f62-4ad7-853c-5340efb3f693-2.exe
Task: {75A27667-9B97-4DE4-8D95-359D143D8090} - System32\Tasks\RocketTab Update Task => C:\Program Files (x86)\RocketTab\uninstall.exe [2014-08-30] ()
Task: {75B7BD55-7A38-4E1F-9E6B-A08AD3214464} - System32\Tasks\RocketTab => C:\Windows\system32\cmd.exe [2011-06-09] (Microsoft Corporation)
Task: {7CB343CF-977A-4E75-A6F4-341C0E79B1D5} - System32\Tasks\Activeris AntiMalware_startup => C:\Program Files (x86)\Activeris AntiMalware\ActiverisAntiMalware.exe [2014-01-23] (Activeris)
Task: {84C2DE6E-F752-49B9-B420-6E855ECB4FEC} - System32\Tasks\pricemeterdownloader => C:\Users\pascal\AppData\Local\PriceMeter\pricemeterd.exe
Task: {CD69CBEC-B2B1-42F9-BFC5-D61037365A05} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => C:\Windows\TEMP\{23BA86CB-37E1-4563-B024-91A526341EE7}.exe
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\Windows\TEMP\{23BA86CB-37E1-4563-B024-91A526341EE7}.exe
Task: C:\Windows\Tasks\ccb43658-9f62-4ad7-853c-5340efb3f693-2.job => C:\Program Files (x86)\MediaPlayerplus\ccb43658-9f62-4ad7-853c-5340efb3f693-2.exe
Task: C:\Windows\Tasks\pricemetertask.job => C:\Users\pascal\AppData\Local\PriceMeter\pricemeter.exe
Task: C:\Windows\Tasks\pricemeterwatcher.job => C:\Users\pascal\AppData\Local\PriceMeter\pricemeterw.exe
AlternateDataStreams: C:\ProgramData\Temp:0B9176C0
AlternateDataStreams: C:\ProgramData\Temp:373E1720
AlternateDataStreams: C:\ProgramData\Temp:798A3728
EmptyTemp:
end