start
CloseProcesses:
HKLM-x32\...\Run: [BrowserSafeguard] => "C:\Program Files (x86)\Browsersafeguard\BrowserSafeguard.exe"
HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64Loader.dll [233280 2014-11-10] (Search Protect)
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC32Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32Loader.dll [188224 2014-11-10] (Search Protect)
HKU\S-1-5-21-3591381806-1162582937-4171372800-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.trovi.com/?gd=&ctid=CT3317919&octid=EB_ORIGINAL_CTID&ISID=MD4D4CADE-66B3-408B-AB2B-2610B8CC4BF8&SearchSource=55&CUI=&UM=6&UP=SP18DCD786-CA5F-42E4-99A0-1640E548E0CD&SSPV=
HKU\S-1-5-21-3591381806-1162582937-4171372800-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.nationzoom.com/?type=hp&ts=1390135455&from=adks&uid=WDCXWD3200BPVT-75JJ5T0_WD-WXK1E72HKYL8HKYL8
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.nationzoom.com/web/?type=ds&ts=1390135455&from=adks&uid=WDCXWD3200BPVT-75JJ5T0_WD-WXK1E72HKYL8HKYL8&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.nationzoom.com/?type=hp&ts=1390135455&from=adks&uid=WDCXWD3200BPVT-75JJ5T0_WD-WXK1E72HKYL8HKYL8
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nationzoom.com/?type=hp&ts=1390135455&from=adks&uid=WDCXWD3200BPVT-75JJ5T0_WD-WXK1E72HKYL8HKYL8
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.nationzoom.com/web/?type=ds&ts=1390135455&from=adks&uid=WDCXWD3200BPVT-75JJ5T0_WD-WXK1E72HKYL8HKYL8&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.nationzoom.com/web/?type=ds&ts=1390135455&from=adks&uid=WDCXWD3200BPVT-75JJ5T0_WD-WXK1E72HKYL8HKYL8&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.nationzoom.com/?type=hp&ts=1390135455&from=adks&uid=WDCXWD3200BPVT-75JJ5T0_WD-WXK1E72HKYL8HKYL8
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.nationzoom.com/?type=hp&ts=1390135455&from=adks&uid=WDCXWD3200BPVT-75JJ5T0_WD-WXK1E72HKYL8HKYL8
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.nationzoom.com/web/?type=ds&ts=1390135455&from=adks&uid=WDCXWD3200BPVT-75JJ5T0_WD-WXK1E72HKYL8HKYL8&q={searchTerms}
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.nationzoom.com/web/?type=ds&ts=1390135455&from=adks&uid=WDCXWD3200BPVT-75JJ5T0_WD-WXK1E72HKYL8HKYL8&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.nationzoom.com/web/?type=ds&ts=1390135455&from=adks&uid=WDCXWD3200BPVT-75JJ5T0_WD-WXK1E72HKYL8HKYL8&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.nationzoom.com/web/?type=ds&ts=1390135455&from=adks&uid=WDCXWD3200BPVT-75JJ5T0_WD-WXK1E72HKYL8HKYL8&q={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.nationzoom.com/web/?type=ds&ts=1390135455&from=adks&uid=WDCXWD3200BPVT-75JJ5T0_WD-WXK1E72HKYL8HKYL8&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3591381806-1162582937-4171372800-1000 -> DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://www.trovi.com/Results.aspx?gd=&ctid=CT3317919&octid=EB_ORIGINAL_CTID&ISID=MD4D4CADE-66B3-408B-AB2B-2610B8CC4BF8&SearchSource=58&CUI=&UM=6&UP=SP18DCD786-CA5F-42E4-99A0-1640E548E0CD&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-3591381806-1162582937-4171372800-1000 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://www.trovi.com/Results.aspx?gd=&ctid=CT3317919&octid=EB_ORIGINAL_CTID&ISID=MD4D4CADE-66B3-408B-AB2B-2610B8CC4BF8&SearchSource=58&CUI=&UM=6&UP=SP18DCD786-CA5F-42E4-99A0-1640E548E0CD&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-3591381806-1162582937-4171372800-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.nationzoom.com/web/?type=ds&ts=1390135455&from=adks&uid=WDCXWD3200BPVT-75JJ5T0_WD-WXK1E72HKYL8HKYL8&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3591381806-1162582937-4171372800-1000 -> {4EC4A5CD-9C00-4BA0-B9A4-0C0C0D4265F4} URL =
BHO: winservice86 -> {11111111-1111-1111-1111-110611471155} -> C:\Program Files (x86)\winservice86\winservice86-bho64.dll (Corporate Inc)
BHO-x32: winservice86 -> {11111111-1111-1111-1111-110611471155} -> C:\Program Files (x86)\winservice86\winservice86-bho.dll (Corporate Inc)
BHO-x32: Bubble Dock SurfMatch -> {23AF19F7-1D5B-442c-B14C-3D1081953C94} -> C:\Program Files (x86)\Nosibay\Bubble Dock\extensions\axSurfMatch.dll No File
BHO-x32: SaveByclick -> {2A98DFCC-4F75-4BAE-F789-DE566B50D872} -> C:\ProgramData\SaveByclick\50e59287bb62e.dll No File
BHO-x32: WinServices -> {70C53538-9F82-42BC-A327-74F7A46E700C} -> C:\Program Files (x86)\WinServices\ScriptHost.dll (WinServices)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\nationzoom.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\sweet-page.xml
FF HKLM-x32\...\Firefox\Extensions: [bubbledock@nosibay.com] - C:\Program Files (x86)\Nosibay\Bubble Dock\extensions\FFSurfMatch
CHR HKLM-x32\...\Chrome\Extension: [bmgkjeniaaaamphokmobhjogfikkmcje] - C:\ProgramData\SaveByclick\bmgkjeniaaaamphokmobhjogfikkmcje.crx []
CHR HKLM-x32\...\Chrome\Extension: [kbjlipmgfoamgjaogmbihaffnpkpjajp] - C:\Program Files (x86)\Nosibay\Bubble Dock\extensions\GCSurfMatch.crx []
R2 CltMngSvc; C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe [3056960 2014-11-10] (Search Protect)
S2 globalUpdate; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2014-10-01] (globalUpdate) [File not signed]
S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2014-10-01] (globalUpdate) [File not signed]
R2 Wpm; C:\ProgramData\WPM\wprotectmanager.exe [499856 2014-01-07] (Cherished Technololgy LIMITED)
R3 SPPD; \??\C:\Windows\system32\drivers\SPPD.sys [X]
2014-11-26 13:57 - 2014-11-26 13:57 - 00003280 _____ () C:\Windows\System32\Tasks\b1awkKNwBLq47FI
2014-11-26 13:57 - 2014-11-26 13:57 - 00000000 ____D () C:\Users\admin\AppData\Roaming\hG5XnNp
2014-11-24 17:25 - 2014-11-29 11:04 - 00000002 _____ () C:\Users\admin\AppData\Local\recently-fix.db
2014-11-23 18:35 - 2014-11-26 13:57 - 00000000 ____D () C:\Users\admin\AppData\Roaming\j3yGNc4
2014-11-23 18:35 - 2014-11-23 18:35 - 00719521 _____ () C:\Windows\unins000.exe
2014-11-23 18:35 - 2014-11-23 18:35 - 00003240 _____ () C:\Windows\System32\Tasks\HqCHhRbemewhfxG
2014-11-23 18:35 - 2014-11-23 18:35 - 00003238 _____ () C:\Windows\System32\Tasks\TGN5SuDW61PSa0i
2014-11-23 18:35 - 2014-11-23 18:35 - 00000890 _____ () C:\Windows\unins000.dat
2014-11-23 18:35 - 2014-11-23 18:35 - 00000000 ____D () C:\Users\admin\AppData\Roaming\51tpIG6
2014-11-23 18:35 - 2014-11-23 18:35 - 00000000 ____D () C:\ProgramData\atjs
2014-11-23 18:35 - 2014-11-21 19:03 - 00019456 _____ ( ) C:\Windows\inst.exe
2014-11-23 18:35 - 2014-11-21 11:39 - 00091136 _____ ( ) C:\Windows\Kommun.dll
2014-11-23 18:35 - 2014-10-15 10:18 - 00006144 _____ () C:\Windows\LibDownloadManagement.dll
2014-11-19 09:56 - 2014-11-19 09:56 - 00000000 ____D () C:\Users\admin\AppData\Local\SearchProtect
2014-11-19 09:56 - 2014-11-19 09:56 - 00000000 ____D () C:\Program Files (x86)\SearchProtect
2014-11-19 09:55 - 2014-11-19 09:55 - 00000000 ____D () C:\Users\admin\AppData\Roaming\VOPackage
2014-11-19 09:55 - 2014-11-19 09:55 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
2014-11-29 11:00 - 2014-10-01 17:14 - 00000000 ____D () C:\Users\admin\AppData\Roaming\winservices
2014-11-29 11:00 - 2014-07-12 20:15 - 00000000 ____D () C:\Users\admin\AppData\Roaming\betadeeal
2014-11-23 18:29 - 2014-01-06 13:41 - 00000000 ____D () C:\Users\admin\AppData\Roaming\wp_update
C:\ProgramData\uninstall_Deeal.exe
C:\ProgramData\uninstall_Winservices.exe
C:\Program Files (x86)\Nosibay
C:\Program Files (x86)\Mobogenie
C:\Program Files (x86)\Browsersafeguard
C:\Program Files (x86)\globalUpdate
C:\Program Files (x86)\winservice86
C:\Program Files (x86)\WinServices
C:\Program Files (x86)\MyPC Backup
C:\Program Files (x86)\Desk 365
C:\ProgramData\WPM
C:\ProgramData\SaveByclick
C:\Users\admin\AppData\Roaming\51tpIG6
C:\Users\admin\AppData\Roaming\hG5XnNp
C:\Users\admin\AppData\Local\Microsoft\WinU
C:\Users\admin\AppData\Roaming\~kmvumca.exe
C:\Users\admin\AppData\Roaming\~ashppdx.exe
C:\Users\admin\AppData\Roaming\~vseuwvw.exe
C:\Users\admin\AppData\Roaming\j3yGNc4
Task: {08514D51-F480-46BF-A202-14202D934371} - System32\Tasks\globalUpdateUpdateTaskMachineCore => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2014-10-01] (globalUpdate) <==== ATTENTION
Task: {117BF383-782B-49A0-80E6-3D13BD1E1116} - System32\Tasks\a62014e3-bad8-4b48-bf82-9772a676629c-2 => C:\Program Files (x86)\winservice86\a62014e3-bad8-4b48-bf82-9772a676629c-2.exe [2014-10-01] (Corporate Inc) <==== ATTENTION
Task: {365ED7E2-A703-4754-8A33-579A7D18D168} - System32\Tasks\HqCHhRbemewhfxG => C:\Users\admin\AppData\Roaming\51tpIG6\RpaBkAf.exe [2014-11-23] ( )
Task: {3795FE22-C003-4711-9995-A59FAF95D421} - System32\Tasks\b1awkKNwBLq47FI => C:\Users\admin\AppData\Roaming\hG5XnNp\cIW2mus.exe [2014-11-26] ( )
Task: {4098322E-E75C-42C5-BC02-14150BDE6E57} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe <==== ATTENTION
Task: {4F9EA975-2C64-43B3-85E1-350FF5639C80} - System32\Tasks\a62014e3-bad8-4b48-bf82-9772a676629c-11 => C:\Program Files (x86)\winservice86\a62014e3-bad8-4b48-bf82-9772a676629c-11.exe [2014-10-01] (Corporate Inc) <==== ATTENTION
Task: {55D39756-46E1-46E8-91FF-D140FE646E40} - System32\Tasks\a62014e3-bad8-4b48-bf82-9772a676629c-5 => C:\Program Files (x86)\winservice86\a62014e3-bad8-4b48-bf82-9772a676629c-5.exe [2014-10-01] (Corporate Inc) <==== ATTENTION
Task: {5BA3E464-6A13-4EB0-A564-F363504D3511} - System32\Tasks\Desk 365 RunAsStdUser => C:\Program Files (x86)\Desk 365\desk365.exe <==== ATTENTION
Task: {5F898D24-DBB5-49B6-BC8E-B14D09BF98C9} - System32\Tasks\WIN-statsSystem => C:\Users\admin\AppData\Local\Microsoft\WinU\~fgwqvsz.exe [2014-06-30] ()
Task: {628B447E-1F0A-464C-9DEF-17ECDD6F20C3} - System32\Tasks\WIN-statsAdmin => C:\Users\admin\AppData\Local\Microsoft\WinU\~gkqucci.exe [2014-08-06] () <==== ATTENTION
Task: {79656F7A-BB1E-4F10-8D7A-15E39040987C} - System32\Tasks\WIN-fdfEfEfAfC => C:\Users\admin\AppData\Roaming\~kmvumca.exe [2014-07-12] ()
Task: {8DE6C11E-4F7E-4A08-811D-82C28247DC00} - System32\Tasks\TaskUserUpdate_wp => C:\Users\admin\AppData\Roaming\~ashppdx.exe [2013-12-06] ()
Task: {AB64B574-1F4D-415E-8223-DBB0B78DCE65} - System32\Tasks\globalUpdateUpdateTaskMachineUA => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2014-10-01] (globalUpdate) <==== ATTENTION
Task: {B5810B7C-2A55-4D07-B431-910CED5AD7A1} - System32\Tasks\WIN-GGfIfEGCfEGbGffIfCfEGC => C:\Users\admin\AppData\Roaming\~vseuwvw.exe [2014-10-01] ()
Task: {BF15FDE7-3805-496A-8F6A-F658412E905E} - System32\Tasks\ad7f33aa-5b98-444f-bb11-17bb5c480c66 => C:\Program Files (x86)\winservice86\ad7f33aa-5b98-444f-bb11-17bb5c480c66.exe [2014-10-01] (Corporate Inc) <==== ATTENTION
Task: {D13AC12D-6D41-4C22-BE37-0CF94CBDC9A1} - System32\Tasks\a62014e3-bad8-4b48-bf82-9772a676629c-1 => C:\Program Files (x86)\winservice86\winservice86-codedownloader.exe [2014-10-01] (Corporate Inc) <==== ATTENTION
Task: {D2362A6E-8862-42C7-9616-E3F876A22876} - System32\Tasks\a62014e3-bad8-4b48-bf82-9772a676629c-5_user => C:\Program Files (x86)\winservice86\a62014e3-bad8-4b48-bf82-9772a676629c-5.exe [2014-10-01] (Corporate Inc) <==== ATTENTION
Task: {F9D21A80-B921-4A31-B9A4-C232B8A9B19E} - System32\Tasks\TGN5SuDW61PSa0i => C:\Users\admin\AppData\Roaming\j3yGNc4\uNvtaMy.exe [2014-11-23] ( )
Task: {FEA63CC6-1EDB-47C0-BEF0-86FEEC7A8D15} - System32\Tasks\3e053bf9-585b-4a22-9008-a747798372a1 => C:\Program Files (x86)\winservice86\3e053bf9-585b-4a22-9008-a747798372a1.exe [2014-10-01] () <==== ATTENTION
Task: C:\Windows\Tasks\3e053bf9-585b-4a22-9008-a747798372a1.job => C:\Program Files (x86)\winservice86\3e053bf9-585b-4a22-9008-a747798372a1.exe <==== ATTENTION
Task: C:\Windows\Tasks\a62014e3-bad8-4b48-bf82-9772a676629c-1.job => C:\Program Files (x86)\winservice86\winservice86-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\a62014e3-bad8-4b48-bf82-9772a676629c-11.job => C:\Program Files (x86)\winservice86\a62014e3-bad8-4b48-bf82-9772a676629c-11.exe <==== ATTENTION
Task: C:\Windows\Tasks\a62014e3-bad8-4b48-bf82-9772a676629c-2.job => C:\Program Files (x86)\winservice86\a62014e3-bad8-4b48-bf82-9772a676629c-2.exe <==== ATTENTION
Task: C:\Windows\Tasks\a62014e3-bad8-4b48-bf82-9772a676629c-5.job => C:\Program Files (x86)\winservice86\a62014e3-bad8-4b48-bf82-9772a676629c-5.exe <==== ATTENTION
Task: C:\Windows\Tasks\a62014e3-bad8-4b48-bf82-9772a676629c-5_user.job => C:\Program Files (x86)\winservice86\a62014e3-bad8-4b48-bf82-9772a676629c-5.exe <==== ATTENTION
Task: C:\Windows\Tasks\ad7f33aa-5b98-444f-bb11-17bb5c480c66.job => C:\Program Files (x86)\winservice86\ad7f33aa-5b98-444f-bb11-17bb5c480c66.exe <==== ATTENTION
Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe
EmptyTemp:
end