start
CreateRestorePoint:
CloseProcesses:
HKLM-x32\...\Run: [mbot_fr_602] => [X]
HKU\S-1-5-21-592185993-1017439616-3603128292-1001\...\Run: [GoogleChromeAutoLaunch_45E6AD8795A1EE169740D65F698BD172] => "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe" --no-startup-window
AppInit_DLLs-x32: c:\programdata\flashbeat\flashbeat32.dll => "c:\programdata\flashbeat\flashbeat32.dll" File Not Found
Startup: C:\Users\Laurčne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hqghumeaylnlf.lnk [2015-04-21]
ShortcutTarget: hqghumeaylnlf.lnk -> C:\ProgramData\{99fff0b7-2dbb-95aa-99ff-ff0b72dbc2dc}\hqghumeaylnlf.exe (No File)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction 
CHR HKU\S-1-5-21-592185993-1017439616-3603128292-1001\SOFTWARE\Policies\Google: Policy restriction
HKU\S-1-5-21-592185993-1017439616-3603128292-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction
URLSearchHook: HKLM-x32 - Default Value = {CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}
FF SelectedSearchEngine: Trovi
FF Extension: CinemaPlus-3.2cV12.05 - C:\Users\Laurčne\AppData\Roaming\Mozilla\Firefox\Profiles\a6iwjavp.default\Extensions\d4db60df25f14dae9dd18@185c395f9e794c9ab86be3eb.com [2015-05-12]
FF Extension: Zoom It - C:\Users\Laurčne\AppData\Roaming\Mozilla\Firefox\Profiles\a6iwjavp.default\Extensions\{14e5d2fa-092b-ec85-01ab-ba8c709d84c8} [2015-04-04]
FF Extension: No Name - C:\Users\Laurčne\AppData\Roaming\Mozilla\Firefox\Profiles\a6iwjavp.default\extensions\taylorralston@hotmail.com [Not Found]
FF Extension: No Name - C:\Users\Laurčne\AppData\Roaming\Mozilla\Firefox\Profiles\a6iwjavp.default\extensions\taylorralston@hotmail.com [Not Found]
FF Extension: No Name - C:\Users\Laurčne\AppData\Roaming\Mozilla\Firefox\Profiles\a6iwjavp.default\extensions\taylorralston@hotmail.com [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [gfkbfjcbkhnmiignagpkiijohkcdkffb] - https://clients2.google.com/service/update2/crx
S2 fuhofyho; C:\Users\Laurčne\AppData\Roaming\4C4C4544-1431451407-3510-8058-C4C04F325331\nsz5EB0.tmp [X]
S2 gecyqyji; C:\Users\Laurčne\AppData\Roaming\4C4C4544-1428168311-3510-8058-C4C04F325331\nsyDF8B.tmp [X]
S2 qozyzuwu; C:\Users\Laurčne\AppData\Roaming\4C4C4544-1431451407-3510-8058-C4C04F325331\jnsf187E.tmp [X]
S2 xyhigysy; C:\Users\Laurčne\AppData\Roaming\4C4C4544-1428168311-3510-8058-C4C04F325331\jnsi2951.tmp [X]
2015-05-14 13:37 - 2015-05-14 13:37 - 02209792 _____ () C:\Users\Laurčne\Desktop\adwcleaner_4.204 (1).exe
2015-05-14 01:44 - 2015-05-14 01:45 - 02204160 _____ () C:\Users\Laurčne\Downloads\adwcleaner_4.203 (1).exe
2015-05-13 02:32 - 2015-05-13 02:32 - 00000000 ____D () C:\Program Files\Enigma Software Group
2015-05-13 02:31 - 2015-05-13 02:31 - 03109248 _____ (Enigma Software Group USA, LLC.) C:\Users\Laurčne\Downloads\SpyHunter-Installer.exe
2015-05-13 01:07 - 2015-05-13 01:07 - 02204160 _____ () C:\Users\Laurčne\Downloads\adwcleaner_4.203.exe
2015-05-12 21:11 - 2015-05-12 21:11 - 00613255 _____ (CMI Limited) C:\Users\Laurčne\AppData\Local\nsb6839.tmp
2015-05-12 21:03 - 2015-05-12 21:03 - 00001020 _____ () C:\Windows\Tasks\piFHSprdaKx0XtS1m5SE.job
2015-05-12 21:03 - 2015-05-12 21:03 - 00001008 _____ () C:\Windows\Tasks\Va09IKAvEnHk8B.job
2015-05-12 21:02 - 2015-05-14 23:03 - 00000000 ____D () C:\Program Files (x86)\CinemaPlus-3.2cV12.05
2015-05-12 21:02 - 2015-05-12 21:02 - 00000000 ____D () C:\Program Files (x86)\1728e62f-763a-4471-b5ed-f67bc046fbf7
2015-05-12 21:00 - 2015-05-12 21:00 - 00002251 _____ () C:\Users\Public\Desktop\Search.lnk
2015-05-12 19:47 - 2015-05-12 19:47 - 02209792 _____ () C:\Users\Laurčne\Downloads\adwcleaner_4.204.exe
2015-05-12 19:43 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\2SnHk5C
2015-05-12 19:42 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\6HsPH7P
2015-05-12 19:15 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\TgsXZDV
2015-05-12 19:14 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\9ehymqg
2015-05-12 14:56 - 2015-05-12 14:56 - 00001034 _____ () C:\Windows\Tasks\g69pUwN5XxmM9dasq6U0PlxijWR.job
2015-05-12 14:56 - 2015-05-12 14:56 - 00001020 _____ () C:\Windows\Tasks\JcIZU7yasaUNfZaPauJa.job
2015-05-12 13:03 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\rdAoP2K
2015-05-12 13:03 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\hjO2y92
2015-05-12 13:03 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\SAWYSvk
2015-05-12 13:03 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\23ajY94
2015-05-11 15:39 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\IJRrW2e
2015-05-11 15:39 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\1zODr7c
2015-05-11 15:38 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\xH8Id3H
2015-05-11 15:38 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\lc4Su5a
2015-05-11 15:31 - 2015-05-11 15:31 - 00000000 ____D () C:\ProgramData\4ea261900000880
2015-05-10 22:04 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\odkFEwG
2015-05-10 22:04 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\LBffzfU
2015-05-10 11:56 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\EOJT3hL
2015-05-10 11:56 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\rzk6USI
2015-05-10 11:54 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\LzKyJyw
2015-05-10 11:54 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\9lP4Sp7
2015-05-09 19:26 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\N5ycNQR
2015-05-09 19:26 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\vMOYS65
2015-05-08 21:35 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\aHETF6t
2015-05-08 21:35 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\vGnSO9k
2015-05-08 12:04 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\ik3Xe4L
2015-05-08 12:04 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\Ebwt3P4
2015-05-08 12:01 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\9ASeuq5
2015-05-08 12:01 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\u0rwWCd
2015-05-07 19:31 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\revkEUh
2015-05-07 19:31 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\oTWSF4d
2015-05-07 19:30 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\bO54HTN
2015-05-07 19:30 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\Iu7Z6CB
2015-05-06 10:07 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\PzVE5Qe
2015-05-06 10:07 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\awkhfi3
2015-05-06 10:05 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\SsDGpxo
2015-05-06 10:05 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\LO0Ax75
2015-05-05 09:18 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\gVclMpq
2015-05-05 09:18 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\ljmsaiD
2015-05-05 09:14 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\pf81Uus
2015-05-05 09:14 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\8lq1IWt
2015-05-04 07:59 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\OJGCFyu
2015-05-04 07:59 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\EABVVVa
2015-05-03 11:51 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\NnLk6Uf
2015-05-03 11:51 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\2rGlVbp
2015-05-03 11:49 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\qe0TcTz
2015-05-03 11:48 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\jx6UAd7
2015-05-02 08:22 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\QxwgZv3
2015-05-02 08:22 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\0ZhEUfq
2015-05-02 08:17 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\Gq7ni2S
2015-05-02 08:17 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\vKs29nU
2015-05-01 15:56 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\7Yd5tym
2015-05-01 15:56 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\vw8zHve
2015-05-01 10:01 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\uPG1dGL
2015-05-01 10:01 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\5pPdXCo
2015-05-01 09:57 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\9Gst1ck
2015-05-01 09:57 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\cUWd1bU
2015-05-01 01:09 - 2015-05-01 01:09 - 00000000 ____D () C:\Users\Laurčne\AppData\Local\ZombieNews
2015-05-01 01:03 - 2015-05-01 01:09 - 00000000 ____D () C:\ProgramData\ZombieNews
2015-04-30 17:40 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\pXL3f74
2015-04-30 17:40 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\DIXOrYK
2015-04-30 12:30 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\oOpNls9
2015-04-30 12:30 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\so9pHsY
2015-04-30 12:14 - 2015-04-30 12:15 - 00000000 ____D () C:\Program Files (x86)\165e141c-7ce7-4d2d-95c9-2e448d0ea2e3
2015-04-30 12:12 - 2015-04-30 12:12 - 00628688 _____ (CMI Limited) C:\Users\Laurčne\AppData\Local\nsv2A82.tmp
2015-04-30 10:59 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\MJS35gw
2015-04-30 10:59 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\sXYcdWA
2015-04-30 10:55 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\zuIatmB
2015-04-30 10:55 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\xIqncNJ
2015-04-30 10:54 - 2015-05-15 12:10 - 00000334 _____ () C:\Windows\Tasks\FHXDFWKG1.job
2015-04-30 10:54 - 2015-05-12 20:02 - 00000000 ____D () C:\ProgramData\76d560a736784e8cbee063e17c51ac68
2015-04-30 10:54 - 2015-04-30 10:54 - 00002856 _____ () C:\Windows\System32\Tasks\FHXDFWKG1
2015-04-30 10:54 - 2015-04-30 10:54 - 00000000 ____D () C:\ProgramData\7796c505eb454c2a97ca17c4283c1378
2015-04-30 01:04 - 2015-04-30 01:04 - 00001022 _____ () C:\Windows\Tasks\cwSScdqs8gKLaX7O4NGkP.job
2015-04-30 01:04 - 2015-04-30 01:04 - 00000994 _____ () C:\Windows\Tasks\p6cMjer.job
2015-04-30 01:02 - 2015-05-12 19:42 - 00000000 ____D () C:\Program Files (x86)\46218469-0e02-4578-b95d-4f536da68b3a
2015-04-29 22:05 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\zFxTxUd
2015-04-29 22:05 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\23J6KBy
2015-04-29 14:41 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\ZxJ1W8U
2015-04-29 14:41 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\SIRiLMK
2015-04-29 14:20 - 2015-05-05 21:36 - 00000000 ____D () C:\Users\Laurčne\Desktop\G-pord
2015-04-29 12:46 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\Wfqhoin
2015-04-29 12:46 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\25Q9Pyi
2015-04-29 12:42 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\WqPxGVV
2015-04-29 12:42 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\rkAJpM1
2015-04-29 00:19 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\pUv1Pem
2015-04-29 00:19 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\4QzTYxR
2015-04-27 15:56 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\YQZAIyg
2015-04-27 15:56 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\qW2rFfs
2015-04-27 15:53 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\nwpopwp
2015-04-27 15:53 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\TlTAEVn
2015-04-26 20:36 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\BD7Vttl
2015-04-26 20:36 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\TKsKPVY
2015-04-25 01:21 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\qIeqOHq
2015-04-25 01:21 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\vOGojJA
2015-04-25 01:08 - 2015-04-25 01:08 - 02224640 _____ () C:\Users\Laurčne\Downloads\adwcleaner_4.202.exe
2015-04-24 19:19 - 2015-05-12 22:53 - 00000000 ____D () C:\Program Files (x86)\62274fc2-44fa-4a68-8025-9f9311683e85
2015-04-24 19:17 - 2015-05-12 20:17 - 00000000 ____D () C:\Users\Laurčne\AppData\Local\avaavbxvba
2015-04-24 07:37 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\nZMIoXd
2015-04-24 07:37 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\VbQ43Qu
2015-04-23 22:39 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\Yccyi7Y
2015-04-23 22:39 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\QHzEafg
2015-04-23 22:39 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\hDuW57I
2015-04-23 22:38 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\p4vrMjd
2015-04-22 07:37 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\C05OoED
2015-04-22 07:37 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\9NayPFw
2015-04-22 01:41 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\h5k3sF9
2015-04-22 01:41 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\RQRR9cu
2015-04-21 22:29 - 2015-04-21 22:29 - 00000000 ____D () C:\Users\Laurčne\Documents\Optimizer Pro
2015-04-21 14:45 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\tTAnEl6
2015-04-21 14:45 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\IoxKzPn
2015-04-21 14:40 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\ONvSnVd
2015-04-21 14:40 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\nX4vaOa
2015-04-20 17:53 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\z7gmQWr
2015-04-20 17:53 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\BHwaXVm
2015-04-20 17:52 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\p5qRqFo
2015-04-20 17:52 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\etvyQYV
2015-04-19 14:20 - 2015-05-14 22:39 - 00000626 _____ () C:\Users\Laurčne\AppData\Roaming\piFHSprdaKx0XtS1m5SE
2015-04-19 14:20 - 2015-05-14 22:39 - 00000626 _____ () C:\Users\Laurčne\AppData\Roaming\g69pUwN5XxmM9dasq6U0PlxijWR
2015-04-19 14:20 - 2015-05-12 20:23 - 00000626 _____ () C:\Users\Laurčne\AppData\Roaming\p6cMjer
2015-04-19 13:55 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\9JW4wGN
2015-04-19 13:55 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\j3rhrT2
2015-04-19 13:54 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\SJWYhOn
2015-04-19 13:53 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\A7bls2k
2015-04-18 02:49 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\QsDrN0f
2015-04-18 02:49 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\kHCUNUx
2015-04-17 12:14 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\lmviYJn
2015-04-17 12:14 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\12wEsYC
2015-04-15 22:42 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\vZqsk5o
2015-04-15 22:42 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\0Ltdd2f
2015-04-15 15:57 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\h5f3BKV
2015-04-15 15:57 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\5AuNIxr
2015-04-15 09:06 - 2015-05-12 20:23 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\f5DUHJk
2015-04-15 09:06 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\4HCDrcH
2015-04-15 09:02 - 2015-05-12 22:53 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\bcht1hB
2015-04-15 09:02 - 2015-05-12 20:22 - 00000000 ____D () C:\Users\Laurčne\AppData\Roaming\jEhCj8A
C:\Program Files (x86)\Crossbrowse
C:\ProgramData\FlashBeat
C:\ProgramData\{99fff0b7-2dbb-95aa-99ff-ff0b72dbc2dc}
C:\Users\Laurý˙ne\AppData\Roaming\cwSScdqs8gKLaX7O4NGkP.exe 
C:\Users\Laurý˙ne\AppData\Roaming\g69pUwN5XxmM9dasq6U0PlxijWR.exe 
C:\Users\Laurý˙ne\AppData\Roaming\IMZRO.exe
C:\Users\Laurý˙ne\AppData\Roaming\JcIZU7yasaUNfZaPauJa.exe
C:\Users\Laurý˙ne\AppData\Roaming\p6cMjer.exe
C:\Users\Laurý˙ne\AppData\Roaming\piFHSprdaKx0XtS1m5SE.exe
C:\Users\Laurý˙ne\AppData\Roaming\TXCT.exe
C:\Users\Laurý˙ne\AppData\Roaming\Va09IKAvEnHk8B.exe 
C:\Users\Laurčne\AppData\Roaming\4C4C4544-1431451407-3510-8058-C4C04F325331
Task: C:\Windows\Tasks\cwSScdqs8gKLaX7O4NGkP.job => C:\Users\Laurý˙ne\AppData\Roaming\cwSScdqs8gKLaX7O4NGkP.exe 
Task: C:\Windows\Tasks\FHXDFWKG1.job => C:\ProgramData\FlashBeat\FlashBeat.exe
Task: C:\Windows\Tasks\g69pUwN5XxmM9dasq6U0PlxijWR.job => C:\Users\Laurý˙ne\AppData\Roaming\g69pUwN5XxmM9dasq6U0PlxijWR.exe 
Task: C:\Windows\Tasks\IMZRO.job => C:\Users\Laurý˙ne\AppData\Roaming\IMZRO.exe 
Task: C:\Windows\Tasks\JcIZU7yasaUNfZaPauJa.job => C:\Users\Laurý˙ne\AppData\Roaming\JcIZU7yasaUNfZaPauJa.exe 
Task: C:\Windows\Tasks\p6cMjer.job => C:\Users\Laurý˙ne\AppData\Roaming\p6cMjer.exe 
Task: C:\Windows\Tasks\piFHSprdaKx0XtS1m5SE.job => C:\Users\Laurý˙ne\AppData\Roaming\piFHSprdaKx0XtS1m5SE.exe 
Task: C:\Windows\Tasks\TXCT.job => C:\Users\Laurý˙ne\AppData\Roaming\TXCT.exe 
Task: C:\Windows\Tasks\Va09IKAvEnHk8B.job => C:\Users\Laurý˙ne\AppData\Roaming\Va09IKAvEnHk8B.exe 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MyOSProtect => ""="service" 
RemoveProxy:
EmptyTemp:
end