Task: {5546FC70-9AFB-4B4D-9BF4-9475098C209B} - System32\Tasks\WSE_Vosteran => C:\Users\Kaban\AppData\Roaming\WSE_Vosteran\UpdateProc\UpdateTask.exe [2015-01-13] () <==== ATTENTION
Task: {7D4C64DE-6153-46EE-BA3B-820B43276A1E} - System32\Tasks\{E909978F-EAA9-4F93-B188-121294DD63E8} => Chrome.exe
http://ui.skype.com/ui/0/7.0.0.102/pl/abandoninstall?page=tsProgressBar
Task: C:\Windows\Tasks\WSE_Vosteran.job => C:\Users\Kaban\AppData\Roaming\WSE_VO~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
HKU\.DEFAULT\Software\Classes\.exe: exefile => "%1" %* <===== ATTENTION!
HKU\.DEFAULT\Software\Classes\exefile: "%1" %* <===== ATTENTION!
HKU\S-1-5-19\Software\Classes\.exe: exefile => "%1" %* <===== ATTENTION!
HKU\S-1-5-19\Software\Classes\exefile: "%1" %* <===== ATTENTION!
HKU\S-1-5-20\Software\Classes\.exe: exefile => "%1" %* <===== ATTENTION!
HKU\S-1-5-20\Software\Classes\exefile: "%1" %* <===== ATTENTION!
HKU\S-1-5-21-1240708796-960402954-1301851095-1000\Software\Classes\.exe: exefile => "%1" %* <===== ATTENTION!
HKU\S-1-5-21-1240708796-960402954-1301851095-1000\Software\Classes\exefile: "%1" %* <===== ATTENTION!
HKU\S-1-5-21-1240708796-960402954-1301851095-1000\...\RunOnce: [WSE_Vosteran] => wscript /E:vbscript /B "C:\Users\Kaban\AppData\Roaming\WSE_Vosteran\UpdateProc\bkup.dat"
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-1240708796-960402954-1301851095-1000\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://isearch.omiga-plus.com/?type=hppp&...om=cor&uid=SAMSUNGXHM250HI_S1RUJ90SA28485
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://isearch.omiga-plus.com/web/?type=dspp&...amp;uid=SAMSUNGXHM250HI_S1RUJ90SA28485&q= {searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://isearch.omiga-plus.com/?type=hppp&...om=cor&uid=SAMSUNGXHM250HI_S1RUJ90SA28485
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://isearch.omiga-plus.com/web/?type=dspp&...amp;uid=SAMSUNGXHM250HI_S1RUJ90SA28485&q= {searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
http://vosteran.com/results.php?f=4&q= {searchTerms}&a=vst_ir_15_03_ch&cd=2XzuyEtN2Y1L1QzutDtDtBtByCyEyDyByC0C0D0C0AyEyE0CtN0D0Tzu0StCtCtDzztN1L2XzutAtFyBtFtCtFyEtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2StDtD0E0FyD0D0DtAtG0FyByDtBtGyDzz0F0DtG0C0FtDyEtGtC0ByCtCzyyD0Azy0AyC0B0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAtDyC0A0B0CyC0FtGzy0DtD0CtGyEtC0D0FtGzy0A0AtCtGzz0F0AyD0AyD0B0D0E0BtA0D2Q&cr=798609360&ir=
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
http://vosteran.com/results.php?f=4&q= {searchTerms}&a=vst_ir_15_03_ch&cd=2XzuyEtN2Y1L1QzutDtDtBtByCyEyDyByC0C0D0C0AyEyE0CtN0D0Tzu0StCtCtDzztN1L2XzutAtFyBtFtCtFyEtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2StDtD0E0FyD0D0DtAtG0FyByDtBtGyDzz0F0DtG0C0FtDyEtGtC0ByCtCzyyD0Azy0AyC0B0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAtDyC0A0B0CyC0FtGzy0DtD0CtGyEtC0D0FtGzy0A0AtCtGzz0F0AyD0AyD0B0D0E0BtA0D2Q&cr=798609360&ir=
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
http://isearch.omiga-plus.com/web/?type=dspp&...amp;uid=SAMSUNGXHM250HI_S1RUJ90SA28485&q= {searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
http://isearch.omiga-plus.com/web/?type=dspp&...amp;uid=SAMSUNGXHM250HI_S1RUJ90SA28485&q= {searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1240708796-960402954-1301851095-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
http://isearch.omiga-plus.com/web/?type=dspp&...amp;uid=SAMSUNGXHM250HI_S1RUJ90SA28485&q= {searchTerms}
SearchScopes: HKU\S-1-5-21-1240708796-960402954-1301851095-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
http://vosteran.com/results.php?f=4&q= {searchTerms}&a=vst_ir_15_03_ch&cd=2XzuyEtN2Y1L1QzutDtDtBtByCyEyDyByC0C0D0C0AyEyE0CtN0D0Tzu0StCtCtDzztN1L2XzutAtFyBtFtCtFyEtN1L1CzutCyEtBzytDyD1V1ByEtN1L1G1B1V1N2Y1L1Qzu2StDtD0E0FyD0D0DtAtG0FyByDtBtGyDzz0F0DtG0C0FtDyEtGtC0ByCtCzyyD0Azy0AyC0B0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2StAtDyC0A0B0CyC0FtGzy0DtD0CtGyEtC0D0FtGzy0A0AtCtGzz0F0AyD0AyD0B0D0E0BtA0D2Q&cr=798609360&ir=
SearchScopes: HKU\S-1-5-21-1240708796-960402954-1301851095-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
http://isearch.omiga-plus.com/web/?type=dspp&...amp;uid=SAMSUNGXHM250HI_S1RUJ90SA28485&q= {searchTerms}
BHO-x32: No Name -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
CHR HKU\S-1-5-21-1240708796-960402954-1301851095-1000\...\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - No Path
CHR HKLM-x32\...\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - No Path
R2 IHProtect Service; C:\Program Files (x86)\XTab\ProtectService.exe [158864 2014-12-29] (XTab system)
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [473088 2015-01-13] (Fuyu LIMITED) [File not signed]
S3 njldjdjo; No ImagePath
S3 cpuz134; \??\C:\Users\Kaban\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]
U0 SR; No ImagePath
U2 srservice; No ImagePath
2015-01-13 15:43 - 2015-01-13 15:43 - 00005815 _____ () C:\Users\Kaban\Desktop\hijackthis123
2015-01-13 15:35 - 2015-01-13 15:35 - 00006837 _____ () C:\Users\Kaban\Desktop\hijackthis.log
2015-01-13 15:34 - 2015-01-13 15:34 - 00002271 _____ () C:\Users\Kaban\Desktop\Vosteran.lnk
2015-01-13 15:34 - 2015-01-13 15:34 - 00000000 ____D () C:\Users\Kaban\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Vosteran
2015-01-13 15:33 - 2015-01-13 15:34 - 00000000 ____D () C:\Users\Kaban\AppData\Local\Vosteran
2015-01-13 15:33 - 2015-01-13 15:33 - 00003244 _____ () C:\Windows\System32\Tasks\WSE_Vosteran
2015-01-13 15:33 - 2015-01-13 15:33 - 00000292 _____ () C:\Windows\Tasks\WSE_Vosteran.job
2015-01-13 15:33 - 2015-01-13 15:33 - 00000000 ____D () C:\Users\Kaban\AppData\Roaming\WSE_Vosteran
2015-01-13 15:33 - 2015-01-13 15:33 - 00000000 ____D () C:\Program Files (x86)\WSE_Vosteran
2015-01-13 15:32 - 2015-01-13 15:32 - 00000000 ____D () C:\ProgramData\IHProtectUpDate
2015-01-13 15:32 - 2015-01-13 15:32 - 00000000 ____D () C:\Program Files (x86)\XTab
2015-01-13 15:31 - 2015-01-13 15:31 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2015-01-13 15:30 - 2015-01-13 15:31 - 00000000 ____D () C:\Users\Kaban\AppData\Roaming\MailUpdate
2015-01-13 15:30 - 2015-01-13 15:30 - 00000000 ____D () C:\Users\Kaban\AppData\Roaming\omiga-plus
2015-01-13 15:30 - 2015-01-13 15:30 - 00000000 ____D () C:\ProgramData\MailUpdate
2015-01-13 15:29 - 2015-01-13 15:29 - 00730528 _____ ( ) C:\Users\Kaban\Downloads\HijackThis(12030)-dp.exe
2015-01-13 14:49 - 2015-01-13 15:13 - 00000000 ____D () C:\AdwCleaner
2015-01-13 13:20 - 2015-01-13 13:20 - 03044736 _____ (Enigma Software Group USA, LLC.) C:\Users\Kaban\Downloads\sh-remover.exe
2015-01-07 00:44 - 2015-01-07 00:44 - 00003104 _____ () C:\Windows\System32\Tasks\{E909978F-EAA9-4F93-B188-121294DD63E8}
EmptyTemp: