IFEO\bitguard.exe: [Debugger] tasklist.exe
IFEO\bprotect.exe: [Debugger] tasklist.exe
IFEO\bpsvc.exe: [Debugger] tasklist.exe
IFEO\browserdefender.exe: [Debugger] tasklist.exe
IFEO\browserprotect.exe: [Debugger] tasklist.exe
IFEO\browsersafeguard.exe: [Debugger] tasklist.exe
IFEO\dprotectsvc.exe: [Debugger] tasklist.exe
IFEO\jumpflip: [Debugger] tasklist.exe
IFEO\protectedsearch.exe: [Debugger] tasklist.exe
IFEO\searchinstaller.exe: [Debugger] tasklist.exe
IFEO\searchprotection.exe: [Debugger] tasklist.exe
IFEO\searchprotector.exe: [Debugger] tasklist.exe
IFEO\searchsettings.exe: [Debugger] tasklist.exe
IFEO\searchsettings64.exe: [Debugger] tasklist.exe
IFEO\snapdo.exe: [Debugger] tasklist.exe
IFEO\stinst32.exe: [Debugger] tasklist.exe
IFEO\stinst64.exe: [Debugger] tasklist.exe
IFEO\umbrella.exe: [Debugger] tasklist.exe
IFEO\utiljumpflip.exe: [Debugger] tasklist.exe
IFEO\volaro: [Debugger] tasklist.exe
IFEO\vonteera: [Debugger] tasklist.exe
IFEO\websteroids.exe: [Debugger] tasklist.exe
IFEO\websteroidsservice.exe: [Debugger] tasklist.exe
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://nightwarez.ru/
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://nightwarez.ru/
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://nightwarez.ru/
SearchScopes: HKU\S-1-5-21-1085031214-179605362-682003330-500 -> {6DC2596C-844E-40F3-BDD2-B69867CF9788} URL = hxxp://NightWarez.ru/index.php?story={searchTerms}&do=search&subaction=search
FF Extension: (Neiron Search Tools) - C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\{ca42e45e-2389-4e62-a7d6-11db0a4a9054}.xpi [2015-04-02] [not signed]
FF Extension: (Everysale.Net) - C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\nahd6ha2.default\extensions\{4d31e4c9-ce86-4b0f-8ffb-56345a8b5f6c}.xpi [2015-04-02] [not signed]
FF Extension: (MegaSmiles) - C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\nahd6ha2.default\Extensions\exnice@smile-net.lv [2013-09-14] [not signed]
FF Extension: (TrollBar) - C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\nahd6ha2.default\Extensions\ithappy@it-net.ua [2013-09-14] [not signed]
FF Extension: (PhoenixGuard) - C:\Documents and Settings\Admin\Application Data\Mozilla\Firefox\Profiles\nahd6ha2.default\Extensions\jid1-mQ4tv5noZTml7A@jetpack.xpi [2015-04-02] [not signed]
OPR Extension: (System Security Application) - C:\Documents and Settings\Admin\Application Data\Opera Software\Opera Stable\Extensions\epcjbhgkehdidecpfkplcclbpedaioda [2014-01-07]
OPR Extension: (Everysale.Net) - C:\Documents and Settings\Admin\Application Data\Opera Software\Opera Stable\Extensions\iapdadaeaebaoigieglfababneoaifnf [2015-04-02]
OPR Extension: (Neiron Search Tools) - C:\Documents and Settings\Admin\Application Data\Opera Software\Opera Stable\Extensions\oehahoblpagnioelpmminjmlpnabnmok [2015-04-02]
OPR Extension: (PhoenixGuard - бесплатный антивирусный тулбар) - C:\Documents and Settings\Admin\Application Data\Opera Software\Opera Stable\Extensions\pleoihkpdomoijdpaibdciidfoeedamm [2015-04-02]
EmptyTemp:
Reboot: