brent58

Hi Maurice, Everything seems to be ok now so I would just like to thank you for your time in helping me with this and the valuable advice offered. Kind Regards, Brent

Hi Maurice, results below... Presumably I am ok to re-install Prevx now? Also, I would be interested to know if you think my current security precautions (ie. ms essentials, MAMB & Prevx) offer a good level of protection...... would you change anything? Many thanks, Brent Results of screen317's Security Check version 0.99.56 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Microsoft Security Essentials Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware version 1.65.1.1000 Java 7 Update 9 Adobe Flash Player 11.5.502.110 Adobe Reader 9 Adobe Reader out of Date! Adobe Reader 10.1.4 Adobe Reader out of Date! Mozilla Firefox 16.0.2 Firefox out of Date! Google Chrome 21.0.1180.83 Google Chrome 21.0.1180.89 Google Chrome 22.0.1229.79 Google Chrome 22.0.1229.92 Google Chrome 22.0.1229.94 Google Chrome 23.0.1271.64 Google Chrome 23.0.1271.91 ````````Process Check: objlist.exe by Laurent```````` Microsoft Security Essentials MSMpEng.exe Microsoft Security Essentials msseces.exe Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 0% ````````````````````End of Log``````````````````````

Hi Maurice, here are the results..... I have Cyberlink DVD Suite software installed on my machine but have never used it as far as I can recall. I had a small problem with running ComboFix as it asked that Prevx anti-virus be disabled before starting. However, I was unable to find any way to do that... I think the instructions in the link you provided are maybe out of date and I could find no way of disabling it. In the end I re-booted my pc to prevent Combofix from running, un-installed Prevx and re-booted again. I was then able to run combofix without any problems and the log is shown below. I will not re-install prevx until you let me know it is ok to do so. Apart from that, everything seems to be working ok. Many Thanks, Brent ComboFix 12-11-29.01 - Brent 29/11/2012 9:28.1.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.4087.2830 [GMT 0:00] Running from: c:\users\Brent\Desktop\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C} SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\SysWow64\muzapp.exe . . ((((((((((((((((((((((((( Files Created from 2012-10-28 to 2012-11-29 ))))))))))))))))))))))))))))))) . . 2012-11-29 09:35 . 2012-11-29 09:35 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-11-29 09:11 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2EDD2076-6627-4AEF-8120-E8049B63EA38}\mpengine.dll 2012-11-29 08:39 . 2012-11-29 08:38 972264 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{EAEB4E82-5A0C-4119-86E5-6F9D45CB957D}\gapaengine.dll 2012-11-28 18:26 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-11-28 09:54 . 2012-11-28 10:12 -------- d-----w- c:\users\Brent\DoctorWeb 2012-11-27 11:42 . 2012-11-27 11:42 -------- d-----w- c:\program files (x86)\ESET 2012-11-24 14:34 . 2012-11-24 14:34 -------- d-----w- c:\users\Brent\AppData\Roaming\Malwarebytes 2012-11-24 14:34 . 2012-11-24 14:34 -------- d-----w- c:\programdata\Malwarebytes 2012-11-24 14:33 . 2012-11-24 14:34 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-11-24 14:33 . 2012-09-29 19:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-11-17 00:55 . 2012-07-26 04:47 2560 ----a-w- c:\windows\system32\drivers\en-US\wdf01000.sys.mui 2012-11-17 00:55 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys 2012-11-17 00:55 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys 2012-11-17 00:55 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll 2012-11-17 00:46 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys 2012-11-17 00:46 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys 2012-11-17 00:46 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe 2012-11-17 00:46 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll 2012-11-17 00:46 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll 2012-11-17 00:46 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll 2012-11-17 00:46 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll 2012-11-15 14:14 . 2012-06-27 08:37 1917416 ----a-w- c:\windows\system32\WdfCoInstaller01005.dll 2012-11-15 14:14 . 2012-06-27 08:37 1917416 ----a-w- c:\windows\system32\drivers\WdfCoInstaller01005.dll 2012-11-15 13:43 . 1997-04-22 01:00 27632 ----a-w- c:\windows\SysWow64\Ctl3dv2.dll 2012-11-13 10:20 . 2012-11-13 10:20 -------- d-----w- c:\programdata\eBay 2012-11-13 10:20 . 2012-11-13 10:20 -------- d-----w- c:\program files (x86)\eBay 2012-11-11 20:03 . 2012-11-11 20:03 -------- d-----w- c:\users\Brent\AppData\Roaming\OpenOffice.org 2012-11-11 20:01 . 2012-11-11 20:01 -------- d-----w- c:\program files (x86)\OpenOffice.org 3 2012-11-08 15:24 . 2012-11-08 15:24 -------- d-----w- c:\program files (x86)\LinkChecker 2012-11-07 14:21 . 2012-11-07 14:21 14825544 ----a-w- c:\program files (x86)\Common Files\lpuninstall.exe 2012-11-06 15:30 . 1998-02-13 14:30 143872 ----a-w- c:\windows\SysWow64\iacenc.dll 2012-11-06 15:30 . 1997-11-06 12:53 27648 ----a-w- c:\windows\SysWow64\ir50_lcs.dll 2012-11-06 15:30 . 1997-08-27 09:53 391168 ----a-w- c:\windows\SysWow64\i263_32.drv 2012-11-06 15:30 . 1997-06-13 08:56 56832 ----a-w- c:\windows\SysWow64\Iyvu9_32.dll 2012-11-06 15:30 . 1998-07-30 12:51 305152 ----a-w- c:\windows\IsUninst.exe . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-11-17 00:47 . 2010-09-25 09:48 66395536 ----a-w- c:\windows\system32\MRT.exe 2012-11-15 08:59 . 2012-06-24 16:29 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-11-15 08:59 . 2012-06-24 16:29 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-10-29 12:10 . 2012-10-10 15:43 4659712 ----a-w- c:\windows\SysWow64\Redemption.dll 2012-10-19 09:45 . 2012-10-19 09:45 163056 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10142.bin 2012-10-19 09:17 . 2012-10-19 09:17 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2012-10-19 09:17 . 2012-10-19 09:18 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll 2012-10-19 09:17 . 2012-10-19 09:18 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll 2012-10-16 08:38 . 2012-11-28 09:48 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll 2012-10-16 08:38 . 2012-11-28 09:48 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll 2012-10-16 07:39 . 2012-11-28 09:48 561664 ----a-w- c:\windows\apppatch\AcLayers.dll 2012-10-09 19:11 . 2012-10-09 19:11 49152 ----a-r- c:\windows\SysWow64\inetwh32.dll 2012-10-09 19:11 . 2012-10-09 19:11 1044480 ----a-r- c:\windows\SysWow64\roboex32.dll 2012-10-02 16:07 . 2012-10-02 16:07 972192 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll 2012-09-26 19:57 . 2012-09-26 19:57 974848 ----a-w- c:\windows\SysWow64\cis-2.4.dll 2012-09-26 19:57 . 2012-09-26 19:57 81920 ----a-w- c:\windows\SysWow64\issacapi_bs-2.3.dll 2012-09-26 19:57 . 2012-09-26 19:57 65536 ----a-w- c:\windows\SysWow64\issacapi_pe-2.3.dll 2012-09-26 19:57 . 2012-09-26 19:57 57344 ----a-w- c:\windows\SysWow64\MTXSYNCICON.dll 2012-09-26 19:57 . 2012-09-26 19:57 57344 ----a-w- c:\windows\SysWow64\MK_Lyric.dll 2012-09-26 19:57 . 2012-09-26 19:57 57344 ----a-w- c:\windows\SysWow64\issacapi_se-2.3.dll 2012-09-26 19:57 . 2012-09-26 19:57 569344 ----a-w- c:\windows\SysWow64\muzdecode.ax 2012-09-26 19:57 . 2012-09-26 19:57 491520 ----a-w- c:\windows\SysWow64\muzapp.dll 2012-09-26 19:57 . 2012-09-26 19:57 49152 ----a-w- c:\windows\SysWow64\MaJGUILib.dll 2012-09-26 19:57 . 2012-09-26 19:57 45320 ----a-w- c:\windows\SysWow64\MAMACExtract.dll 2012-09-26 19:57 . 2012-09-26 19:57 45056 ----a-w- c:\windows\SysWow64\MaXMLProto.dll 2012-09-26 19:57 . 2012-09-26 19:57 45056 ----a-w- c:\windows\SysWow64\MACXMLProto.dll 2012-09-26 19:57 . 2012-09-26 19:57 40960 ----a-w- c:\windows\SysWow64\MTTELECHIP.dll 2012-09-26 19:57 . 2012-09-26 19:57 352256 ----a-w- c:\windows\SysWow64\MSLUR71.dll 2012-09-26 19:57 . 2012-09-26 19:57 258048 ----a-w- c:\windows\SysWow64\muzoggsp.ax 2012-09-26 19:57 . 2012-09-26 19:57 245760 ----a-w- c:\windows\SysWow64\MSCLib.dll 2012-09-26 19:57 . 2012-09-26 19:57 24576 ----a-w- c:\windows\SysWow64\MASetupCleaner.exe 2012-09-26 19:57 . 2012-09-26 19:57 200704 ----a-w- c:\windows\SysWow64\muzwmts.dll 2012-09-26 19:57 . 2012-09-26 19:57 155648 ----a-w- c:\windows\SysWow64\MSFLib.dll 2012-09-26 19:57 . 2012-09-26 19:57 143360 ----a-w- c:\windows\SysWow64\3DAudio.ax 2012-09-26 19:57 . 2012-09-26 19:57 135168 ----a-w- c:\windows\SysWow64\muzaf1.dll 2012-09-26 19:57 . 2012-09-26 19:57 131072 ----a-w- c:\windows\SysWow64\muzmpgsp.ax 2012-09-26 19:57 . 2012-09-26 19:57 122880 ----a-w- c:\windows\SysWow64\muzeffect.ax 2012-09-26 19:57 . 2012-09-26 19:57 118784 ----a-w- c:\windows\SysWow64\MaDRM.dll 2012-09-26 19:57 . 2012-09-26 19:57 110592 ----a-w- c:\windows\SysWow64\muzmp4sp.ax 2012-09-25 11:36 . 2012-09-25 11:37 916456 ----a-w- c:\windows\system32\deployJava1.dll 2012-09-25 11:36 . 2012-09-25 11:37 1034216 ----a-w- c:\windows\system32\npDeployJava1.dll 2012-09-19 09:02 . 2012-09-29 17:36 1589248 ----a-w- c:\windows\SysWow64\libmysql_d.dll 2012-09-14 19:19 . 2012-10-10 13:52 2048 ----a-w- c:\windows\system32\tzres.dll 2012-09-14 18:28 . 2012-10-10 13:52 2048 ----a-w- c:\windows\SysWow64\tzres.dll 2012-08-31 18:19 . 2012-10-10 13:53 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-15 00:32 94208 ----a-w- c:\users\Brent\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-15 00:32 94208 ----a-w- c:\users\Brent\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-15 00:32 94208 ----a-w- c:\users\Brent\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Xmarks"="c:\program files (x86)\Xmarks\IE Extension\xmarkssync.exe" [2012-03-07 1122848] "Spotify Web Helper"="c:\users\Brent\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-11-06 1199576] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "RemoteControl"="c:\program files (x86)\ (x86)\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-14 71216] "LanguageShortcut"="c:\program files (x86)\ (x86)\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256] "TurboV"="c:\program files\ASUS\TurboV\TurboV.exe" [2009-09-07 5507072] "QFan Help"="c:\program files\ASUS\Ai Suite\QFan3\QFanHelp.exe" [2009-08-19 603136] "Cpu Level Up help"="c:\program files\ASUS\Ai Suite\CpuLevelUpHelp.exe" [2009-08-21 887936] "HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2009-08-28 2252800] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-04-06 102400] "HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2010-06-09 49208] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] . c:\users\Brent\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ 7 Sticky Notes.lnk - c:\program files (x86)\7 Sticky Notes\7StickyNotes.exe [2012-7-4 9097216] OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680] OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux3"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-29 676936] R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-10-02 3064000] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-06-07 160944] R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2011-05-13 36328] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-30 128456] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-12 368896] R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-05-13 157672] R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-05-13 16872] R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-05-13 177640] R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [2011-05-13 146920] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-09-25 1255736] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2008-06-16 55024] S2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [2009-09-06 169312] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-04-07 202752] S2 AsSysCtrlService;ASUS System Control Service;c:\program files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [2009-08-19 90112] S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-29 399432] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-29 25928] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240] S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-08-17 1235968] S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys [2008-05-06 14464] . . Contents of the 'Scheduled Tasks' folder . 2012-11-29 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-24 08:59] . 2012-11-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-26 18:19] . 2012-11-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-26 18:19] . 2012-11-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1572878878-1834635408-3462484821-1001Core.job - c:\users\Brent\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-09 16:24] . 2012-11-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1572878878-1834635408-3462484821-1001UA.job - c:\users\Brent\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-09 16:24] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-15 00:32 97792 ----a-w- c:\users\Brent\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-15 00:32 97792 ----a-w- c:\users\Brent\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-15 00:32 97792 ----a-w- c:\users\Brent\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2012-02-15 00:32 97792 ----a-w- c:\users\Brent\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}] 2012-10-25 15:45 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}] 2012-10-25 15:45 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}] 2012-10-25 15:45 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}] 2012-10-25 15:45 755224 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 1289704] . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.bing.com/ uDefault_Search_URL = hxxp://www.google.com/ie mLocal Page = c:\windows\SysWOW64\blank.htm uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 IE: LastPass - file://c:\users\Brent\AppData\LocalLow\LastPass\context.html?cmd=lastpass IE: LastPass Fill Forms - file://c:\users\Brent\AppData\LocalLow\LastPass\context.html?cmd=fillforms IE: NuSphere PhpED :: Debug this page - c:\program files (x86)\NuSphere\PhpED\NuSphereIEBar.dll/1000 TCP: DhcpNameServer = 194.168.4.100 194.168.8.100 FF - ProfilePath - c:\users\Brent\AppData\Roaming\Mozilla\Firefox\Profiles\uvtvei7p.default\ FF - ExtSQL: 2012-11-06 10:40; {966762eb-7132-4081-ac70-20d20161ad96}; c:\users\Brent\AppData\Roaming\Mozilla\Firefox\Profiles\uvtvei7p.default\extensions\{966762eb-7132-4081-ac70-20d20161ad96}.xpi . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Wow6432Node-HKLM-Run-<NO NAME> - (no file) Wow6432Node-HKLM-Run-KiesTrayAgent - c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe SafeBoot-BsScanner Toolbar-Locked - (no file) AddRemove-CodInstl - c:\windows\system32\CDUninst.isu . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-11-29 09:37:48 ComboFix-quarantined-files.txt 2012-11-29 09:37 . Pre-Run: 913,620,865,024 bytes free Post-Run: 915,094,310,912 bytes free . - - End Of File - - E5248F08B30F56762BB227A22E35F992

Results of DrWeb - 1 infection found. DrWeb.csv PDAurora.dll;C:\Program Files (x86)\ (x86)\CyberLink\PowerDirector Express;BackDoor.Siggen.49659;Deleted.; Do you want to see the CureIt.txt file as well ? Many thanks, Brent

Hi Maurice, here are the results.... Java 7 Update 7 (64 bit) - Removed Step 1 When running the fix.bat file it flashed up "not authorised" in the command window during the run. It was too quick to see what it was referring to but it completed ok and re-booted the pc. Step 2 Background Intelligent Transfer Service. >> OK Base Filtering Engine >> OK COM+ Event System >> OK COM+ System Application >> OK but STOPPED Cryptographic Services >> OK Ipsec Policy Agent >> OK Remote Procedure Call (RPC) Locator >> OK but STOPPED RPC Endpoint Mapper >> OK Windows Firewall >> OK Windows Installer >> OK but STOPPED Windows Management Instrumentation >> OK Windows Update >> OK Step 3 - esat scan log ESETSmartInstaller@High as CAB hook log: OnlineScanner64.ocx - registred OK OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330) # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=339f79a65b80264689a755599fb4c72d # end=finished # remove_checked=true # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2012-11-27 01:06:56 # local_time=2012-11-27 01:06:56 (+0000, GMT Standard Time) # country="United Kingdom" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=5893 16776574 100 94 13398196 106481850 0 0 # compatibility_mode=8192 67108863 100 0 3853 3853 0 0 # scanned=376580 # found=8 # cleaned=8 # scan_time=4816 C:\WebDev\MyWebSites\#Group1\UK2 - Client - DiscountInternetDirectory\cube-cart\CubeCart_3.0.20\upload\includes\boxes\siteDocs.inc.php PHP/Obfuscated.F application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\WebDev\MyWebSites\#Group1\UK2 - Client - DiscountInternetDirectory\cube-cart\CubeCart_3.0.20\upload\language\nl\lang.inc.php PHP/Obfuscated.F application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\WebDev\MyWebSites\StudentDiscountNetwork - 123-reg\my backups\public_html\estelles_mod_store_cat_desc.php PHP/Obfuscated.F application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\WebDev\MyWebSites\StudentDiscountNetwork - 123-reg\my backups\public_html\estelles_mod_store_character_limit.php PHP/Obfuscated.F application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\WebDev\MyWebSites\StudentDiscountNetwork - 123-reg\my backups\public_html\admin\products\ppqd_lock.php PHP/Obfuscated.F application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\WebDev\MyWebSites\StudentDiscountNetwork - 123-reg\original-backups\studentd\studentd\yorkstudentdiscounts\estelles_mod_store_cat_desc.php PHP/Obfuscated.F application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\WebDev\MyWebSites\StudentDiscountNetwork - 123-reg\original-backups\studentd\studentd\yorkstudentdiscounts\estelles_mod_store_character_limit.php PHP/Obfuscated.F application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C C:\WebDev\MyWebSites\StudentDiscountNetwork - 123-reg\original-backups\studentd\studentd\yorkstudentdiscounts\admin\products\ppqd_lock.php PHP/Obfuscated.F application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

Hi Maurice, thanks for the reply, I can confirm that I have run a antivirus scan on all drives using up to date version and definitions (ms security essentials) and here are the logs you asked for. Many Thanks, Brent MBAM Log Malwarebytes Anti-Malware (PRO) 1.65.1.1000 www.malwarebytes.org Database version: v2012.11.26.09 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Brent :: BRENT-PC [administrator] Protection: Enabled 26/11/2012 21:00:32 mbam-log-2012-11-26 (21-00-32).txt Scan type: Full scan (C:\|D:\|F:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 564853 Time elapsed: 1 hour(s), 23 minute(s), 59 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) DDS.TXT DDS (Ver_2012-11-20.01) - NTFS_AMD64 Internet Explorer: 9.0.8112.16455 BrowserJavaVersion: 10.9.2 Run by Brent at 23:56:05 on 2012-11-26 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.4087.1563 [GMT 0:00] . AV: Microsoft Security Essentials *Enabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C} AV: Prevx 3.0 *Enabled/Updated* {85194EF3-9578-0A22-9A51-A9FE4DD90287} SP: Microsoft Security Essentials *Enabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Prevx 3.0 *Enabled/Updated* {3E78AF17-B342-05AC-A0E1-928C365E483A} . ============== Running Processes =============== . C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS c:\Program Files\Microsoft Security Client\MsMpEng.exe C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\atieclxx.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe C:\Program Files\Prevx\prevx.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\lxbycoms.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe C:\Windows\system32\svchost.exe -k imgsvc c:\Program Files\Microsoft Security Client\NisSrv.exe C:\Windows\System32\WUDFHost.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Prevx\prevx.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Program Files (x86)\Xmarks\IE Extension\xmarkssync.exe C:\Users\Brent\AppData\Local\Google\Update\1.3.21.123\GoogleCrashHandler.exe C:\Users\Brent\AppData\Local\Google\Update\1.3.21.123\GoogleCrashHandler64.exe C:\Users\Brent\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe C:\Program Files (x86)\ (x86)\CyberLink\PowerDVD\PDVDServ.exe C:\Program Files\ASUS\TurboV\TurboV.exe C:\Program Files\ASUS\Ai Suite\QFan3\QFanHelp.exe C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\7 Sticky Notes\7StickyNotes.exe C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin C:\Windows\system32\taskeng.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe C:\Windows\system32\SearchIndexer.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Windows\system32\svchost.exe -k SDRSVC C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\system32\taskhost.exe C:\Users\Brent\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Brent\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Brent\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Brent\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Brent\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Brent\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Brent\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Brent\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Brent\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Brent\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Brent\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Brent\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\AUDIODG.EXE C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\cscript.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.bing.com/ uSearch Bar = hxxp://www.google.com/ie uSearch Page = hxxp://www.google.com uDefault_Page_URL = hxxp://nmd.msn.com uDefault_Search_URL = hxxp://www.google.com/ie uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mWinlogon: Userinit = userinit.exe, BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: LastPass Vault: {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPToolbar.dll BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll TB: NuSphere ToolBar: {0F62D223-9206-4EA3-9EA8-D0F3C7C82ACA} - C:\Program Files (x86)\NuSphere\PhpED\NuSphereIEBar.dll TB: LastPass Toolbar: {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll EB: Developer Tools: {1A6FE369-F28C-4AD9-A3E6-2BCB50807CF1} - C:\Program Files (x86)\Internet Explorer\iedvtool.dll uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background uRun: [Xmarks] C:\Program Files (x86)\Xmarks\IE Extension\xmarkssync.exe -q uRun: [Google Update] "C:\Users\Brent\AppData\Local\Google\Update\GoogleUpdate.exe" /c uRun: [] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe uRun: [spotify Web Helper] "C:\Users\Brent\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" mRun: [RemoteControl] "C:\Program Files (x86)\ (x86)\CyberLink\PowerDVD\PDVDServ.exe" mRun: [LanguageShortcut] "C:\Program Files (x86)\ (x86)\CyberLink\PowerDVD\Language\Language.exe" mRun: [TurboV] "C:\Program Files\ASUS\TurboV\TurboV.exe" -b mRun: [QFan Help] "C:\Program Files\ASUS\Ai Suite\QFan3\QFanHelp.exe" mRun: [Cpu Level Up help] "C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe" mRun: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" StartupFolder: C:\Users\Brent\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\7STICK~1.LNK - C:\Program Files (x86)\7 Sticky Notes\7StickyNotes.exe StartupFolder: C:\Users\Brent\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE StartupFolder: C:\Users\Brent\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe mPolicies-Explorer: NoActiveDesktop = dword:1 mPolicies-System: ConsentPromptBehaviorAdmin = dword:5 mPolicies-System: ConsentPromptBehaviorUser = dword:3 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr/200 IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 IE: LastPass - C:\Users\Brent\AppData\LocalLow\LastPass\context.html?cmd=lastpass IE: LastPass Fill Forms - C:\Users\Brent\AppData\LocalLow\LastPass\context.html?cmd=fillforms IE: NuSphere PhpED :: Debug this page - C:\Program Files (x86)\NuSphere\PhpED\NuSphereIEBar.dll/1000 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll IE: {43699cd0-e34f-11de-8a39-0800200c9a66} - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPToolbar.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab TCP: NameServer = 194.168.4.100 194.168.8.100 TCP: Interfaces\{1E9B5501-FAF4-4F16-BFD6-E5E57C397426} : DHCPNameServer = 194.168.4.100 194.168.8.100 Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll SSODL: WebCheck - <orphaned> x64-BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll x64-BHO: LastPass Vault: {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll x64-BHO: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll x64-BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll x64-TB: NuSphere ToolBar: {0F62D223-9206-4EA3-9EA8-D0F3C7C82ACA} - C:\Program Files (x86)\NuSphere\PhpED\NuSphereIEBar64.dll x64-TB: LastPass Toolbar: {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey x64-IE: {43699cd0-e34f-11de-8a39-0800200c9a66} - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll x64-IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll x64-DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned> x64-SSODL: WebCheck - <orphaned> . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Brent\AppData\Roaming\Mozilla\Firefox\Profiles\uvtvei7p.default\ FF - component: C:\Users\Brent\AppData\Roaming\Mozilla\Firefox\Profiles\uvtvei7p.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}\platform\WINNT\components\ColorZilla.dll FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll FF - plugin: C:\Users\Brent\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll FF - plugin: C:\Windows\SysWOW64\npmproxy.dll FF - ExtSQL: 2012-11-06 10:40; {966762eb-7132-4081-ac70-20d20161ad96}; C:\Users\Brent\AppData\Roaming\Mozilla\Firefox\Profiles\uvtvei7p.default\extensions\{966762eb-7132-4081-ac70-20d20161ad96}.xpi . ============= SERVICES / DRIVERS =============== . R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2012-8-30 228768] R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2010-9-26 55024] R0 pxscan;pxscan;C:\Windows\System32\drivers\pxscan.sys [2012-6-25 36384] R1 pxrts;pxrts;C:\Windows\System32\drivers\pxrts.sys [2012-6-25 65736] R2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [2009-9-6 169312] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-6-17 202752] R2 AsSysCtrlService;ASUS System Control Service;C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [2010-9-23 90112] R2 CSIScanner;CSIScanner;C:\Program Files\Prevx\prevx.exe [2012-6-25 6746280] R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-11-24 399432] R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-11-24 676936] R2 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2012-3-20 128456] R2 Skype C2C Service;Skype C2C Service;C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-10-2 3064000] R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2012-11-24 25928] R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-9-12 368896] R3 pxkbf;pxkbf;C:\Windows\System32\drivers\pxkbf.sys [2012-6-25 24024] R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-6-10 539240] R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;C:\Windows\System32\drivers\viahduaa.sys [2010-6-17 1235968] R3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\drivers\wdcsam64.sys [2008-5-6 14464] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-6-7 160944] S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;C:\Windows\System32\drivers\ssadadb.sys [2011-5-13 36328] S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);C:\Windows\System32\drivers\ssadbus.sys [2011-5-13 157672] S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);C:\Windows\System32\drivers\ssadmdfl.sys [2011-5-13 16872] S3 ssadmdm;SAMSUNG Android USB Modem Drivers;C:\Windows\System32\drivers\ssadmdm.sys [2011-5-13 177640] S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);C:\Windows\System32\drivers\ssadserd.sys [2011-5-13 146920] S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-6-25 59392] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-9-25 1255736] S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2009-6-10 389120] . =============== Created Last 30 ================ . 2012-11-26 08:52:17 9125352 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{EBE5217C-4056-4345-B531-EF18DD584F5F}\mpengine.dll 2012-11-25 02:05:43 9125352 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2012-11-24 14:34:19 -------- d-----w- C:\Users\Brent\AppData\Roaming\Malwarebytes 2012-11-24 14:34:01 -------- d-----w- C:\ProgramData\Malwarebytes 2012-11-24 14:33:59 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys 2012-11-24 14:33:59 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware 2012-11-17 00:55:17 2560 ----a-w- C:\Windows\System32\drivers\en-US\wdf01000.sys.mui 2012-11-17 00:55:16 9728 ----a-w- C:\Windows\System32\Wdfres.dll 2012-11-17 00:55:16 785512 ----a-w- C:\Windows\System32\drivers\Wdf01000.sys 2012-11-17 00:55:16 54376 ----a-w- C:\Windows\System32\drivers\WdfLdr.sys 2012-11-17 00:46:44 87040 ----a-w- C:\Windows\System32\drivers\WUDFPf.sys 2012-11-17 00:46:44 198656 ----a-w- C:\Windows\System32\drivers\WUDFRd.sys 2012-11-17 00:46:43 84992 ----a-w- C:\Windows\System32\WUDFSvc.dll 2012-11-17 00:46:43 744448 ----a-w- C:\Windows\System32\WUDFx.dll 2012-11-17 00:46:43 45056 ----a-w- C:\Windows\System32\WUDFCoinstaller.dll 2012-11-17 00:46:43 229888 ----a-w- C:\Windows\System32\WUDFHost.exe 2012-11-17 00:46:43 194048 ----a-w- C:\Windows\System32\WUDFPlatform.dll 2012-11-15 14:14:21 1917416 ----a-w- C:\Windows\System32\WdfCoInstaller01005.dll 2012-11-15 14:14:21 1917416 ----a-w- C:\Windows\System32\drivers\WdfCoInstaller01005.dll 2012-11-15 13:43:04 27632 ----a-w- C:\Windows\SysWow64\Ctl3dv2.dll 2012-11-13 10:20:26 -------- d-----w- C:\ProgramData\eBay 2012-11-13 10:20:26 -------- d-----w- C:\Program Files (x86)\eBay 2012-11-11 20:03:12 -------- d-----w- C:\Users\Brent\AppData\Roaming\OpenOffice.org 2012-11-11 20:01:22 -------- d-----w- C:\Program Files (x86)\OpenOffice.org 3 2012-11-08 15:24:02 -------- d-----w- C:\Program Files (x86)\LinkChecker 2012-11-07 14:21:17 14825544 ----a-w- C:\Program Files (x86)\Common Files\lpuninstall.exe 2012-11-06 15:30:57 56832 ----a-w- C:\Windows\SysWow64\Iyvu9_32.dll 2012-11-06 15:30:57 391168 ----a-w- C:\Windows\SysWow64\i263_32.drv 2012-11-06 15:30:57 27648 ----a-w- C:\Windows\SysWow64\ir50_lcs.dll 2012-11-06 15:30:57 143872 ----a-w- C:\Windows\SysWow64\iacenc.dll 2012-11-06 15:30:45 305152 ----a-w- C:\Windows\IsUninst.exe . ==================== Find3M ==================== . 2012-11-15 08:59:56 73656 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2012-11-15 08:59:56 697272 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2012-10-29 12:10:02 4659712 ----a-w- C:\Windows\SysWow64\Redemption.dll 2012-10-19 09:17:46 95208 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll 2012-10-19 09:17:43 821736 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll 2012-10-19 09:17:43 746984 ----a-w- C:\Windows\SysWow64\deployJava1.dll 2012-10-18 18:25:58 3149824 ----a-w- C:\Windows\System32\win32k.sys 2012-10-09 19:11:10 49152 ----a-r- C:\Windows\SysWow64\inetwh32.dll 2012-10-09 19:11:10 1044480 ----a-r- C:\Windows\SysWow64\roboex32.dll 2012-10-09 18:17:13 55296 ----a-w- C:\Windows\System32\dhcpcsvc6.dll 2012-10-09 18:17:13 226816 ----a-w- C:\Windows\System32\dhcpcore6.dll 2012-10-09 17:40:31 44032 ----a-w- C:\Windows\SysWow64\dhcpcsvc6.dll 2012-10-09 17:40:31 193536 ----a-w- C:\Windows\SysWow64\dhcpcore6.dll 2012-10-08 11:31:03 2312704 ----a-w- C:\Windows\System32\jscript9.dll 2012-10-08 11:23:52 1392128 ----a-w- C:\Windows\System32\wininet.dll 2012-10-08 11:22:55 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl 2012-10-08 11:18:22 173056 ----a-w- C:\Windows\System32\ieUnatt.exe 2012-10-08 11:17:35 599040 ----a-w- C:\Windows\System32\vbscript.dll 2012-10-08 11:13:33 2382848 ----a-w- C:\Windows\System32\mshtml.tlb 2012-10-08 07:56:24 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll 2012-10-08 07:48:03 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll 2012-10-08 07:47:44 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl 2012-10-08 07:44:05 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe 2012-10-08 07:43:21 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll 2012-10-08 07:40:56 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb 2012-10-03 17:56:54 1914248 ----a-w- C:\Windows\System32\drivers\tcpip.sys 2012-10-03 17:44:21 70656 ----a-w- C:\Windows\System32\nlaapi.dll 2012-10-03 17:44:21 303104 ----a-w- C:\Windows\System32\nlasvc.dll 2012-10-03 17:44:17 246272 ----a-w- C:\Windows\System32\netcorehc.dll 2012-10-03 17:44:17 18944 ----a-w- C:\Windows\System32\netevent.dll 2012-10-03 17:44:16 216576 ----a-w- C:\Windows\System32\ncsi.dll 2012-10-03 17:42:16 569344 ----a-w- C:\Windows\System32\iphlpsvc.dll 2012-10-03 16:42:24 18944 ----a-w- C:\Windows\SysWow64\netevent.dll 2012-10-03 16:42:24 175104 ----a-w- C:\Windows\SysWow64\netcorehc.dll 2012-10-03 16:42:23 156672 ----a-w- C:\Windows\SysWow64\ncsi.dll 2012-10-03 16:07:26 45568 ----a-w- C:\Windows\System32\drivers\tcpipreg.sys 2012-09-25 22:47:43 78336 ----a-w- C:\Windows\SysWow64\synceng.dll 2012-09-25 22:46:17 95744 ----a-w- C:\Windows\System32\synceng.dll 2012-09-25 11:36:58 108008 ----a-w- C:\Windows\System32\WindowsAccessBridge-64.dll 2012-09-25 11:36:57 916456 ----a-w- C:\Windows\System32\deployJava1.dll 2012-09-25 11:36:57 1034216 ----a-w- C:\Windows\System32\npDeployJava1.dll 2012-09-19 09:02:14 1589248 ----a-w- C:\Windows\SysWow64\libmysql_d.dll 2012-09-14 19:19:29 2048 ----a-w- C:\Windows\System32\tzres.dll 2012-09-14 18:28:53 2048 ----a-w- C:\Windows\SysWow64\tzres.dll 2012-08-31 18:19:35 1659760 ----a-w- C:\Windows\System32\drivers\ntfs.sys 2012-08-30 21:03:48 228768 ----a-w- C:\Windows\System32\drivers\MpFilter.sys 2012-08-30 21:03:48 128456 ----a-w- C:\Windows\System32\drivers\NisDrvWFP.sys 2012-08-30 18:03:45 5559664 ----a-w- C:\Windows\System32\ntoskrnl.exe 2012-08-30 17:12:02 3968880 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe 2012-08-30 17:12:02 3914096 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe . ============= FINISH: 23:56:38.14 =============== ATTACH.TXT . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-20.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 24/09/2010 09:27:12 System Uptime: 26/11/2012 11:37:17 (12 hours ago) . Motherboard: ASUSTeK Computer INC. | | P7P55 LX Processor: Intel® Core i5 CPU 760 @ 2.80GHz | LGA1156 | 1988/133mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 922 GiB total, 855.377 GiB free. D: is FIXED (NTFS) - 931 GiB total, 674.629 GiB free. E: is CDROM () F: is Removable . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP115: 24/11/2012 14:17:23 - Windows Update RP116: 25/11/2012 19:00:20 - Windows Backup . ==== Installed Programs ====================== . Update for Microsoft Office 2007 (KB2508958) 7-Zip 9.20 (x64 edition) 7 Sticky Notes Adobe AIR Adobe Flash Player 11 ActiveX Adobe Flash Player 11 Plugin Adobe Photoshop Elements 8.0 Adobe Reader X (10.1.4) AI Suite Akeeba eXtract Wizard 3.3 Akeeba SiteDiff 3.1 Artisteer 3 Artisteer 4 ASAP Utilities ATI AVIVO64 Codecs ATI Catalyst Install Manager Beyond Compare Version 3.3.5 calibre Catalyst Control Center - Branding Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center Graphics Previews Common Catalyst Control Center Graphics Previews Vista Catalyst Control Center HydraVision Full Catalyst Control Center Localization All ccc-core-static ccc-utility64 CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help English CCC Help Japanese CCC Help Korean CCC Help Thai CloudBerry Explorer for Amazon S3 3.5 CSE HTML Validator Lite v6.52 DHTML Editing Component Dropbox DVD Suite EPU-4 Engine FastStone Photo Resizer 3.0 FileZilla Client 3.5.3 FreeCommander 2009.02b Google Chrome Google Drive Google Update Helper HeidiSQL 7.0.0.4053 Hotfix for Microsoft .NET Framework 4 Client Profile (KB2461678) HP Deskjet 3050 J610 series Basic Device Software HP Deskjet 3050 J610 series Help HP Photo Creations HP Update IcoFX 1.6.4 Intel A/V Codecs V2.0 Java 7 Update 7 (64-bit) Java 7 Update 9 Java Auto Updater Java SE Development Kit 7 Update 7 (64-bit) LabelPrint LastPass(uninstall only) Lexmark P910 Series LinkChecker 8.1 Malwarebytes Anti-Malware version 1.65.1.1000 MediaShow Microsoft .NET Framework 4 Client Profile Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Excel MUI (English) 2007 Microsoft Office File Validation Add-In Microsoft Office Home and Student 2007 Microsoft Office Office 64-bit Components 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Shared 64-bit MUI (English) 2007 Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Security Client Microsoft Security Essentials Microsoft Silverlight Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft_VC100_CRT_SP1_x64 Microsoft_VC100_CRT_SP1_x86 Mozilla Embedded Browser version 3.5 Mozilla Firefox 16.0.2 (x86 en-US) Mozilla Maintenance Service MSVC80_x64_v2 MSVC80_x86_v2 MSVC90_x64 MSVC90_x86 MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MyFreeCodec NetBeans IDE 7.2 Nokia Connectivity Cable Driver Nokia Suite Notepad++ NuSphere PhpED version 5.9.5 OpenOffice.org 3.4.1 OutWit Hub 2.1.4.22 (x86 en-US) PC Connectivity Solution PhotoNow! 1.0 php-4.4.9 for NuSphere PhpED php-5.2.13 for NuSphere PhpED php-5.3.2 for NuSphere PhpED Php Documentor version 1.4.2 for NuSphere PhpED Picasa 3 Platform Polystyle 2.0zo (trial) for NuSphere PhpED Power2Go 5.0 PowerBackup PowerDirector Express PowerDVD PowerDVD Copy PowerProducer Prevx Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449) Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019) Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687314) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Word 2007 (KB2687315) 32-Bit Edition Skype Click to Call Skype™ 5.10 SpeedFan (remove only) Spelling Dictionaries Support For Adobe Reader 9 Spotify SQLyog 8.61 Turbo Lister 2 TurboV Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office OneNote 2007 Help (KB963670) Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) VIA Platform Device Manager WampServer 2.2 Windows Driver Package - Nokia pccsmcfd LegacyDriver (05/31/2012 7.1.2.0) Windows Live Sign-in Assistant Windows Live Sync Windows Live Upload Tool Xmarks for IE . ==== Event Viewer Messages From Past Week ======== . 26/11/2012 14:45:39, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the DHCP Client service, but this action failed with the following error: An instance of the service is already running. 26/11/2012 14:44:39, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the HomeGroup Provider service, but this action failed with the following error: An instance of the service is already running. 26/11/2012 14:43:39, Error: Service Control Manager [7031] - The Windows Event Log service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 26/11/2012 14:43:39, Error: Service Control Manager [7031] - The Windows Audio service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 26/11/2012 14:43:39, Error: Service Control Manager [7031] - The TCP/IP NetBIOS Helper service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 100 milliseconds: Restart the service. 26/11/2012 14:43:39, Error: Service Control Manager [7031] - The Security Center service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service. 26/11/2012 14:43:39, Error: Service Control Manager [7031] - The HomeGroup Provider service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service. 26/11/2012 14:43:39, Error: Service Control Manager [7031] - The DHCP Client service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service. 26/11/2012 12:09:33, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1. 26/11/2012 11:35:43, Error: Service Control Manager [7000] - The CSIScanner service failed to start due to the following error: The pipe has been ended. 26/11/2012 11:35:33, Error: Service Control Manager [7031] - The CSIScanner service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service. 26/11/2012 00:21:37, Error: Service Control Manager [7000] - The CSIScanner service failed to start due to the following error: The system cannot find the path specified. 24/11/2012 14:32:22, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk2\DR2. 24/11/2012 14:16:45, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect. 24/11/2012 14:16:45, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 24/11/2012 14:16:45, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030} 24/11/2012 14:16:30, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service. 24/11/2012 14:16:30, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error %%-1073473535. 24/11/2012 14:14:54, Error: volmgr [46] - Crash dump initialization failed! . ==== End Of File ===========================

Hi there, I installed malwarebytes pro a few days ago to "beef up" the security on my pc and ran a scan. It detected an infection in one of my windows image backups (on my external drive) which is subsequently removed. A day or so later I tried to boot up my pc and it went into windows recovery mode. My only option was to restore from the most recent backup which I did and everything seemed ok. I then had to re-install malwarebytes and ran it again. This time it found "Affiliate.Downloader" in my recycle bin which it quarantined. My pc is now appears to be running fine but I noticed I have an empty directory in my documents folder called "NativeFus_Log" which I think looks suspicious? It got me wondering if I am still infected and so I would greatly appreciate it if someone could check over the dds logs for me and confirm if everything is ok. Many thanks, Brent dds.txt attach.txt