Jump to content

hackfall

Honorary Members
 View Profile  See their activity

  • Posts

    21

  • Joined

  • Last visited

 Content Type 

Posts posted by hackfall

    Windows 7 Build not a genuine version of Windows, Message

    in Resolved Malware Removal Logs

    Posted

    Hi Kevin,

     

    I purchased my version of Windows 7 via an online software seller through ebay. It wasn't particularly cheap and all seemed genuine. At the time there were few retailers offering Windows 7 most were Windows 8, my machine will only run Windows 7, I installed it last Jan/Feb and have had no problems.

     

    I did try a fix yesterday which I found online which suggested typing some text in to the command prompt, clicking okay to a window that came up, re-booting then uninstalling a Microsoft update file?

     

    I was talking to a colleague at work yesterday who has a Dell laptop with manufacturer installed software and he is getting the same error?

     

    So I guess the answer is I've been 'had', and a new operating system is required!

     

    Many thanks for your time,

     

    Regards,

     

    Andrew

    Windows 7 Build not a genuine version of Windows, Message

    in Resolved Malware Removal Logs

    Posted

    Hi Kevin,

     

    I have just run the Farbar Recovery Scan Tool, here is the log:

     

    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-07-2014 01
    Ran by Andy Sarah (administrator) on ANDYSARAH-PC on 17-07-2014 20:10:10
    Running from C:\Users\Andy Sarah\Desktop
    Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)
    Internet Explorer Version 11
    Boot Mode: Normal

    The only official download link for FRST:
    Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
    Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
    Download link from any site other than Bleeping Computer is unpermitted or outdated.
    See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

     

     


    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
    (Check Point Software Technologies Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
    (LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
    (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
    (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
    (Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
    (Infineon Technologies AG) C:\Program Files (x86)\Infineon\Security Platform Software\IFXSPMGT.exe
    (Intel Corporation) C:\Windows\System32\igfxtray.exe
    (Intel Corporation) C:\Windows\System32\hkcmd.exe
    (Intel Corporation) C:\Windows\System32\igfxpers.exe
    (Intel Corporation) C:\Windows\System32\igfxsrvc.exe
    (TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
    (Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
    (Infineon Technologies AG) C:\Program Files (x86)\Infineon\Security Platform Software\IFXTCS.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
    (Microsoft Corporation) C:\Windows\vVX3000.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
    (Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
    (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
    (Check Point Software Technologies Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
    (Microsoft) C:\Program Files (x86)\CYSEC\CYSEC AV\cysec-AV.exe
    (Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
    (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
    (Infineon Technologies AG) C:\Program Files (x86)\Infineon\Security Platform Software\IfxPsdSv.exe
    (Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
    (TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
    (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
    (Check Point Software Technologies, Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe
    (Intel Corporation) C:\Windows\System32\igfxext.exe
    (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
    (TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
    (Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
    (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
    (Infineon Technologies AG) C:\Program Files (x86)\Infineon\Security Platform Software\PSDrt.exe
    (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
    (TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
    (Infineon Technologies AG) C:\Program Files (x86)\Infineon\Security Platform Software\SpTNA.exe
    (Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE
    (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
    (Eyeo GmbH) C:\Program Files\Adblock Plus for IE\AdblockPlusEngine.exe


    ==================== Registry (Whitelisted) ==================

    HKLM\...\Run: [ThpSrv] => C:\Windows\system32\thpsrv /logon
    HKLM\...\Run: [HSON] => C:\Program Files\TOSHIBA\TBS\HSON.exe [52600 2009-03-09] (TOSHIBA Corporation)
    HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [505696 2009-11-05] (TOSHIBA Corporation)
    HKLM\...\Run: [smoothView] => C:\Program Files\Toshiba\SmoothView\SmoothView.exe [570680 2009-08-13] (TOSHIBA Corporation)
    HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [910136 2009-11-10] (TOSHIBA Corporation)
    HKLM\...\Run: [Toshiba TEMPRO] => C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1546720 2011-02-10] (Toshiba Europe GmbH)
    HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
    HKLM\...\Run: [VX3000] => C:\Windows\vVX3000.exe [762736 2010-05-20] (Microsoft Corporation)
    HKLM-x32\...\Run: [iFXSPMGT] => C:\Program Files (x86)\Infineon\Security Platform Software\ifxspmgt.exe [1107232 2009-08-04] (Infineon Technologies AG)
    HKLM-x32\...\Run: [ZoneAlarm] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [137352 2014-04-25] (Check Point Software Technologies Ltd.)
    HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [LifeCam] => C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation)
    HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)
    Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
    HKU\.DEFAULT\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [122200 2014-06-09] (Garmin Ltd or its subsidiaries)
    HKU\S-1-5-21-4258492332-1760705100-2659948102-1001\...\Run: [CCleaner] => C:\Program Files\CCleaner\CCleaner64.exe [5973272 2013-12-17] (Piriform Ltd)
    HKU\S-1-5-21-4258492332-1760705100-2659948102-1001\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Auto Start CYSEC AV on Reboot.lnk
    ShortcutTarget: Auto Start CYSEC AV on Reboot.lnk -> C:\Windows\Installer\{42118C43-5167-4AB0-AC9D-3B2644EE7600}\_103A73FCA2D3AABDC6757E.exe ()
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk
    ShortcutTarget: Bluetooth Manager.lnk -> C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
    Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
    ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
    ShellIconOverlayIdentifiers:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
    ShellIconOverlayIdentifiers:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
    ShellIconOverlayIdentifiers:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
    ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
    ShellIconOverlayIdentifiers-x32:  SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
    ShellIconOverlayIdentifiers-x32:  SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
    ShellIconOverlayIdentifiers-x32:  SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

    ==================== Internet (Whitelisted) ====================

    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:newtab
    SearchScopes: HKLM-x32 - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.certified-toolbar.com?si=77302&st=bs&tid=18145&ver=5.7&ts=1394236800000.000000&tguid=77302-18145-1394302323709-9140FBD2ADEA252EA4A4C54B0932F8EC&q={searchTerms}
    SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.certified-toolbar.com?si=77302&st=bs&tid=18145&ver=5.7&ts=1394236800000.000000&tguid=77302-18145-1394302323709-9140FBD2ADEA252EA4A4C54B0932F8EC&q={searchTerms}
    SearchScopes: HKCU - URL http://search.conduit.com/Results.aspx?ctid=CT3323878&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPBCAC3AC2-164E-425C-8238-9EE1FAB6BBFB&q={searchTerms}&SSPV=
    SearchScopes: HKCU - SuggestionsURL_JSON http://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
    SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
    BHO: No Name -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} ->  No File
    BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
    BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
    BHO: WOT Helper -> {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} -> C:\Program Files\WOT\WOT.dll ()
    BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
    BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll (Adblock Plus)
    BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)
    BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
    BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
    BHO-x32: WOT Helper -> {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} -> C:\Program Files (x86)\WOT\WOT.dll ()
    BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
    BHO-x32: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll (Adblock Plus)
    Toolbar: HKLM - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
    Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
    Toolbar: HKLM-x32 - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files (x86)\WOT\WOT.dll ()
    Toolbar: HKCU - WOT - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
    Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
    Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
    Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
    Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    Handler-x32: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files (x86)\WOT\WOT.dll ()
    Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
    Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
    Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
    Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
    Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
    Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
    Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
    Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
    Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
    Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
    Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
    Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
    Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
    Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
    Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
    Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
    Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

    FireFox:
    ========
    FF ProfilePath: C:\Users\Andy Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\chqr9k67.default
    FF NewTab: about:home
    FF DefaultSearchEngine: Web Search
    FF SearchEngineOrder.1: Web Search
    FF SelectedSearchEngine: Web Search
    FF Homepage: about:home
    FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
    FF Plugin: @microsoft.com/GENUINE - disabled No File
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
    FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
    FF Plugin-x32: @Citrix.com/npican - C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)
    FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
    FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
    FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
    FF user.js: detected! => C:\Users\Andy Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\chqr9k67.default\user.js
    FF Extension: Garmin Communicator - C:\Users\Andy Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\chqr9k67.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2014-01-16]
    FF Extension: WOT - C:\Users\Andy Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\chqr9k67.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-01-12]
    FF Extension: Google Translator for Firefox - C:\Users\Andy Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\chqr9k67.default\Extensions\translator@zoli.bod.xpi [2014-03-17]
    FF Extension: Adblock Plus - C:\Users\Andy Sarah\AppData\Roaming\Mozilla\Firefox\Profiles\chqr9k67.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-12]
    FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-06-19]

    ==================== Services (Whitelisted) =================

    R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)
    R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1764992 2014-04-11] (Microsoft Corporation)
    R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2279608 2014-05-21] (Microsoft Corporation)
    R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [435032 2014-06-09] (Garmin Ltd or its subsidiaries)
    R2 IFXSpMgtSrv; C:\Program Files (x86)\Infineon\Security Platform Software\ifxspmgt.exe [1107232 2009-08-04] (Infineon Technologies AG)
    R2 IFXTCS; C:\Program Files (x86)\Infineon\Security Platform Software\ifxtcs.exe [984352 2009-07-19] (Infineon Technologies AG)
    R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
    R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
    R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
    S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
    R2 PersonalSecureDriveService; C:\Program Files (x86)\Infineon\Security Platform Software\IfxPsdSv.exe [214304 2009-07-19] (Infineon Technologies AG)
    R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
    R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
    S2 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
    R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [3592120 2014-04-25] (Check Point Software Technologies Ltd.)
    R2 ZAPrivacyService; C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe [92176 2014-04-09] (Check Point Software Technologies, Ltd.)

    ==================== Drivers (Whitelisted) ====================

    R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [7717984 2014-03-19] (Kaspersky Lab ZAO)
    U5 klflt; C:\Windows\System32\Drivers\klflt.sys [92768 2014-03-19] (Kaspersky Lab ZAO)
    R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [490592 2014-03-19] (Kaspersky Lab ZAO)
    R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
    R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-17] (Malwarebytes Corporation)
    R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
    R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
    S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
    R1 PersonalSecureDrive; C:\Windows\System32\drivers\psd.sys [44576 2009-07-19] (Infineon Technologies AG)
    R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
    R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
    R3 tifm21; C:\Windows\System32\drivers\tifm21.sys [314880 2007-05-02] (Texas Instruments)
    R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [450968 2014-04-24] (Check Point Software Technologies Ltd.)
    U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)

    ==================== NetSvcs (Whitelisted) ===================


    ==================== One Month Created Files and Folders ========

    2014-07-17 20:10 - 2014-07-17 20:11 - 00023569 _____ () C:\Users\Andy Sarah\Desktop\FRST.txt
    2014-07-17 20:09 - 2014-07-17 20:10 - 00000000 ____D () C:\FRST
    2014-07-17 19:56 - 2014-07-17 19:56 - 02086912 _____ (Farbar) C:\Users\Andy Sarah\Desktop\FRST64.exe
    2014-07-17 19:55 - 2014-07-17 19:55 - 02086912 _____ (Farbar) C:\Users\Andy Sarah\Downloads\FRST64.exe
    2014-07-15 20:03 - 2014-07-15 20:03 - 00000000 ____D () C:\Users\Andy Sarah\AppData\Local\Microsoft Help
    2014-07-15 19:53 - 2014-07-15 19:54 - 02406064 _____ (Trend Micro Inc.) C:\Users\Andy Sarah\Downloads\HousecallLauncher64.exe
    2014-07-14 19:40 - 2014-07-14 19:40 - 00000000 ____D () C:\Users\Andy Sarah\Desktop\installation
    2014-07-14 19:40 - 2014-07-14 19:40 - 00000000 ____D () C:\Users\Andy Sarah\AppData\Roaming\WinRAR
    2014-07-14 19:38 - 2014-07-14 19:38 - 00000000 ____D () C:\Users\Andy Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
    2014-07-14 19:38 - 2014-07-14 19:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
    2014-07-14 19:38 - 2014-07-14 19:38 - 00000000 ____D () C:\Program Files (x86)\WinRAR
    2014-07-14 19:37 - 2014-07-14 19:37 - 00000000 ____D () C:\Users\Andy Sarah\Desktop\WinRAR_TSA15DAQY
    2014-07-14 19:35 - 2014-07-14 19:35 - 00000000 ____D () C:\Program Files (x86)\sweetpacks bundle uninstaller_WinRAR_1635924
    2014-07-14 19:21 - 2014-01-09 03:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
    2014-07-14 19:21 - 2014-01-03 23:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
    2014-07-14 19:18 - 2014-07-14 19:19 - 00657272 _____ (© 2014 ClientConnect Ltd.) C:\Users\Andy Sarah\Desktop\WinRAR_TSA15DAQY.exe
    2014-07-14 19:13 - 2014-07-14 19:14 - 10582559 _____ () C:\Users\Andy Sarah\Desktop\installation.rar
    2014-07-13 18:52 - 2013-10-02 03:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
    2014-07-13 18:52 - 2013-10-02 03:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
    2014-07-13 18:52 - 2013-10-02 03:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
    2014-07-13 18:52 - 2013-10-02 02:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
    2014-07-13 18:52 - 2013-10-02 02:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
    2014-07-13 18:52 - 2013-10-02 02:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
    2014-07-13 18:52 - 2013-10-02 02:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
    2014-07-13 18:52 - 2013-10-02 01:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
    2014-07-13 18:52 - 2013-10-02 01:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
    2014-07-13 18:52 - 2013-10-02 01:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
    2014-07-13 18:52 - 2013-10-02 01:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
    2014-07-13 18:52 - 2013-10-02 01:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
    2014-07-13 18:52 - 2013-10-02 00:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
    2014-07-13 18:52 - 2013-10-02 00:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
    2014-07-13 18:52 - 2013-10-02 00:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
    2014-07-13 18:52 - 2013-10-01 23:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
    2014-07-13 18:49 - 2013-09-25 03:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
    2014-07-13 18:49 - 2013-09-25 02:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
    2014-07-10 21:23 - 2014-07-10 21:23 - 00001783 _____ () C:\Users\Public\Desktop\iTunes.lnk
    2014-07-10 21:23 - 2014-07-10 21:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
    2014-07-10 21:21 - 2014-07-10 21:23 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
    2014-07-10 21:21 - 2014-07-10 21:23 - 00000000 ____D () C:\Program Files\iTunes
    2014-07-10 21:21 - 2014-07-10 21:23 - 00000000 ____D () C:\Program Files (x86)\iTunes
    2014-07-10 21:21 - 2014-07-10 21:21 - 00000000 ____D () C:\Program Files\iPod
    2014-07-09 22:48 - 2014-06-20 21:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
    2014-07-09 22:48 - 2014-06-20 20:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
    2014-07-09 22:48 - 2014-06-19 02:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2014-07-09 22:48 - 2014-06-19 02:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2014-07-09 22:48 - 2014-06-19 02:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
    2014-07-09 22:48 - 2014-06-19 01:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2014-07-09 22:48 - 2014-06-19 01:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
    2014-07-09 22:48 - 2014-06-19 01:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
    2014-07-09 22:48 - 2014-06-19 01:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
    2014-07-09 22:48 - 2014-06-19 01:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
    2014-07-09 22:48 - 2014-06-19 01:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2014-07-09 22:48 - 2014-06-19 01:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
    2014-07-09 22:48 - 2014-06-19 01:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2014-07-09 22:48 - 2014-06-19 01:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
    2014-07-09 22:48 - 2014-06-19 01:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
    2014-07-09 22:48 - 2014-06-19 01:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
    2014-07-09 22:48 - 2014-06-19 01:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2014-07-09 22:48 - 2014-06-19 01:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
    2014-07-09 22:48 - 2014-06-19 01:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
    2014-07-09 22:48 - 2014-06-19 00:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
    2014-07-09 22:48 - 2014-06-19 00:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2014-07-09 22:48 - 2014-06-19 00:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
    2014-07-09 22:48 - 2014-06-19 00:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2014-07-09 22:48 - 2014-06-19 00:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
    2014-07-09 22:48 - 2014-06-19 00:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
    2014-07-09 22:48 - 2014-06-19 00:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
    2014-07-09 22:48 - 2014-06-19 00:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
    2014-07-09 22:48 - 2014-06-19 00:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2014-07-09 22:48 - 2014-06-19 00:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
    2014-07-09 22:48 - 2014-06-19 00:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
    2014-07-09 22:48 - 2014-06-19 00:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2014-07-09 22:48 - 2014-06-19 00:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2014-07-09 22:48 - 2014-06-19 00:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2014-07-09 22:48 - 2014-06-19 00:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2014-07-09 22:48 - 2014-06-19 00:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
    2014-07-09 22:48 - 2014-06-19 00:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
    2014-07-09 22:48 - 2014-06-19 00:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2014-07-09 22:48 - 2014-06-19 00:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
    2014-07-09 22:48 - 2014-06-19 00:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
    2014-07-09 22:48 - 2014-06-19 00:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
    2014-07-09 22:48 - 2014-06-19 00:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
    2014-07-09 22:48 - 2014-06-19 00:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
    2014-07-09 22:48 - 2014-06-18 23:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
    2014-07-09 22:48 - 2014-06-18 23:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2014-07-09 22:48 - 2014-06-18 23:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
    2014-07-09 22:48 - 2014-06-18 23:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2014-07-09 22:48 - 2014-06-18 23:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2014-07-09 22:48 - 2014-06-18 23:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2014-07-09 22:48 - 2014-06-18 23:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
    2014-07-09 22:48 - 2014-06-18 23:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
    2014-07-09 22:48 - 2014-06-18 23:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2014-07-09 22:48 - 2014-06-18 23:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2014-07-09 22:48 - 2014-06-18 23:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
    2014-07-09 22:48 - 2014-06-18 23:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2014-07-09 22:48 - 2014-06-18 23:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2014-07-09 22:48 - 2014-06-18 23:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
    2014-07-09 22:46 - 2014-06-30 03:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
    2014-07-09 22:46 - 2014-06-30 03:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
    2014-07-09 22:46 - 2014-06-18 03:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
    2014-07-09 22:46 - 2014-06-18 02:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
    2014-07-09 22:46 - 2014-06-18 02:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
    2014-07-09 22:46 - 2014-06-06 11:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
    2014-07-09 22:46 - 2014-06-06 10:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
    2014-07-09 22:46 - 2014-06-05 15:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
    2014-07-09 22:46 - 2014-06-05 15:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
    2014-07-09 22:46 - 2014-06-05 15:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
    2014-07-09 22:46 - 2014-05-30 09:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
    2014-07-09 22:46 - 2014-05-30 09:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
    2014-07-09 22:46 - 2014-05-30 09:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
    2014-07-09 22:46 - 2014-05-30 09:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
    2014-07-09 22:46 - 2014-05-30 09:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
    2014-07-09 22:46 - 2014-05-30 09:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
    2014-07-09 22:46 - 2014-05-30 09:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
    2014-07-09 22:46 - 2014-05-30 08:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
    2014-07-09 22:46 - 2014-05-30 08:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
    2014-07-09 22:46 - 2014-05-30 08:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
    2014-07-09 22:46 - 2014-05-30 08:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
    2014-07-09 22:46 - 2014-05-30 08:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
    2014-07-09 22:46 - 2014-05-30 08:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
    2014-07-09 22:46 - 2014-05-30 08:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
    2014-07-09 22:46 - 2014-05-30 07:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
    2014-07-09 15:11 - 2014-07-17 19:46 - 00574426 _____ () C:\Windows\WindowsUpdate.log
    2014-06-23 22:09 - 2014-06-23 22:09 - 00000000 ____D () C:\Users\Andy Sarah\AppData\Local\Adobe
    2014-06-20 20:54 - 2014-06-20 20:54 - 00082308 _____ () C:\Users\Andy Sarah\Documents\cc_20140620_205402.reg
    2014-06-19 21:04 - 2014-06-19 21:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

    ==================== One Month Modified Files and Folders =======

    2014-07-17 20:11 - 2014-07-17 20:10 - 00023569 _____ () C:\Users\Andy Sarah\Desktop\FRST.txt
    2014-07-17 20:10 - 2014-07-17 20:09 - 00000000 ____D () C:\FRST
    2014-07-17 19:56 - 2014-07-17 19:56 - 02086912 _____ (Farbar) C:\Users\Andy Sarah\Desktop\FRST64.exe
    2014-07-17 19:55 - 2014-07-17 19:55 - 02086912 _____ (Farbar) C:\Users\Andy Sarah\Downloads\FRST64.exe
    2014-07-17 19:51 - 2014-01-21 09:48 - 00005010 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for AndySarah-PC-Andy Sarah AndySarah-PC
    2014-07-17 19:50 - 2014-05-19 23:19 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
    2014-07-17 19:46 - 2014-07-09 15:11 - 00574426 _____ () C:\Windows\WindowsUpdate.log
    2014-07-17 19:41 - 2009-07-14 05:45 - 00022736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2014-07-17 19:41 - 2009-07-14 05:45 - 00022736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2014-07-17 19:37 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
    2014-07-17 13:41 - 2014-04-30 19:29 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
    2014-07-17 07:54 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
    2014-07-15 20:20 - 2014-04-05 16:19 - 00350322 _____ () C:\Users\Andy Sarah\AppData\Local\census.cache
    2014-07-15 20:20 - 2014-04-05 16:18 - 00107931 _____ () C:\Users\Andy Sarah\AppData\Local\ars.cache
    2014-07-15 20:03 - 2014-07-15 20:03 - 00000000 ____D () C:\Users\Andy Sarah\AppData\Local\Microsoft Help
    2014-07-15 19:54 - 2014-07-15 19:53 - 02406064 _____ (Trend Micro Inc.) C:\Users\Andy Sarah\Downloads\HousecallLauncher64.exe
    2014-07-14 19:40 - 2014-07-14 19:40 - 00000000 ____D () C:\Users\Andy Sarah\Desktop\installation
    2014-07-14 19:40 - 2014-07-14 19:40 - 00000000 ____D () C:\Users\Andy Sarah\AppData\Roaming\WinRAR
    2014-07-14 19:38 - 2014-07-14 19:38 - 00000000 ____D () C:\Users\Andy Sarah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
    2014-07-14 19:38 - 2014-07-14 19:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
    2014-07-14 19:38 - 2014-07-14 19:38 - 00000000 ____D () C:\Program Files (x86)\WinRAR
    2014-07-14 19:37 - 2014-07-14 19:37 - 00000000 ____D () C:\Users\Andy Sarah\Desktop\WinRAR_TSA15DAQY
    2014-07-14 19:35 - 2014-07-14 19:35 - 00000000 ____D () C:\Program Files (x86)\sweetpacks bundle uninstaller_WinRAR_1635924
    2014-07-14 19:19 - 2014-07-14 19:18 - 00657272 _____ (© 2014 ClientConnect Ltd.) C:\Users\Andy Sarah\Desktop\WinRAR_TSA15DAQY.exe
    2014-07-14 19:14 - 2014-07-14 19:13 - 10582559 _____ () C:\Users\Andy Sarah\Desktop\installation.rar
    2014-07-13 11:00 - 2014-01-12 22:23 - 00000000 ____D () C:\Users\Andy Sarah\Sarah Stuff
    2014-07-11 19:13 - 2009-07-14 06:13 - 00781298 _____ () C:\Windows\system32\PerfStringBackup.INI
    2014-07-10 21:23 - 2014-07-10 21:23 - 00001783 _____ () C:\Users\Public\Desktop\iTunes.lnk
    2014-07-10 21:23 - 2014-07-10 21:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
    2014-07-10 21:23 - 2014-07-10 21:21 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
    2014-07-10 21:23 - 2014-07-10 21:21 - 00000000 ____D () C:\Program Files\iTunes
    2014-07-10 21:23 - 2014-07-10 21:21 - 00000000 ____D () C:\Program Files (x86)\iTunes
    2014-07-10 21:21 - 2014-07-10 21:21 - 00000000 ____D () C:\Program Files\iPod
    2014-07-09 23:02 - 2009-07-14 05:45 - 00436152 _____ () C:\Windows\system32\FNTCACHE.DAT
    2014-07-09 22:59 - 2014-05-06 09:33 - 00000000 ___SD () C:\Windows\system32\CompatTel
    2014-07-09 22:59 - 2010-11-21 08:17 - 00000000 ____D () C:\Program Files\Windows Journal
    2014-07-09 22:59 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
    2014-07-09 22:59 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Dism
    2014-07-09 22:53 - 2014-01-11 23:23 - 00000000 ____D () C:\Windows\system32\MRT
    2014-07-09 22:51 - 2014-01-11 23:23 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
    2014-07-09 19:19 - 2014-01-12 22:21 - 00000000 ____D () C:\Users\Andy Sarah\Sarah Pics
    2014-07-08 19:31 - 2014-04-30 19:29 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
    2014-07-08 19:31 - 2014-04-30 19:29 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
    2014-07-08 19:31 - 2014-04-30 19:29 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
    2014-07-08 19:30 - 2014-03-12 22:47 - 05659136 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
    2014-07-06 22:00 - 2014-02-02 12:29 - 00000000 ____D () C:\Users\Andy Sarah\AppData\Roaming\Skype
    2014-07-04 16:13 - 2014-04-27 22:23 - 00000000 ____D () C:\Users\Andy Sarah\Desktop\Holiday 2014
    2014-07-01 06:23 - 2014-02-10 19:24 - 00000000 ____D () C:\Windows\Minidump
    2014-06-30 03:09 - 2014-07-09 22:46 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
    2014-06-30 03:04 - 2014-07-09 22:46 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
    2014-06-23 22:09 - 2014-06-23 22:09 - 00000000 ____D () C:\Users\Andy Sarah\AppData\Local\Adobe
    2014-06-21 08:48 - 2014-01-11 21:12 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
    2014-06-20 21:14 - 2014-07-09 22:48 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
    2014-06-20 20:54 - 2014-06-20 20:54 - 00082308 _____ () C:\Users\Andy Sarah\Documents\cc_20140620_205402.reg
    2014-06-20 20:39 - 2014-07-09 22:48 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
    2014-06-19 21:05 - 2014-06-19 21:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
    2014-06-19 02:39 - 2014-07-09 22:48 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2014-06-19 02:06 - 2014-07-09 22:48 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2014-06-19 02:06 - 2014-07-09 22:48 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
    2014-06-19 01:48 - 2014-07-09 22:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2014-06-19 01:42 - 2014-07-09 22:48 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
    2014-06-19 01:42 - 2014-07-09 22:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
    2014-06-19 01:41 - 2014-07-09 22:48 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
    2014-06-19 01:41 - 2014-07-09 22:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
    2014-06-19 01:32 - 2014-07-09 22:48 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2014-06-19 01:31 - 2014-07-09 22:48 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
    2014-06-19 01:26 - 2014-07-09 22:48 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2014-06-19 01:24 - 2014-07-09 22:48 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
    2014-06-19 01:24 - 2014-07-09 22:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
    2014-06-19 01:23 - 2014-07-09 22:48 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
    2014-06-19 01:16 - 2014-07-09 22:48 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2014-06-19 01:14 - 2014-07-09 22:48 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
    2014-06-19 01:09 - 2014-07-09 22:48 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
    2014-06-19 00:59 - 2014-07-09 22:48 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
    2014-06-19 00:56 - 2014-07-09 22:48 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2014-06-19 00:53 - 2014-07-09 22:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
    2014-06-19 00:51 - 2014-07-09 22:48 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2014-06-19 00:50 - 2014-07-09 22:48 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
    2014-06-19 00:48 - 2014-07-09 22:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
    2014-06-19 00:39 - 2014-07-09 22:48 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
    2014-06-19 00:38 - 2014-07-09 22:48 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
    2014-06-19 00:37 - 2014-07-09 22:48 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2014-06-19 00:36 - 2014-07-09 22:48 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
    2014-06-19 00:35 - 2014-07-09 22:48 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
    2014-06-19 00:33 - 2014-07-09 22:48 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2014-06-19 00:32 - 2014-07-09 22:48 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2014-06-19 00:28 - 2014-07-09 22:48 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2014-06-19 00:28 - 2014-07-09 22:48 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2014-06-19 00:27 - 2014-07-09 22:48 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
    2014-06-19 00:27 - 2014-07-09 22:48 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
    2014-06-19 00:25 - 2014-07-09 22:48 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2014-06-19 00:23 - 2014-07-09 22:48 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
    2014-06-19 00:22 - 2014-07-09 22:48 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
    2014-06-19 00:12 - 2014-07-09 22:48 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
    2014-06-19 00:06 - 2014-07-09 22:48 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
    2014-06-19 00:01 - 2014-07-09 22:48 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
    2014-06-18 23:59 - 2014-07-09 22:48 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
    2014-06-18 23:58 - 2014-07-09 22:48 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2014-06-18 23:58 - 2014-07-09 22:48 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
    2014-06-18 23:52 - 2014-07-09 22:48 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2014-06-18 23:51 - 2014-07-09 22:48 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2014-06-18 23:49 - 2014-07-09 22:48 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2014-06-18 23:46 - 2014-07-09 22:48 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
    2014-06-18 23:45 - 2014-07-09 22:48 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
    2014-06-18 23:35 - 2014-07-09 22:48 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2014-06-18 23:34 - 2014-07-09 22:48 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2014-06-18 23:15 - 2014-07-09 22:48 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
    2014-06-18 23:13 - 2014-07-09 22:48 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2014-06-18 23:09 - 2014-07-09 22:48 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2014-06-18 23:07 - 2014-07-09 22:48 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
    2014-06-18 03:18 - 2014-07-09 22:46 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe
    2014-06-18 02:51 - 2014-07-09 22:46 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
    2014-06-18 02:10 - 2014-07-09 22:46 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

    ==================== Bamital & volsnap Check =================

    C:\Windows\System32\winlogon.exe => File is digitally signed
    C:\Windows\System32\wininit.exe => File is digitally signed
    C:\Windows\SysWOW64\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\System32\services.exe => File is digitally signed
    C:\Windows\System32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\System32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed
    C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2014-07-09 15:40

    ==================== End Of Log ============================

     

    Here is the MGA Diagnostic Tool log:

    Diagnostic Report (1.9.0027.0):
    -----------------------------------------
    Windows Validation Data-->

    Validation Code: 0
    Cached Online Validation Code: N/A, hr = 0xc004f012
    Windows Product Key: *****-*****-*****-*****-3Y8PX
    Windows Product Key Hash: SQKRywFXkmsLcJjJ4WRV6YmnbX4=
    Windows Product ID: 55041-152-0552295-86783
    Windows Product ID Type: 6
    Windows License Type: Volume MAK
    Windows OS version: 6.1.7601.2.00010100.1.0.048
    ID: {AD61429E-7F12-4264-8FF5-5B21D0CB96E5}(1)
    Is Admin: Yes
    TestCab: 0x0
    LegitcheckControl ActiveX: N/A, hr = 0x80070002
    Signed By: N/A, hr = 0x80070002
    Product Name: Windows 7 Professional
    Architecture: 0x00000009
    Build lab: 7601.win7sp1_gdr.140303-2144
    TTS Error:
    Validation Diagnostic:
    Resolution Status: N/A

    Vista WgaER Data-->
    ThreatID(s): N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002

    Windows XP Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    File Exists: No
    Version: N/A, hr = 0x80070002
    WgaTray.exe Signed By: N/A, hr = 0x80070002
    WgaLogon.dll Signed By: N/A, hr = 0x80070002

    OGA Notifications Data-->
    Cached Result: N/A, hr = 0x80070002
    Version: N/A, hr = 0x80070002
    OGAExec.exe Signed By: N/A, hr = 0x80070002
    OGAAddin.dll Signed By: N/A, hr = 0x80070002

    OGA Data-->
    Office Status: 109 N/A
    OGA Version: N/A, 0x80070002
    Signed By: N/A, hr = 0x80070002
    Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

    Browser Data-->
    Proxy settings: N/A
    User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    Default Browser: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    Download signed ActiveX controls: Prompt
    Download unsigned ActiveX controls: Disabled
    Run ActiveX controls and plug-ins: Allowed
    Initialize and script ActiveX controls not marked as safe: Disabled
    Allow scripting of Internet Explorer Webbrowser control: Disabled
    Active scripting: Allowed
    Script ActiveX controls marked as safe for scripting: Allowed

    File Scan Data-->

    Other data-->
    Office Details: <GenuineResults><MachineData><UGUID>{AD61429E-7F12-4264-8FF5-5B21D0CB96E5}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.048</OS><Architecture>x64</Architecture><PKey>*****-*****-*****-*****-BBBBB</PKey><PID>55041-152-0552295-86783</PID><PIDType>6</PIDType><SID>S-1-5-21-4258492332-1760705100-2659948102</SID><SYSTEM><Manufacturer>TOSHIBA</Manufacturer><Model>TECRA A9</Model></SYSTEM><BIOS><Manufacturer>TOSHIBA</Manufacturer><Version>Version 1.70</Version><SMBIOSVersion major="2" minor="4"/><Date>20071122000000.000000+000</Date></BIOS><HWID>1ED33907018400FA</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>TOSHIB</OEMID><OEMTableID>A0054   </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  

    Spsys.log Content: 0x80070002

    Licensing Data-->
    Software licensing service version: 6.1.7601.17514

    Name: Windows® 7, Professional edition
    Description: Windows Operating System - Windows® 7, VOLUME_MAK channel
    Activation ID: 9abf5984-9c16-46f2-ad1e-7fe15931a8dd
    Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
    Extended PID: 55041-00172-152-055229-03-2057-7601.0000-0112014
    Installation ID: 011463160364691934410375637480551505160940947966402305
    Processor Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88338
    Machine Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88339
    Use License URL: http://go.microsoft.com/fwlink/?LinkID=88341
    Product Key Certificate URL: http://go.microsoft.com/fwlink/?LinkID=88340
    Partial Product Key: 3Y8PX
    License Status: Initial grace period
    Time remaining: 40980 minute(s) (28 day(s))
    Remaining Windows rearm count: 2
    Trusted time: 17/07/2014 20:37:53

    Windows Activation Technologies-->
    HrOffline: 0x00000000
    HrOnline: 0x00000000
    HealthStatus: 0x0000000000000000
    Event Time Stamp: 7:11:2014 23:19
    ActiveX: Registered, Version: 7.1.7600.16395
    Admin Service: Registered, Version: 7.1.7600.16395
    HealthStatus Bitmask Output:


    HWID Data-->
    HWID Hash Current: MAAAAAEAAgABAAIAAAABAAAAAgABAAEAJJSikUzWkpX8kIQSaJyADf4/7sIOlyqF

    OEM Activation 1.0 Data-->
    N/A

    OEM Activation 2.0 Data-->
    BIOS valid for OA 2.0: yes
    Windows marker version: 0x0
    OEMID and OEMTableID Consistent: yes
    BIOS Information:
      ACPI Table Name    OEMID Value    OEMTableID Value
      APIC            TOSHIB        A0054   
      FACP            TOSHIB        A0054   
      HPET            TOSHIB        A0054   
      BOOT            TOSHIB        A0054   
      MCFG            TOSHIB        A0054   
      SSDT            TOSHIB        A0054   
      TCPA            TOSHIB        A0054   
      SLIC            TOSHIB        A0054   
      SSDT            TOSHIB        A0054   
      SSDT            TOSHIB        A0054   
      SSDT            TOSHIB        A0054   


    Many Thanks!

     

    Regards,

     

    Andrew

     

    Hackfall

     

     

    Windows 7 Build not a genuine version of Windows, Message

    in Resolved Malware Removal Logs

    Posted

    Hi,

     

    Yesterday I downloaded a free version of Winrar, today on starting my computer it went to the usual log-in screen, once I logged-on the screen went black and the above message was displayed at the bottom right corner of the screen there was also a number 7601? My computer then froze and became unresponsive. I did a hard quit and logged on again this time everything booted up after I logged-on the above message was displayed again at the bottom right of the desktop for approximately 30 seconds and the disappeared? My computer is working but seems slow!

     

    I have run an Mbam scan and it found 4 pups, quarantined these not sure if I am infected or not? I did find a posting about a similar virus/problem posted on the Mbam forum 01.12.12, this suggested it was a virus that needed removing.

     

    I am running Windows 7 Professional.

     

    I would appreciate any help or advice you can offer.

     

    Regards,

     

    Hackfall

    Google Re-direct Virus

    in Resolved Malware Removal Logs

    Posted

    Hi Gringo,

    I have removed one bank of Ram, the computer has run for the last 8 hrs or so with no crashes, I will order some new Ram!

    I have removed the virus removal programs, I will scan the back-up hard drive.

    Many thanks for all your help, I will become a fully paid up member of Malwarebytes and make a donation, I stumbled upon this forum by chance, I am very glad I did!

    Regards,

    Hackfall

    Google Re-direct Virus

    in Resolved Malware Removal Logs

    Posted

    Hi Gringo,

    The computer had been running okay for about an hour. It has just crashed again, same beeping. I have noticed that the hard drive clicks a couple of times then goes silent. I think a new new laptops is probably required. There are two sticks of ram 500mb each.

    Regards,

    Hackfall

    Google Re-direct Virus

    in Resolved Malware Removal Logs

    Posted

    Hi Gringo,

    I was about to start working through the above, however my my machine beeped 3 times and crashed, now when I try to re-boot it she fires-up and beeps 3 times the screen is black/blank, no sign of a dektop or anything? I wonder if it has finally expired!

    My wife has a smart phone so I can get access to the internet through that, I am not sure if there is anything that I will be able to do!

    Regards,

    Hackfall

    Google Re-direct Virus

    in Resolved Malware Removal Logs

    Posted

    Hi Gringo,

    Ran Hijackthis and fixed the files. I then ran Eset Scan, 2 x Threats found:

    C:\System Volume Information\_restore{9545F2D3-E50C-4E44-912E-CB8DAE2CB663}\RP400\A0236609.dll a variant of Win32/Toolbar.Widgi application

    C:\System Volume Information\_restore{9545F2D3-E50C-4E44-912E-CB8DAE2CB663}\RP400\A0236618.exe a variant of Win32/Toolbar.Widgi application

    Google Re-direct Virus

    in Resolved Malware Removal Logs

    Posted

    Hi Gringo,

    I have followed above steps, MBAM found no infections, I have run Hijackthis both reports are below:

    Malwarebytes Anti-Malware (Trial) 1.70.0.1100

    www.malwarebytes.org

    Database version: v2013.01.02.03

    Windows XP Service Pack 3 x86 NTFS

    Internet Explorer 8.0.6001.18702

    Administrator :: LANEFOXCIRENCES [administrator]

    Protection: Enabled

    02/01/2013 09:15:12

    mbam-log-2013-01-02 (09-15-12).txt

    Scan type: Quick scan

    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

    Scan options disabled: P2P

    Objects scanned: 245987

    Time elapsed: 16 minute(s), 51 second(s)

    Memory Processes Detected: 0

    (No malicious items detected)

    Memory Modules Detected: 0

    (No malicious items detected)

    Registry Keys Detected: 0

    (No malicious items detected)

    Registry Values Detected: 0

    (No malicious items detected)

    Registry Data Items Detected: 0

    (No malicious items detected)

    Folders Detected: 0

    (No malicious items detected)

    Files Detected: 0

    (No malicious items detected)

    (end)

    Logfile of Trend Micro HijackThis v2.0.4

    Scan saved at 09:45:08, on 02/01/2013

    Platform: Windows XP SP3 (WinNT 5.01.2600)

    MSIE: Internet Explorer v8.00 (8.00.6001.18702)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\AVAST Software\Avast\AvastSvc.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

    C:\Program Files\Microsoft LifeCam\MSCamS32.exe

    C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

    C:\WINDOWS\Explorer.EXE

    C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe

    C:\Program Files\AVAST Software\Avast\avastUI.exe

    C:\WINDOWS\vVX3000.exe

    C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe

    C:\Program Files\Windows Media Player\WMPNSCFG.exe

    C:\Program Files\Microsoft ActiveSync\wcescomm.exe

    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\WINDOWS\system32\slserv.exe

    C:\WINDOWS\System32\svchost.exe

    C:\PROGRA~1\MICROS~4\rapimgr.exe

    C:\WINDOWS\System32\wltrysvc.exe

    C:\WINDOWS\System32\bcmwltry.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Windows NT\Accessories\wordpad.exe

    C:\Program Files\Java\jre7\bin\jqs.exe

    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

    C:\WINDOWS\system32\NOTEPAD.EXE

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.12.201:8080

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = dynhost.inetcam.com;register.inetcam.com;<local>

    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    O2 - BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll

    O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

    O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

    O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5825.1100\swg.dll

    O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

    O3 - Toolbar: (no name) - {8B68564D-53FD-4293-B80C-993A9F3988EE} - (no file)

    O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

    O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

    O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

    O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe

    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"

    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

    O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm

    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll

    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll

    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll

    O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O14 - IERESET.INF: START_PAGE_URL=http://www.orange.co.uk/

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab

    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab

    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1222373357081

    O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll

    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll

    O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe

    O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe

    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe

    O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

    O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

    O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

    O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

    O23 - Service: RealNetworks Downloader Resolver Service - Unknown owner - C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe

    O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe

    O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

    O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

    O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

    O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg

    --

    End of file - 9689 bytes

    Google Re-direct Virus

    in Resolved Malware Removal Logs

    Posted

    Hi Gringo,

    I ran the extra combofix report:

    Adobe AIR

    Adobe Flash Player 11 ActiveX

    Adobe Flash Player Plugin

    Adobe Reader X (10.1.4)

    Adobe Shockwave Player 11.6

    Apple Application Support

    Apple Mobile Device Support

    Apple Software Update

    ATI Display Driver

    Audacity 2.0

    avast! Free Antivirus

    Belkin Wireless Utility

    Canon CanoScan Toolbox 4.1

    CCleaner

    Critical Update for Windows Media Player 11 (KB959772)

    Epson Print CD

    EPSON Printer Software

    First Step Guide

    FreeRIP Toolbar v5.5

    Google Toolbar for Internet Explorer

    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

    Hotfix for Windows Internet Explorer 7 (KB947864)

    Hotfix for Windows Media Format 11 SDK (KB929399)

    Hotfix for Windows Media Format SDK (KB902344)

    Hotfix for Windows Media Player 11 (KB939683)

    Hotfix for Windows XP (KB2443685)

    Hotfix for Windows XP (KB2570791)

    Hotfix for Windows XP (KB2633952)

    Hotfix for Windows XP (KB2756822)

    Hotfix for Windows XP (KB2779562)

    Hotfix for Windows XP (KB952287)

    Hotfix for Windows XP (KB954550-v5)

    Hotfix for Windows XP (KB961118)

    Hotfix for Windows XP (KB976002-v5)

    Hotfix for Windows XP (KB979306)

    ImageMixer VCD2

    InterVideo WinDVD 6

    iTunes

    Java Auto Updater

    Java 6 Update 30

    Malwarebytes Anti-Malware version 1.70.0.1100

    McAfee Shredder

    Microsoft .NET Framework 1.1

    Microsoft .NET Framework 1.1 Security Update (KB2656370)

    Microsoft .NET Framework 1.1 Security Update (KB2698023)

    Microsoft .NET Framework 2.0 Service Pack 2

    Microsoft .NET Framework 3.0 Service Pack 2

    Microsoft .NET Framework 3.5 SP1

    Microsoft ActiveSync

    Microsoft Base Smart Card Cryptographic Service Provider Package

    Microsoft Compression Client Pack 1.0 for Windows XP

    Microsoft Internationalized Domain Names Mitigation APIs

    Microsoft LifeCam

    Microsoft National Language Support Downlevel APIs

    Microsoft Office XP Professional with FrontPage

    Microsoft Silverlight

    Microsoft User-Mode Driver Framework Feature Pack 1.0

    Microsoft Visual C Runtime

    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

    Microsoft Visual C++ 2005 Redistributable

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

    MobileMe Control Panel

    Mozilla Firefox 17.0.1 (x86 en-US)

    Mozilla Maintenance Service

    MSXML 4.0 SP2 (KB936181)

    MSXML 4.0 SP2 (KB954430)

    MSXML 4.0 SP2 (KB973688)

    MSXML 4.0 SP2 Parser and SDK

    My DSC

    NavDesk 2009

    Notepad++

    OGA Notifier 2.0.0048.0

    Picture Package

    Pinnacle TVCenter Pro

    QuickTime

    RealDownloader

    RealNetworks - Microsoft Visual C++ 2008 Runtime

    RealNetworks - Microsoft Visual C++ 2010 Runtime

    RealPlayer

    Realtek AC'97 Audio

    Realtek Ethernet Controller All-In-One Windows Driver

    RealUpgrade 1.1

    Safari

    SAMSUNG USB Driver for Mobile Phones

    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)

    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

    Security Update for Microsoft Windows (KB2564958)

    Security Update for Windows Internet Explorer 7 (KB929969)

    Security Update for Windows Internet Explorer 7 (KB933566)

    Security Update for Windows Internet Explorer 7 (KB937143)

    Security Update for Windows Internet Explorer 7 (KB938127)

    Security Update for Windows Internet Explorer 7 (KB939653)

    Security Update for Windows Internet Explorer 7 (KB942615)

    Security Update for Windows Internet Explorer 7 (KB944533)

    Security Update for Windows Internet Explorer 7 (KB950759)

    Security Update for Windows Internet Explorer 7 (KB953838)

    Security Update for Windows Internet Explorer 8 (KB2510531)

    Security Update for Windows Internet Explorer 8 (KB2544521)

    Security Update for Windows Internet Explorer 8 (KB2618444)

    Security Update for Windows Internet Explorer 8 (KB2647516)

    Security Update for Windows Internet Explorer 8 (KB2675157)

    Security Update for Windows Internet Explorer 8 (KB2699988)

    Security Update for Windows Internet Explorer 8 (KB2722913)

    Security Update for Windows Internet Explorer 8 (KB2744842)

    Security Update for Windows Internet Explorer 8 (KB2761465)

    Security Update for Windows Internet Explorer 8 (KB982381)

    Security Update for Windows Media Player (KB2378111)

    Security Update for Windows Media Player (KB911564)

    Security Update for Windows Media Player (KB952069)

    Security Update for Windows Media Player (KB954155)

    Security Update for Windows Media Player (KB968816)

    Security Update for Windows Media Player (KB973540)

    Security Update for Windows Media Player (KB975558)

    Security Update for Windows Media Player (KB978695)

    Security Update for Windows Media Player 10 (KB911565)

    Security Update for Windows Media Player 10 (KB917734)

    Security Update for Windows Media Player 10 (KB936782)

    Security Update for Windows Media Player 11 (KB936782)

    Security Update for Windows Media Player 11 (KB954154)

    Security Update for Windows Media Player 6.4 (KB925398)

    Security Update for Windows XP (KB2079403)

    Security Update for Windows XP (KB2115168)

    Security Update for Windows XP (KB2229593)

    Security Update for Windows XP (KB2296011)

    Security Update for Windows XP (KB2347290)

    Security Update for Windows XP (KB2360937)

    Security Update for Windows XP (KB2387149)

    Security Update for Windows XP (KB2393802)

    Security Update for Windows XP (KB2412687)

    Security Update for Windows XP (KB2419632)

    Security Update for Windows XP (KB2423089)

    Security Update for Windows XP (KB2440591)

    Security Update for Windows XP (KB2443105)

    Security Update for Windows XP (KB2476490)

    Security Update for Windows XP (KB2478960)

    Security Update for Windows XP (KB2478971)

    Security Update for Windows XP (KB2479943)

    Security Update for Windows XP (KB2481109)

    Security Update for Windows XP (KB2483185)

    Security Update for Windows XP (KB2485663)

    Security Update for Windows XP (KB2503665)

    Security Update for Windows XP (KB2506212)

    Security Update for Windows XP (KB2507618)

    Security Update for Windows XP (KB2507938)

    Security Update for Windows XP (KB2508272)

    Security Update for Windows XP (KB2508429)

    Security Update for Windows XP (KB2509553)

    Security Update for Windows XP (KB2524375)

    Security Update for Windows XP (KB2535512)

    Security Update for Windows XP (KB2536276-v2)

    Security Update for Windows XP (KB2536276)

    Security Update for Windows XP (KB2544893-v2)

    Security Update for Windows XP (KB2544893)

    Security Update for Windows XP (KB2555917)

    Security Update for Windows XP (KB2562937)

    Security Update for Windows XP (KB2566454)

    Security Update for Windows XP (KB2567053)

    Security Update for Windows XP (KB2567680)

    Security Update for Windows XP (KB2570222)

    Security Update for Windows XP (KB2570947)

    Security Update for Windows XP (KB2584146)

    Security Update for Windows XP (KB2585542)

    Security Update for Windows XP (KB2592799)

    Security Update for Windows XP (KB2598479)

    Security Update for Windows XP (KB2603381)

    Security Update for Windows XP (KB2618451)

    Security Update for Windows XP (KB2619339)

    Security Update for Windows XP (KB2620712)

    Security Update for Windows XP (KB2621440)

    Security Update for Windows XP (KB2624667)

    Security Update for Windows XP (KB2631813)

    Security Update for Windows XP (KB2633171)

    Security Update for Windows XP (KB2639417)

    Security Update for Windows XP (KB2641653)

    Security Update for Windows XP (KB2646524)

    Security Update for Windows XP (KB2647518)

    Security Update for Windows XP (KB2653956)

    Security Update for Windows XP (KB2655992)

    Security Update for Windows XP (KB2659262)

    Security Update for Windows XP (KB2660465)

    Security Update for Windows XP (KB2676562)

    Security Update for Windows XP (KB2685939)

    Security Update for Windows XP (KB2686509)

    Security Update for Windows XP (KB2691442)

    Security Update for Windows XP (KB2695962)

    Security Update for Windows XP (KB2698365)

    Security Update for Windows XP (KB2705219)

    Security Update for Windows XP (KB2707511)

    Security Update for Windows XP (KB2709162)

    Security Update for Windows XP (KB2712808)

    Security Update for Windows XP (KB2718523)

    Security Update for Windows XP (KB2719985)

    Security Update for Windows XP (KB2723135)

    Security Update for Windows XP (KB2724197)

    Security Update for Windows XP (KB2727528)

    Security Update for Windows XP (KB2731847)

    Security Update for Windows XP (KB2753842-v2)

    Security Update for Windows XP (KB2753842)

    Security Update for Windows XP (KB2758857)

    Security Update for Windows XP (KB2761226)

    Security Update for Windows XP (KB2770660)

    Security Update for Windows XP (KB2779030)

    Security Update for Windows XP (KB923561)

    Security Update for Windows XP (KB923689)

    Security Update for Windows XP (KB923789)

    Security Update for Windows XP (KB938464)

    Security Update for Windows XP (KB941569)

    Security Update for Windows XP (KB946648)

    Security Update for Windows XP (KB950760)

    Security Update for Windows XP (KB950762)

    Security Update for Windows XP (KB950974)

    Security Update for Windows XP (KB951066)

    Security Update for Windows XP (KB951376-v2)

    Security Update for Windows XP (KB951376)

    Security Update for Windows XP (KB951698)

    Security Update for Windows XP (KB951748)

    Security Update for Windows XP (KB952004)

    Security Update for Windows XP (KB952954)

    Security Update for Windows XP (KB953839)

    Security Update for Windows XP (KB954211)

    Security Update for Windows XP (KB954459)

    Security Update for Windows XP (KB954600)

    Security Update for Windows XP (KB955069)

    Security Update for Windows XP (KB956391)

    Security Update for Windows XP (KB956572)

    Security Update for Windows XP (KB956744)

    Security Update for Windows XP (KB956802)

    Security Update for Windows XP (KB956803)

    Security Update for Windows XP (KB956841)

    Security Update for Windows XP (KB956844)

    Security Update for Windows XP (KB957095)

    Security Update for Windows XP (KB957097)

    Security Update for Windows XP (KB958644)

    Security Update for Windows XP (KB958687)

    Security Update for Windows XP (KB958690)

    Security Update for Windows XP (KB958869)

    Security Update for Windows XP (KB959426)

    Security Update for Windows XP (KB960225)

    Security Update for Windows XP (KB960715)

    Security Update for Windows XP (KB960803)

    Security Update for Windows XP (KB960859)

    Security Update for Windows XP (KB961501)

    Security Update for Windows XP (KB969059)

    Security Update for Windows XP (KB969947)

    Security Update for Windows XP (KB970238)

    Security Update for Windows XP (KB970430)

    Security Update for Windows XP (KB971468)

    Security Update for Windows XP (KB971657)

    Security Update for Windows XP (KB972270)

    Security Update for Windows XP (KB973507)

    Security Update for Windows XP (KB973869)

    Security Update for Windows XP (KB973904)

    Security Update for Windows XP (KB974112)

    Security Update for Windows XP (KB974318)

    Security Update for Windows XP (KB974392)

    Security Update for Windows XP (KB974571)

    Security Update for Windows XP (KB975025)

    Security Update for Windows XP (KB975467)

    Security Update for Windows XP (KB975560)

    Security Update for Windows XP (KB975561)

    Security Update for Windows XP (KB975562)

    Security Update for Windows XP (KB975713)

    Security Update for Windows XP (KB977816)

    Security Update for Windows XP (KB977914)

    Security Update for Windows XP (KB978037)

    Security Update for Windows XP (KB978262)

    Security Update for Windows XP (KB978338)

    Security Update for Windows XP (KB978542)

    Security Update for Windows XP (KB978601)

    Security Update for Windows XP (KB978706)

    Security Update for Windows XP (KB979309)

    Security Update for Windows XP (KB979482)

    Security Update for Windows XP (KB979683)

    Security Update for Windows XP (KB979687)

    Security Update for Windows XP (KB980232)

    Security Update for Windows XP (KB980436)

    Security Update for Windows XP (KB981322)

    Security Update for Windows XP (KB981997)

    Security Update for Windows XP (KB982132)

    Security Update for Windows XP (KB982665)

    Skype Click to Call

    Skype™ 5.10

    SmartSound Quicktracks Plugin

    Sony USB Driver

    SpeedTouch USB Software

    swMSM

    TalkTalk Broadband

    Ulead VideoStudio 5.0 DV

    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

    Update for Windows Internet Explorer 8 (KB2598845)

    Update for Windows XP (KB2345886)

    Update for Windows XP (KB2467659)

    Update for Windows XP (KB2541763)

    Update for Windows XP (KB2607712)

    Update for Windows XP (KB2616676)

    Update for Windows XP (KB2641690)

    Update for Windows XP (KB2661254-v2)

    Update for Windows XP (KB2718704)

    Update for Windows XP (KB2736233)

    Update for Windows XP (KB2749655)

    Update for Windows XP (KB951072-v2)

    Update for Windows XP (KB951978)

    Update for Windows XP (KB955759)

    Update for Windows XP (KB955839)

    Update for Windows XP (KB967715)

    Update for Windows XP (KB968389)

    Update for Windows XP (KB971029)

    Update for Windows XP (KB971737)

    Update for Windows XP (KB973687)

    Update for Windows XP (KB973815)

    WebFldrs XP

    Windows Genuine Advantage Notifications (KB905474)

    Windows Genuine Advantage Validation Tool (KB892130)

    Windows Internet Explorer 7

    Windows Internet Explorer 8

    Windows Media Connect

    Windows Media Format 11 runtime

    Windows Media Format SDK Hotfix - KB891122

    Windows Media Player 11

    Windows PowerShell 1.0

    Windows XP Service Pack 3

    WinZip

    Google Re-direct Virus

    in Resolved Malware Removal Logs

    Posted

    Hi Gringo,

    Half way through running the Combofix, I got a 'rich text format error'. It was at that point I realized my machine was running Wordpad instead of Notepad. I have downloaded Notepad, pasted the text into it and re-ran it, all seemed okay, see report below:

    ComboFix 13-01-01.02 - Administrator 02/01/2013 0:27.2.1 - x86

    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1021.626 [GMT 0:00]

    Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

    Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt

    AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

    .

    .

    ((((((((((((((((((((((((( Files Created from 2012-12-02 to 2013-01-02 )))))))))))))))))))))))))))))))

    .

    .

    2013-01-02 00:15 . 2013-01-02 00:15 -------- d-----w- c:\documents and settings\Administrator\Application Data\Notepad++

    2013-01-02 00:15 . 2013-01-02 00:15 -------- d-----w- c:\program files\Notepad++

    2012-12-31 20:55 . 2012-12-31 20:55 -------- d-----w- c:\documents and settings\Administrator\Application Data\PCTools

    2012-12-31 20:37 . 2012-12-31 20:37 -------- d-----w- c:\program files\PC Tools

    2012-12-31 20:21 . 2012-11-01 15:35 202280 ----a-w- c:\windows\system32\drivers\PCTSD.sys

    2012-12-31 20:21 . 2012-12-31 21:52 -------- d-----w- c:\program files\Common Files\PC Tools

    2012-12-31 20:19 . 2012-12-31 20:19 -------- d-----w- c:\documents and settings\Administrator\Application Data\TestApp

    2012-12-30 17:36 . 2012-12-30 17:36 35144 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys

    2012-12-29 21:07 . 2012-12-29 21:07 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

    2012-12-29 21:07 . 2012-12-29 21:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

    2012-12-29 21:07 . 2012-12-30 18:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

    2012-12-29 21:07 . 2012-12-14 16:49 21104 ----a-w- c:\windows\system32\drivers\mbam.sys

    2012-12-21 11:19 . 2012-12-21 11:19 -------- d-----w- c:\documents and settings\Administrator\Application Data\RealNetworks

    2012-12-21 11:18 . 2012-12-21 11:18 -------- d-----w- c:\program files\RealNetworks

    2012-12-21 11:17 . 2012-12-21 11:17 -------- d-----w- c:\documents and settings\All Users\Application Data\RealNetworks

    2012-12-21 11:17 . 2012-12-21 11:17 -------- d-----w- c:\program files\Common Files\xing shared

    2012-12-13 14:30 . 2012-12-13 14:30 5955856 ----a-w- c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2012-12-21 11:16 . 2003-08-27 20:43 499712 ----a-w- c:\windows\system32\msvcp71.dll

    2012-12-21 11:16 . 2003-02-22 01:42 348160 ----a-w- c:\windows\system32\msvcr71.dll

    2012-12-16 12:23 . 2003-03-31 12:00 290560 ----a-w- c:\windows\system32\atmfd.dll

    2012-12-12 20:52 . 2012-05-04 19:07 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe

    2012-12-12 20:52 . 2011-07-25 17:00 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

    2012-12-12 20:51 . 2012-07-13 07:51 15728568 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe

    2012-11-13 01:25 . 2003-03-31 12:00 1866368 ----a-w- c:\windows\system32\win32k.sys

    2012-11-02 02:02 . 2003-03-31 12:00 375296 ----a-w- c:\windows\system32\dpnet.dll

    2012-11-01 12:17 . 2003-03-31 12:00 916992 ----a-w- c:\windows\system32\wininet.dll

    2012-11-01 12:17 . 2003-03-31 12:00 43520 ------w- c:\windows\system32\licmgr10.dll

    2012-11-01 12:17 . 2003-03-31 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl

    2012-11-01 00:35 . 2006-03-20 16:44 385024 ------w- c:\windows\system32\html.iec

    2012-11-29 08:27 . 2012-12-28 21:03 262112 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

    @="{472083B0-C522-11CF-8763-00608CC02F24}"

    [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

    2011-07-04 11:43 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll

    .

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

    "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]

    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-04 68856]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-07-04 3493720]

    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

    "VX3000"="c:\windows\vVX3000.exe" [2006-10-13 707376]

    .

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

    "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

    backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk

    backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk

    backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^OneCare.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\OneCare.lnk

    backup=c:\windows\pss\OneCare.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package Menu.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package Menu.lnk

    backup=c:\windows\pss\Picture Package Menu.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package VCD Maker.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package VCD Maker.lnk

    backup=c:\windows\pss\Picture Package VCD Maker.lnkCommon Startup

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

    2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo R800]

    2007-01-16 05:00 177664 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATI9YE.EXE

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

    2011-08-19 00:07 421736 ----a-w- c:\program files\iTunes\iTunesHelper.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]

    2006-10-13 17:01 277296 ----a-w- c:\program files\Microsoft LifeCam\LifeExp.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McAfeeUpdaterUI]

    2004-08-06 03:50 139320 ----a-w- c:\program files\Network Associates\Common Framework\UpdaterUI.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

    2008-04-14 00:12 1695232 --sh--w- c:\program files\Messenger\msmsgs.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

    2011-07-05 17:36 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]

    2012-12-21 11:16 500888 ----a-w- c:\program files\Real\RealPlayer\realplay.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

    2012-12-21 11:16 295072 ----a-w- c:\program files\Real\RealPlayer\Update\realsched.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]

    "AntiVirusOverride"=dword:00000001

    .

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

    "EnableFirewall"= 0 (0x0)

    .

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

    "c:\\WINDOWS\\system32\\mmc.exe"=

    "c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=

    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager

    "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager

    "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

    "c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=

    "c:\\Program Files\\iTunes\\iTunes.exe"=

    "c:\\WINDOWS\\system32\\muzapp.exe"=

    "c:\\WINDOWS\\system32\\sessmgr.exe"=

    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=

    .

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

    "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

    "3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

    .

    R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [25/07/2011 17:58 441176]

    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [25/07/2011 17:58 309848]

    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [25/07/2011 17:58 19544]

    R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe [29/11/2012 20:31 38608]

    S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys --> c:\windows\system32\drivers\TfFsMon.sys [?]

    S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys --> c:\windows\system32\drivers\TfSysMon.sys [?]

    S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [29/12/2012 21:07 398184]

    S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [29/12/2012 21:07 682344]

    S2 Scutum50;Scutum50 NDIS Protocol Driver;c:\windows\system32\Drivers\Scutum50.sys --> c:\windows\system32\Drivers\Scutum50.sys [?]

    S2 Skype C2C Service;Skype C2C Service;c:\documents and settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [13/12/2012 14:26 3290896]

    S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [13/07/2012 12:28 160944]

    S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys --> c:\windows\system32\drivers\dgderdrv.sys [?]

    S3 Ltn_stk7070P;PCTV based TV tuner device;c:\windows\system32\drivers\Ltn_stk7070P.sys [01/01/2008 14:52 466048]

    S3 Ltn_stkrc;PCTV Infrared Receiver;c:\windows\system32\drivers\Ltn_stkrc.sys [01/01/2008 14:52 13440]

    S3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [30/12/2012 17:36 35144]

    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [29/12/2012 21:07 21104]

    S3 MSHUSBVideo;NX6000 Filter Driver;c:\windows\system32\drivers\nx6000.sys [13/10/2006 17:01 30512]

    S3 TfNetMon;TfNetMon;\??\c:\windows\system32\drivers\TfNetMon.sys --> c:\windows\system32\drivers\TfNetMon.sys [?]

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2013-01-01 c:\windows\Tasks\Adobe Flash Player Updater.job

    - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-04 13:07]

    .

    2012-10-12 c:\windows\Tasks\AppleSoftwareUpdate.job

    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:57]

    .

    2012-09-04 c:\windows\Tasks\ParetoLogic Registration3.job

    - c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2012-06-27 21:07]

    .

    2012-09-04 c:\windows\Tasks\ParetoLogic Update Version3 Startup Task.job

    - c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2012-06-27 21:07]

    .

    2012-09-04 c:\windows\Tasks\ParetoLogic Update Version3.job

    - c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2012-06-27 21:07]

    .

    2013-01-02 c:\windows\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1614895754-1957994488-854245398-500.job

    - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 15:30]

    .

    2013-01-02 c:\windows\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1614895754-1957994488-854245398-500.job

    - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 15:30]

    .

    2013-01-02 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-1957994488-854245398-500.job

    - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 15:30]

    .

    2012-12-05 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-1957994488-854245398-500.job

    - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 15:30]

    .

    2013-01-01 c:\windows\Tasks\User_Feed_Synchronization-{B204F492-A90A-446D-A4C3-80EA6A5015ED}.job

    - c:\windows\system32\msfeedssync.exe [2006-10-17 04:31]

    .

    .

    ------- Supplementary Scan -------

    .

    uStart Page = hxxp://www.google.co.uk/

    uSearchMigratedDefaultURL = hxxp://search.orange.co.uk/all?brand=ouk&tab=web&p=_adr&q={searchTerms}

    uInternet Settings,ProxyServer = 192.168.12.201:8080

    uInternet Settings,ProxyOverride = dynhost.inetcam.com;register.inetcam.com;<local>

    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

    IE: Search with Wanadoo - c:\progra~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm

    TCP: DhcpNameServer = 192.168.1.254

    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

    FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\thtpf9s1.default\

    FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

    FF - prefs.js: browser.startup.homepage - about:home

    FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=386496&ilc=12&p=

    FF - prefs.js: network.proxy.type - 0

    FF - ExtSQL: 2012-12-15 18:03; {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}; c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

    .

    .

    **************************************************************************

    .

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

    Rootkit scan 2013-01-02 00:39

    Windows 5.1.2600 Service Pack 3 NTFS

    .

    scanning hidden processes ...

    .

    scanning hidden autostart entries ...

    .

    scanning hidden files ...

    .

    scan completed successfully

    hidden files: 0

    .

    **************************************************************************

    .

    --------------------- LOCKED REGISTRY KEYS ---------------------

    .

    [HKEY_USERS\S-1-5-21-1614895754-1957994488-854245398-500\Software\Microsoft\Internet Explorer\User Preferences]

    @Denied: (2) (Administrator)

    "659BD8E725A05FDCC64118EA787EAA2B534A94FABE"=hex:01,00,00,00,d0,8c,9d,df,01,15,

    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2c,8a,a8,bb,77,93,51,4d,81,00,fe,\

    "3A77B377802A4B6183DDE08FDE4AD9AF647A702826"=hex:01,00,00,00,d0,8c,9d,df,01,15,

    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2c,8a,a8,bb,77,93,51,4d,81,00,fe,\

    "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,42,ea,43,ba,d2,0f,04,4a,82,c7,33,\

    "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,01,c4,17,fd,c4,ed,a1,48,b4,49,d4,\

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    --------------------- DLLs Loaded Under Running Processes ---------------------

    .

    - - - - - - - > 'explorer.exe'(3924)

    c:\windows\system32\WININET.dll

    c:\windows\system32\ieframe.dll

    c:\windows\system32\mshtml.dll

    c:\windows\system32\msls31.dll

    c:\windows\system32\msdbg2.dll

    c:\windows\IME\SPGRMR.DLL

    c:\program files\Common Files\Microsoft Shared\Ink\SKCHUI.DLL

    c:\windows\system32\webcheck.dll

    c:\windows\system32\WPDShServiceObj.dll

    c:\windows\system32\PortableDeviceTypes.dll

    c:\windows\system32\PortableDeviceApi.dll

    .

    Completion time: 2013-01-02 00:43:20

    ComboFix-quarantined-files.txt 2013-01-02 00:43

    ComboFix2.txt 2013-01-01 22:26

    .

    Pre-Run: 43,581,161,472 bytes free

    Post-Run: 43,574,652,928 bytes free

    .

    - - End Of File - - 966A4EED3064C37A834AAB4E0F1B0705

    Google Re-direct Virus

    in Resolved Malware Removal Logs

    Posted

    Hi Gringo,

    It works much better when you follow the instructions!

    Combofix ran, here is the report:

    ComboFix 13-01-01.02 - Administrator 01/01/2013 22:09:39.1.1 - x86

    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1021.671 [GMT 0:00]

    Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

    AV: avast! Antivirus *Disabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

    .

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    C:\0.bak

    c:\documents and settings\Administrator\WINDOWS

    c:\documents and settings\All Users\Application Data\TEMP

    c:\windows\system32\ClientSyncLoader.htm

    c:\windows\system32\ClientSyncLoaderDriver.htm

    c:\windows\system32\SET58.tmp

    c:\windows\system32\SET64.tmp

    c:\windows\system32\SET6D.tmp

    c:\windows\system32\SET6E.tmp

    c:\windows\system32\SET6F.tmp

    c:\windows\system32\SET72.tmp

    c:\windows\system32\System32\MASetupCleaner.exe

    c:\windows\system32\System32\muzapp.exe

    c:\windows\system32\URTTemp

    c:\windows\system32\URTTemp\fusion.dll

    c:\windows\system32\URTTemp\mscoree.dll

    c:\windows\system32\URTTemp\mscoree.dll.local

    c:\windows\system32\URTTemp\mscorsn.dll

    c:\windows\system32\URTTemp\mscorwks.dll

    c:\windows\system32\URTTemp\msvcr71.dll

    c:\windows\system32\URTTemp\regtlib.exe

    .

    .

    ((((((((((((((((((((((((( Files Created from 2012-12-01 to 2013-01-01 )))))))))))))))))))))))))))))))

    .

    .

    2012-12-31 20:55 . 2012-12-31 20:55 -------- d-----w- c:\documents and settings\Administrator\Application Data\PCTools

    2012-12-31 20:37 . 2012-12-31 20:37 -------- d-----w- c:\program files\PC Tools

    2012-12-31 20:21 . 2012-11-01 15:35 202280 ----a-w- c:\windows\system32\drivers\PCTSD.sys

    2012-12-31 20:21 . 2012-12-31 21:52 -------- d-----w- c:\program files\Common Files\PC Tools

    2012-12-31 20:19 . 2012-12-31 20:19 -------- d-----w- c:\documents and settings\Administrator\Application Data\TestApp

    2012-12-30 17:36 . 2012-12-30 17:36 35144 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys

    2012-12-29 21:07 . 2012-12-29 21:07 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

    2012-12-29 21:07 . 2012-12-29 21:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

    2012-12-29 21:07 . 2012-12-30 18:30 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

    2012-12-29 21:07 . 2012-12-14 16:49 21104 ----a-w- c:\windows\system32\drivers\mbam.sys

    2012-12-21 11:19 . 2012-12-21 11:19 -------- d-----w- c:\documents and settings\Administrator\Application Data\RealNetworks

    2012-12-21 11:18 . 2012-12-21 11:18 -------- d-----w- c:\program files\RealNetworks

    2012-12-21 11:17 . 2012-12-21 11:17 -------- d-----w- c:\documents and settings\All Users\Application Data\RealNetworks

    2012-12-21 11:17 . 2012-12-21 11:17 -------- d-----w- c:\program files\Common Files\xing shared

    2012-12-13 14:30 . 2012-12-13 14:30 5955856 ----a-w- c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}\components\SkypeFfComponent.dll

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2012-12-21 11:16 . 2003-08-27 20:43 499712 ----a-w- c:\windows\system32\msvcp71.dll

    2012-12-21 11:16 . 2003-02-22 01:42 348160 ----a-w- c:\windows\system32\msvcr71.dll

    2012-12-16 12:23 . 2003-03-31 12:00 290560 ----a-w- c:\windows\system32\atmfd.dll

    2012-12-12 20:52 . 2012-05-04 19:07 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe

    2012-12-12 20:52 . 2011-07-25 17:00 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

    2012-12-12 20:51 . 2012-07-13 07:51 15728568 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe

    2012-11-13 01:25 . 2003-03-31 12:00 1866368 ----a-w- c:\windows\system32\win32k.sys

    2012-11-02 02:02 . 2003-03-31 12:00 375296 ----a-w- c:\windows\system32\dpnet.dll

    2012-11-01 12:17 . 2003-03-31 12:00 916992 ----a-w- c:\windows\system32\wininet.dll

    2012-11-01 12:17 . 2003-03-31 12:00 43520 ------w- c:\windows\system32\licmgr10.dll

    2012-11-01 12:17 . 2003-03-31 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl

    2012-11-01 00:35 . 2006-03-20 16:44 385024 ------w- c:\windows\system32\html.iec

    2012-11-29 08:27 . 2012-12-28 21:03 262112 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

    @="{472083B0-C522-11CF-8763-00608CC02F24}"

    [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

    2011-07-04 11:43 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll

    .

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

    "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]

    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-04 68856]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-07-04 3493720]

    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

    "VX3000"="c:\windows\vVX3000.exe" [2006-10-13 707376]

    .

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

    "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

    backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk

    backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk

    backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^OneCare.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\OneCare.lnk

    backup=c:\windows\pss\OneCare.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package Menu.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package Menu.lnk

    backup=c:\windows\pss\Picture Package Menu.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package VCD Maker.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package VCD Maker.lnk

    backup=c:\windows\pss\Picture Package VCD Maker.lnkCommon Startup

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

    2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo R800]

    2007-01-16 05:00 177664 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_FATI9YE.EXE

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

    2011-08-19 00:07 421736 ----a-w- c:\program files\iTunes\iTunesHelper.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]

    2006-10-13 17:01 277296 ----a-w- c:\program files\Microsoft LifeCam\LifeExp.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McAfeeUpdaterUI]

    2004-08-06 03:50 139320 ----a-w- c:\program files\Network Associates\Common Framework\UpdaterUI.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

    2008-04-14 00:12 1695232 --sh--w- c:\program files\Messenger\msmsgs.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

    2011-07-05 17:36 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]

    2012-12-21 11:16 500888 ----a-w- c:\program files\Real\RealPlayer\realplay.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

    2012-12-21 11:16 295072 ----a-w- c:\program files\Real\RealPlayer\Update\realsched.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]

    "AntiVirusOverride"=dword:00000001

    .

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

    "EnableFirewall"= 0 (0x0)

    .

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

    "c:\\WINDOWS\\system32\\mmc.exe"=

    "c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=

    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager

    "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager

    "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

    "c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=

    "c:\\Program Files\\iTunes\\iTunes.exe"=

    "c:\\WINDOWS\\system32\\muzapp.exe"=

    "c:\\WINDOWS\\system32\\sessmgr.exe"=

    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=

    .

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

    "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

    "3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

    .

    R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [25/07/2011 17:58 441176]

    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [25/07/2011 17:58 309848]

    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [25/07/2011 17:58 19544]

    R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe [29/11/2012 20:31 38608]

    S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys --> c:\windows\system32\drivers\TfFsMon.sys [?]

    S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys --> c:\windows\system32\drivers\TfSysMon.sys [?]

    S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [29/12/2012 21:07 398184]

    S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [29/12/2012 21:07 682344]

    S2 Scutum50;Scutum50 NDIS Protocol Driver;c:\windows\system32\Drivers\Scutum50.sys --> c:\windows\system32\Drivers\Scutum50.sys [?]

    S2 Skype C2C Service;Skype C2C Service;c:\documents and settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [13/12/2012 14:26 3290896]

    S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [13/07/2012 12:28 160944]

    S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys --> c:\windows\system32\drivers\dgderdrv.sys [?]

    S3 Ltn_stk7070P;PCTV based TV tuner device;c:\windows\system32\drivers\Ltn_stk7070P.sys [01/01/2008 14:52 466048]

    S3 Ltn_stkrc;PCTV Infrared Receiver;c:\windows\system32\drivers\Ltn_stkrc.sys [01/01/2008 14:52 13440]

    S3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [30/12/2012 17:36 35144]

    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [29/12/2012 21:07 21104]

    S3 MSHUSBVideo;NX6000 Filter Driver;c:\windows\system32\drivers\nx6000.sys [13/10/2006 17:01 30512]

    S3 TfNetMon;TfNetMon;\??\c:\windows\system32\drivers\TfNetMon.sys --> c:\windows\system32\drivers\TfNetMon.sys [?]

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2013-01-01 c:\windows\Tasks\Adobe Flash Player Updater.job

    - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-04 13:07]

    .

    2012-10-12 c:\windows\Tasks\AppleSoftwareUpdate.job

    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:57]

    .

    2012-09-04 c:\windows\Tasks\ParetoLogic Registration3.job

    - c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2012-06-27 21:07]

    .

    2012-09-04 c:\windows\Tasks\ParetoLogic Update Version3 Startup Task.job

    - c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2012-06-27 21:07]

    .

    2012-09-04 c:\windows\Tasks\ParetoLogic Update Version3.job

    - c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2012-06-27 21:07]

    .

    2013-01-01 c:\windows\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1614895754-1957994488-854245398-500.job

    - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 15:30]

    .

    2013-01-01 c:\windows\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1614895754-1957994488-854245398-500.job

    - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 15:30]

    .

    2013-01-01 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1614895754-1957994488-854245398-500.job

    - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 15:30]

    .

    2012-12-05 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1614895754-1957994488-854245398-500.job

    - c:\program files\Real\RealUpgrade\realupgrade.exe [2012-11-30 15:30]

    .

    2013-01-01 c:\windows\Tasks\User_Feed_Synchronization-{B204F492-A90A-446D-A4C3-80EA6A5015ED}.job

    - c:\windows\system32\msfeedssync.exe [2006-10-17 04:31]

    .

    .

    ------- Supplementary Scan -------

    .

    uStart Page = hxxp://www.google.co.uk/

    uSearchMigratedDefaultURL = hxxp://search.orange.co.uk/all?brand=ouk&tab=web&p=_adr&q={searchTerms}

    uInternet Settings,ProxyServer = 192.168.12.201:8080

    uInternet Settings,ProxyOverride = dynhost.inetcam.com;register.inetcam.com;<local>

    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

    IE: Search with Wanadoo - c:\progra~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm

    TCP: DhcpNameServer = 192.168.1.254

    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

    FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\thtpf9s1.default\

    FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

    FF - prefs.js: browser.startup.homepage - about:home

    FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=386496&ilc=12&p=

    FF - prefs.js: network.proxy.type - 0

    FF - ExtSQL: 2012-12-15 18:03; {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}; c:\program files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}

    .

    - - - - ORPHANS REMOVED - - - -

    .

    MSConfigStartUp-hpppta - c:\program files\Hewlett-Packard\HP PrecisionScan\PrecisionScan Pro\hpppta.exe

    MSConfigStartUp-KiesHelper - c:\program files\Samsung\Kies\KiesHelper.exe

    MSConfigStartUp-KiesPDLR - c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

    MSConfigStartUp-KiesTrayAgent - c:\program files\Samsung\Kies\KiesTrayAgent.exe

    MSConfigStartUp-Motive SmartBridge - c:\progra~1\OneCare\SMARTB~1\MotiveSB.exe

    MSConfigStartUp-Network Associates Error Reporting Service - c:\program files\Common Files\Network Associates\TalkBack\TBMon.exe

    AddRemove-{501451DE-5808-4599-B544-8BD0915B6B24}_is1 - c:\program files\FreeRIP3\unins000.exe

    AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe

    AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe

    AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe

    AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe

    AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe

    AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe

    AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe

    AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe

    AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe

    AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe

    AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe

    AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe

    AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe

    AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe

    AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe

    AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe

    AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe

    AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe

    AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe

    .

    .

    .

    **************************************************************************

    .

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

    Rootkit scan 2013-01-01 22:21

    Windows 5.1.2600 Service Pack 3 NTFS

    .

    scanning hidden processes ...

    .

    scanning hidden autostart entries ...

    .

    scanning hidden files ...

    .

    scan completed successfully

    hidden files: 0

    .

    **************************************************************************

    .

    --------------------- LOCKED REGISTRY KEYS ---------------------

    .

    [HKEY_USERS\S-1-5-21-1614895754-1957994488-854245398-500\Software\Microsoft\Internet Explorer\User Preferences]

    @Denied: (2) (Administrator)

    "659BD8E725A05FDCC64118EA787EAA2B534A94FABE"=hex:01,00,00,00,d0,8c,9d,df,01,15,

    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2c,8a,a8,bb,77,93,51,4d,81,00,fe,\

    "3A77B377802A4B6183DDE08FDE4AD9AF647A702826"=hex:01,00,00,00,d0,8c,9d,df,01,15,

    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2c,8a,a8,bb,77,93,51,4d,81,00,fe,\

    "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,42,ea,43,ba,d2,0f,04,4a,82,c7,33,\

    "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,01,c4,17,fd,c4,ed,a1,48,b4,49,d4,\

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    Completion time: 2013-01-01 22:26:28

    ComboFix-quarantined-files.txt 2013-01-01 22:26

    .

    Pre-Run: 43,791,777,792 bytes free

    Post-Run: 43,830,198,272 bytes free

    .

    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

    [boot loader]

    timeout=2

    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

    [operating systems]

    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

    UnsupportedDebug="do not select this" /debug

    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

    .

    - - End Of File - - 2018CF3743E7B5046FAAB1D22DCC5926

    Google Re-direct Virus

    in Resolved Malware Removal Logs

    Posted

    Hi Gringo,

    I followed the instructions I turned off Microsoft Firewall, Avast and Malwarebytes, I then ran the Combofix file, however I got this (attached) error message, I clicked OK and the program quit with no report being created?

    I have been using the computer, surfing today, however I have neen using Firefox instead of IE and avoiding Google and using Yahoo, with no issues. I was concerned that I did not want to re-infect or make the computer unstable by going back to IE or Google.

    Regards,

    Hackfall

    Combofix error.rtf

    Google Re-direct Virus

    in Resolved Malware Removal Logs

    Posted

    Hi Gringo,

    Can you tell I'm an IT novice!

    Here is the adwcleaner report, after I had clicked delete and the Rougekiller report:

    # AdwCleaner v2.104 - Logfile created 01/01/2013 at 09:01:00

    # Updated 29/12/2012 by Xplode

    # Operating system : Microsoft Windows XP Service Pack 3 (32 bits)

    # User : Administrator - LANEFOXCIRENCES

    # Boot Mode : Normal

    # Running from : C:\Documents and Settings\Administrator\Desktop\adwcleaner.exe

    # Option [Delete]

    ***** [services] *****

    Stopped & Deleted : Application Updater

    ***** [Files / Folders] *****

    Folder Deleted : C:\Documents and Settings\Administrator\Application Data\FreeRIP

    Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Search Settings

    Folder Deleted : C:\Documents and Settings\Administrator\Start Menu\Programs\FreeRIP

    Folder Deleted : C:\Documents and Settings\All Users\Application Data\FreeRIP

    Folder Deleted : C:\Documents and Settings\All Users\Start Menu\Programs\FreeRIP3

    Folder Deleted : C:\Program Files\Application Updater

    Folder Deleted : C:\Program Files\Common Files\spigot

    Folder Deleted : C:\Program Files\FreeRIP Toolbar

    Folder Deleted : C:\Program Files\FreeRIP3

    ***** [Registry] *****

    Key Deleted : HKCU\Software\AppDataLow\Software\Search Settings

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E634228A-03CF-4BC8-B0AB-668257F1FD8C}

    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E634228A-03CF-4BC8-B0AB-668257F1FD8C}

    Key Deleted : HKCU\Software\Search Settings

    Key Deleted : HKLM\Software\Application Updater

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLL

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E634228A-03CF-4BC8-B0AB-668257F1FD8C}

    Key Deleted : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SearchSettings

    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E634228A-03CF-4BC8-B0AB-668257F1FD8C}

    Key Deleted : HKLM\Software\Search Settings

    Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{E634228A-03CF-4BC8-B0AB-668257F1FD8C}]

    Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{E634228A-03CF-4BC8-B0AB-668257F1FD8C}]

    ***** [internet Browsers] *****

    -\\ Internet Explorer v8.0.6001.18702

    [OK] Registry is clean.

    -\\ Mozilla Firefox v17.0.1 (en-US)

    File : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\thtpf9s1.default\prefs.js

    [OK] File is clean.

    *************************

    AdwCleaner[R1].txt - [2496 octets] - [01/01/2013 08:47:28]

    AdwCleaner[R2].txt - [2556 octets] - [01/01/2013 09:00:19]

    AdwCleaner[s1].txt - [2541 octets] - [01/01/2013 09:01:00]

    ########## EOF - C:\AdwCleaner[s1].txt - [2601 octets] ##########

    RogueKiller V8.4.2 [Dec 31 2012] by Tigzy

    mail : tigzyRK<at>gmail<dot>com

    Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

    Website : http://tigzy.geekstogo.com/roguekiller.php

    Blog : http://tigzyrk.blogspot.com/

    Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version

    Started in : Normal mode

    User : Administrator [Admin rights]

    Mode : Remove -- Date : 01/01/2013 09:10:18

    ¤¤¤ Bad processes : 0 ¤¤¤

    ¤¤¤ Registry Entries : 1 ¤¤¤

    [PROXY IE] HKCU\[...]\Internet Settings : ProxyServer (192.168.12.201:8080) -> NOT REMOVED, USE PROXYFIX

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [LOADED] ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤

    --> C:\WINDOWS\system32\drivers\etc\hosts

    127.0.0.1 localhost

    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: WDC WD600UE-22HCT0 +++++

    --- User ---

    [MBR] fc2e4e50753fa2735437be293dee664b

    [bSP] 4f6d596ccade31196e704a9db72b39f6 : Windows XP MBR Code

    Partition table:

    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 57223 Mo

    User = LL1 ... OK!

    User = LL2 ... OK!

    Finished : << RKreport[3]_D_01012013_02d0910.txt >>

    RKreport[1]_S_01012013_02d0909.txt ; RKreport[2]_D_01012013_02d0910.txt ; RKreport[3]_D_01012013_02d0910.txt

    Google Re-direct Virus

    in Resolved Malware Removal Logs

    Posted

    Hi Gringo,

    Many thanks for the promp response, Happy New Year!

    I have been unable to find the watch topic button at the top of my posting?

    I am working through the fix, posted the details below.

    Results of screen317's Security Check version 0.99.56

    Windows XP Service Pack 3 x86

    Internet Explorer 8

    ``````````````Antivirus/Firewall Check:``````````````

    Windows Firewall Enabled!

    avast! Antivirus

    Antivirus out of date!

    `````````Anti-malware/Other Utilities Check:`````````

    Malwarebytes Anti-Malware version 1.70.0.1100

    CCleaner

    Java 6 Update 30

    Java version out of Date!

    Adobe Reader 10.1.4 Adobe Reader out of Date!

    Mozilla Firefox (17.0.1)

    ````````Process Check: objlist.exe by Laurent````````

    Malwarebytes Anti-Malware mbamservice.exe

    Malwarebytes Anti-Malware mbamgui.exe

    Malwarebytes' Anti-Malware mbamscheduler.exe

    AVAST Software Avast AvastSvc.exe

    AVAST Software Avast setup avast.setup

    AVAST Software Avast avastUI.exe

    `````````````````System Health check`````````````````

    Total Fragmentation on Drive C:: 2%

    ````````````````````End of Log`````````````````````` # AdwCleaner v2.104 - Logfile created 01/01/2013 at 08:47:28

    # Updated 29/12/2012 by Xplode

    # Operating system : Microsoft Windows XP Service Pack 3 (32 bits)

    # User : Administrator - LANEFOXCIRENCES

    # Boot Mode : Normal

    # Running from : C:\Documents and Settings\Administrator\Desktop\adwcleaner.exe

    # Option [search]

    ***** [services] *****

    Found : Application Updater

    ***** [Files / Folders] *****

    Folder Found : C:\Documents and Settings\Administrator\Application Data\FreeRIP

    Folder Found : C:\Documents and Settings\Administrator\Application Data\Search Settings

    Folder Found : C:\Documents and Settings\Administrator\Start Menu\Programs\FreeRIP

    Folder Found : C:\Documents and Settings\All Users\Application Data\FreeRIP

    Folder Found : C:\Documents and Settings\All Users\Start Menu\Programs\FreeRIP3

    Folder Found : C:\Program Files\Application Updater

    Folder Found : C:\Program Files\Common Files\spigot

    Folder Found : C:\Program Files\FreeRIP Toolbar

    Folder Found : C:\Program Files\FreeRIP3

    ***** [Registry] *****

    Key Found : HKCU\Software\AppDataLow\Software\Search Settings

    Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E634228A-03CF-4BC8-B0AB-668257F1FD8C}

    Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E634228A-03CF-4BC8-B0AB-668257F1FD8C}

    Key Found : HKCU\Software\Search Settings

    Key Found : HKLM\Software\Application Updater

    Key Found : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLL

    Key Found : HKLM\SOFTWARE\Classes\CLSID\{E634228A-03CF-4BC8-B0AB-668257F1FD8C}

    Key Found : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SearchSettings

    Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E634228A-03CF-4BC8-B0AB-668257F1FD8C}

    Key Found : HKLM\Software\Search Settings

    Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{E634228A-03CF-4BC8-B0AB-668257F1FD8C}]

    Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{E634228A-03CF-4BC8-B0AB-668257F1FD8C}]

    ***** [internet Browsers] *****

    -\\ Internet Explorer v8.0.6001.18702

    [OK] Registry is clean.

    -\\ Mozilla Firefox v17.0.1 (en-US)

    File : C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\thtpf9s1.default\prefs.js

    [OK] File is clean.

    *************************

    AdwCleaner[R1].txt - [2367 octets] - [01/01/2013 08:47:28]

    Adwcleaner results:

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.