stevemartin83

Thank you so much 1PW!! Tried the MBAM Clean Removal Process and it is now working flawlessly, running a scan right now actually just to be safe!! No idea why it stopped working, but its working now and that's what matters!!

I also tried running rkill.exe, it found no processes to kill. Security Essentials also came back clean as well.

I noticed tonight that MBAM wasn't running. I have performed a full virus scan using Microsoft Security Essentials and then decided I was going to run full scan using MBAM, which is when I found the problem. MBAM will not open at all. I tried using chameleon, all 13 steps, and still nothing. I have no idea what else to do, I am using Windows 7 64-bit.

Thank you so much for giving me back my computer!! I was pretty much ready to give up due to the persistence of this virus/malware. It was, by far, 100 times more difficult to remove than the System Tools virus/malware I got a couple years ago!!

Results of screen317's Security Check version 0.99.63 Windows 7 Service Pack 1 x64 (UAC is disabled!) Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Microsoft Security Essentials Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware version 1.75.0.1300 JavaFX 2.0.3 Java 7 Update 17 Java version out of Date! Adobe Reader 10.1.6 Adobe Reader out of Date! ````````Process Check: objlist.exe by Laurent```````` Microsoft Security Essentials MSMpEng.exe Microsoft Security Essentials msseces.exe Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 0% ````````````````````End of Log``````````````````````

# AdwCleaner v2.300 - Logfile created 05/09/2013 at 17:27:59 # Updated 28/04/2013 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : Owner - OWNER-PC # Boot Mode : Normal # Running from : C:\Users\Owner\Desktop\adwcleaner.exe # Option [Delete] ***** [services] ***** ***** [Files / Folders] ***** File Deleted : C:\END Folder Deleted : C:\Program Files (x86)\Conduit Folder Deleted : C:\Users\Owner\AppData\Local\Conduit Folder Deleted : C:\Users\Owner\AppData\LocalLow\Conduit Folder Deleted : C:\Users\Owner\AppData\LocalLow\PriceGong ***** [Registry] ***** Key Deleted : HKCU\Software\AppDataLow\Software\Conduit Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3244149 Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} ***** [internet Browsers] ***** -\\ Internet Explorer v10.0.9200.16537 [OK] Registry is clean. ************************* AdwCleaner[R1].txt - [1295 octets] - [09/05/2013 17:04:58] AdwCleaner[R2].txt - [1355 octets] - [09/05/2013 17:27:45] AdwCleaner[s1].txt - [1310 octets] - [09/05/2013 17:27:59] ########## EOF - C:\AdwCleaner[s1].txt - [1370 octets] ##########

Here's the log from AdwCleaner. Looks like it's all crap, not seeing anything that could be mistaken for a "keeper". # AdwCleaner v2.300 - Logfile created 05/09/2013 at 17:04:58 # Updated 28/04/2013 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : Owner - OWNER-PC # Boot Mode : Normal # Running from : C:\Users\Owner\Desktop\adwcleaner.exe # Option [search] ***** [services] ***** ***** [Files / Folders] ***** File Found : C:\END Folder Found : C:\Program Files (x86)\Conduit Folder Found : C:\Users\Owner\AppData\Local\Conduit Folder Found : C:\Users\Owner\AppData\LocalLow\Conduit Folder Found : C:\Users\Owner\AppData\LocalLow\PriceGong ***** [Registry] ***** Key Found : HKCU\Software\AppDataLow\Software\Conduit Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes Key Found : HKCU\Software\AppDataLow\Software\PriceGong Key Found : HKCU\Software\AppDataLow\Software\SmartBar Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3244149 Key Found : HKLM\Software\Conduit Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} ***** [internet Browsers] ***** -\\ Internet Explorer v10.0.9200.16537 [OK] Registry is clean. ************************* AdwCleaner[R1].txt - [1166 octets] - [09/05/2013 17:04:58] ########## EOF - C:\AdwCleaner[R1].txt - [1226 octets] ##########

I was just playing it safe and not touching anything until I got the all clear. Going into the control panel, seems like the virus turned off my theme. Now it looks just like normal, aside from 2 icon images not loading as if the .gif images for them have been deleted.

Here's the log from RogueKillerX64. I noticed it seemed to be very interested in curse client. Don't know if you play games, but its an add-on management for World of Warcraft. Basically Steam for warcraft add-ons, keeps them up to date with latest version. RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy mail : tigzyRK<at>gmail<dot>com Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/ Website : http://tigzy.geekstogo.com/roguekiller.php Blog : http://tigzyrk.blogspot.com/ Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version Started in : Normal mode User : Owner [Admin rights] Mode : Scan -- Date : 05/09/2013 15:17:30 | ARK || FAK || MBR | ¤¤¤ Bad processes : 1 ¤¤¤ [sUSP PATH] CurseClient.exe -- C:\Users\Owner\AppData\Local\Apps\2.0\RNX0EZQE.KKO\MPGT8ZHD.PE4\curs..tion_9e9e83ddf3ed3ead_0005.0001_35ab96b41397406c\CurseClient.exe [-] -> KILLED [TermProc] ¤¤¤ Registry Entries : 8 ¤¤¤ [HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND [HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND [HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> FOUND [HJ] HKLM\[...]\Wow6432Node\System : ConsentPromptBehaviorAdmin (0) -> FOUND [HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND [HJ] HKLM\[...]\Wow6432Node\System : EnableLUA (0) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver : [NOT LOADED] ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ --> C:\Windows\system32\drivers\etc\hosts 127.0.0.1 localhost ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: ST31000524AS +++++ --- User --- [MBR] 7d495c9e80d1d03943476c8f5fb0500b [bSP] 25b6910abf9c3e45a9dfa4e897c311cb : Windows Vista MBR Code Partition table: 0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo 1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 12544 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 25772032 | Size: 941284 Mo User = LL1 ... OK! User = LL2 ... OK! Finished : << RKreport[1]_S_05092013_02d1517.txt >> RKreport[1]_S_05092013_02d1517.txt

The screen is still not normal, background is all black and the windows bar at the bottom looks more like Windows 95 than Windows 7. Here's a screen shot.

Ok, ran ComboFix, this is the log that came up. ComboFix 13-05-08.02 - Owner 05/08/2013 21:27:26.1.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8153.6292 [GMT -4:00] Running from: c:\users\Owner\Desktop\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5} SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\PCDr\6032\AddOnDownloaded\1ea63693-456f-437c-857f-522df77e7357.dll c:\programdata\PCDr\6032\AddOnDownloaded\32ac3173-77bd-4ec6-9638-94e174508c22.dll c:\programdata\PCDr\6032\AddOnDownloaded\4d4f44db-c9f0-4cc8-a32f-e98ea4fff68d.dll c:\programdata\PCDr\6032\AddOnDownloaded\7b6e388f-35d0-44f8-aa2c-20538273473f.dll c:\programdata\PCDr\6032\AddOnDownloaded\7dd123b0-30e9-4f67-b7e2-20e7374cbb87.dll c:\programdata\PCDr\6032\AddOnDownloaded\88bde4bf-b24d-4cb6-92ef-eb02d3276f09.dll c:\programdata\PCDr\6032\AddOnDownloaded\96c23f75-9f21-4ef8-a3c8-1a554b815309.dll c:\programdata\PCDr\6032\AddOnDownloaded\97cd9b9c-9747-469a-acfa-cfbf8aed528a.dll c:\programdata\PCDr\6032\AddOnDownloaded\9cdc7b97-c1d2-495c-8b7f-12fd3c7e14b8.dll c:\programdata\PCDr\6032\AddOnDownloaded\be661974-a339-4e9a-bea4-bda0af68ba7f.dll c:\programdata\PCDr\6032\AddOnDownloaded\bea3f575-677a-4c92-89ca-7be8480c11a9.dll c:\programdata\PCDr\6032\AddOnDownloaded\c0ff87a7-2f82-4d5e-8d0f-38cbd0c2f4d1.dll c:\programdata\PCDr\6032\AddOnDownloaded\ca35a61e-780d-401f-891e-22b67162d061.dll c:\programdata\PCDr\6032\AddOnDownloaded\ca39d363-7f7b-442f-9d1a-7cf8e06b7b08.dll c:\programdata\PCDr\6032\AddOnDownloaded\caf72ad2-a222-415c-a303-8ca35e466713.dll c:\programdata\PCDr\6032\AddOnDownloaded\d04640e7-f772-4909-8f8e-f8294ff0752f.dll c:\programdata\PCDr\6032\AddOnDownloaded\d2597799-52b1-4a68-9280-897ad5c0c18e.dll c:\programdata\PCDr\6032\AddOnDownloaded\fb803e34-29ed-4941-a7b3-4074ca51286c.dll c:\windows\RPSETUP.EXE.LOG . . ((((((((((((((((((((((((( Files Created from 2013-04-09 to 2013-05-09 ))))))))))))))))))))))))))))))) . . 2013-05-09 01:31 . 2013-05-09 01:31 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-05-09 01:05 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{14B9DF71-CE98-40DA-A027-2A529EC9E9B8}\mpengine.dll 2013-05-07 20:52 . 2013-05-07 20:52 -------- d-----w- C:\FRST 2013-05-07 20:12 . 2013-05-07 20:12 12872 ----a-w- c:\windows\system32\bootdelete.exe 2013-05-07 20:06 . 2013-05-07 20:12 -------- d-----w- c:\programdata\HitmanPro 2013-05-07 13:29 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2013-04-24 21:51 . 2013-04-24 21:50 905296 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{97CE9639-3DB4-4E4C-80A0-0B46AD5AE10D}\gapaengine.dll 2013-04-24 21:51 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys 2013-04-22 01:23 . 2013-04-22 01:23 163504 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10144.bin 2013-04-18 22:38 . 2013-04-18 22:38 39904 ----a-w- c:\windows\SysWow64\Media Player - Codec Pack Disc handler.exe 2013-04-18 22:38 . 2013-04-18 22:38 39904 ----a-w- c:\windows\SysWow64\dischandler.exe 2013-04-16 21:34 . 2013-04-16 21:34 -------- d-----w- c:\windows\SysWow64\C2MP 2013-04-16 10:40 . 2013-04-16 10:40 4012544 ----a-w- c:\windows\system32\ffmpeg.dll 2013-04-16 10:39 . 2013-04-16 10:39 127488 ----a-w- c:\windows\system32\ff_vfw.dll 2013-04-16 10:39 . 2013-04-16 10:39 4372992 ----a-w- c:\windows\system32\ffdshow.ax 2013-04-16 10:38 . 2013-04-16 10:38 474624 ----a-w- c:\windows\system32\ff_kernelDeint.dll 2013-04-16 10:37 . 2013-04-16 10:37 631296 ----a-w- c:\windows\system32\TomsMoComp_ff.dll 2013-04-16 10:37 . 2013-04-16 10:37 114688 ----a-w- c:\windows\system32\ff_wmv9.dll 2013-04-16 10:37 . 2013-04-16 10:37 183296 ----a-w- c:\windows\system32\ff_unrar.dll 2013-04-16 10:37 . 2013-04-16 10:37 156672 ----a-w- c:\windows\system32\ff_libmad.dll 2013-04-16 10:37 . 2013-04-16 10:37 222720 ----a-w- c:\windows\system32\ff_libdts.dll 2013-04-16 10:37 . 2013-04-16 10:37 1532928 ----a-w- c:\windows\system32\ff_samplerate.dll 2013-04-16 10:37 . 2013-04-16 10:37 190464 ----a-w- c:\windows\system32\libmpeg2_ff.dll 2013-04-16 10:37 . 2013-04-16 10:37 116224 ----a-w- c:\windows\system32\ff_liba52.dll 2013-04-16 10:35 . 2013-04-16 10:35 3915776 ----a-w- c:\windows\SysWow64\ffmpeg.dll 2013-04-16 10:33 . 2013-04-16 10:33 112640 ----a-w- c:\windows\SysWow64\ff_vfw.dll 2013-04-16 10:33 . 2013-04-16 10:33 3501568 ----a-w- c:\windows\SysWow64\ffdshow.ax 2013-04-16 10:32 . 2013-04-16 10:32 157184 ----a-w- c:\windows\SysWow64\ff_unrar.dll 2013-04-16 10:32 . 2013-04-16 10:32 271360 ----a-w- c:\windows\SysWow64\TomsMoComp_ff.dll 2013-04-16 10:32 . 2013-04-16 10:32 99840 ----a-w- c:\windows\SysWow64\ff_wmv9.dll 2013-04-16 10:32 . 2013-04-16 10:32 211968 ----a-w- c:\windows\SysWow64\ff_libdts.dll 2013-04-16 10:32 . 2013-04-16 10:32 147456 ----a-w- c:\windows\SysWow64\ff_libmad.dll 2013-04-16 10:32 . 2013-04-16 10:32 1525760 ----a-w- c:\windows\SysWow64\ff_samplerate.dll 2013-04-16 10:32 . 2013-04-16 10:32 114688 ----a-w- c:\windows\SysWow64\ff_liba52.dll 2013-04-16 10:32 . 2013-04-16 10:32 136704 ----a-w- c:\windows\SysWow64\libmpeg2_ff.dll 2013-04-13 12:24 . 2013-04-13 12:24 1515520 ----a-w- c:\windows\system32\LAVVideo.ax 2013-04-13 12:24 . 2013-04-13 12:24 364720 ----a-w- c:\windows\system32\IntelQuickSyncDecoder.dll 2013-04-13 12:24 . 2013-04-13 12:24 509952 ----a-w- c:\windows\system32\LAVSplitter.ax 2013-04-13 12:24 . 2013-04-13 12:24 272384 ----a-w- c:\windows\system32\LAVAudio.ax 2013-04-13 12:24 . 2013-04-13 12:24 421600 ----a-w- c:\windows\system32\swscale-lav-2.dll 2013-04-13 12:24 . 2013-04-13 12:24 7977200 ----a-w- c:\windows\system32\avcodec-lav-55.dll 2013-04-13 12:24 . 2013-04-13 12:24 289008 ----a-w- c:\windows\system32\avutil-lav-52.dll 2013-04-13 12:24 . 2013-04-13 12:24 202648 ----a-w- c:\windows\system32\avfilter-lav-3.dll 2013-04-13 12:24 . 2013-04-13 12:24 194016 ----a-w- c:\windows\system32\avresample-lav-1.dll 2013-04-13 12:24 . 2013-04-13 12:24 1245920 ----a-w- c:\windows\system32\avformat-lav-55.dll 2013-04-13 12:23 . 2013-04-13 12:23 7788672 ----a-w- c:\windows\SysWow64\avcodec-lav-55.dll 2013-04-13 12:23 . 2013-04-13 12:23 424624 ----a-w- c:\windows\SysWow64\LAVSplitter.ax 2013-04-13 12:23 . 2013-04-13 12:23 400592 ----a-w- c:\windows\SysWow64\swscale-lav-2.dll 2013-04-13 12:23 . 2013-04-13 12:23 284336 ----a-w- c:\windows\SysWow64\IntelQuickSyncDecoder.dll 2013-04-13 12:23 . 2013-04-13 12:23 272192 ----a-w- c:\windows\SysWow64\avutil-lav-52.dll 2013-04-13 12:23 . 2013-04-13 12:23 244400 ----a-w- c:\windows\SysWow64\LAVAudio.ax 2013-04-13 12:23 . 2013-04-13 12:23 194632 ----a-w- c:\windows\SysWow64\avfilter-lav-3.dll 2013-04-13 12:23 . 2013-04-13 12:23 172728 ----a-w- c:\windows\SysWow64\avresample-lav-1.dll 2013-04-13 12:23 . 2013-04-13 12:23 1300152 ----a-w- c:\windows\SysWow64\avformat-lav-55.dll 2013-04-13 12:23 . 2013-04-13 12:23 1185456 ----a-w- c:\windows\SysWow64\LAVVideo.ax 2013-04-10 19:03 . 2013-03-01 03:36 3153408 ----a-w- c:\windows\system32\win32k.sys 2013-04-10 19:03 . 2013-01-24 06:01 223752 ----a-w- c:\windows\system32\drivers\fvevol.sys 2013-04-10 19:03 . 2013-03-19 06:04 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe 2013-04-10 19:03 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe 2013-04-10 19:03 . 2013-03-19 05:46 43520 ----a-w- c:\windows\system32\csrsrv.dll 2013-04-10 19:03 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe 2013-04-10 19:03 . 2013-03-19 04:47 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll 2013-04-10 19:03 . 2013-03-19 03:06 112640 ----a-w- c:\windows\system32\smss.exe . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-05-02 15:29 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe 2013-04-25 19:35 . 2012-04-24 16:35 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-04-25 19:35 . 2012-04-24 16:35 691592 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-04-11 07:02 . 2012-07-12 13:06 72702784 ----a-w- c:\windows\system32\MRT.exe 2013-03-16 04:32 . 2013-03-16 04:32 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe 2013-03-16 04:32 . 2013-03-16 04:32 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe 2013-03-16 04:32 . 2013-03-16 04:32 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll 2013-03-16 04:32 . 2013-03-16 04:32 61952 ----a-w- c:\windows\SysWow64\tdc.ocx 2013-03-16 04:32 . 2013-03-16 04:32 523264 ----a-w- c:\windows\SysWow64\vbscript.dll 2013-03-16 04:32 . 2013-03-16 04:32 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll 2013-03-16 04:32 . 2013-03-16 04:32 38400 ----a-w- c:\windows\SysWow64\imgutil.dll 2013-03-16 04:32 . 2013-03-16 04:32 361984 ----a-w- c:\windows\SysWow64\html.iec 2013-03-16 04:32 . 2013-03-16 04:32 226304 ----a-w- c:\windows\system32\elshyph.dll 2013-03-16 04:32 . 2013-03-16 04:32 185344 ----a-w- c:\windows\SysWow64\elshyph.dll 2013-03-16 04:32 . 2013-03-16 04:32 158720 ----a-w- c:\windows\SysWow64\msls31.dll 2013-03-16 04:32 . 2013-03-16 04:32 150528 ----a-w- c:\windows\SysWow64\iexpress.exe 2013-03-16 04:32 . 2013-03-16 04:32 138752 ----a-w- c:\windows\SysWow64\wextract.exe 2013-03-16 04:32 . 2013-03-16 04:32 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe 2013-03-16 04:32 . 2013-03-16 04:32 12800 ----a-w- c:\windows\SysWow64\mshta.exe 2013-03-16 04:32 . 2013-03-16 04:32 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll 2013-03-16 04:32 . 2013-03-16 04:32 97280 ----a-w- c:\windows\system32\mshtmled.dll 2013-03-16 04:32 . 2013-03-16 04:32 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll 2013-03-16 04:32 . 2013-03-16 04:32 81408 ----a-w- c:\windows\system32\icardie.dll 2013-03-16 04:32 . 2013-03-16 04:32 762368 ----a-w- c:\windows\system32\ieapfltr.dll 2013-03-16 04:32 . 2013-03-16 04:32 62976 ----a-w- c:\windows\system32\pngfilt.dll 2013-03-16 04:32 . 2013-03-16 04:32 599552 ----a-w- c:\windows\system32\vbscript.dll 2013-03-16 04:32 . 2013-03-16 04:32 52224 ----a-w- c:\windows\system32\msfeedsbs.dll 2013-03-16 04:32 . 2013-03-16 04:32 51200 ----a-w- c:\windows\system32\imgutil.dll 2013-03-16 04:32 . 2013-03-16 04:32 452096 ----a-w- c:\windows\system32\dxtmsft.dll 2013-03-16 04:32 . 2013-03-16 04:32 441856 ----a-w- c:\windows\system32\html.iec 2013-03-16 04:32 . 2013-03-16 04:32 281600 ----a-w- c:\windows\system32\dxtrans.dll 2013-03-16 04:32 . 2013-03-16 04:32 27648 ----a-w- c:\windows\system32\licmgr10.dll 2013-03-16 04:32 . 2013-03-16 04:32 270848 ----a-w- c:\windows\system32\iedkcs32.dll 2013-03-16 04:32 . 2013-03-16 04:32 247296 ----a-w- c:\windows\system32\webcheck.dll 2013-03-16 04:32 . 2013-03-16 04:32 235008 ----a-w- c:\windows\system32\url.dll 2013-03-16 04:32 . 2013-03-16 04:32 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll 2013-03-16 04:32 . 2013-03-16 04:32 216064 ----a-w- c:\windows\system32\msls31.dll 2013-03-16 04:32 . 2013-03-16 04:32 197120 ----a-w- c:\windows\system32\msrating.dll 2013-03-16 04:32 . 2013-03-16 04:32 173568 ----a-w- c:\windows\system32\ieUnatt.exe 2013-03-16 04:32 . 2013-03-16 04:32 167424 ----a-w- c:\windows\system32\iexpress.exe 2013-03-16 04:32 . 2013-03-16 04:32 1509376 ----a-w- c:\windows\system32\inetcpl.cpl 2013-03-16 04:32 . 2013-03-16 04:32 149504 ----a-w- c:\windows\system32\occache.dll 2013-03-16 04:32 . 2013-03-16 04:32 144896 ----a-w- c:\windows\system32\wextract.exe 2013-03-16 04:32 . 2013-03-16 04:32 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl 2013-03-16 04:32 . 2013-03-16 04:32 1400416 ----a-w- c:\windows\system32\ieapfltr.dat 2013-03-16 04:32 . 2013-03-16 04:32 13824 ----a-w- c:\windows\system32\mshta.exe 2013-03-16 04:32 . 2013-03-16 04:32 136192 ----a-w- c:\windows\system32\iepeers.dll 2013-03-16 04:32 . 2013-03-16 04:32 135680 ----a-w- c:\windows\system32\IEAdvpack.dll 2013-03-16 04:32 . 2013-03-16 04:32 12800 ----a-w- c:\windows\system32\msfeedssync.exe 2013-03-16 04:32 . 2013-03-16 04:32 102912 ----a-w- c:\windows\system32\inseng.dll 2013-03-16 04:32 . 2013-03-16 04:32 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe 2013-03-16 04:32 . 2013-03-16 04:32 77312 ----a-w- c:\windows\system32\tdc.ocx 2013-03-16 04:32 . 2013-03-16 04:32 48640 ----a-w- c:\windows\system32\mshtmler.dll 2013-03-08 17:39 . 2013-03-08 17:39 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2013-03-08 17:39 . 2012-08-29 15:56 861088 ----a-w- c:\windows\SysWow64\npdeployJava1.dll 2013-03-08 17:39 . 2012-08-29 15:56 782240 ----a-w- c:\windows\SysWow64\deployJava1.dll 2013-02-12 05:45 . 2013-03-12 22:52 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll 2013-02-12 05:45 . 2013-03-12 22:52 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll 2013-02-12 05:45 . 2013-03-12 22:52 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll 2013-02-12 05:45 . 2013-03-12 22:52 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll 2013-02-12 04:48 . 2013-03-12 22:52 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll 2013-02-12 04:48 . 2013-03-12 22:52 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll 2013-02-12 04:12 . 2013-03-15 12:14 19968 ----a-w- c:\windows\system32\drivers\usb8023.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HP Photosmart 6520 series (NET)"="c:\program files\HP\HP Photosmart 6520 series\Bin\ScanToPCActivationApp.exe" [2012-10-17 2573416] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X] "IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2011-11-30 284440] "USB3MON"="c:\program files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-02-17 291608] "ShwiconXP9106"="c:\program files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe" [2010-03-10 237568] "Dell Registration"="c:\program files (x86)\System Registration\prodreg.exe" [2011-08-04 4165440] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2012-12-18 38112] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352] "Lachesis"="c:\program files (x86)\Razer\Lachesis\razerhid.exe" [2007-09-12 172032] "Tarantula"="c:\program files (x86)\Razer\Tarantula\razerhid.exe" [2006-09-30 176128] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720] "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-08-06 642216] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888] "HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-18 152392] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] . c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ CurseClientStartup.ccip [2012-8-29 0] Monitor Ink Alerts - HP Photosmart 6520 series (Network).lnk - c:\windows\system32\RunDll32.exe [2009-7-13 45568] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ CodecPackTrayMenu.lnk - c:\windows\SysWOW64\C2MP\TrayMenu.exe [2013-3-19 704008] CodecPackUpdateChecker.lnk - c:\windows\SysWOW64\C2MP\UpdateChecker.exe [2013-3-21 46848] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944] R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [x] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360] R3 pmxdrv;pmxdrv;c:\windows\system32\drivers\pmxdrv.sys [2013-01-12 31152] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-07-10 1255736] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S0 iusb3hcs;Intel® USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys [2012-01-27 16152] S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-17 98208] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-07-28 239616] S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe [2011-12-29 106144] S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624] S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-11-30 13592] S2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe [2012-01-11 627936] S2 Intel® ME Service;Intel® ME Service;c:\program files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [2012-01-21 128280] S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776] S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2012-02-16 1695040] S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2012-01-21 363800] S2 ZAtheros Wlan Agent;ZAtheros Wlan Agent;c:\program files (x86)\Dell Wireless\Ath_WlanAgent.exe [2011-12-27 76960] S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2011-12-29 36000] S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-05-14 96896] S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2011-12-29 338592] S3 btath_avdt;Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys [2011-12-29 110752] S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2011-12-29 30368] S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [2011-12-29 167584] S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2011-12-29 68256] S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [2011-12-29 280992] S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2011-12-29 548000] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2011-12-06 331264] S3 iusb3hub;Intel® USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys [2012-01-27 356120] S3 iusb3xhc;Intel® USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys [2012-01-27 787736] S3 PCDSRVC{1E208CE0-FB7451FF-06020200}_0;PCDSRVC{1E208CE0-FB7451FF-06020200}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc_x64.pkms [2012-11-26 25584] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-11-24 648808] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496] S3 VaneFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys [2007-08-17 30336] . . Contents of the 'Scheduled Tasks' folder . 2013-05-09 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-24 19:35] . 2013-05-09 c:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job - c:\program files (x86)\Intel\Intel® ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25 18:41] . 2013-05-06 c:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job - c:\program files (x86)\Intel\Intel® ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25 18:41] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AtherosBtStack"="c:\program files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe" [2011-12-29 1014432] "AthBtTray"="c:\program files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe" [2011-12-29 800416] "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-12-23 6457960] "RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-11-16 1156712] . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService FontCache . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.yahoo.com/ mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local;192.168.*.* IE: Download with &Shareaza - c:\program files\Shareaza\RazaWebHook64.dll/3000 TCP: DhcpNameServer = 10.0.0.1 . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Wow6432Node-HKLM-Run-<NO NAME> - (no file) HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start Toolbar-Locked - (no file) HKLM-Run-MSC - c:\program files\Microsoft Security Client\mssecex.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCDSRVC{1E208CE0-FB7451FF-06020200}_0] "ImagePath"="\??\c:\program files\dell support center\pcdsrvc_x64.pkms" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2013-05-08 21:34:12 ComboFix-quarantined-files.txt 2013-05-09 01:34 . Pre-Run: 692,620,079,104 bytes free Post-Run: 694,148,902,912 bytes free . - - End Of File - - 1F63FC02EA27A7EC5B9638DA342E6F3A

I ran it FRST64 again and clicked "Fix" with the fixlist.txt you gave me. Computer has booted up in normal mode now, but background is all black Windows Firewall is blocking something with my printer. I have literally not touched anything yet, awaiting next step. Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 08-05-2013 Ran by SYSTEM at 2013-05-08 20:53:59 Run:1 Running from H:\ Boot Mode: Recovery ============================================== HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value was restored successfully. HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default => Value was restored successfully. C:\Users\Owner\AppData\Local\ztfriln.fdp => Moved successfully. C:\Users\Owner\Local Settings\ztfriln.fdp => File/Directory not found. C:\Users\Owner\Local Settings\Application Data\ztfriln.fdp => File/Directory not found. C:\ProgramData\pqmxqchx.fmf => Moved successfully. C:\ProgramData\Application Data\pqmxqchx.fmf => File/Directory not found. ==== End of Fixlog ====

Sorry it took so long to get back, hard to find computer access without another computer. Anyway, I think this is what I'm supposed to provide. Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-05-2013 Ran by SYSTEM on 08-05-2013 20:28:42 Running from H:\ Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US) Internet Explorer Version 9 Boot Mode: Recovery The current controlset is ControlSet001 ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log. ==================== Registry (Whitelisted) ================== HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\mssecex.exe" -hide -runkey [x] HKLM\...\Run: [AtherosBtStack] "C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe" [1014432 2011-12-29] (Atheros Commnucations) HKLM\...\Run: [AthBtTray] "C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe" [800416 2011-12-29] (Atheros Commnucations) HKLM\...\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s [6457960 2011-12-23] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /MAXX4 [1156712 2011-11-15] (Realtek Semiconductor) HKLM\...\Winlogon: [shell] regsvr32 /n /i /s "C:\Users\Owner\AppData\Local\ztfriln.fdp" [x ] () HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] ATTENTION! ====> ZeroAccess HKLM-x32\...\Run: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation) HKLM-x32\...\Run: [uSB3MON] "C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [291608 2012-02-16] (Intel Corporation) HKLM-x32\...\Run: [shwiconXP9106] C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe [237568 2010-03-10] (Alcor Micro Corp.) HKLM-x32\...\Run: [Dell Registration] C:\Program Files (x86)\System Registration\prodreg.exe /boot [4165440 2011-08-04] (Dell, Inc.) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [38112 2012-12-18] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [946352 2012-12-02] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Lachesis] C:\Program Files (x86)\Razer\Lachesis\razerhid.exe [172032 2007-09-12] () HKLM-x32\...\Run: [Tarantula] C:\Program Files (x86)\Razer\Tarantula\razerhid.exe [176128 2006-09-30] () HKLM-x32\...\Run: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml [20992 2012-03-19] () HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-01-28] (Apple Inc.) HKLM-x32\...\Run: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [642216 2012-08-06] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.) HKLM-x32\...\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard) HKLM-x32\...\Run: [] [x] HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-02-18] (Apple Inc.) HKLM-x32\...\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.) HKU\Owner\...\Run: [HP Photosmart 6520 series (NET)] "C:\Program Files\HP\HP Photosmart 6520 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN291151TM05TZ:NW" -scfn "HP Photosmart 6520 series (NET)" -AutoStart 1 [2573416 2012-10-17] (Hewlett-Packard Co.) Startup: C:\ProgramData\Start Menu\Programs\Startup\CodecPackTrayMenu.lnk ShortcutTarget: CodecPackTrayMenu.lnk -> C:\Windows\SysWOW64\C2MP\TrayMenu.exe () Startup: C:\ProgramData\Start Menu\Programs\Startup\CodecPackUpdateChecker.lnk ShortcutTarget: CodecPackUpdateChecker.lnk -> C:\Windows\SysWOW64\C2MP\UpdateChecker.exe () Startup: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip () Startup: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Photosmart 6520 series (Network).lnk ShortcutTarget: Monitor Ink Alerts - HP Photosmart 6520 series (Network).lnk -> C:\Program Files\HP\HP Photosmart 6520 series\bin\HPStatusBL.dll (Hewlett-Packard Co.) ==================== Services (Whitelisted) ================= S2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [109352 2013-05-07] (SurfRight B.V.) S2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [128280 2012-01-21] () S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22056 2013-01-27] (Microsoft Corporation) S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [379360 2013-01-27] (Microsoft Corporation) S2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2012-12-04] () S2 ZAtheros Wlan Agent; C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe [76960 2011-12-26] (Atheros) ==================== Drivers (Whitelisted) ==================== S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [230320 2013-01-20] (Microsoft Corporation) S2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [130008 2013-01-20] (Microsoft Corporation) S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2013-01-12] () S3 VaneFltr; C:\Windows\System32\drivers\Lachesis.sys [30336 2007-08-17] (Razer (Asia-Pacific) Pte Ltd) S3 motandroidusb; System32\Drivers\motoandroid.sys [x] S3 PCDSRVC{1E208CE0-FB7451FF-06020200}_0; \??\c:\program files\dell support center\pcdsrvc_x64.pkms [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-05-07 12:52 - 2013-05-07 12:52 - 00000000 ____D C:\FRST 2013-05-07 12:12 - 2013-05-07 12:12 - 00012872 ____A (SurfRight B.V.) C:\Windows\System32\bootdelete.exe 2013-05-07 12:06 - 2013-05-07 12:20 - 00001823 ____A C:\Users\Public\Desktop\HitmanPro.lnk 2013-05-07 12:06 - 2013-05-07 12:20 - 00001823 ____A C:\ProgramData\Desktop\HitmanPro.lnk 2013-05-07 12:06 - 2013-05-07 12:12 - 00000000 ____D C:\ProgramData\HitmanPro 2013-05-07 12:06 - 2013-05-07 12:12 - 00000000 ____D C:\ProgramData\Application Data\HitmanPro 2013-05-07 12:06 - 2013-05-07 12:06 - 00000000 ____D C:\Program Files\HitmanPro 2013-05-07 07:04 - 2013-05-07 07:04 - 00055808 ____A C:\Users\Owner\Local Settings\ztfriln.fdp 2013-05-07 07:04 - 2013-05-07 07:04 - 00055808 ____A C:\Users\Owner\Local Settings\Application Data\ztfriln.fdp 2013-05-07 07:04 - 2013-05-07 07:04 - 00055808 ____A C:\Users\Owner\AppData\Local\ztfriln.fdp 2013-05-07 07:04 - 2013-05-07 07:04 - 00055808 ____A C:\ProgramData\pqmxqchx.fmf 2013-05-07 07:04 - 2013-05-07 07:04 - 00055808 ____A C:\ProgramData\Application Data\pqmxqchx.fmf 2013-05-05 16:31 - 2013-05-04 18:30 - 735027200 ____A C:\Users\Owner\Desktop\28 Days Later.avi 2013-04-24 13:51 - 2013-04-12 06:45 - 01656680 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys 2013-04-18 14:38 - 2013-04-18 14:38 - 00039904 ____A C:\Windows\SysWOW64\Media Player - Codec Pack Disc handler.exe 2013-04-18 14:38 - 2013-04-18 14:38 - 00039904 ____A C:\Windows\SysWOW64\dischandler.exe 2013-04-16 13:34 - 2013-04-16 13:34 - 00000000 ____D C:\Windows\SysWOW64\C2MP 2013-04-16 13:28 - 2013-04-16 13:28 - 00000000 ____D C:\ProgramData\Windows Genuine Advantage 2013-04-16 13:28 - 2013-04-16 13:28 - 00000000 ____D C:\ProgramData\Application Data\Windows Genuine Advantage 2013-04-16 02:40 - 2013-04-16 02:40 - 04012544 ____A C:\Windows\System32\ffmpeg.dll 2013-04-16 02:39 - 2013-04-16 02:39 - 04372992 ____A C:\Windows\System32\ffdshow.ax 2013-04-16 02:39 - 2013-04-16 02:39 - 00127488 ____A C:\Windows\System32\ff_vfw.dll 2013-04-16 02:38 - 2013-04-16 02:38 - 00474624 ____A C:\Windows\System32\ff_kernelDeint.dll 2013-04-16 02:37 - 2013-04-16 02:37 - 01532928 ____A C:\Windows\System32\ff_samplerate.dll 2013-04-16 02:37 - 2013-04-16 02:37 - 00631296 ____A C:\Windows\System32\TomsMoComp_ff.dll 2013-04-16 02:37 - 2013-04-16 02:37 - 00222720 ____A C:\Windows\System32\ff_libdts.dll 2013-04-16 02:37 - 2013-04-16 02:37 - 00190464 ____A C:\Windows\System32\libmpeg2_ff.dll 2013-04-16 02:37 - 2013-04-16 02:37 - 00183296 ____A C:\Windows\System32\ff_unrar.dll 2013-04-16 02:37 - 2013-04-16 02:37 - 00156672 ____A C:\Windows\System32\ff_libmad.dll 2013-04-16 02:37 - 2013-04-16 02:37 - 00116224 ____A C:\Windows\System32\ff_liba52.dll 2013-04-16 02:37 - 2013-04-16 02:37 - 00114688 ____A C:\Windows\System32\ff_wmv9.dll 2013-04-16 02:35 - 2013-04-16 02:35 - 03915776 ____A C:\Windows\SysWOW64\ffmpeg.dll 2013-04-16 02:33 - 2013-04-16 02:33 - 03501568 ____A C:\Windows\SysWOW64\ffdshow.ax 2013-04-16 02:33 - 2013-04-16 02:33 - 00112640 ____A C:\Windows\SysWOW64\ff_vfw.dll 2013-04-16 02:32 - 2013-04-16 02:32 - 01525760 ____A C:\Windows\SysWOW64\ff_samplerate.dll 2013-04-16 02:32 - 2013-04-16 02:32 - 00271360 ____A C:\Windows\SysWOW64\TomsMoComp_ff.dll 2013-04-16 02:32 - 2013-04-16 02:32 - 00211968 ____A C:\Windows\SysWOW64\ff_libdts.dll 2013-04-16 02:32 - 2013-04-16 02:32 - 00157184 ____A C:\Windows\SysWOW64\ff_unrar.dll 2013-04-16 02:32 - 2013-04-16 02:32 - 00147456 ____A C:\Windows\SysWOW64\ff_libmad.dll 2013-04-16 02:32 - 2013-04-16 02:32 - 00136704 ____A C:\Windows\SysWOW64\libmpeg2_ff.dll 2013-04-16 02:32 - 2013-04-16 02:32 - 00114688 ____A C:\Windows\SysWOW64\ff_liba52.dll 2013-04-16 02:32 - 2013-04-16 02:32 - 00099840 ____A C:\Windows\SysWOW64\ff_wmv9.dll 2013-04-13 04:24 - 2013-04-13 04:24 - 07977200 ____A C:\Windows\System32\avcodec-lav-55.dll 2013-04-13 04:24 - 2013-04-13 04:24 - 01515520 ____A (1f0.de - Hendrik Leppkes) C:\Windows\System32\LAVVideo.ax 2013-04-13 04:24 - 2013-04-13 04:24 - 01245920 ____A C:\Windows\System32\avformat-lav-55.dll 2013-04-13 04:24 - 2013-04-13 04:24 - 00509952 ____A (1f0.de - Hendrik Leppkes) C:\Windows\System32\LAVSplitter.ax 2013-04-13 04:24 - 2013-04-13 04:24 - 00421600 ____A C:\Windows\System32\swscale-lav-2.dll 2013-04-13 04:24 - 2013-04-13 04:24 - 00364720 ____A (Intel Corp.) C:\Windows\System32\IntelQuickSyncDecoder.dll 2013-04-13 04:24 - 2013-04-13 04:24 - 00289008 ____A C:\Windows\System32\avutil-lav-52.dll 2013-04-13 04:24 - 2013-04-13 04:24 - 00272384 ____A (1f0.de - Hendrik Leppkes) C:\Windows\System32\LAVAudio.ax 2013-04-13 04:24 - 2013-04-13 04:24 - 00202648 ____A C:\Windows\System32\avfilter-lav-3.dll 2013-04-13 04:24 - 2013-04-13 04:24 - 00194016 ____A C:\Windows\System32\avresample-lav-1.dll 2013-04-13 04:23 - 2013-04-13 04:23 - 07788672 ____A C:\Windows\SysWOW64\avcodec-lav-55.dll 2013-04-13 04:23 - 2013-04-13 04:23 - 01300152 ____A C:\Windows\SysWOW64\avformat-lav-55.dll 2013-04-13 04:23 - 2013-04-13 04:23 - 01185456 ____A (1f0.de - Hendrik Leppkes) C:\Windows\SysWOW64\LAVVideo.ax 2013-04-13 04:23 - 2013-04-13 04:23 - 00424624 ____A (1f0.de - Hendrik Leppkes) C:\Windows\SysWOW64\LAVSplitter.ax 2013-04-13 04:23 - 2013-04-13 04:23 - 00400592 ____A C:\Windows\SysWOW64\swscale-lav-2.dll 2013-04-13 04:23 - 2013-04-13 04:23 - 00284336 ____A (Intel Corp.) C:\Windows\SysWOW64\IntelQuickSyncDecoder.dll 2013-04-13 04:23 - 2013-04-13 04:23 - 00272192 ____A C:\Windows\SysWOW64\avutil-lav-52.dll 2013-04-13 04:23 - 2013-04-13 04:23 - 00244400 ____A (1f0.de - Hendrik Leppkes) C:\Windows\SysWOW64\LAVAudio.ax 2013-04-13 04:23 - 2013-04-13 04:23 - 00194632 ____A C:\Windows\SysWOW64\avfilter-lav-3.dll 2013-04-13 04:23 - 2013-04-13 04:23 - 00172728 ____A C:\Windows\SysWOW64\avresample-lav-1.dll 2013-04-10 23:01 - 2013-02-21 02:30 - 01766912 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-04-10 23:01 - 2013-02-21 02:30 - 01129984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-04-10 23:01 - 2013-02-21 02:29 - 14323200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-04-10 23:01 - 2013-02-21 02:29 - 13761024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-04-10 23:01 - 2013-02-21 02:29 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-04-10 23:01 - 2013-02-21 02:29 - 02046464 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-04-10 23:01 - 2013-02-21 02:29 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-04-10 23:01 - 2013-02-21 02:29 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-04-10 23:01 - 2013-02-21 02:29 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-04-10 23:01 - 2013-02-21 02:29 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-04-10 23:01 - 2013-02-21 02:29 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-04-10 23:01 - 2013-02-21 02:29 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-04-10 23:01 - 2013-02-21 02:29 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-04-10 23:01 - 2013-02-21 02:15 - 02240512 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2013-04-10 23:01 - 2013-02-21 02:15 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe 2013-04-10 23:01 - 2013-02-21 02:14 - 19230208 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2013-04-10 23:01 - 2013-02-21 02:14 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2013-04-10 23:01 - 2013-02-21 02:14 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2013-04-10 23:01 - 2013-02-21 02:14 - 02647040 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2013-04-10 23:01 - 2013-02-21 02:14 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2013-04-10 23:01 - 2013-02-21 02:14 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2013-04-10 23:01 - 2013-02-21 02:14 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2013-04-10 23:01 - 2013-02-21 02:14 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2013-04-10 23:01 - 2013-02-21 02:14 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll 2013-04-10 23:01 - 2013-02-21 02:14 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll 2013-04-10 23:01 - 2013-02-21 02:14 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2013-04-10 23:01 - 2013-02-21 02:14 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll 2013-04-10 23:01 - 2013-02-19 04:01 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-04-10 23:01 - 2013-02-19 03:42 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2013-04-10 23:01 - 2013-02-19 03:10 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-04-10 23:01 - 2013-02-19 02:51 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe 2013-04-10 11:03 - 2013-03-18 22:04 - 05550424 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe 2013-04-10 11:03 - 2013-03-18 21:46 - 00043520 ____A (Microsoft Corporation) C:\Windows\System32\csrsrv.dll 2013-04-10 11:03 - 2013-03-18 21:04 - 03968856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2013-04-10 11:03 - 2013-03-18 21:04 - 03913560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2013-04-10 11:03 - 2013-03-18 20:47 - 00006656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll 2013-04-10 11:03 - 2013-03-18 19:06 - 00112640 ____A (Microsoft Corporation) C:\Windows\System32\smss.exe 2013-04-10 11:03 - 2013-02-28 19:36 - 03153408 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2013-04-10 11:03 - 2013-01-23 22:01 - 00223752 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\fvevol.sys ==================== One Month Modified Files and Folders ======= 2013-05-07 13:35 - 2012-04-24 08:54 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup 2013-05-07 13:35 - 2012-04-24 08:49 - 00000828 ____A C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job 2013-05-07 13:35 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2013-05-07 13:35 - 2009-07-13 20:51 - 00142845 ____A C:\Windows\setupact.log 2013-05-07 12:52 - 2013-05-07 12:52 - 00000000 ____D C:\FRST 2013-05-07 12:31 - 2012-04-24 08:34 - 01879788 ____A C:\Windows\WindowsUpdate.log 2013-05-07 12:27 - 2009-07-13 20:45 - 00021296 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-05-07 12:27 - 2009-07-13 20:45 - 00021296 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-05-07 12:26 - 2012-04-24 08:35 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-05-07 12:25 - 2009-07-13 21:13 - 00779788 ____A C:\Windows\System32\PerfStringBackup.INI 2013-05-07 12:20 - 2013-05-07 12:06 - 00001823 ____A C:\Users\Public\Desktop\HitmanPro.lnk 2013-05-07 12:20 - 2013-05-07 12:06 - 00001823 ____A C:\ProgramData\Desktop\HitmanPro.lnk 2013-05-07 12:20 - 2012-04-24 09:06 - 00000000 ____D C:\Users\Default\Local Settings\SoftThinks 2013-05-07 12:20 - 2012-04-24 09:06 - 00000000 ____D C:\Users\Default\Local Settings\Application Data\SoftThinks 2013-05-07 12:20 - 2012-04-24 09:06 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks 2013-05-07 12:20 - 2012-04-24 09:06 - 00000000 ____D C:\Users\Default User\Local Settings\SoftThinks 2013-05-07 12:20 - 2012-04-24 09:06 - 00000000 ____D C:\Users\Default User\Local Settings\Application Data\SoftThinks 2013-05-07 12:20 - 2012-04-24 09:06 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks 2013-05-07 12:12 - 2013-05-07 12:12 - 00012872 ____A (SurfRight B.V.) C:\Windows\System32\bootdelete.exe 2013-05-07 12:12 - 2013-05-07 12:06 - 00000000 ____D C:\ProgramData\HitmanPro 2013-05-07 12:12 - 2013-05-07 12:06 - 00000000 ____D C:\ProgramData\Application Data\HitmanPro 2013-05-07 12:06 - 2013-05-07 12:06 - 00000000 ____D C:\Program Files\HitmanPro 2013-05-07 08:10 - 2012-07-09 11:25 - 00000000 ____D C:\users\Owner 2013-05-07 07:04 - 2013-05-07 07:04 - 00055808 ____A C:\Users\Owner\Local Settings\ztfriln.fdp 2013-05-07 07:04 - 2013-05-07 07:04 - 00055808 ____A C:\Users\Owner\Local Settings\Application Data\ztfriln.fdp 2013-05-07 07:04 - 2013-05-07 07:04 - 00055808 ____A C:\Users\Owner\AppData\Local\ztfriln.fdp 2013-05-07 07:04 - 2013-05-07 07:04 - 00055808 ____A C:\ProgramData\pqmxqchx.fmf 2013-05-07 07:04 - 2013-05-07 07:04 - 00055808 ____A C:\ProgramData\Application Data\pqmxqchx.fmf 2013-05-07 06:54 - 2012-08-29 19:26 - 00000000 ____D C:\Users\Owner\Local Settings\Deployment 2013-05-07 06:54 - 2012-08-29 19:26 - 00000000 ____D C:\Users\Owner\Local Settings\Application Data\Deployment 2013-05-07 06:54 - 2012-08-29 19:26 - 00000000 ____D C:\Users\Owner\AppData\Local\Deployment 2013-05-06 11:55 - 2012-04-24 08:49 - 00000830 ____A C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job 2013-05-04 18:30 - 2013-05-05 16:31 - 735027200 ____A C:\Users\Owner\Desktop\28 Days Later.avi 2013-05-02 07:29 - 2010-11-20 19:27 - 00278800 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe 2013-04-30 06:28 - 2012-07-09 15:05 - 00000000 ____D C:\Program Files (x86)\Steam 2013-04-25 11:35 - 2012-04-24 09:03 - 00000000 ____D C:\ProgramData\Application Data\Adobe 2013-04-25 11:35 - 2012-04-24 09:03 - 00000000 ____D C:\ProgramData\Adobe 2013-04-25 11:35 - 2012-04-24 08:35 - 00691592 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-04-25 11:35 - 2012-04-24 08:35 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-04-24 23:17 - 2012-07-11 20:04 - 00000000 ____D C:\Users\Owner\Local Settings\CrashDumps 2013-04-24 23:17 - 2012-07-11 20:04 - 00000000 ____D C:\Users\Owner\Local Settings\Application Data\CrashDumps 2013-04-24 23:17 - 2012-07-11 20:04 - 00000000 ____D C:\Users\Owner\AppData\Local\CrashDumps 2013-04-18 14:38 - 2013-04-18 14:38 - 00039904 ____A C:\Windows\SysWOW64\Media Player - Codec Pack Disc handler.exe 2013-04-18 14:38 - 2013-04-18 14:38 - 00039904 ____A C:\Windows\SysWOW64\dischandler.exe 2013-04-16 13:34 - 2013-04-16 13:34 - 00000000 ____D C:\Windows\SysWOW64\C2MP 2013-04-16 13:28 - 2013-04-16 13:28 - 00000000 ____D C:\ProgramData\Windows Genuine Advantage 2013-04-16 13:28 - 2013-04-16 13:28 - 00000000 ____D C:\ProgramData\Application Data\Windows Genuine Advantage 2013-04-16 02:40 - 2013-04-16 02:40 - 04012544 ____A C:\Windows\System32\ffmpeg.dll 2013-04-16 02:39 - 2013-04-16 02:39 - 04372992 ____A C:\Windows\System32\ffdshow.ax 2013-04-16 02:39 - 2013-04-16 02:39 - 00127488 ____A C:\Windows\System32\ff_vfw.dll 2013-04-16 02:38 - 2013-04-16 02:38 - 00474624 ____A C:\Windows\System32\ff_kernelDeint.dll 2013-04-16 02:37 - 2013-04-16 02:37 - 01532928 ____A C:\Windows\System32\ff_samplerate.dll 2013-04-16 02:37 - 2013-04-16 02:37 - 00631296 ____A C:\Windows\System32\TomsMoComp_ff.dll 2013-04-16 02:37 - 2013-04-16 02:37 - 00222720 ____A C:\Windows\System32\ff_libdts.dll 2013-04-16 02:37 - 2013-04-16 02:37 - 00190464 ____A C:\Windows\System32\libmpeg2_ff.dll 2013-04-16 02:37 - 2013-04-16 02:37 - 00183296 ____A C:\Windows\System32\ff_unrar.dll 2013-04-16 02:37 - 2013-04-16 02:37 - 00156672 ____A C:\Windows\System32\ff_libmad.dll 2013-04-16 02:37 - 2013-04-16 02:37 - 00116224 ____A C:\Windows\System32\ff_liba52.dll 2013-04-16 02:37 - 2013-04-16 02:37 - 00114688 ____A C:\Windows\System32\ff_wmv9.dll 2013-04-16 02:35 - 2013-04-16 02:35 - 03915776 ____A C:\Windows\SysWOW64\ffmpeg.dll 2013-04-16 02:33 - 2013-04-16 02:33 - 03501568 ____A C:\Windows\SysWOW64\ffdshow.ax 2013-04-16 02:33 - 2013-04-16 02:33 - 00112640 ____A C:\Windows\SysWOW64\ff_vfw.dll 2013-04-16 02:32 - 2013-04-16 02:32 - 01525760 ____A C:\Windows\SysWOW64\ff_samplerate.dll 2013-04-16 02:32 - 2013-04-16 02:32 - 00271360 ____A C:\Windows\SysWOW64\TomsMoComp_ff.dll 2013-04-16 02:32 - 2013-04-16 02:32 - 00211968 ____A C:\Windows\SysWOW64\ff_libdts.dll 2013-04-16 02:32 - 2013-04-16 02:32 - 00157184 ____A C:\Windows\SysWOW64\ff_unrar.dll 2013-04-16 02:32 - 2013-04-16 02:32 - 00147456 ____A C:\Windows\SysWOW64\ff_libmad.dll 2013-04-16 02:32 - 2013-04-16 02:32 - 00136704 ____A C:\Windows\SysWOW64\libmpeg2_ff.dll 2013-04-16 02:32 - 2013-04-16 02:32 - 00114688 ____A C:\Windows\SysWOW64\ff_liba52.dll 2013-04-16 02:32 - 2013-04-16 02:32 - 00099840 ____A C:\Windows\SysWOW64\ff_wmv9.dll 2013-04-13 04:24 - 2013-04-13 04:24 - 07977200 ____A C:\Windows\System32\avcodec-lav-55.dll 2013-04-13 04:24 - 2013-04-13 04:24 - 01515520 ____A (1f0.de - Hendrik Leppkes) C:\Windows\System32\LAVVideo.ax 2013-04-13 04:24 - 2013-04-13 04:24 - 01245920 ____A C:\Windows\System32\avformat-lav-55.dll 2013-04-13 04:24 - 2013-04-13 04:24 - 00509952 ____A (1f0.de - Hendrik Leppkes) C:\Windows\System32\LAVSplitter.ax 2013-04-13 04:24 - 2013-04-13 04:24 - 00421600 ____A C:\Windows\System32\swscale-lav-2.dll 2013-04-13 04:24 - 2013-04-13 04:24 - 00364720 ____A (Intel Corp.) C:\Windows\System32\IntelQuickSyncDecoder.dll 2013-04-13 04:24 - 2013-04-13 04:24 - 00289008 ____A C:\Windows\System32\avutil-lav-52.dll 2013-04-13 04:24 - 2013-04-13 04:24 - 00272384 ____A (1f0.de - Hendrik Leppkes) C:\Windows\System32\LAVAudio.ax 2013-04-13 04:24 - 2013-04-13 04:24 - 00202648 ____A C:\Windows\System32\avfilter-lav-3.dll 2013-04-13 04:24 - 2013-04-13 04:24 - 00194016 ____A C:\Windows\System32\avresample-lav-1.dll 2013-04-13 04:23 - 2013-04-13 04:23 - 07788672 ____A C:\Windows\SysWOW64\avcodec-lav-55.dll 2013-04-13 04:23 - 2013-04-13 04:23 - 01300152 ____A C:\Windows\SysWOW64\avformat-lav-55.dll 2013-04-13 04:23 - 2013-04-13 04:23 - 01185456 ____A (1f0.de - Hendrik Leppkes) C:\Windows\SysWOW64\LAVVideo.ax 2013-04-13 04:23 - 2013-04-13 04:23 - 00424624 ____A (1f0.de - Hendrik Leppkes) C:\Windows\SysWOW64\LAVSplitter.ax 2013-04-13 04:23 - 2013-04-13 04:23 - 00400592 ____A C:\Windows\SysWOW64\swscale-lav-2.dll 2013-04-13 04:23 - 2013-04-13 04:23 - 00284336 ____A (Intel Corp.) C:\Windows\SysWOW64\IntelQuickSyncDecoder.dll 2013-04-13 04:23 - 2013-04-13 04:23 - 00272192 ____A C:\Windows\SysWOW64\avutil-lav-52.dll 2013-04-13 04:23 - 2013-04-13 04:23 - 00244400 ____A (1f0.de - Hendrik Leppkes) C:\Windows\SysWOW64\LAVAudio.ax 2013-04-13 04:23 - 2013-04-13 04:23 - 00194632 ____A C:\Windows\SysWOW64\avfilter-lav-3.dll 2013-04-13 04:23 - 2013-04-13 04:23 - 00172728 ____A C:\Windows\SysWOW64\avresample-lav-1.dll 2013-04-12 06:45 - 2013-04-24 13:51 - 01656680 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys 2013-04-10 23:25 - 2009-07-13 20:45 - 00275712 ____A C:\Windows\System32\FNTCACHE.DAT 2013-04-10 23:02 - 2012-07-12 05:06 - 72702784 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe 2013-04-09 15:00 - 2012-07-09 17:01 - 00000000 ____D C:\Program Files (x86)\World of Warcraft ==================== Known DLLs (Whitelisted) ================ ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= Restore point made on: 2013-04-21 07:57:01 Restore point made on: 2013-04-24 13:50:17 Restore point made on: 2013-04-24 23:00:24 Restore point made on: 2013-04-28 02:55:23 Restore point made on: 2013-05-01 04:23:49 Restore point made on: 2013-05-04 09:57:26 ==================== Memory info =========================== Percentage of memory in use: 9% Total physical RAM: 8152.96 MB Available physical RAM: 7356.33 MB Total Pagefile: 8151.16 MB Available Pagefile: 7345.66 MB Total Virtual: 8192 MB Available Virtual: 8191.88 MB ==================== Drives ================================ Drive c: (OS) (Fixed) (Total:919.22 GB) (Free:645.45 GB) NTFS (Disk=0 Partition=3) Drive h: (USB20FD) (Removable) (Total:14.74 GB) (Free:14.74 GB) FAT32 (Disk=1 Partition=1) Drive i: (RECOVERY) (Fixed) (Total:12.25 GB) (Free:5.06 GB) NTFS (Disk=0 Partition=2) ==>[system with boot components (obtained from reading drive)] Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows Vista) (Size: 932 GB) (Disk ID: 9A8CC90F) Partition 1: (Not Active) - (Size=39 MB) - (Type=DE) Partition 2: (Active) - (Size=12 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=919 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 15 GB) (Disk ID: 9E16F1CA) Partition 1: (Not Active) - (Size=15 GB) - (Type=0B) Last Boot: 2013-05-04 07:38 ==================== End Of Log ============================

I woke up this morning to the famed FBI Moneypak virus/malware on my computer and am completely beat. I have spent the day exploring every option I could find and none work. All 3 safe modes are blocked and I also tried using HitmanPro Kickstart. It opened and scanned as advertised. It restarted my computer as advertised. And the virus was still going full force with no change, not as advertised. I really don't know what else to do, aside from a complete system wipe and restore, which I don't want to do. I'm running Windows 7 64-bit and really need some help, this virus/malware is kicking my butt!