Jump to content

bipster10

Members
  • Posts

    14
  • Joined

  • Last visited

Everything posted by bipster10

  1. I want to thank you again for all of your help. One more question I have is do you have any guides on how to reformat computers? It is a windows 7 hp and I do not have any of the cd's. I feel like my computer may need to be reformatted pretty soon.
  2. Results of screen317's Security Check version 0.99.71 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! AVG Anti-Virus Free Edition 2011 Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware version 1.70.0.1100 Out of date Malwarebytes Anti-Malware installed! CCleaner Java 6 Update 21 Java version out of Date! Adobe Flash Player 11.7.700.224 Adobe Reader XI Mozilla Firefox (22.0) ````````Process Check: objlist.exe by Laurent```````` AVG avgwdsvc.exe AVG avgtray.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 0% ````````````````````End of Log``````````````````````
  3. It seems to be running fine. Thanks again for all of your help! Here is the log for AdwCleaner. # AdwCleaner v2.301 - Logfile created 07/30/2013 at 14:53:19# Updated 16/05/2013 by Xplode# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)# User : Owner - SHREDFEST# Boot Mode : Normal# Running from : C:\Users\Owner\Desktop\adwcleaner.exe# Option [search] ***** [services] ***** ***** [Files / Folders] ***** ***** [Registry] ***** ***** [internet Browsers] ***** -\\ Internet Explorer v10.0.9200.16635 [OK] Registry is clean. -\\ Mozilla Firefox v22.0 (en-US) File : C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\ukzgnjr5.default\prefs.js [OK] File is clean. ************************* AdwCleaner[R1].txt - [10417 octets] - [17/05/2013 13:49:02]AdwCleaner[R2].txt - [10478 octets] - [17/05/2013 13:52:39]AdwCleaner[R3].txt - [10539 octets] - [17/05/2013 13:54:58]AdwCleaner[R4].txt - [852 octets] - [30/07/2013 14:53:19]AdwCleaner[s1].txt - [10788 octets] - [17/05/2013 14:13:50] ########## EOF - C:\AdwCleaner[R4].txt - [972 octets] ##########
  4. Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-05-2013 Ran by SYSTEM at 2013-07-30 14:13:43 Run:2 Running from G:\ Boot Mode: Recovery ============================================== HKEY_USERS\Owner\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully. C:\Users\Owner\AppData\Roaming\skype.dat => Moved successfully. C:\Users\Owner\AppData\Roaming\skype.ini => Moved successfully. ==== End of Fixlog == the two mbar logs are attached mbar-log-2013-07-30 (14-25-15).txt system-log.txt
  5. Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-05-2013 (ATTENTION: FRST version is 75 days old) Ran by SYSTEM on 30-07-2013 13:56:07 Running from G:\Fix Windows 7 Home Premium (X64) OS Language: English(US) Internet Explorer Version 9 Boot Mode: Recovery The current controlset is ControlSet001 ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log. ==================== Registry (Whitelisted) ================== HKLM\...\Run: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1808168 2009-06-18] (Synaptics Incorporated) HKLM\...\Run: [cAudioFilterAgent] C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [495104 2009-07-14] (Conexant Systems, Inc.) HKLM\...\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" [171520 2009-08-17] (Sun Microsystems, Inc.) HKLM-x32\...\Run: [QPService] "C:\Program Files (x86)\HP\QuickPlay\QPService.exe" [468264 2009-06-23] (CyberLink Corp.) HKLM-x32\...\Run: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start [323640 2009-11-24] ( Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [updatePRCShortCut] "C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Hewlett-Packard\Recovery" UpdateWithCreateOnce "Software\CyberLink\PowerRecover" [222504 2009-05-19] (CyberLink Corp.) HKLM-x32\...\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [54576 2008-12-08] (Hewlett-Packard) HKLM-x32\...\Run: [] [x] HKLM-x32\...\Run: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [498744 2009-07-23] (Hewlett-Packard) HKLM-x32\...\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation) HKLM-x32\...\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [248552 2010-05-14] (Sun Microsystems, Inc.) HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2010-11-29] (Apple Inc.) HKLM-x32\...\Run: [bncsaui.exe] %ProgramFiles%\Bradford Networks\Persistent Agent\bncsaui.exe [2625304 2010-09-29] (Bradford Networks) HKLM-x32\...\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe [2345592 2012-08-01] (AVG Technologies CZ, s.r.o.) HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-05-30] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421776 2012-06-07] (Apple Inc.) HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated) HKU\Default\...\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1668664 2009-07-15] (Hewlett-Packard) HKU\Default\...\Policies\system: [WallpaperStyle] 2 HKU\Default User\...\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1668664 2009-07-15] (Hewlett-Packard) HKU\Default User\...\Policies\system: [WallpaperStyle] 2 HKU\Owner\...\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1668664 2009-07-15] (Hewlett-Packard) HKU\Owner\...\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden [2363392 2010-01-22] (Hewlett-Packard Company) HKU\Owner\...\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [5629312 2013-01-07] (SUPERAntiSpyware.com) HKU\Owner\...\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent [3325952 2009-03-28] (Electronic Arts) HKU\Owner\...\Winlogon: [shell] explorer.exe,C:\Users\Owner\AppData\Roaming\skype.dat [125440 2011-11-16] (MoonDev Software Group) <==== ATTENTION Startup: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk ShortcutTarget: MagicDisc.lnk -> C:\Program Files (x86)\MagicDisc\MagicDisc.exe (MagicISO, Inc.) Startup: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) BootExecute: autocheck autochk * C:\PROGRA~2\AVG\AVG10\avgchsva.exe /syncC:\PROGRA~2\AVG\AVG10\avgrsa.exe /sync /restart ==================== Services (Whitelisted) ================= S2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [140672 2013-01-07] (SUPERAntiSpyware.com) S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [7391072 2012-01-31] (AVG Technologies CZ, s.r.o.) S2 avgwd; C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe [269520 2011-02-08] (AVG Technologies CZ, s.r.o.) S2 BNPagent; C:\Program Files (x86)\Bradford Networks\Persistent Agent\bndaemon.exe [3067672 2010-09-29] (Bradford Networks) S2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [66872 2011-07-07] () S2 PnkBstrB; C:\Windows\SysWow64\PnkBstrB.exe [107832 2011-07-07] () S2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-01-21] () ==================== Drivers (Whitelisted) ==================== S3 AVGIDSDriver; C:\Windows\System32\DRIVERS\AVGIDSDriver.Sys [118864 2011-05-27] (AVG Technologies CZ, s.r.o. ) S0 AVGIDSEH; C:\Windows\System32\DRIVERS\AVGIDSEH.Sys [26704 2011-02-22] (AVG Technologies CZ, s.r.o. ) S3 AVGIDSFilter; C:\Windows\System32\DRIVERS\AVGIDSFilter.Sys [29264 2011-02-10] (AVG Technologies CZ, s.r.o. ) S1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [312160 2012-11-12] (AVG Technologies CZ, s.r.o.) S1 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [41552 2011-03-01] (AVG Technologies CZ, s.r.o.) S0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [37456 2011-03-16] (AVG Technologies CZ, s.r.o.) S1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [377936 2011-04-04] (AVG Technologies CZ, s.r.o.) S1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com) S1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com) S3 catchme; \??\C:\ComboFix\catchme.sys [x] S4 eabfiltr; S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x] S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [x] S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-07-30 09:31 - 2013-07-30 09:45 - 00000004 ____A C:\Users\Owner\AppData\Roaming\skype.ini 2013-07-29 11:58 - 2013-07-30 09:39 - 00000672 ____A C:\Windows\setupact.log 2013-07-29 11:58 - 2013-07-29 11:58 - 00000000 ____A C:\Windows\setuperr.log 2013-07-28 13:02 - 2013-07-28 13:02 - 00002172 ____A C:\Users\Public\Desktop\Google Earth.lnk 2013-07-18 17:15 - 2013-07-18 17:15 - 00260909 ____A C:\Users\Owner\Documents\lol.wma 2013-07-12 10:31 - 2013-06-11 15:43 - 14329856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-07-12 10:31 - 2013-06-11 15:43 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-07-12 10:31 - 2013-06-11 15:43 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-07-12 10:31 - 2013-06-11 15:43 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-07-12 10:31 - 2013-06-11 15:43 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-07-12 10:31 - 2013-06-11 15:43 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-07-12 10:31 - 2013-06-11 15:43 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-07-12 10:31 - 2013-06-11 15:42 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-07-12 10:31 - 2013-06-11 15:42 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-07-12 10:31 - 2013-06-11 15:42 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-07-12 10:31 - 2013-06-11 15:42 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-07-12 10:31 - 2013-06-11 15:42 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-07-12 10:31 - 2013-06-11 15:42 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-07-12 10:31 - 2013-06-11 15:26 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2013-07-12 10:31 - 2013-06-11 15:26 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2013-07-12 10:31 - 2013-06-11 15:26 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe 2013-07-12 10:31 - 2013-06-11 15:25 - 19238912 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2013-07-12 10:31 - 2013-06-11 15:25 - 15404032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2013-07-12 10:31 - 2013-06-11 15:25 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2013-07-12 10:31 - 2013-06-11 15:25 - 02648576 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2013-07-12 10:31 - 2013-06-11 15:25 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2013-07-12 10:31 - 2013-06-11 15:25 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2013-07-12 10:31 - 2013-06-11 15:25 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2013-07-12 10:31 - 2013-06-11 15:25 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll 2013-07-12 10:31 - 2013-06-11 15:25 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll 2013-07-12 10:31 - 2013-06-11 15:25 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2013-07-12 10:31 - 2013-06-11 15:25 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll 2013-07-12 10:31 - 2013-06-11 14:51 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-07-12 10:31 - 2013-06-11 14:50 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe 2013-07-12 10:31 - 2013-06-06 19:22 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2013-07-12 10:31 - 2013-06-06 18:37 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-07-09 13:12 - 2013-06-03 22:00 - 00624128 ____A (Microsoft Corporation) C:\Windows\System32\qedit.dll 2013-07-09 13:12 - 2013-06-03 20:53 - 00509440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2013-07-09 13:12 - 2013-05-05 22:03 - 01887744 ____A (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL 2013-07-09 13:12 - 2013-05-05 20:56 - 01620480 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL 2013-07-09 13:11 - 2013-06-04 19:34 - 03153920 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2013-07-09 13:11 - 2013-04-02 14:51 - 01643520 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll 2013-07-09 13:10 - 2013-04-09 15:34 - 01247744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2013-07-06 11:52 - 2013-07-06 12:00 - 733120512 ____A C:\Users\Owner\Desktop\Pumping Iron (Arnold Schwarzenegger) [XviD].avi 2013-07-04 20:11 - 2013-07-04 20:11 - 00000000 ____D C:\Users\Owner\AppData\Local\{AD53A0B4-DAC7-41E1-9C1F-71AF18805715} 2013-07-04 16:28 - 2013-07-04 16:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox ==================== One Month Modified Files and Folders ======= 2013-07-30 09:45 - 2013-07-30 09:31 - 00000004 ____A C:\Users\Owner\AppData\Roaming\skype.ini 2013-07-30 09:43 - 2009-10-23 08:45 - 01239428 ____A C:\Windows\WindowsUpdate.log 2013-07-30 09:40 - 2011-01-30 15:43 - 00000437 ____A C:\Windows\System32\Drivers\etc\hosts.ics 2013-07-30 09:40 - 2009-10-23 08:59 - 00000290 ____A C:\ProgramData\hpqp.ini 2013-07-30 09:39 - 2013-07-29 11:58 - 00000672 ____A C:\Windows\setupact.log 2013-07-30 09:39 - 2011-02-17 12:57 - 00000892 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-07-30 09:39 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2013-07-30 09:09 - 2012-07-06 16:45 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-07-30 08:37 - 2011-02-17 12:57 - 00000896 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-07-30 06:55 - 2011-05-12 06:14 - 00000000 ____D C:\Windows\System32\Drivers\AVG 2013-07-29 11:58 - 2013-07-29 11:58 - 00000000 ____A C:\Windows\setuperr.log 2013-07-29 10:43 - 2009-11-30 20:48 - 00000052 ____A C:\Windows\SysWOW64\DOErrors.log 2013-07-29 10:42 - 2012-06-04 10:21 - 00000000 ____A C:\Windows\System32\HP_ActiveX_Patch_NOT_DETECTED.txt 2013-07-28 17:35 - 2009-07-13 20:45 - 00023248 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-07-28 17:35 - 2009-07-13 20:45 - 00023248 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-07-28 13:02 - 2013-07-28 13:02 - 00002172 ____A C:\Users\Public\Desktop\Google Earth.lnk 2013-07-28 13:02 - 2011-02-17 12:57 - 00000000 ____D C:\Program Files (x86)\Google 2013-07-25 10:00 - 2012-05-02 19:24 - 00000000 ____D C:\Users\Owner\AppData\Local\TSVNCache 2013-07-24 19:30 - 2010-11-01 19:40 - 00000000 ____A C:\Users\Owner\AppData\Local\prvlcl.dat 2013-07-18 17:15 - 2013-07-18 17:15 - 00260909 ____A C:\Users\Owner\Documents\lol.wma 2013-07-12 12:56 - 2012-09-15 21:28 - 00000332 ____A C:\Windows\Tasks\HPCeeScheduleForOwner.job 2013-07-12 10:54 - 2009-07-13 20:45 - 00433824 ____A C:\Windows\System32\FNTCACHE.DAT 2013-07-12 10:53 - 2013-03-14 05:04 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-07-12 10:53 - 2013-03-14 05:04 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2013-07-12 10:53 - 2012-07-08 06:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-07-12 10:50 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\Windows Defender 2013-07-12 10:50 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender 2013-07-12 10:40 - 2009-07-13 21:13 - 00740814 ____A C:\Windows\System32\PerfStringBackup.INI 2013-07-12 10:35 - 2009-11-29 13:39 - 78185248 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe 2013-07-12 10:34 - 2009-12-17 16:46 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-07-06 12:00 - 2013-07-06 11:52 - 733120512 ____A C:\Users\Owner\Desktop\Pumping Iron (Arnold Schwarzenegger) [XviD].avi 2013-07-06 12:00 - 2011-04-30 22:12 - 00000000 ____D C:\Users\Owner\AppData\Roaming\BitTorrent 2013-07-04 20:12 - 2010-10-31 16:18 - 00000000 ____D C:\Users\Owner\AppData\Local\Windows Live 2013-07-04 20:11 - 2013-07-04 20:11 - 00000000 ____D C:\Users\Owner\AppData\Local\{AD53A0B4-DAC7-41E1-9C1F-71AF18805715} 2013-07-04 16:28 - 2013-07-04 16:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-07-03 17:37 - 2009-07-13 21:08 - 00032540 ____A C:\Windows\Tasks\SCHEDLGU.TXT Other Malware: =========== C:\Users\Owner\AppData\Roaming\skype.dat C:\Users\Owner\AppData\Roaming\skype.ini ==================== Known DLLs (Whitelisted) ================ ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= Restore point made on: 2013-07-11 16:44:34 Restore point made on: 2013-07-14 15:00:37 Restore point made on: 2013-07-21 15:00:36 Restore point made on: 2013-07-28 15:00:59 ==================== Memory info =========================== Percentage of memory in use: 30% Total physical RAM: 1979.2 MB Available physical RAM: 1365.79 MB Total Pagefile: 1979.2 MB Available Pagefile: 1351.36 MB Total Virtual: 8192 MB Available Virtual: 8191.87 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:136.98 GB) (Free:44.83 GB) NTFS (Disk=0 Partition=2) ==>[system with boot components (obtained from reading drive)] Drive e: (RECOVERY) (Fixed) (Total:11.87 GB) (Free:2 GB) NTFS (Disk=0 Partition=3) ==>[system with boot components (obtained from reading drive)] Drive f: (Sims3) (CDROM) (Total:5.54 GB) (Free:0 GB) UDF Drive g: (STORE N GO) (Removable) (Total:7.45 GB) (Free:3.57 GB) FAT32 (Disk=1 Partition=1) Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Drive y: (SYSTEM) (Fixed) (Total:0.19 GB) (Free:0.16 GB) NTFS (Disk=0 Partition=1) ==>[system with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 149 GB) (Disk ID: 135C058F) Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=137 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=12 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 7 GB) (Disk ID: 00000000) Partition 1: (Not Active) - (Size=7 GB) - (Type=0B) Last Boot: 2013-07-23 11:17 ==================== End Of Log ============================
  6. Hello, While I was checking my email, I got a large pop-up on my screen. It said something about it was the government and i had to pay a fine or something. I got something like this earlier so I knew it was a virus. I shut off my laptop and now it logs me off anytime I try to start in any kind of safe-mode. However, when I log in normally, my screen goes completely white. Can anyone help me remove this? Thanks!
  7. # AdwCleaner v2.301 - Logfile created 05/17/2013 at 14:13:50 # Updated 16/05/2013 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : Owner - SHREDFEST # Boot Mode : Normal # Running from : C:\Users\Owner\Desktop \adwcleaner.exe # Option [Delete] ***** [services] ***** ***** [Files / Folders] ***** File Deleted : C:\ProgramData\Microsoft \Windows\Start Menu\Programs\eBay.lnk Folder Deleted : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB Folder Deleted : C:\Program Files (x86)\Free Offers from Freeze.com Folder Deleted : C:\Program Files (x86)\OApps Folder Deleted : C:\ProgramData\AVG Security Toolbar Folder Deleted : C:\ProgramData\Tarma Installer Folder Deleted : C:\ProgramData\WeCareReminder Folder Deleted : C:\Users\Owner\AppData\Local \Wajam Folder Deleted : C:\Users\Owner\AppData\Local \Zoom_Downloader Folder Deleted : C:\Users\Owner\AppData \Roaming\dvdvideosoftiehelpers Folder Deleted : C:\Users\Owner\AppData \Roaming\Mozilla\Firefox\Profiles \ukzgnjr5.default\FCTB ***** [Registry] ***** Key Deleted : HKCU\Software\AppDataLow \Software\Crossrider Key Deleted : HKCU\Software\Microsoft\Windows \CurrentVersion\Ext\Settings\{02478D38-C3F9- 4EFB-9B51-7695ECA05670} Key Deleted : HKCU\Software\Microsoft\Windows \CurrentVersion\Ext\Settings\{D824F0DE-3D60- 4F57-9EB1-66033ECD8ABB} Key Deleted : HKCU\Software\Microsoft\Windows \CurrentVersion\Ext\Stats\{02478D38-C3F9- 4EFB-9B51-7695ECA05670} Key Deleted : HKCU\Software\Microsoft\Windows \CurrentVersion\Ext\Stats\{D824F0DE-3D60-4F57 -9EB1-66033ECD8ABB} Key Deleted : HKCU\Software\Microsoft\Windows \CurrentVersion\Ext\Stats\{DF7770F7-832F- 4BDF-B144-100EDDD0C3AE} Key Deleted : HKCU\Software\wecarereminder Key Deleted : HKCU\Software \YahooPartnerToolbar Key Deleted : HKLM\Software\AVG Secure Search Key Deleted : HKLM\Software\AVG Security Toolbar Key Deleted : HKLM\SOFTWARE\Classes\AppID \{4FBBF769-ECEB-420A-B536-133B1D505C36} Key Deleted : HKLM\SOFTWARE\Classes\AppID \{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17} Key Deleted : HKLM\SOFTWARE\Classes\AppID \IEHelperv2.5.0.DLL Key Deleted : HKLM\SOFTWARE\Classes\AppID \NCTAudioCDGrabber2.DLL Key Deleted : HKLM\SOFTWARE\Classes \IEHelperv250.WeCareReminder Key Deleted : HKLM\SOFTWARE\Classes \IEHelperv250.WeCareReminder.1 Key Deleted : HKLM\SOFTWARE\Classes\TypeLib \{93E3D79C-0786-48FF-9329-93BC9F6DC2B3} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib \{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib \{B12920CF-BE13-4C09-890D-1B6EFFFE2FBE} Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\Software\Freeze.com Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing \WajamUpdater_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing \WajamUpdater_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Windows \CurrentVersion\Ext\PreApproved\{02478D38- C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows \CurrentVersion\Ext\PreApproved\{EF99BD32- C1FB-11D2-892F-0090271D4F88} Key Deleted : HKLM\SOFTWARE\Wow6432Node \Classes\CLSID\{35B8892D-C3FB-4D88-990D- 31DB2EBD72BD} Key Deleted : HKLM\SOFTWARE\Wow6432Node \Classes\CLSID\{5EB0259D-AB79-4AE6-A6E6- 24FFE21C3DA4} Key Deleted : HKLM\SOFTWARE\Wow6432Node \Classes\CLSID\{761F6A83-F007-49E4-8EAC- CDB6808EF06F} Key Deleted : HKLM\SOFTWARE\Wow6432Node \Classes\CLSID\{80922EE0-8A76-46AE-95D5- BD3C3FE0708D} Key Deleted : HKLM\SOFTWARE\Wow6432Node \Classes\CLSID\{97D69524-BB57-4185-9C7F- 5F05593B771A} Key Deleted : HKLM\SOFTWARE\Wow6432Node \Classes\CLSID\{CADAF6BE-BF50-4669-8BFD- C27BD4E6181B} Key Deleted : HKLM\SOFTWARE\Wow6432Node \Classes\CLSID\{D824F0DE-3D60-4F57-9EB1- 66033ECD8ABB} Key Deleted : HKLM\SOFTWARE\Wow6432Node \Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673- 4ED3E9456D39} Key Deleted : HKLM\SOFTWARE\Wow6432Node \Classes\CLSID\{F773BB94-6C19-4643-A570- 0E429103D1C3} Key Deleted : HKLM\SOFTWARE\Wow6432Node \Classes\Interface\{03E2A1F3-4402-4121-8B35- 733216D61217} Key Deleted : HKLM\SOFTWARE\Wow6432Node \Classes\Interface\{2BEF239C-752E-4001-8048- F256E0D8CD93} Key Deleted : HKLM\SOFTWARE\Wow6432Node \Classes\Interface\{3F607E46-0D3C-4442-B1DE- DE7FA4768F5C} Key Deleted : HKLM\SOFTWARE\Wow6432Node \Classes\Interface\{49C00A51-6E59-41FE-B3FA- 2D2157FAD67B} Key Deleted : HKLM\SOFTWARE\Wow6432Node \Classes\Interface\{6DFF5DBA-AE3A-46DB-B301- ECFFC6DB2982} Key Deleted : HKLM\SOFTWARE\Wow6432Node \Classes\Interface\{9E3B11F6-4179-4603-A71B- A55F4BCB0BEC} Key Deleted : HKLM\SOFTWARE\Wow6432Node \Classes\Interface\{DE34CD67-F1C8-4001-9A23- B8A68F63F377} Key Deleted : HKLM\SOFTWARE\Wow6432Node \Classes\Interface\{F773BB94-6C19-4643-A570- 0E429103D1C3} Key Deleted : HKLM\SOFTWARE\Wow6432Node \Classes\Interface\{FE0273D1-99DF-4AC0-87D5- 1371C6271785} Key Deleted : HKLM\SOFTWARE\Wow6432Node \Google\Chrome\Extensions \jmfkcklnlgedgbglfkkgedjfmejoahla Key Deleted : HKLM\SOFTWARE\Wow6432Node \Google\Chrome\Extensions \jpmbfleldcgkldadpdinhjjopdfpjfjp Key Deleted : HKLM\SOFTWARE\Wow6432Node \Microsoft\Internet Explorer\Low Rights \ElevationPolicy\{AC5B6CDA-8F90-4740-9A8C- 28AC5D3C73FE} Key Deleted : HKLM\SOFTWARE\Wow6432Node \Microsoft\Windows\CurrentVersion\Explorer \Browser Helper Objects\{02478D38-C3F9-4EFB- 9B51-7695ECA05670} Key Deleted : HKLM\SOFTWARE\Wow6432Node \Microsoft\Windows\CurrentVersion\Explorer \Browser Helper Objects\{D824F0DE-3D60-4F57- 9EB1-66033ECD8ABB} Key Deleted : HKLM\SOFTWARE\Classes\Interface \{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Classes\Interface \{10DE7085-6A1E-4D41-A7BF-9AF93E351401} Key Deleted : HKLM\SOFTWARE\Classes\Interface \{1AD27395-1659-4DFF-A319-2CFA243861A5} Key Deleted : HKLM\SOFTWARE\Classes\Interface \{2BEF239C-752E-4001-8048-F256E0D8CD93} Key Deleted : HKLM\SOFTWARE\Classes\Interface \{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C} Key Deleted : HKLM\SOFTWARE\Classes\Interface \{431532BD-0AE1-4ABC-BE8C-919F3D1332E2} Key Deleted : HKLM\SOFTWARE\Classes\Interface \{49C00A51-6E59-41FE-B3FA-2D2157FAD67B} Key Deleted : HKLM\SOFTWARE\Classes\Interface \{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7} Key Deleted : HKLM\SOFTWARE\Classes\Interface \{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982} Key Deleted : HKLM\SOFTWARE\Classes\Interface \{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Deleted : HKLM\SOFTWARE\Classes\Interface \{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6} Key Deleted : HKLM\SOFTWARE\Classes\Interface \{DE34CD67-F1C8-4001-9A23-B8A68F63F377} Key Deleted : HKLM\SOFTWARE\Classes\Interface \{FE0273D1-99DF-4AC0-87D5-1371C6271785} ***** [internet Browsers] ***** -\\ Internet Explorer v10.0.9200.16576 [OK] Registry is clean. -\\ Mozilla Firefox v20.0.1 (en-US) File : C:\Users\Owner\AppData\Roaming\Mozilla \Firefox\Profiles\ukzgnjr5.default\prefs.js C:\Users\Owner\AppData\Roaming\Mozilla \Firefox\Profiles\ukzgnjr5.default\user.js ... Deleted ! Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.Au toSearchEventData", "auto%20search"); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.Cl earCacheDate", 7); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.DN SCatch", true); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.Di splayEULA", true); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.Dn sCatchEventData", "dns%20catch"); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.EB OMode", true); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.Fi rstLaunchShown", true); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.In stallDomain", "freecause.com"); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.In stallType", "standard"); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.Lo adLayoutDate.100815", 7); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.Ne wTabSearchEventData", "tab%20search"); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.Sh owRecommendedOptions", true); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.St ateReportDate", "1341669311954"); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.To pRightSearchEventData", "top%20right%20search [...] Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.be foreInstallSaved", true); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.be foreinstall.homepage", "hxxp%3A//www.google.c [...] Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.be foreinstall.search", "Jixey"); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.cu stomNewTab", true); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.he lpUsImprove", true); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.hi deOthers", true); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.pa rtnerauth", false); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.pr ocessAddrBar", true); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.re storeSearch", false); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.ru ncmd.", "bb_acct_status_1341699594"); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.se archHistory", true); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.se ssion", "84D6EFFA1187D2C13E07912CF8CD59E2D559 [...] Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.sh owFirstLaunchOptions", false); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.tb _lang", "en"); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.to ol_id", "100815"); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.us er_id", "110813648"); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.us er_key", "4e76e438f817385ab402ab19cdfcc26aa53 [...] Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.us er_layouts", "100815"); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.us er_lnames", "fcreward.100815.b"); Deleted : user_pref ("freecause758d6aeb75e49f24fd4951b640add07f.ya hooSearch", true); Deleted : user_pref("keyword.URL", "hxxp://serp.freecause.com/? ourmark=3&sid=100815&q="); Deleted : user_pref("vshare.install.date", "1286668800000"); Deleted : user_pref("vshare.install.finished", "1.0.0"); Deleted : user_pref("vshare.install.guid", "{6e14033f-b6e9-4298-9ed2-36f045163a02}"); Deleted : user_pref ("vshare.install.laststatreq", "1341619200000"); Deleted : user_pref("vshare.install.newtab", false); ************************* AdwCleaner[R1].txt - [10417 octets] - [17/05/2013 13:49:02] AdwCleaner[R2].txt - [10478 octets] - [17/05/2013 13:52:39] AdwCleaner[R3].txt - [10539 octets] - [17/05/2013 13:54:58] AdwCleaner[s1].txt - [10683 octets] - [17/05/2013 14:13:50] ########## EOF - C:\AdwCleaner[s1].txt - [10744 octets] ########## Results of screen317's Security Check version 0.99.63 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` Windows Security Center service is not running! This report may not be accurate! Windows Firewall Enabled! AVG Anti-Virus Free Edition 2011 Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware version 1.70.0.1100 CCleaner Java 6 Update 21 Java version out of Date! Adobe Flash Player 11.7.700.202 Adobe Reader XI Mozilla Firefox (20.0.1) ````````Process Check: objlist.exe by Laurent```````` AVG avgwdsvc.exe AVG avgtray.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 0% ````````````````````End of Log``````````````````````
  8. That was quick. # AdwCleaner v2.301 - Logfile created 05/17/2013 at 13:52:39 # Updated 16/05/2013 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : Owner - SHREDFEST # Boot Mode : Normal # Running from : C:\Users\Owner\Desktop\adwcleaner.exe # Option [search] ***** [services] ***** ***** [Files / Folders] ***** File Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk Folder Found : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB Folder Found : C:\Program Files (x86)\Free Offers from Freeze.com Folder Found : C:\Program Files (x86)\OApps Folder Found : C:\ProgramData\AVG Security Toolbar Folder Found : C:\ProgramData\Tarma Installer Folder Found : C:\ProgramData\WeCareReminder Folder Found : C:\Users\Owner\AppData\Local\Wajam Folder Found : C:\Users\Owner\AppData\Local\Zoom_Downloader Folder Found : C:\Users\Owner\AppData\Roaming\dvdvideosoftiehelpers Folder Found : C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\ukzgnjr5.default\FCTB ***** [Registry] ***** Key Found : HKCU\Software\AppDataLow\Software\Crossrider Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE} Key Found : HKCU\Software\wecarereminder Key Found : HKCU\Software\YahooPartnerToolbar Key Found : HKLM\Software\AVG Secure Search Key Found : HKLM\Software\AVG Security Toolbar Key Found : HKLM\SOFTWARE\Classes\AppID\{4FBBF769-ECEB-420A-B536-133B1D505C36} Key Found : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17} Key Found : HKLM\SOFTWARE\Classes\AppID\IEHelperv2.5.0.DLL Key Found : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLL Key Found : HKLM\SOFTWARE\Classes\IEHelperv250.WeCareReminder Key Found : HKLM\SOFTWARE\Classes\IEHelperv250.WeCareReminder.1 Key Found : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{B12920CF-BE13-4C09-890D-1B6EFFFE2FBE} Key Found : HKLM\Software\Conduit Key Found : HKLM\Software\Freeze.com Key Found : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASMANCS Key Found : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASMANCS Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{5EB0259D-AB79-4AE6-A6E6-24FFE21C3DA4} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{97D69524-BB57-4185-9C7F-5F05593B771A} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F773BB94-6C19-4643-A570-0E429103D1C3} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F773BB94-6C19-4643-A570-0E429103D1C3} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785} Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AC5B6CDA-8F90-4740-9A8C-28AC5D3C73FE} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Found : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401} Key Found : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5} Key Found : HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93} Key Found : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C} Key Found : HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2} Key Found : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B} Key Found : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7} Key Found : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982} Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Found : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6} Key Found : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377} Key Found : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785} ***** [internet Browsers] ***** -\\ Internet Explorer v10.0.9200.16576 [OK] Registry is clean. -\\ Mozilla Firefox v20.0.1 (en-US) File : C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\ukzgnjr5.default\prefs.js Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.AutoSearchEventData", "auto%20search"); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.ClearCacheDate", 7); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.DNSCatch", true); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.DisplayEULA", true); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.DnsCatchEventData", "dns%20catch"); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.EBOMode", true); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.FirstLaunchShown", true); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.InstallDomain", "freecause.com"); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.InstallType", "standard"); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.LoadLayoutDate.100815", 7); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.NewTabSearchEventData", "tab%20search"); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.ShowRecommendedOptions", true); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.StateReportDate", "1341669311954"); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.TopRightSearchEventData", "top%20right%20search[...] Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.beforeInstallSaved", true); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.beforeinstall.homepage", "hxxp%3A//www.google.c[...] Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.beforeinstall.search", "Jixey"); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.customNewTab", true); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.helpUsImprove", true); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.hideOthers", true); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.partnerauth", false); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.processAddrBar", true); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.restoreSearch", false); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.runcmd.", "bb_acct_status_1341699594"); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.searchHistory", true); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.session", "84D6EFFA1187D2C13E07912CF8CD59E2D559[...] Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.showFirstLaunchOptions", false); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.tb_lang", "en"); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.tool_id", "100815"); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.user_id", "110813648"); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.user_key", "4e76e438f817385ab402ab19cdfcc26aa53[...] Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.user_layouts", "100815"); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.user_lnames", "fcreward.100815.b"); Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.yahooSearch", true); Found : user_pref("keyword.URL", "hxxp://serp.freecause.com/?ourmark=3&sid=100815&q="); Found : user_pref("vshare.install.date", "1286668800000"); Found : user_pref("vshare.install.finished", "1.0.0"); Found : user_pref("vshare.install.guid", "{6e14033f-b6e9-4298-9ed2-36f045163a02}"); Found : user_pref("vshare.install.laststatreq", "1341619200000"); Found : user_pref("vshare.install.newtab", false); ************************* AdwCleaner[R1].txt - [10417 octets] - [17/05/2013 13:49:02] AdwCleaner[R2].txt - [10373 octets] - [17/05/2013 13:52:39] ########## EOF - C:\AdwCleaner[R2].txt - [10434 octets] ##########
  9. ComboFix log ComboFix 13-05-16.02 - Owner 05/17/2013 12:52:24.1.1 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.1979.986 [GMT -4:00] Running from: c:\users\Owner\Desktop\ComboFix.exe AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} SP: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Owner\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk c:\users\Owner\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\rasphone.pbk c:\users\Owner\xobglu32.dll . . ((((((((((((((((((((((((( Files Created from 2013-04-17 to 2013-05-17 ))))))))))))))))))))))))))))))) . . 2013-05-17 18:44 . 2013-05-17 18:44 -------- d-----w- C:\FRST 2013-05-17 17:04 . 2013-05-17 17:04 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-05-15 09:29 . 2013-04-10 06:01 265064 ----a-w- c:\windows\system32\drivers\dxgmms1.sys 2013-05-14 21:09 . 2013-05-14 21:09 17613192 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe 2013-04-28 05:53 . 2013-04-28 05:54 -------- d-----w- c:\users\Owner\AppData\Roaming\Stella 2013-04-28 04:58 . 2013-04-28 04:58 40960 ----a-r- c:\users\Owner\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\NewShortcut1_9559F7CA5E344237A2D9D856464AD727.exe 2013-04-28 04:58 . 2013-04-28 04:58 40960 ----a-r- c:\users\Owner\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\ARPPRODUCTICON.exe 2013-04-28 04:58 . 2013-04-28 05:00 -------- d-----w- c:\program files (x86)\Project64 1.6 2013-04-24 02:39 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys 2013-04-21 18:52 . 2013-04-21 18:52 226304 ----a-w- c:\windows\system32\elshyph.dll 2013-04-21 18:52 . 2013-04-21 18:52 185344 ----a-w- c:\windows\SysWow64\elshyph.dll 2013-04-21 18:52 . 2013-04-21 18:52 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe 2013-04-21 18:52 . 2013-04-21 18:52 158720 ----a-w- c:\windows\SysWow64\msls31.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-05-17 14:16 . 2010-06-24 15:33 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2013-05-15 22:15 . 2009-11-29 21:39 75016696 ----a-w- c:\windows\system32\MRT.exe 2013-05-14 21:09 . 2012-07-07 00:45 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-05-14 21:09 . 2012-07-07 00:45 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-04-13 05:49 . 2013-05-15 09:29 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll 2013-04-13 05:49 . 2013-05-15 09:29 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll 2013-04-13 05:49 . 2013-05-15 09:29 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll 2013-04-13 05:49 . 2013-05-15 09:29 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll 2013-04-13 04:45 . 2013-05-15 09:29 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll 2013-04-13 04:45 . 2013-05-15 09:29 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll 2013-03-19 06:04 . 2013-04-10 13:10 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe 2013-03-19 05:46 . 2013-04-10 13:10 43520 ----a-w- c:\windows\system32\csrsrv.dll 2013-03-19 05:04 . 2013-04-10 13:10 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe 2013-03-19 05:04 . 2013-04-10 13:10 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe 2013-03-19 04:47 . 2013-04-10 13:10 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll 2013-03-19 03:06 . 2013-04-10 13:10 112640 ----a-w- c:\windows\system32\smss.exe . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 14:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 14:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 14:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 14:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 14:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 14:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 14:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 14:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 14:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HPADVISOR"="c:\program files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2009-07-16 1668664] "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-01-22 2363392] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2013-01-08 5629312] "EA Core"="c:\program files (x86)\Electronic Arts\EADM\Core.exe" [2009-03-28 3325952] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "QPService"="c:\program files (x86)\HP\QuickPlay\QPService.exe" [2009-06-24 468264] "QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-11-24 323640] "UpdatePRCShortCut"="c:\program files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504] "HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576] "WirelessAssistant"="c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744] "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888] "bncsaui.exe"="c:\program files (x86)\Bradford Networks\Persistent Agent\bncsaui.exe" [2010-09-29 2625304] "AVG_TRAY"="c:\program files (x86)\AVG\AVG10\avgtray.exe" [2012-08-01 2345592] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-06-07 421776] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] "Z1"="c:\users\Owner\Desktop\Protection\mbar\mbar.exe" [2013-03-23 1398856] . c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ MagicDisc.lnk - c:\program files (x86)\MagicDisc\MagicDisc.exe [2011-5-1 576000] OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system] "WallpaperStyle"= 2 . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG10\avgchsva.exe /sync\0c:\progra~2\AVG\AVG10\avgrsa.exe /sync /restart . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" . R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [2012-01-31 7391072] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x] R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-06-05 216064] R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-04-25 52736] R3 UsbFltr;WayTech USB Filter Driver;c:\windows\system32\Drivers\UsbFltr.sys [2007-04-09 12288] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-03-01 1255736] R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [2011-02-22 26704] S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2011-03-16 37456] S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2012-11-12 312160] S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2011-03-01 41552] S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2011-04-05 377936] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368] S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2013-01-08 140672] S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG10\avgwdsvc.exe [2011-02-08 269520] S2 BNPagent;Bradford Persistent Agent Service;c:\program files (x86)\Bradford Networks\Persistent Agent\bndaemon.exe [2010-09-29 3067672] S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2012-09-27 86528] S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe [2009-07-14 27136] S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [2011-05-27 118864] S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [2011-02-10 29264] S3 CAXHWAZL;CAXHWAZL;c:\windows\system32\DRIVERS\CAXHWAZL.sys [2009-06-24 292864] S3 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2010-01-12 227896] S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-05-26 138752] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-05-23 215040] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] 2010-01-22 15:06 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe . Contents of the 'Scheduled Tasks' folder . 2013-05-17 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-07 21:09] . 2013-05-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-17 20:57] . 2013-05-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-17 20:57] . 2013-05-13 c:\windows\Tasks\HPCeeScheduleForOwner.job - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 02:15] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 14:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 14:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 14:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 14:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 14:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 14:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 14:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 14:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2011-06-13 14:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2009-07-14 495104] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-17 171520] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-26 161304] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-26 386584] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 415256] . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService FontCache . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\system32\blank.htm uInternet Settings,ProxyOverride = <local>;*.local IE: Free YouTube to MP3 Converter - c:\users\Owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm Trusted Zone: juniata.edu\firepass TCP: DhcpNameServer = 192.168.2.1 DPF: {195538FD-1C39-44B1-A7C3-5D7137A8A8F1} - hxxps://firepass.juniata.edu/vdesk/terminal/f5opswati.cab#Version=7001,2011,223,1226 DPF: {30CF9713-6614-4556-B5F5-66F8C7F9DEF1} - hxxps://firepass.juniata.edu/vdesk/terminal/f5opswati.cab#Version=7001,2011,223,1226 DPF: {49EC7987-E331-44E3-B170-748B58A268B9} - hxxps://firepass.juniata.edu/vdesk/terminal/f5opswati.cab#Version=7001,2011,223,1226 DPF: {EBDC91CB-F23F-477D-B152-3F7243760D04} - hxxps://firepass.juniata.edu/vdesk/terminal/f5opswati.cab#Version=7001,2011,223,1226 FF - ProfilePath - c:\users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\ukzgnjr5.default\ FF - prefs.js: browser.search.selectedEngine - XFINITY FF - prefs.js: browser.startup.homepage - www.google.com FF - prefs.js: keyword.URL - hxxp://serp.freecause.com/?ourmark=3&sid=100815&q= FF - user.js: extensions.autoDisableScopes - 14 user_pref('extensions.autoDisableScopes', 0);user_pref('security.csp.enable', false);user_pref('security.OCSP.enabled', 0); . - - - - ORPHANS REMOVED - - - - . BHO-{300BEC06-B743-4D19-86B9-11DC711D7FFB} - (no file) Toolbar-Locked - (no file) Wow6432Node-HKCU-Run-ROC_ROC_APR2013_AV - c:\users\Owner\AppData\Roaming\AVG April 2013 Campaign\AVG-Secure-Search-Update.exe Wow6432Node-HKLM-Run-<NO NAME> - (no file) HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe AddRemove-{EA2DB6E0-72C5-4ef9-A3A0-E6705F4A6A9E} - c:\programdata\NexonUS\NGM\NGM.exe AddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*] @="?????????????????? v1" . [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID] @="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}" . [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*] @="?????????????????? v2" . [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID] @="{9BE31822-FDAD-461B-AD51-BE1D1C159921}" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2013-05-17 13:30:01 ComboFix-quarantined-files.txt 2013-05-17 17:29 . Pre-Run: 52,248,780,800 bytes free Post-Run: 51,739,504,640 bytes free . - - End Of File - - 1AE09299A3276E93ECF8F37EED6E6ED4
  10. First Log Malwarebytes Anti-Rootkit BETA 1.05.0.1001 www.malwarebytes.org Database version: v2013.05.17.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16576 Owner :: SHREDFEST [administrator] 5/17/2013 11:51:34 AM mbar-log-2013-05-17 (11-51-34).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 31473 Time elapsed: 12 minute(s), 8 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 7 HKLM\SOFTWARE\CLASSES\APPID\{F85FA3F2-D2C8-4D4D-BB1C-3181E691AF2B} (PUP.FaceThemes) -> Delete on reboot. HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{F85FA3F2-D2C8-4D4D-BB1C-3181E691AF2B} (PUP.FaceThemes) -> Delete on reboot. HKLM\SOFTWARE\CLASSES\TYPELIB\{A3F56272-CDB4-4310-9BB1-9A0D0757A3B3} (PUP.FaceThemes) -> Delete on reboot. HKLM\SOFTWARE\CLASSES\INTERFACE\{D6975F9E-15B2-4FE7-9D16-FC2E85CB201B} (PUP.FaceThemes) -> Delete on reboot. HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{D6975F9E-15B2-4FE7-9D16-FC2E85CB201B} (PUP.FaceThemes) -> Delete on reboot. HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{A3F56272-CDB4-4310-9BB1-9A0D0757A3B3} (PUP.FaceThemes) -> Delete on reboot. HKCU\SOFTWARE\CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} (Hijack.Trojan.Siredef.C) -> Delete on reboot. Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 1 HKCU\SOFTWARE\CLASSES\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\INPROCSERVER32| (Trojan.0Access) -> Bad: (C:\$Recycle.Bin\S-1-5-21-2861860325-1608682575-3244310698-1000\$708e671f3545291506c06082039c15b2\n.) Good: (shell32.dll) -> Delete on reboot. Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) After Reboot Malwarebytes Anti-Rootkit BETA 1.05.0.1001 www.malwarebytes.org Database version: v2013.05.17.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16576 Owner :: SHREDFEST [administrator] 5/17/2013 12:30:01 PM mbar-log-2013-05-17 (12-30-01).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 31455 Time elapsed: 12 minute(s), 18 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) System Log --------------------------------------- Malwarebytes Anti-Rootkit BETA 1.05.0.1001 © Malwarebytes Corporation 2011-2012 OS version: 6.1.7601 Windows 7 Service Pack 1 x64 Account is Administrative Internet Explorer version: 10.0.9200.16576 Java version: 1.6.0_21 File system is: NTFS Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED CPU speed: 2.194000 GHz Memory total: 2075336704, free: 895168512 ------------ Kernel report ------------ 05/17/2013 11:38:15 ------------ Loaded modules ----------- \SystemRoot\system32\ntoskrnl.exe \SystemRoot\system32\hal.dll \SystemRoot\system32\kdcom.dll \SystemRoot\system32\mcupdate_GenuineIntel.dll \SystemRoot\system32\PSHED.dll \SystemRoot\system32\CLFS.SYS \SystemRoot\system32\CI.dll \SystemRoot\system32\drivers\Wdf01000.sys \SystemRoot\system32\drivers\WDFLDR.SYS \SystemRoot\system32\drivers\ACPI.sys \SystemRoot\system32\drivers\WMILIB.SYS \SystemRoot\system32\drivers\msisadrv.sys \SystemRoot\system32\drivers\pci.sys \SystemRoot\system32\drivers\vdrvroot.sys \SystemRoot\system32\drivers\isapnp.sys \SystemRoot\system32\drivers\mpio.sys \SystemRoot\System32\drivers\partmgr.sys \SystemRoot\system32\DRIVERS\compbatt.sys \SystemRoot\system32\DRIVERS\BATTC.SYS \SystemRoot\system32\drivers\volmgr.sys \SystemRoot\System32\drivers\volmgrx.sys \SystemRoot\system32\drivers\intelide.sys \SystemRoot\system32\drivers\PCIIDEX.SYS \SystemRoot\system32\drivers\aliide.sys \SystemRoot\system32\drivers\amdide.sys \SystemRoot\system32\drivers\cmdide.sys \SystemRoot\System32\drivers\mountmgr.sys \SystemRoot\system32\drivers\msdsm.sys \SystemRoot\system32\drivers\nvraid.sys \SystemRoot\system32\drivers\CLASSPNP.SYS \SystemRoot\system32\drivers\pciide.sys \SystemRoot\system32\drivers\viaide.sys \SystemRoot\system32\drivers\iaStorV.sys \SystemRoot\system32\drivers\atapi.sys \SystemRoot\system32\drivers\ataport.SYS \SystemRoot\system32\DRIVERS\lsi_sas.sys \SystemRoot\system32\DRIVERS\storport.sys \SystemRoot\system32\drivers\msahci.sys \SystemRoot\system32\drivers\HpSAMD.sys \SystemRoot\system32\DRIVERS\adp94xx.sys \SystemRoot\system32\DRIVERS\adpahci.sys \SystemRoot\system32\DRIVERS\adpu320.sys \SystemRoot\system32\drivers\amdsata.sys \SystemRoot\system32\DRIVERS\amdsbs.sys \SystemRoot\system32\drivers\amdxata.sys \SystemRoot\system32\DRIVERS\arc.sys \SystemRoot\system32\DRIVERS\arcsas.sys \SystemRoot\system32\DRIVERS\elxstor.sys \SystemRoot\system32\DRIVERS\iirsp.sys \SystemRoot\system32\DRIVERS\lsi_fc.sys \SystemRoot\system32\DRIVERS\lsi_sas2.sys \SystemRoot\system32\DRIVERS\lsi_scsi.sys \SystemRoot\system32\DRIVERS\megasas.sys \SystemRoot\system32\DRIVERS\MegaSR.sys \SystemRoot\system32\DRIVERS\nfrd960.sys \SystemRoot\system32\drivers\nvstor.sys \SystemRoot\system32\DRIVERS\ql2300.sys \SystemRoot\system32\DRIVERS\ql40xx.sys \SystemRoot\system32\DRIVERS\SiSRaid2.sys \SystemRoot\system32\DRIVERS\sisraid4.sys \SystemRoot\system32\DRIVERS\stexstor.sys \SystemRoot\system32\DRIVERS\vsmraid.sys \SystemRoot\system32\drivers\fltmgr.sys \SystemRoot\system32\drivers\fileinfo.sys \SystemRoot\System32\Drivers\Ntfs.sys \SystemRoot\System32\Drivers\msrpc.sys \SystemRoot\System32\Drivers\ksecdd.sys \SystemRoot\System32\Drivers\cng.sys \SystemRoot\System32\drivers\pcw.sys \SystemRoot\System32\Drivers\Fs_Rec.sys \SystemRoot\system32\drivers\ndis.sys \SystemRoot\system32\drivers\NETIO.SYS \SystemRoot\System32\Drivers\ksecpkg.sys \SystemRoot\System32\drivers\tcpip.sys \SystemRoot\System32\drivers\fwpkclnt.sys \SystemRoot\system32\DRIVERS\wd.sys \SystemRoot\system32\drivers\volsnap.sys \SystemRoot\System32\Drivers\spldr.sys \SystemRoot\system32\drivers\sbp2port.sys \SystemRoot\System32\drivers\rdyboost.sys \SystemRoot\System32\Drivers\mup.sys \SystemRoot\System32\drivers\hwpolicy.sys \SystemRoot\System32\DRIVERS\fvevol.sys \SystemRoot\system32\DRIVERS\disk.sys \SystemRoot\system32\DRIVERS\avgrkx64.sys \SystemRoot\system32\DRIVERS\AVGIDSEH.Sys \SystemRoot\system32\DRIVERS\cdrom.sys \SystemRoot\system32\DRIVERS\avgmfx64.sys \SystemRoot\System32\Drivers\Null.SYS \SystemRoot\System32\Drivers\Beep.SYS \SystemRoot\System32\drivers\vga.sys \SystemRoot\System32\drivers\VIDEOPRT.SYS \SystemRoot\System32\drivers\watchdog.sys \SystemRoot\System32\DRIVERS\RDPCDD.sys \SystemRoot\system32\drivers\rdpencdd.sys \SystemRoot\system32\drivers\rdprefmp.sys \SystemRoot\System32\Drivers\Msfs.SYS \SystemRoot\System32\Drivers\Npfs.SYS \SystemRoot\system32\DRIVERS\tdx.sys \SystemRoot\system32\DRIVERS\TDI.SYS \SystemRoot\system32\DRIVERS\avgtdia.sys \SystemRoot\System32\DRIVERS\netbt.sys \SystemRoot\system32\drivers\afd.sys \SystemRoot\system32\DRIVERS\wfplwf.sys \SystemRoot\system32\DRIVERS\pacer.sys \SystemRoot\system32\DRIVERS\vwififlt.sys \SystemRoot\system32\DRIVERS\netbios.sys \SystemRoot\system32\DRIVERS\wanarp.sys \SystemRoot\system32\drivers\termdd.sys \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS \SystemRoot\system32\DRIVERS\rdbss.sys \SystemRoot\system32\drivers\nsiproxy.sys \SystemRoot\system32\drivers\mssmbios.sys \SystemRoot\System32\drivers\discache.sys \SystemRoot\System32\Drivers\dfsc.sys \SystemRoot\system32\DRIVERS\blbdrive.sys \SystemRoot\system32\DRIVERS\avgldx64.sys \SystemRoot\system32\DRIVERS\tunnel.sys \SystemRoot\system32\DRIVERS\intelppm.sys \SystemRoot\system32\drivers\wmiacpi.sys \SystemRoot\system32\DRIVERS\igdkmd64.sys \SystemRoot\System32\drivers\dxgkrnl.sys \SystemRoot\System32\drivers\dxgmms1.sys \SystemRoot\system32\drivers\usbuhci.sys \SystemRoot\system32\drivers\USBPORT.SYS \SystemRoot\system32\drivers\usbehci.sys \SystemRoot\system32\drivers\HDAudBus.sys \SystemRoot\system32\DRIVERS\Rt64win7.sys \SystemRoot\system32\DRIVERS\athrx.sys \SystemRoot\system32\DRIVERS\vwifibus.sys \SystemRoot\system32\drivers\i8042prt.sys \SystemRoot\system32\DRIVERS\HpqKbFiltr.sys \SystemRoot\system32\drivers\kbdclass.sys \SystemRoot\system32\DRIVERS\SynTP.sys \SystemRoot\system32\DRIVERS\USBD.SYS \SystemRoot\system32\DRIVERS\mouclass.sys \SystemRoot\system32\DRIVERS\CmBatt.sys \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys \SystemRoot\system32\drivers\CompositeBus.sys \SystemRoot\system32\DRIVERS\AgileVpn.sys \SystemRoot\system32\DRIVERS\rasl2tp.sys \SystemRoot\system32\DRIVERS\ndistapi.sys \SystemRoot\system32\DRIVERS\ndiswan.sys \SystemRoot\system32\DRIVERS\raspppoe.sys \SystemRoot\system32\DRIVERS\raspptp.sys \SystemRoot\system32\DRIVERS\rassstp.sys \SystemRoot\system32\DRIVERS\mcdbus.sys \SystemRoot\system32\DRIVERS\SCSIPORT.SYS \SystemRoot\system32\drivers\swenum.sys \SystemRoot\system32\drivers\ks.sys \SystemRoot\system32\drivers\umbus.sys \SystemRoot\system32\DRIVERS\usbhub.sys \SystemRoot\System32\Drivers\NDProxy.SYS \SystemRoot\system32\drivers\CHDRT64.sys \SystemRoot\system32\drivers\portcls.sys \SystemRoot\system32\drivers\drmk.sys \SystemRoot\system32\drivers\ksthunk.sys \SystemRoot\system32\DRIVERS\CAXHWAZL.sys \SystemRoot\system32\DRIVERS\CAX_DPV.sys \SystemRoot\system32\DRIVERS\CAX_CNXT.sys \SystemRoot\system32\drivers\modem.sys \SystemRoot\system32\drivers\IntcHdmi.sys \SystemRoot\system32\DRIVERS\udfs.sys \SystemRoot\system32\DRIVERS\cdfs.sys \SystemRoot\System32\Drivers\crashdmp.sys \SystemRoot\System32\Drivers\dump_dumpata.sys \SystemRoot\System32\Drivers\dump_msahci.sys \SystemRoot\System32\Drivers\dump_dumpfve.sys \SystemRoot\System32\win32k.sys \SystemRoot\System32\drivers\Dxapi.sys \SystemRoot\system32\DRIVERS\monitor.sys \SystemRoot\System32\TSDDD.dll \SystemRoot\System32\cdd.dll \SystemRoot\system32\drivers\luafv.sys \SystemRoot\system32\DRIVERS\lltdio.sys \SystemRoot\system32\DRIVERS\nwifi.sys \SystemRoot\system32\DRIVERS\ndisuio.sys \SystemRoot\system32\DRIVERS\rspndr.sys \SystemRoot\system32\drivers\HTTP.sys \SystemRoot\System32\DRIVERS\srvnet.sys \SystemRoot\system32\DRIVERS\bowser.sys \SystemRoot\system32\DRIVERS\mrxsmb.sys \SystemRoot\system32\DRIVERS\mrxsmb10.sys \SystemRoot\system32\DRIVERS\mrxsmb20.sys \SystemRoot\System32\DRIVERS\srv2.sys \SystemRoot\System32\DRIVERS\srv.sys \SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys \SystemRoot\system32\DRIVERS\mdmxsdk.sys \SystemRoot\system32\drivers\peauth.sys \SystemRoot\System32\Drivers\secdrv.SYS \SystemRoot\System32\drivers\tcpipreg.sys \SystemRoot\system32\DRIVERS\XAudio64.sys \SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys \SystemRoot\system32\DRIVERS\USBSTOR.SYS \SystemRoot\system32\drivers\spsys.sys \SystemRoot\System32\Drivers\fastfat.SYS \SystemRoot\system32\drivers\WudfPf.sys \SystemRoot\system32\DRIVERS\WUDFRd.sys \??\C:\Windows\system32\drivers\mbamchameleon.sys \??\C:\Windows\system32\drivers\mbamswissarmy.sys \Windows\System32\ntdll.dll \Windows\System32\smss.exe \Windows\System32\apisetschema.dll ----------- End ----------- <<<1>>> Upper Device Name: \Device\Harddisk1\DR1 Upper Device Object: 0xfffffa8002593790 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\000000a1\ Lower Device Object: 0xfffffa8003f0c060 Lower Device Driver Name: \Driver\USBSTOR\ Driver name found: USBSTOR Initialization returned 0x0 Load Function returned 0x0 <<<1>>> Upper Device Name: \Device\Harddisk0\DR0 Upper Device Object: 0xfffffa8002423060 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\ Lower Device Object: 0xfffffa8002211680 Lower Device Driver Name: \Driver\atapi\ Driver name found: atapi Initialization returned 0x0 Port sub-driver loaded: \??\C:\Windows\System32\drivers\ataport.sys (0x0) Load Function returned 0x0 Downloaded database version: v2013.05.17.05 Downloaded database version: v2013.05.14.03 Initializing... Done! <<<2>>> Device number: 0, partition: 2 Physical Sector Size: 512 Drive: 0, DevicePointer: 0xfffffa8002423060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xfffffa8002423b90, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xfffffa8002423060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ DevicePointer: 0xfffffa8002211680, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\ ------------ End ---------- Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ Upper DeviceData: 0xfffff8a0008227b0, 0xfffffa8002423060, 0xfffffa8001ce0090 Lower DeviceData: 0xfffff8a0036853a0, 0xfffffa8002211680, 0xfffffa8003ef5e40 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Scanning directory: C:\Windows\system32\drivers... <<<2>>> Device number: 0, partition: 2 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Done! Drive 0 Scanning MBR on drive 0... Inspecting partition table: MBR Signature: 55AA Disk Signature: 135C058F Partition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 2048 Numsec = 407552 Partition file system is NTFS Partition is bootable Partition 1 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 409600 Numsec = 287277056 Partition 2 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 287686656 Numsec = 24891392 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 160041885696 bytes Sector size: 512 bytes Scanning physical sectors of unpartitioned space on drive 0 (1-2047-312561808-312581808)... Physical Sector Size: 512 Drive: 1, DevicePointer: 0xfffffa8002593790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xfffffa8003f4a040, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xfffffa8002593790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\ DevicePointer: 0xfffffa8003f0c060, DeviceName: \Device\000000a1\, DriverName: \Driver\USBSTOR\ ------------ End ---------- Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\ Upper DeviceData: 0xfffff8a0008227e0, 0xfffffa8002593790, 0xfffffa8001c4b790 Lower DeviceData: 0xfffff8a01140a5f0, 0xfffffa8003f0c060, 0xfffffa8003c1d750 Drive 1 Scanning MBR on drive 1... Inspecting partition table: MBR Signature: 55AA Disk Signature: 0 Partition information: Partition 0 type is Other (0xb) Partition is NOT ACTIVE. Partition starts at LBA: 32 Numsec = 15656928 Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 8016363520 bytes Sector size: 512 bytes Done! Performing system, memory and registry scan... Infected: HKLM\SOFTWARE\CLASSES\APPID\{F85FA3F2-D2C8-4D4D-BB1C-3181E691AF2B} --> [PUP.FaceThemes] Infected: HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{F85FA3F2-D2C8-4D4D-BB1C-3181E691AF2B} --> [PUP.FaceThemes] Infected: HKLM\SOFTWARE\CLASSES\TYPELIB\{A3F56272-CDB4-4310-9BB1-9A0D0757A3B3} --> [PUP.FaceThemes] Infected: HKLM\SOFTWARE\CLASSES\INTERFACE\{D6975F9E-15B2-4FE7-9D16-FC2E85CB201B} --> [PUP.FaceThemes] Infected: HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{D6975F9E-15B2-4FE7-9D16-FC2E85CB201B} --> [PUP.FaceThemes] Infected: HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{A3F56272-CDB4-4310-9BB1-9A0D0757A3B3} --> [PUP.FaceThemes] Infected: HKCU\SOFTWARE\CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} --> [Hijack.Trojan.Siredef.C] Infected: HKCU\SOFTWARE\CLASSES\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\INPROCSERVER32| --> [Trojan.0Access] Done! Scan finished Creating System Restore point... Scheduling clean up... <<<2>>> Device number: 0, partition: 2 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Executing an action fixdamage.exe... Success! Removal successful. No system shutdown is required. ======================================= --------------------------------------- Malwarebytes Anti-Rootkit BETA 1.05.0.1001 © Malwarebytes Corporation 2011-2012 OS version: 6.1.7601 Windows 7 Service Pack 1 x64 Account is Administrative Internet Explorer version: 10.0.9200.16576 Java version: 1.6.0_21 File system is: NTFS Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED CPU speed: 2.194000 GHz Memory total: 2075336704, free: 998584320 ------------ Kernel report ------------ 05/17/2013 11:55:39 ------------ Loaded modules ----------- \SystemRoot\system32\ntoskrnl.exe \SystemRoot\system32\hal.dll \SystemRoot\system32\kdcom.dll \SystemRoot\system32\mcupdate_GenuineIntel.dll \SystemRoot\system32\PSHED.dll \SystemRoot\system32\CLFS.SYS \SystemRoot\system32\CI.dll \SystemRoot\system32\drivers\Wdf01000.sys \SystemRoot\system32\drivers\WDFLDR.SYS \SystemRoot\system32\drivers\ACPI.sys \SystemRoot\system32\drivers\WMILIB.SYS \SystemRoot\system32\drivers\msisadrv.sys \SystemRoot\system32\drivers\pci.sys \SystemRoot\system32\drivers\vdrvroot.sys \SystemRoot\system32\drivers\isapnp.sys \SystemRoot\system32\drivers\mpio.sys \SystemRoot\System32\drivers\partmgr.sys \SystemRoot\system32\DRIVERS\compbatt.sys \SystemRoot\system32\DRIVERS\BATTC.SYS \SystemRoot\system32\drivers\volmgr.sys \SystemRoot\System32\drivers\volmgrx.sys \SystemRoot\system32\drivers\intelide.sys \SystemRoot\system32\drivers\PCIIDEX.SYS \SystemRoot\system32\drivers\aliide.sys \SystemRoot\system32\drivers\amdide.sys \SystemRoot\system32\drivers\cmdide.sys \SystemRoot\System32\drivers\mountmgr.sys \SystemRoot\system32\drivers\msdsm.sys \SystemRoot\system32\drivers\nvraid.sys \SystemRoot\system32\drivers\CLASSPNP.SYS \SystemRoot\system32\drivers\pciide.sys \SystemRoot\system32\drivers\viaide.sys \SystemRoot\system32\drivers\iaStorV.sys \SystemRoot\system32\drivers\atapi.sys \SystemRoot\system32\drivers\ataport.SYS \SystemRoot\system32\DRIVERS\lsi_sas.sys \SystemRoot\system32\DRIVERS\storport.sys \SystemRoot\system32\drivers\msahci.sys \SystemRoot\system32\drivers\HpSAMD.sys \SystemRoot\system32\DRIVERS\adp94xx.sys \SystemRoot\system32\DRIVERS\adpahci.sys \SystemRoot\system32\DRIVERS\adpu320.sys \SystemRoot\system32\drivers\amdsata.sys \SystemRoot\system32\DRIVERS\amdsbs.sys \SystemRoot\system32\drivers\amdxata.sys \SystemRoot\system32\DRIVERS\arc.sys \SystemRoot\system32\DRIVERS\arcsas.sys \SystemRoot\system32\DRIVERS\elxstor.sys \SystemRoot\system32\DRIVERS\iirsp.sys \SystemRoot\system32\DRIVERS\lsi_fc.sys \SystemRoot\system32\DRIVERS\lsi_sas2.sys \SystemRoot\system32\DRIVERS\lsi_scsi.sys \SystemRoot\system32\DRIVERS\megasas.sys \SystemRoot\system32\DRIVERS\MegaSR.sys \SystemRoot\system32\DRIVERS\nfrd960.sys \SystemRoot\system32\drivers\nvstor.sys \SystemRoot\system32\DRIVERS\ql2300.sys \SystemRoot\system32\DRIVERS\ql40xx.sys \SystemRoot\system32\DRIVERS\SiSRaid2.sys \SystemRoot\system32\DRIVERS\sisraid4.sys \SystemRoot\system32\DRIVERS\stexstor.sys \SystemRoot\system32\DRIVERS\vsmraid.sys \SystemRoot\system32\drivers\fltmgr.sys \SystemRoot\system32\drivers\fileinfo.sys \SystemRoot\System32\Drivers\Ntfs.sys \SystemRoot\System32\Drivers\msrpc.sys \SystemRoot\System32\Drivers\ksecdd.sys \SystemRoot\System32\Drivers\cng.sys \SystemRoot\System32\drivers\pcw.sys \SystemRoot\System32\Drivers\Fs_Rec.sys \SystemRoot\system32\drivers\ndis.sys \SystemRoot\system32\drivers\NETIO.SYS \SystemRoot\System32\Drivers\ksecpkg.sys \SystemRoot\System32\drivers\tcpip.sys \SystemRoot\System32\drivers\fwpkclnt.sys \SystemRoot\system32\DRIVERS\wd.sys \SystemRoot\system32\drivers\volsnap.sys \SystemRoot\System32\Drivers\spldr.sys \SystemRoot\system32\drivers\sbp2port.sys \SystemRoot\System32\drivers\rdyboost.sys \SystemRoot\System32\Drivers\mup.sys \SystemRoot\System32\drivers\hwpolicy.sys \SystemRoot\System32\DRIVERS\fvevol.sys \SystemRoot\system32\DRIVERS\disk.sys \SystemRoot\system32\DRIVERS\avgrkx64.sys \SystemRoot\system32\DRIVERS\AVGIDSEH.Sys \SystemRoot\system32\DRIVERS\cdrom.sys \SystemRoot\system32\DRIVERS\avgmfx64.sys \SystemRoot\System32\Drivers\Null.SYS \SystemRoot\System32\Drivers\Beep.SYS \SystemRoot\System32\drivers\vga.sys \SystemRoot\System32\drivers\VIDEOPRT.SYS \SystemRoot\System32\drivers\watchdog.sys \SystemRoot\System32\DRIVERS\RDPCDD.sys \SystemRoot\system32\drivers\rdpencdd.sys \SystemRoot\system32\drivers\rdprefmp.sys \SystemRoot\System32\Drivers\Msfs.SYS \SystemRoot\System32\Drivers\Npfs.SYS \SystemRoot\system32\DRIVERS\tdx.sys \SystemRoot\system32\DRIVERS\TDI.SYS \SystemRoot\system32\DRIVERS\avgtdia.sys \SystemRoot\System32\DRIVERS\netbt.sys \SystemRoot\system32\drivers\afd.sys \SystemRoot\system32\DRIVERS\wfplwf.sys \SystemRoot\system32\DRIVERS\pacer.sys \SystemRoot\system32\DRIVERS\vwififlt.sys \SystemRoot\system32\DRIVERS\netbios.sys \SystemRoot\system32\DRIVERS\wanarp.sys \SystemRoot\system32\drivers\termdd.sys \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS \SystemRoot\system32\DRIVERS\rdbss.sys \SystemRoot\system32\drivers\nsiproxy.sys \SystemRoot\system32\drivers\mssmbios.sys \SystemRoot\System32\drivers\discache.sys \SystemRoot\System32\Drivers\dfsc.sys \SystemRoot\system32\DRIVERS\blbdrive.sys \SystemRoot\system32\DRIVERS\avgldx64.sys \SystemRoot\system32\DRIVERS\tunnel.sys \SystemRoot\system32\DRIVERS\intelppm.sys \SystemRoot\system32\drivers\wmiacpi.sys \SystemRoot\system32\DRIVERS\igdkmd64.sys \SystemRoot\System32\drivers\dxgkrnl.sys \SystemRoot\System32\drivers\dxgmms1.sys \SystemRoot\system32\drivers\usbuhci.sys \SystemRoot\system32\drivers\USBPORT.SYS \SystemRoot\system32\drivers\usbehci.sys \SystemRoot\system32\drivers\HDAudBus.sys \SystemRoot\system32\DRIVERS\Rt64win7.sys \SystemRoot\system32\DRIVERS\athrx.sys \SystemRoot\system32\DRIVERS\vwifibus.sys \SystemRoot\system32\drivers\i8042prt.sys \SystemRoot\system32\DRIVERS\HpqKbFiltr.sys \SystemRoot\system32\drivers\kbdclass.sys \SystemRoot\system32\DRIVERS\SynTP.sys \SystemRoot\system32\DRIVERS\USBD.SYS \SystemRoot\system32\DRIVERS\mouclass.sys \SystemRoot\system32\DRIVERS\CmBatt.sys \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys \SystemRoot\system32\drivers\CompositeBus.sys \SystemRoot\system32\DRIVERS\AgileVpn.sys \SystemRoot\system32\DRIVERS\rasl2tp.sys \SystemRoot\system32\DRIVERS\ndistapi.sys \SystemRoot\system32\DRIVERS\ndiswan.sys \SystemRoot\system32\DRIVERS\raspppoe.sys \SystemRoot\system32\DRIVERS\raspptp.sys \SystemRoot\system32\DRIVERS\rassstp.sys \SystemRoot\system32\DRIVERS\mcdbus.sys \SystemRoot\system32\DRIVERS\SCSIPORT.SYS \SystemRoot\system32\drivers\swenum.sys \SystemRoot\system32\drivers\ks.sys \SystemRoot\system32\drivers\umbus.sys \SystemRoot\system32\DRIVERS\usbhub.sys \SystemRoot\System32\Drivers\NDProxy.SYS \SystemRoot\system32\drivers\CHDRT64.sys \SystemRoot\system32\drivers\portcls.sys \SystemRoot\system32\drivers\drmk.sys \SystemRoot\system32\drivers\ksthunk.sys \SystemRoot\system32\DRIVERS\CAXHWAZL.sys \SystemRoot\system32\DRIVERS\CAX_DPV.sys \SystemRoot\system32\DRIVERS\CAX_CNXT.sys \SystemRoot\system32\drivers\modem.sys \SystemRoot\system32\drivers\IntcHdmi.sys \SystemRoot\system32\DRIVERS\udfs.sys \SystemRoot\system32\DRIVERS\cdfs.sys \SystemRoot\System32\Drivers\crashdmp.sys \SystemRoot\System32\Drivers\dump_dumpata.sys \SystemRoot\System32\Drivers\dump_msahci.sys \SystemRoot\System32\Drivers\dump_dumpfve.sys \SystemRoot\System32\win32k.sys \SystemRoot\System32\drivers\Dxapi.sys \SystemRoot\system32\DRIVERS\monitor.sys \SystemRoot\System32\TSDDD.dll \SystemRoot\System32\cdd.dll \SystemRoot\system32\drivers\luafv.sys \SystemRoot\system32\DRIVERS\lltdio.sys \SystemRoot\system32\DRIVERS\nwifi.sys \SystemRoot\system32\DRIVERS\ndisuio.sys \SystemRoot\system32\DRIVERS\rspndr.sys \SystemRoot\system32\drivers\HTTP.sys \SystemRoot\System32\DRIVERS\srvnet.sys \SystemRoot\system32\DRIVERS\bowser.sys \SystemRoot\system32\DRIVERS\mrxsmb.sys \SystemRoot\system32\DRIVERS\mrxsmb10.sys \SystemRoot\system32\DRIVERS\mrxsmb20.sys \SystemRoot\System32\DRIVERS\srv2.sys \SystemRoot\System32\DRIVERS\srv.sys \SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys \SystemRoot\system32\DRIVERS\mdmxsdk.sys \SystemRoot\system32\drivers\peauth.sys \SystemRoot\System32\Drivers\secdrv.SYS \SystemRoot\System32\drivers\tcpipreg.sys \SystemRoot\system32\DRIVERS\XAudio64.sys \SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys \SystemRoot\system32\DRIVERS\USBSTOR.SYS \SystemRoot\System32\Drivers\fastfat.SYS \SystemRoot\system32\drivers\WudfPf.sys \SystemRoot\system32\DRIVERS\WUDFRd.sys \SystemRoot\System32\drivers\mpsdrv.sys \??\C:\Windows\system32\drivers\mbamchameleon.sys \??\C:\Windows\system32\drivers\mbamswissarmy.sys \Windows\System32\ntdll.dll \Windows\System32\smss.exe \Windows\System32\apisetschema.dll ----------- End ----------- <<<1>>> Upper Device Name: \Device\Harddisk1\DR1 Upper Device Object: 0xfffffa8002593790 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\000000a1\ Lower Device Object: 0xfffffa8003f0c060 Lower Device Driver Name: \Driver\USBSTOR\ Device already Exists: 0xfffffa8003c1d750 <<<1>>> Upper Device Name: \Device\Harddisk0\DR0 Upper Device Object: 0xfffffa8002423060 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\ Lower Device Object: 0xfffffa8002211680 Lower Device Driver Name: \Driver\atapi\ Device already Exists: 0xfffffa8003ef5e40 Initializing... Done! <<<2>>> Device number: 0, partition: 2 Physical Sector Size: 512 Drive: 0, DevicePointer: 0xfffffa8002423060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xfffffa8002423b90, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xfffffa8002423060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ DevicePointer: 0xfffffa8002211680, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\ ------------ End ---------- Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ Upper DeviceData: 0xfffff8a00449f580, 0xfffffa8002423060, 0xfffffa8001ce0090 Lower DeviceData: 0xfffff8a011a99230, 0xfffffa8002211680, 0xfffffa8003ef5e40 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Scanning directory: C:\Windows\system32\drivers... <<<2>>> Device number: 0, partition: 2 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Done! Drive 0 Scanning MBR on drive 0... Inspecting partition table: MBR Signature: 55AA Disk Signature: 135C058F Partition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 2048 Numsec = 407552 Partition file system is NTFS Partition is bootable Partition 1 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 409600 Numsec = 287277056 Partition 2 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 287686656 Numsec = 24891392 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 160041885696 bytes Sector size: 512 bytes Scanning physical sectors of unpartitioned space on drive 0 (1-2047-312561808-312581808)... Physical Sector Size: 512 Drive: 1, DevicePointer: 0xfffffa8002593790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xfffffa8003f4a040, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xfffffa8002593790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\ DevicePointer: 0xfffffa8003f0c060, DeviceName: \Device\000000a1\, DriverName: \Driver\USBSTOR\ ------------ End ---------- Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\ Upper DeviceData: 0xfffff8a011a12230, 0xfffffa8002593790, 0xfffffa8001c4b790 Lower DeviceData: 0xfffff8a010427940, 0xfffffa8003f0c060, 0xfffffa8003c1d750 Drive 1 Scanning MBR on drive 1... Inspecting partition table: MBR Signature: 55AA Disk Signature: 0 Partition information: Partition 0 type is Other (0xb) Partition is NOT ACTIVE. Partition starts at LBA: 32 Numsec = 15656928 Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 8016363520 bytes Sector size: 512 bytes Done! Performing system, memory and registry scan... Infected: HKCU\SOFTWARE\CLASSES\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9} --> [Hijack.Trojan.Siredef.C] Done! Scan finished Creating System Restore point... Scheduling clean up... <<<2>>> Device number: 0, partition: 2 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Executing an action fixdamage.exe... Success! Removal successful. No system shutdown is required. ======================================= --------------------------------------- Malwarebytes Anti-Rootkit BETA 1.05.0.1001 © Malwarebytes Corporation 2011-2012 OS version: 6.1.7601 Windows 7 Service Pack 1 x64 Account is Administrative Internet Explorer version: 10.0.9200.16576 Java version: 1.6.0_21 File system is: NTFS Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED CPU speed: 2.194000 GHz Memory total: 2075336704, free: 1079119872 Removal queue found; removal started Removal finished ======================================= --------------------------------------- Malwarebytes Anti-Rootkit BETA 1.05.0.1001 © Malwarebytes Corporation 2011-2012 OS version: 6.1.7601 Windows 7 Service Pack 1 x64 Account is Administrative Internet Explorer version: 10.0.9200.16576 Java version: 1.6.0_21 File system is: NTFS Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED CPU speed: 2.194000 GHz Memory total: 2075336704, free: 917045248 ------------ Kernel report ------------ 05/17/2013 12:17:38 ------------ Loaded modules ----------- \SystemRoot\system32\ntoskrnl.exe \SystemRoot\system32\hal.dll \SystemRoot\system32\kdcom.dll \SystemRoot\system32\mcupdate_GenuineIntel.dll \SystemRoot\system32\PSHED.dll \SystemRoot\system32\CLFS.SYS \SystemRoot\system32\CI.dll \SystemRoot\system32\drivers\Wdf01000.sys \SystemRoot\system32\drivers\WDFLDR.SYS \SystemRoot\system32\drivers\ACPI.sys \SystemRoot\system32\drivers\WMILIB.SYS \SystemRoot\system32\drivers\msisadrv.sys \SystemRoot\system32\drivers\pci.sys \SystemRoot\system32\drivers\vdrvroot.sys \SystemRoot\system32\drivers\isapnp.sys \SystemRoot\system32\drivers\mpio.sys \SystemRoot\System32\drivers\partmgr.sys \SystemRoot\system32\DRIVERS\compbatt.sys \SystemRoot\system32\DRIVERS\BATTC.SYS \SystemRoot\system32\drivers\volmgr.sys \SystemRoot\System32\drivers\volmgrx.sys \SystemRoot\system32\drivers\intelide.sys \SystemRoot\system32\drivers\PCIIDEX.SYS \SystemRoot\system32\drivers\aliide.sys \SystemRoot\system32\drivers\amdide.sys \SystemRoot\system32\drivers\cmdide.sys \SystemRoot\System32\drivers\mountmgr.sys \SystemRoot\system32\drivers\msdsm.sys \SystemRoot\system32\drivers\nvraid.sys \SystemRoot\system32\drivers\CLASSPNP.SYS \SystemRoot\system32\drivers\pciide.sys \SystemRoot\system32\drivers\viaide.sys \SystemRoot\system32\drivers\iaStorV.sys \SystemRoot\system32\drivers\atapi.sys \SystemRoot\system32\drivers\ataport.SYS \SystemRoot\system32\DRIVERS\lsi_sas.sys \SystemRoot\system32\DRIVERS\storport.sys \SystemRoot\system32\drivers\msahci.sys \SystemRoot\system32\drivers\HpSAMD.sys \SystemRoot\system32\DRIVERS\adp94xx.sys \SystemRoot\system32\DRIVERS\adpahci.sys \SystemRoot\system32\DRIVERS\adpu320.sys \SystemRoot\system32\drivers\amdsata.sys \SystemRoot\system32\DRIVERS\amdsbs.sys \SystemRoot\system32\drivers\amdxata.sys \SystemRoot\system32\DRIVERS\arc.sys \SystemRoot\system32\DRIVERS\arcsas.sys \SystemRoot\system32\DRIVERS\elxstor.sys \SystemRoot\system32\DRIVERS\iirsp.sys \SystemRoot\system32\DRIVERS\lsi_fc.sys \SystemRoot\system32\DRIVERS\lsi_sas2.sys \SystemRoot\system32\DRIVERS\lsi_scsi.sys \SystemRoot\system32\DRIVERS\megasas.sys \SystemRoot\system32\DRIVERS\MegaSR.sys \SystemRoot\system32\DRIVERS\nfrd960.sys \SystemRoot\system32\drivers\nvstor.sys \SystemRoot\system32\DRIVERS\ql2300.sys \SystemRoot\system32\DRIVERS\ql40xx.sys \SystemRoot\system32\DRIVERS\SiSRaid2.sys \SystemRoot\system32\DRIVERS\sisraid4.sys \SystemRoot\system32\DRIVERS\stexstor.sys \SystemRoot\system32\DRIVERS\vsmraid.sys \SystemRoot\system32\drivers\fltmgr.sys \SystemRoot\system32\drivers\fileinfo.sys \SystemRoot\System32\Drivers\Ntfs.sys \SystemRoot\System32\Drivers\msrpc.sys \SystemRoot\System32\Drivers\ksecdd.sys \SystemRoot\System32\Drivers\cng.sys \SystemRoot\System32\drivers\pcw.sys \SystemRoot\System32\Drivers\Fs_Rec.sys \SystemRoot\system32\drivers\ndis.sys \SystemRoot\system32\drivers\NETIO.SYS \SystemRoot\System32\Drivers\ksecpkg.sys \SystemRoot\System32\drivers\tcpip.sys \SystemRoot\System32\drivers\fwpkclnt.sys \SystemRoot\system32\DRIVERS\wd.sys \SystemRoot\system32\drivers\volsnap.sys \SystemRoot\System32\Drivers\spldr.sys \SystemRoot\system32\drivers\sbp2port.sys \SystemRoot\System32\drivers\rdyboost.sys \SystemRoot\System32\Drivers\mup.sys \SystemRoot\System32\drivers\hwpolicy.sys \SystemRoot\System32\DRIVERS\fvevol.sys \SystemRoot\system32\DRIVERS\disk.sys \SystemRoot\system32\DRIVERS\avgrkx64.sys \SystemRoot\system32\DRIVERS\AVGIDSEH.Sys \SystemRoot\system32\DRIVERS\cdrom.sys \SystemRoot\system32\DRIVERS\avgmfx64.sys \SystemRoot\System32\Drivers\Null.SYS \SystemRoot\System32\Drivers\Beep.SYS \SystemRoot\System32\drivers\vga.sys \SystemRoot\System32\drivers\VIDEOPRT.SYS \SystemRoot\System32\drivers\watchdog.sys \SystemRoot\System32\DRIVERS\RDPCDD.sys \SystemRoot\system32\drivers\rdpencdd.sys \SystemRoot\system32\drivers\rdprefmp.sys \SystemRoot\System32\Drivers\Msfs.SYS \SystemRoot\System32\Drivers\Npfs.SYS \SystemRoot\system32\DRIVERS\tdx.sys \SystemRoot\system32\DRIVERS\TDI.SYS \SystemRoot\system32\DRIVERS\avgtdia.sys \SystemRoot\System32\DRIVERS\netbt.sys \SystemRoot\system32\drivers\afd.sys \SystemRoot\system32\DRIVERS\wfplwf.sys \SystemRoot\system32\DRIVERS\pacer.sys \SystemRoot\system32\DRIVERS\vwififlt.sys \SystemRoot\system32\DRIVERS\netbios.sys \SystemRoot\system32\DRIVERS\wanarp.sys \SystemRoot\system32\drivers\termdd.sys \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS \SystemRoot\system32\DRIVERS\rdbss.sys \SystemRoot\system32\drivers\nsiproxy.sys \SystemRoot\system32\drivers\mssmbios.sys \SystemRoot\System32\drivers\discache.sys \SystemRoot\System32\Drivers\dfsc.sys \SystemRoot\system32\DRIVERS\blbdrive.sys \SystemRoot\system32\DRIVERS\avgldx64.sys \SystemRoot\system32\DRIVERS\tunnel.sys \SystemRoot\system32\DRIVERS\intelppm.sys \SystemRoot\system32\drivers\wmiacpi.sys \SystemRoot\system32\DRIVERS\igdkmd64.sys \SystemRoot\System32\drivers\dxgkrnl.sys \SystemRoot\System32\drivers\dxgmms1.sys \SystemRoot\system32\drivers\usbuhci.sys \SystemRoot\system32\drivers\USBPORT.SYS \SystemRoot\system32\drivers\usbehci.sys \SystemRoot\system32\drivers\HDAudBus.sys \SystemRoot\system32\DRIVERS\Rt64win7.sys \SystemRoot\system32\DRIVERS\athrx.sys \SystemRoot\system32\DRIVERS\vwifibus.sys \SystemRoot\system32\drivers\i8042prt.sys \SystemRoot\system32\DRIVERS\HpqKbFiltr.sys \SystemRoot\system32\drivers\kbdclass.sys \SystemRoot\system32\DRIVERS\SynTP.sys \SystemRoot\system32\DRIVERS\USBD.SYS \SystemRoot\system32\DRIVERS\mouclass.sys \SystemRoot\system32\DRIVERS\CmBatt.sys \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys \SystemRoot\system32\drivers\CompositeBus.sys \SystemRoot\system32\DRIVERS\AgileVpn.sys \SystemRoot\system32\DRIVERS\rasl2tp.sys \SystemRoot\system32\DRIVERS\ndistapi.sys \SystemRoot\system32\DRIVERS\ndiswan.sys \SystemRoot\system32\DRIVERS\raspppoe.sys \SystemRoot\system32\DRIVERS\raspptp.sys \SystemRoot\system32\DRIVERS\rassstp.sys \SystemRoot\system32\DRIVERS\mcdbus.sys \SystemRoot\system32\DRIVERS\SCSIPORT.SYS \SystemRoot\system32\drivers\swenum.sys \SystemRoot\system32\drivers\ks.sys \SystemRoot\system32\drivers\umbus.sys \SystemRoot\system32\DRIVERS\usbhub.sys \SystemRoot\System32\Drivers\NDProxy.SYS \SystemRoot\system32\drivers\CHDRT64.sys \SystemRoot\system32\drivers\portcls.sys \SystemRoot\system32\drivers\drmk.sys \SystemRoot\system32\drivers\ksthunk.sys \SystemRoot\system32\DRIVERS\CAXHWAZL.sys \SystemRoot\system32\DRIVERS\CAX_DPV.sys \SystemRoot\system32\DRIVERS\CAX_CNXT.sys \SystemRoot\system32\drivers\modem.sys \SystemRoot\system32\drivers\IntcHdmi.sys \SystemRoot\system32\DRIVERS\udfs.sys \SystemRoot\system32\DRIVERS\cdfs.sys \SystemRoot\System32\Drivers\crashdmp.sys \SystemRoot\System32\Drivers\dump_dumpata.sys \SystemRoot\System32\Drivers\dump_msahci.sys \SystemRoot\System32\Drivers\dump_dumpfve.sys \SystemRoot\System32\win32k.sys \SystemRoot\System32\drivers\Dxapi.sys \SystemRoot\system32\DRIVERS\monitor.sys \SystemRoot\System32\TSDDD.dll \SystemRoot\System32\cdd.dll \SystemRoot\system32\drivers\luafv.sys \SystemRoot\system32\DRIVERS\lltdio.sys \SystemRoot\system32\DRIVERS\nwifi.sys \SystemRoot\system32\DRIVERS\ndisuio.sys \SystemRoot\system32\DRIVERS\rspndr.sys \SystemRoot\system32\drivers\HTTP.sys \SystemRoot\System32\DRIVERS\srvnet.sys \SystemRoot\system32\DRIVERS\bowser.sys \SystemRoot\System32\drivers\mpsdrv.sys \SystemRoot\system32\DRIVERS\mrxsmb.sys \SystemRoot\system32\DRIVERS\mrxsmb10.sys \SystemRoot\system32\DRIVERS\mrxsmb20.sys \SystemRoot\System32\DRIVERS\srv2.sys \SystemRoot\System32\DRIVERS\srv.sys \SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys \SystemRoot\system32\DRIVERS\mdmxsdk.sys \SystemRoot\system32\drivers\peauth.sys \SystemRoot\System32\Drivers\secdrv.SYS \SystemRoot\System32\drivers\tcpipreg.sys \SystemRoot\system32\DRIVERS\XAudio64.sys \SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys \SystemRoot\system32\DRIVERS\USBSTOR.SYS \SystemRoot\System32\Drivers\fastfat.SYS \SystemRoot\system32\drivers\WudfPf.sys \SystemRoot\system32\DRIVERS\WUDFRd.sys \SystemRoot\system32\drivers\spsys.sys \??\C:\Windows\system32\drivers\mbamchameleon.sys \??\C:\Windows\system32\drivers\mbamswissarmy.sys \Windows\System32\ntdll.dll \Windows\System32\smss.exe \Windows\System32\apisetschema.dll ----------- End ----------- <<<1>>> Upper Device Name: \Device\Harddisk1\DR1 Upper Device Object: 0xfffffa8001caa790 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\000000a1\ Lower Device Object: 0xfffffa8001cc5060 Lower Device Driver Name: \Driver\USBSTOR\ Driver name found: USBSTOR Initialization returned 0x0 Load Function returned 0x0 <<<1>>> Upper Device Name: \Device\Harddisk0\DR0 Upper Device Object: 0xfffffa800273f660 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\ Lower Device Object: 0xfffffa8002282680 Lower Device Driver Name: \Driver\atapi\ Driver name found: atapi Initialization returned 0x0 Port sub-driver loaded: \??\C:\Windows\System32\drivers\ataport.sys (0x0) Load Function returned 0x0 Initializing... Done! <<<2>>> Device number: 0, partition: 2 Physical Sector Size: 512 Drive: 0, DevicePointer: 0xfffffa800273f660, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xfffffa8002740040, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xfffffa800273f660, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ DevicePointer: 0xfffffa8002282680, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\ ------------ End ---------- Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ Upper DeviceData: 0xfffff8a00586e0d0, 0xfffffa800273f660, 0xfffffa8001ff8090 Lower DeviceData: 0xfffff8a0054564e0, 0xfffffa8002282680, 0xfffffa80020fd7d0 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Scanning directory: C:\Windows\system32\drivers... <<<2>>> Device number: 0, partition: 2 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Done! Drive 0 Scanning MBR on drive 0... Inspecting partition table: MBR Signature: 55AA Disk Signature: 135C058F Partition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 2048 Numsec = 407552 Partition file system is NTFS Partition is bootable Partition 1 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 409600 Numsec = 287277056 Partition 2 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 287686656 Numsec = 24891392 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 160041885696 bytes Sector size: 512 bytes Scanning physical sectors of unpartitioned space on drive 0 (1-2047-312561808-312581808)... Physical Sector Size: 512 Drive: 1, DevicePointer: 0xfffffa8001caa790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xfffffa8001c63040, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xfffffa8001caa790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\ DevicePointer: 0xfffffa8001cc5060, DeviceName: \Device\000000a1\, DriverName: \Driver\USBSTOR\ ------------ End ---------- Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\ Upper DeviceData: 0xfffff8a00586e130, 0xfffffa8001caa790, 0xfffffa80020c5090 Lower DeviceData: 0xfffff8a0053fe9b0, 0xfffffa8001cc5060, 0xfffffa8002020130 Drive 1 Scanning MBR on drive 1... Inspecting partition table: MBR Signature: 55AA Disk Signature: 0 Partition information: Partition 0 type is Other (0xb) Partition is NOT ACTIVE. Partition starts at LBA: 32 Numsec = 15656928 Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 8016363520 bytes Sector size: 512 bytes Done! Performing system, memory and registry scan... Done! Scan finished =======================================
  11. ohh sorry, yes it does. I am currenlty doing my second scan with malwarebytes. I will post the logs once it is finished.
  12. Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-05-2013 Ran by SYSTEM at 2013-05-17 11:30:58 Run:1 Running from G:\ Boot Mode: Recovery ============================================== HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default => Value was restored successfully. HKEY_USERS\Owner\Software\Microsoft\Windows\CurrentVersion\Run\\qcgce2mrvjq91kk1e7pnbb19m52fx => Value deleted successfully. HKEY_USERS\Owner\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully. C:\ProgramData\2433f433 => Moved successfully. C:\Users\Owner\AppData\Local\2433f433 => Moved successfully. C:\Users\Owner\AppData\Roaming\2433f433 => Moved successfully. C:\Users\Owner\Documents\29ca7cd9.exe => Moved successfully. C:\$Recycle.Bin\S-1-5-21-2861860325-1608682575-3244310698-1000\$708e671f3545291506c06082039c15b2 => Moved successfully. C:\$Recycle.Bin\S-1-5-18\$708e671f3545291506c06082039c15b2 => Moved successfully. C:\$Recycle.Bin\S-1-5-18\$708e671f3545291506c06082039c15b2\n. => File/Directory not found. ==== End of Fixlog ====
  13. I got the Hijack Virus "Computer Crime & Intellectual Property". Here is my log after scanning. Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-05-2013 Ran by SYSTEM on 17-05-2013 10:44:13 Running from G:\ Windows 7 Home Premium (X64) OS Language: English(US) Internet Explorer Version 9 Boot Mode: Recovery The current controlset is ControlSet001 ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log. ==================== Registry (Whitelisted) ================== HKLM\...\Run: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1808168 2009-06-18] (Synaptics Incorporated) HKLM\...\Run: [cAudioFilterAgent] C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [495104 2009-07-14] (Conexant Systems, Inc.) HKLM\...\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" [171520 2009-08-17] (Sun Microsystems, Inc.) HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] C:\$Recycle.Bin\S-1-5-18\$708e671f3545291506c06082039c15b2\n. ATTENTION! ====> ZeroAccess HKLM-x32\...\Run: [QPService] "C:\Program Files (x86)\HP\QuickPlay\QPService.exe" [468264 2009-06-23] (CyberLink Corp.) HKLM-x32\...\Run: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start [323640 2009-11-24] ( Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [updatePRCShortCut] "C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Hewlett-Packard\Recovery" UpdateWithCreateOnce "Software\CyberLink\PowerRecover" [222504 2009-05-19] (CyberLink Corp.) HKLM-x32\...\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [54576 2008-12-08] (Hewlett-Packard) HKLM-x32\...\Run: [] [x] HKLM-x32\...\Run: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [498744 2009-07-23] (Hewlett-Packard) HKLM-x32\...\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation) HKLM-x32\...\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [248552 2010-05-14] (Sun Microsystems, Inc.) HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2010-11-29] (Apple Inc.) HKLM-x32\...\Run: [bncsaui.exe] %ProgramFiles%\Bradford Networks\Persistent Agent\bncsaui.exe [2625304 2010-09-29] (Bradford Networks) HKLM-x32\...\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe [2345592 2012-08-01] (AVG Technologies CZ, s.r.o.) HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-05-30] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421776 2012-06-07] (Apple Inc.) HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated) HKU\Default\...\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1668664 2009-07-15] (Hewlett-Packard) HKU\Default\...\Policies\system: [WallpaperStyle] 2 HKU\Default User\...\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1668664 2009-07-15] (Hewlett-Packard) HKU\Default User\...\Policies\system: [WallpaperStyle] 2 HKU\Owner\...\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1668664 2009-07-15] (Hewlett-Packard) HKU\Owner\...\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden [2363392 2010-01-22] (Hewlett-Packard Company) HKU\Owner\...\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [5629312 2013-01-07] (SUPERAntiSpyware.com) HKU\Owner\...\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent [3325952 2009-03-28] (Electronic Arts) HKU\Owner\...\Run: [ROC_ROC_APR2013_AV] C:\Users\Owner\AppData\Roaming\AVG April 2013 Campaign\AVG-Secure-Search-Update.exe /PROMPT --mid 81a617cf71db2c1ec1ee89d706ce56e8-4cd87842c5a390c2d205201fdc60c1ae43e8325e --CMPID ROC_APR2013_AV [x] HKU\Owner\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] C:\Users\Owner\Documents\29ca7cd9.exe [24064 2013-05-17] () HKU\Owner\...\Policies\system: [WallpaperStyle] 2 HKU\Owner\...\Winlogon: [shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation) <==== ATTENTION Startup: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk ShortcutTarget: MagicDisc.lnk -> C:\Program Files (x86)\MagicDisc\MagicDisc.exe (MagicISO, Inc.) Startup: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) BootExecute: autocheck autochk * C:\PROGRA~2\AVG\AVG10\avgchsva.exe /syncC:\PROGRA~2\AVG\AVG10\avgrsa.exe /sync /restart ==================== Services (Whitelisted) ================= S2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [140672 2013-01-07] (SUPERAntiSpyware.com) S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [7391072 2012-01-31] (AVG Technologies CZ, s.r.o.) S2 avgwd; C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe [269520 2011-02-08] (AVG Technologies CZ, s.r.o.) S2 BNPagent; C:\Program Files (x86)\Bradford Networks\Persistent Agent\bndaemon.exe [3067672 2010-09-29] (Bradford Networks) S2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [66872 2011-07-07] () S2 PnkBstrB; C:\Windows\SysWow64\PnkBstrB.exe [107832 2011-07-07] () S2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-01-21] () ==================== Drivers (Whitelisted) ==================== S3 AVGIDSDriver; C:\Windows\System32\DRIVERS\AVGIDSDriver.Sys [118864 2011-05-27] (AVG Technologies CZ, s.r.o. ) S0 AVGIDSEH; C:\Windows\System32\DRIVERS\AVGIDSEH.Sys [26704 2011-02-22] (AVG Technologies CZ, s.r.o. ) S3 AVGIDSFilter; C:\Windows\System32\DRIVERS\AVGIDSFilter.Sys [29264 2011-02-10] (AVG Technologies CZ, s.r.o. ) S1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [312160 2012-11-12] (AVG Technologies CZ, s.r.o.) S1 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [41552 2011-03-01] (AVG Technologies CZ, s.r.o.) S0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [37456 2011-03-16] (AVG Technologies CZ, s.r.o.) S1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [377936 2011-04-04] (AVG Technologies CZ, s.r.o.) S1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com) S1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com) S4 eabfiltr; S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x] S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [x] S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-05-17 10:44 - 2013-05-17 10:44 - 00000000 ____D C:\FRST 2013-05-17 06:14 - 2013-05-17 06:14 - 00001400 ____A C:\Windows\PFRO.log 2013-05-17 06:12 - 2013-05-17 06:12 - 00174351 ____A C:\ProgramData\2433f433 2013-05-17 06:12 - 2013-05-17 06:12 - 00174332 ____A C:\Users\Owner\AppData\Local\2433f433 2013-05-17 06:12 - 2013-05-17 06:12 - 00174328 ____A C:\Users\Owner\AppData\Roaming\2433f433 2013-05-17 06:12 - 2013-05-17 06:12 - 00024064 ____A C:\Users\Owner\Documents\29ca7cd9.exe 2013-05-16 17:54 - 2013-05-17 06:27 - 00000336 ____A C:\Windows\setupact.log 2013-05-16 17:54 - 2013-05-16 17:54 - 00000000 ____A C:\Windows\setuperr.log 2013-05-15 14:07 - 2013-04-04 22:52 - 02242048 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2013-05-15 14:07 - 2013-04-04 22:52 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2013-05-15 14:07 - 2013-04-04 22:52 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe 2013-05-15 14:07 - 2013-04-04 22:50 - 19231232 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2013-05-15 14:07 - 2013-04-04 22:50 - 15404032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2013-05-15 14:07 - 2013-04-04 22:50 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2013-05-15 14:07 - 2013-04-04 22:50 - 02647552 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2013-05-15 14:07 - 2013-04-04 22:50 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2013-05-15 14:07 - 2013-04-04 22:50 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2013-05-15 14:07 - 2013-04-04 22:50 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2013-05-15 14:07 - 2013-04-04 22:50 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll 2013-05-15 14:07 - 2013-04-04 22:50 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll 2013-05-15 14:07 - 2013-04-04 22:50 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2013-05-15 14:07 - 2013-04-04 22:50 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll 2013-05-15 14:07 - 2013-04-04 21:28 - 01767424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-05-15 14:07 - 2013-04-04 21:28 - 01130496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-05-15 14:07 - 2013-04-04 21:26 - 14323712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-05-15 14:07 - 2013-04-04 21:26 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-05-15 14:07 - 2013-04-04 21:26 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-05-15 14:07 - 2013-04-04 21:26 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-05-15 14:07 - 2013-04-04 21:26 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-05-15 14:07 - 2013-04-04 21:26 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-05-15 14:07 - 2013-04-04 21:26 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-05-15 14:07 - 2013-04-04 21:26 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-05-15 14:07 - 2013-04-04 21:26 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-05-15 14:07 - 2013-04-04 21:26 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-05-15 14:07 - 2013-04-04 21:26 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-05-15 14:07 - 2013-04-04 20:43 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2013-05-15 14:07 - 2013-04-04 20:29 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-05-15 14:07 - 2013-04-04 19:51 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe 2013-05-15 14:07 - 2013-04-04 19:38 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-05-15 01:29 - 2013-04-09 22:01 - 00983400 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys 2013-05-15 01:29 - 2013-04-09 22:01 - 00265064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys 2013-05-15 01:29 - 2013-04-09 19:30 - 03153920 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2013-05-15 01:29 - 2013-03-18 21:53 - 00230400 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll 2013-05-15 01:29 - 2013-03-18 21:53 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll 2013-05-15 01:29 - 2013-02-26 22:02 - 00111448 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe 2013-05-15 01:29 - 2013-02-26 21:52 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll 2013-05-15 01:29 - 2013-02-26 21:52 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll 2013-05-15 01:29 - 2013-02-26 21:48 - 01930752 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll 2013-05-15 01:29 - 2013-02-26 21:47 - 00070144 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll 2013-05-15 01:29 - 2013-02-26 20:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2013-05-15 01:29 - 2013-02-26 20:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll 2013-05-15 01:29 - 2013-02-26 20:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2013-05-15 01:29 - 2011-02-03 03:25 - 00144384 ____A (Microsoft Corporation) C:\Windows\System32\cdd.dll 2013-05-14 13:09 - 2013-05-14 13:09 - 17613192 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe 2013-05-02 16:07 - 2013-05-02 16:07 - 00171109 ____A C:\Users\Owner\Desktop\tesr.wma 2013-04-27 21:53 - 2013-04-27 21:54 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Stella 2013-04-27 21:18 - 2013-04-28 17:22 - 00000072 ____A C:\Users\Owner\Desktop\layout.jsf 2013-04-27 20:58 - 2013-04-27 21:00 - 00000000 ____D C:\Program Files (x86)\Project64 1.6 2013-04-27 17:19 - 2013-04-27 20:51 - 00000000 ____D C:\Users\Owner\Desktop\Games 2013-04-27 16:50 - 2013-04-27 17:10 - 569063376 ____A C:\Users\Owner\Downloads\mcg-torrent.rar 2013-04-23 18:39 - 2013-04-12 06:45 - 01656680 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys 2013-04-21 10:52 - 2013-04-21 10:52 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe 2013-04-21 10:52 - 2013-04-21 10:52 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll 2013-04-21 10:52 - 2013-04-21 10:52 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll 2013-04-21 10:52 - 2013-04-21 10:52 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2013-04-21 10:52 - 2013-04-21 10:52 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll 2013-04-21 10:52 - 2013-04-21 10:52 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2013-04-21 10:51 - 2013-04-21 10:51 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2013-04-21 10:51 - 2013-04-21 10:51 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat 2013-04-21 10:51 - 2013-04-21 10:51 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat 2013-04-21 10:51 - 2013-04-21 10:51 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec 2013-04-21 10:51 - 2013-04-21 10:51 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2013-04-21 10:51 - 2013-04-21 10:51 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2013-04-21 10:51 - 2013-04-21 10:51 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe 2013-04-21 10:51 - 2013-04-21 10:51 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe 2013-04-21 10:51 - 2013-04-21 10:51 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe 2013-04-21 10:51 - 2013-04-21 10:51 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe 2013-04-21 10:51 - 2013-04-21 10:51 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2013-04-21 10:51 - 2013-04-21 10:51 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe 2013-04-21 10:51 - 2013-04-21 10:51 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx 2013-04-21 10:51 - 2013-04-21 10:51 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe 2013-04-21 10:51 - 2013-04-21 10:51 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2013-04-21 10:51 - 2013-04-21 10:51 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe 2013-04-21 10:51 - 2013-04-21 10:51 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe 2013-04-21 10:51 - 2013-04-21 10:51 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe 2013-04-21 10:51 - 2013-04-21 10:51 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe ==================== One Month Modified Files and Folders ======= 2013-05-17 10:44 - 2013-05-17 10:44 - 00000000 ____D C:\FRST 2013-05-17 06:31 - 2009-10-23 08:45 - 01202107 ____A C:\Windows\WindowsUpdate.log 2013-05-17 06:28 - 2011-02-17 12:57 - 00000892 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-05-17 06:27 - 2013-05-16 17:54 - 00000336 ____A C:\Windows\setupact.log 2013-05-17 06:27 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2013-05-17 06:14 - 2013-05-17 06:14 - 00001400 ____A C:\Windows\PFRO.log 2013-05-17 06:12 - 2013-05-17 06:12 - 00174351 ____A C:\ProgramData\2433f433 2013-05-17 06:12 - 2013-05-17 06:12 - 00174332 ____A C:\Users\Owner\AppData\Local\2433f433 2013-05-17 06:12 - 2013-05-17 06:12 - 00174328 ____A C:\Users\Owner\AppData\Roaming\2433f433 2013-05-17 06:12 - 2013-05-17 06:12 - 00024064 ____A C:\Users\Owner\Documents\29ca7cd9.exe 2013-05-17 06:09 - 2012-07-06 16:45 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-05-17 06:04 - 2011-02-17 12:57 - 00000896 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-05-17 06:00 - 2011-05-12 06:14 - 00000000 ____D C:\Windows\System32\Drivers\AVG 2013-05-16 17:54 - 2013-05-16 17:54 - 00000000 ____A C:\Windows\setuperr.log 2013-05-16 12:58 - 2009-07-13 20:45 - 00023248 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-05-16 12:58 - 2009-07-13 20:45 - 00023248 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-05-15 18:30 - 2010-11-01 19:40 - 00000000 ____A C:\Users\Owner\AppData\Local\prvlcl.dat 2013-05-15 17:54 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache 2013-05-15 14:28 - 2012-08-06 09:48 - 00000000 ____D C:\Program Files\SUPERAntiSpyware 2013-05-15 14:28 - 2009-10-23 08:59 - 00000290 ____A C:\ProgramData\hpqp.ini 2013-05-15 14:26 - 2009-07-13 20:45 - 00433824 ____A C:\Windows\System32\FNTCACHE.DAT 2013-05-15 14:20 - 2009-12-17 16:46 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-05-15 14:15 - 2009-11-29 13:39 - 75016696 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe 2013-05-15 14:11 - 2009-07-13 21:13 - 00740814 ____A C:\Windows\System32\PerfStringBackup.INI 2013-05-14 13:09 - 2013-05-14 13:09 - 17613192 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe 2013-05-14 13:09 - 2012-07-06 16:45 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-05-14 13:09 - 2012-07-06 16:45 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-05-13 11:43 - 2012-06-04 10:21 - 00000000 ____A C:\Windows\System32\HP_ActiveX_Patch_NOT_DETECTED.txt 2013-05-13 11:43 - 2009-11-30 20:48 - 00000052 ____A C:\Windows\SysWOW64\DOErrors.log 2013-05-13 11:32 - 2012-09-15 21:28 - 00000332 ____A C:\Windows\Tasks\HPCeeScheduleForOwner.job 2013-05-02 16:07 - 2013-05-02 16:07 - 00171109 ____A C:\Users\Owner\Desktop\tesr.wma 2013-04-29 18:18 - 2011-04-30 22:12 - 00000000 ____D C:\Users\Owner\AppData\Roaming\BitTorrent 2013-04-28 17:22 - 2013-04-27 21:18 - 00000072 ____A C:\Users\Owner\Desktop\layout.jsf 2013-04-27 21:54 - 2013-04-27 21:53 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Stella 2013-04-27 21:00 - 2013-04-27 20:58 - 00000000 ____D C:\Program Files (x86)\Project64 1.6 2013-04-27 20:51 - 2013-04-27 17:19 - 00000000 ____D C:\Users\Owner\Desktop\Games 2013-04-27 17:10 - 2013-04-27 16:50 - 569063376 ____A C:\Users\Owner\Downloads\mcg-torrent.rar 2013-04-27 08:36 - 2010-01-23 18:40 - 00000021 ____A C:\ProgramData\hpqp.txt 2013-04-24 03:10 - 2012-05-02 19:24 - 00000000 ____D C:\Users\Owner\AppData\Local\TSVNCache 2013-04-21 10:56 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\PolicyDefinitions 2013-04-21 10:52 - 2013-04-21 10:52 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe 2013-04-21 10:52 - 2013-04-21 10:52 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll 2013-04-21 10:52 - 2013-04-21 10:52 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll 2013-04-21 10:52 - 2013-04-21 10:52 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2013-04-21 10:52 - 2013-04-21 10:52 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll 2013-04-21 10:52 - 2013-04-21 10:52 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2013-04-21 10:51 - 2013-04-21 10:51 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2013-04-21 10:51 - 2013-04-21 10:51 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat 2013-04-21 10:51 - 2013-04-21 10:51 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat 2013-04-21 10:51 - 2013-04-21 10:51 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec 2013-04-21 10:51 - 2013-04-21 10:51 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2013-04-21 10:51 - 2013-04-21 10:51 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2013-04-21 10:51 - 2013-04-21 10:51 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe 2013-04-21 10:51 - 2013-04-21 10:51 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe 2013-04-21 10:51 - 2013-04-21 10:51 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe 2013-04-21 10:51 - 2013-04-21 10:51 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe 2013-04-21 10:51 - 2013-04-21 10:51 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2013-04-21 10:51 - 2013-04-21 10:51 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe 2013-04-21 10:51 - 2013-04-21 10:51 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx 2013-04-21 10:51 - 2013-04-21 10:51 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe 2013-04-21 10:51 - 2013-04-21 10:51 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2013-04-21 10:51 - 2013-04-21 10:51 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll 2013-04-21 10:51 - 2013-04-21 10:51 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe 2013-04-21 10:51 - 2013-04-21 10:51 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe 2013-04-21 10:51 - 2013-04-21 10:51 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe 2013-04-21 10:51 - 2013-04-21 10:51 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe ZeroAccess: C:\$Recycle.Bin\S-1-5-21-2861860325-1608682575-3244310698-1000\$708e671f3545291506c06082039c15b2 ZeroAccess: C:\$Recycle.Bin\S-1-5-18\$708e671f3545291506c06082039c15b2 ==================== Known DLLs (Whitelisted) ================ ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= Restore point made on: 2013-05-05 15:00:39 Restore point made on: 2013-05-13 11:33:33 Restore point made on: 2013-05-15 14:06:20 ==================== Memory info =========================== Percentage of memory in use: 31% Total physical RAM: 1979.2 MB Available physical RAM: 1364.7 MB Total Pagefile: 1979.2 MB Available Pagefile: 1358 MB Total Virtual: 8192 MB Available Virtual: 8191.88 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:136.98 GB) (Free:49.03 GB) NTFS (Disk=0 Partition=2) ==>[system with boot components (obtained from reading drive)] Drive e: (RECOVERY) (Fixed) (Total:11.87 GB) (Free:2 GB) NTFS (Disk=0 Partition=3) ==>[system with boot components (obtained from reading drive)] Drive f: (Sims3) (CDROM) (Total:5.54 GB) (Free:0 GB) UDF Drive g: (STORE N GO) (Removable) (Total:7.45 GB) (Free:3.59 GB) FAT32 (Disk=1 Partition=1) Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Drive y: (SYSTEM) (Fixed) (Total:0.19 GB) (Free:0.16 GB) NTFS (Disk=0 Partition=1) ==>[system with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 149 GB) (Disk ID: 135C058F) Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=137 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=12 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 7 GB) (Disk ID: 00000000) Partition 1: (Not Active) - (Size=7 GB) - (Type=0B) Last Boot: 2013-05-13 20:59 ==================== End Of Log ============================
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.