Jump to content

wyoways

Members
  • Posts

    8
  • Joined

  • Last visited

Everything posted by wyoways

  1. Ran HyjackThis to stop start-up programs. Ran ESET, no threats found. Computer is working great. Thank you!
  2. The computer seems to be working fine. Thank you! Malwarebytes Anti-Malware (PRO) 1.75.0.1300 www.malwarebytes.org Database version: v2013.06.06.09 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 wyoways :: WYOWAYS-PC [administrator] Protection: Disabled 6/6/2013 9:49:37 PM mbam-log-2013-06-06 (21-49-37).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 226022 Time elapsed: 5 minute(s), 43 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 10:01:12 PM, on 6/6/2013 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v9.00 (9.00.8112.16483) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Windows\System32\Ctxfihlp.exe C:\Program Files\AVG\AVG2012\avgtray.exe C:\Program Files\AVG Secure Search\vprot.exe C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe C:\Program Files\Real\RealPlayer\Update\realsched.exe C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Garmin\Express Tray\ExpressTray.exe C:\Program Files\D-Link\D-Link DWA-552 Xtreme N Desktop Adapter\wirelesscm.exe C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE C:\Windows\ehome\ehmsas.exe C:\Windows\SYSTEM32\CTXFISPI.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Users\wyoways\Downloads\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r O4 - HKLM\..\Run: [updReg] C:\Windows\UpdReg.EXE O4 - HKLM\..\Run: [iAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe" O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE O4 - HKLM\..\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe" O4 - HKLM\..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe" O4 - HKLM\..\Run: [HTC Sync Loader] "C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Real\RealPlayer\Update\realsched.exe" -osboot O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [iSUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [GarminExpressTrayApp] "C:\Program Files\Garmin\Express Tray\ExpressTray.exe" O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE O4 - Global Startup: Wireless Connection Manager.lnk = C:\Program Files\D-Link\D-Link DWA-552 Xtreme N Desktop Adapter\wirelesscm.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre7\bin\jp2iexp.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre7\bin\jp2iexp.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O16 - DPF: Garmin Communicator Plug-In - https://static.garmincdn.com/gcp/ie/4.0.1.0/GarminAxControl_32.CAB O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgfws.exe O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2012\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Garmin Core Update Service - Garmin Ltd or its subsidiaries - C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe O23 - Service: Google Desktop Manager 5.9.1005.12335 (GoogleDesktopManager-051210-111108) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\D-Link\D-Link DWA-552 Xtreme N Desktop Adapter\jswpsapi.exe O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe O23 - Service: Internet Pass-Through Service (PassThru Service) - Unknown owner - C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe O23 - Service: RealNetworks Downloader Resolver Service - Unknown owner - C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - Unknown owner - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (file missing) O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: vToolbarUpdater14.2.0 - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe -- End of file - 9883 bytes
  3. Ran Combofix.exe The computer seems fine now. Thank You! Attached is the Combofix report: ComboFix 13-06-05.05 - wyoways 06/05/2013 21:53:40.4.4 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3325.1504 [GMT -5:00] Running from: c:\users\wyoways\Desktop\ComboFix.exe Command switches used :: c:\users\wyoways\Desktop\CFScript.txt AV: AVG Internet Security 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} FW: AVG Internet Security 2012 *Enabled* {621CC794-9486-F902-D092-0484E8EA828B} SP: AVG Internet Security 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2013-05-06 to 2013-06-06 ))))))))))))))))))))))))))))))) . . 2013-06-06 03:00 . 2013-06-06 03:00 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-06-05 20:44 . 2013-06-05 20:44 60872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2FE9F1FB-FC6D-41AF-BC33-BE1E1CD14640}\offreg.dll 2013-06-05 20:25 . 2013-05-14 06:49 7016152 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{2FE9F1FB-FC6D-41AF-BC33-BE1E1CD14640}\mpengine.dll 2013-06-05 00:01 . 2013-06-05 02:51 -------- d-----w- C:\FRST 2013-06-02 01:42 . 2013-04-04 19:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys 2013-06-01 01:26 . 2010-04-05 20:00 221568 ----a-w- c:\windows\system32\drivers\netio.sys 2013-06-01 00:53 . 2013-06-06 03:01 -------- d-----w- c:\users\wyoways\AppData\Local\temp 2013-05-30 22:49 . 2013-05-30 22:49 -------- d-----w- c:\users\wyoways\AppData\Roaming\TuneUp Software 2013-05-15 17:06 . 2013-05-05 19:12 2382848 ----a-w- c:\windows\system32\mshtml.tlb 2013-05-15 10:13 . 2013-04-15 14:20 638328 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys 2013-05-15 10:13 . 2013-04-13 10:56 37376 ----a-w- c:\windows\system32\cdd.dll 2013-05-15 10:13 . 2013-04-09 01:36 2049024 ----a-w- c:\windows\system32\win32k.sys . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-05-15 11:05 . 2012-04-05 10:22 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-05-15 11:05 . 2012-04-05 10:22 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-05-02 07:06 . 2009-10-02 17:11 238872 ------w- c:\windows\system32\MpSigStub.exe 2013-04-19 03:16 . 2003-03-19 00:14 499712 ----a-w- c:\windows\system32\msvcp71.dll 2013-04-19 03:16 . 2003-02-21 08:42 348160 ----a-w- c:\windows\system32\msvcr71.dll 2013-04-11 08:18 . 2013-04-11 08:18 302368 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2013-03-11 13:25 . 2013-04-10 15:39 3603816 ----a-w- c:\windows\system32\ntkrnlpa.exe 2013-03-11 13:25 . 2013-04-10 15:39 3551080 ----a-w- c:\windows\system32\ntoskrnl.exe 2013-03-09 03:45 . 2013-04-10 15:39 49152 ----a-w- c:\windows\system32\csrsrv.dll 2013-03-09 01:28 . 2013-04-10 15:39 64000 ----a-w- c:\windows\system32\smss.exe 2013-03-08 03:53 . 2013-04-10 15:39 376320 ----a-w- c:\windows\system32\winsrv.dll 2013-03-08 03:52 . 2013-04-10 15:39 2067968 ----a-w- c:\windows\system32\mstscax.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] 2013-02-19 08:12 1929392 ----a-w- c:\program files\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll" [2013-02-19 1929392] . [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] "GarminExpressTrayApp"="c:\program files\Garmin\Express Tray\ExpressTray.exe" [2013-03-12 1099608] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2007-04-17 184320] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-11-02 30192] "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Elements 6.0\apdproxy.exe" [2007-09-11 67488] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2013-04-04 887432] "CTxfiHlp"="CTXFIHLP.EXE" [2007-09-24 23552] "AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-11-19 2598520] "vProt"="c:\program files\AVG Secure Search\vprot.exe" [2013-02-19 1151152] "HTC Sync Loader"="c:\program files\HTC\HTC Sync 3.0\htcUPCTLoader.exe" [2012-04-17 651264] "TkBellExe"="c:\program files\Real\RealPlayer\Update\realsched.exe" [2013-04-19 295512] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-12 59280] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] . c:\users\wyoways\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Wireless Connection Manager.lnk - c:\program files\D-Link\D-Link DWA-552 Xtreme N Desktop Adapter\wirelesscm.exe [2008-4-16 20803584] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2012-10-25 08:12 421888 ----a-w- c:\program files\QuickTime\QTTask.exe . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . Contents of the 'Scheduled Tasks' folder . 2013-06-06 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 11:05] . 2013-05-27 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job - c:\program files\Dell Support Center\uaclauncher.exe [2010-11-18 15:13] . 2013-06-05 c:\windows\Tasks\ROC_JAN2013_TB_rmv.job - c:\program files\AVG Secure Search\PostInstall\ROC.exe [2013-01-24 02:31] . 2011-04-11 c:\windows\Tasks\SystemToolsDailyTest.job - c:\program files\Dell Support Center\pcdrcui.exe [2010-11-18 15:13] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.foxnews.com/ uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.1.254 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/4.0.1.0/GarminAxControl_32.CAB . - - - - ORPHANS REMOVED - - - - . SafeBoot-92114393.sys . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2013-06-05 22:01 Windows 6.0.6002 Service Pack 2 NTFS . scanning hidden processes ... . [0] 0x00540045 [0] 0x0000292D scanning hidden autostart entries ... . HKLM\Software\Microsoft\Windows\CurrentVersion\Run CTxfiHlp = CTXFIHLP.EXE? . scanning hidden files ... . . c:\users\wyoways\AppData\Local\Temp\catchme.dll 53248 bytes executable . scan completed successfully hidden files: 1 . ************************************************************************** . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\PCDSRVC{E9D79540-57D5953E-06020101}_0] "ImagePath"="\??\c:\program files\dell support center\pcdsrvc.pkms" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions] @Denied: (2) (LocalSystem) "{95B7759C-8C7F-4BF1-B163-73684A933233}"=hex:51,66,7a,6c,4c,1d,38,12,f2,76,a4, 91,4d,c2,9f,0e,ce,75,30,28,4f,cd,76,27 "{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}"=hex:51,66,7a,6c,4c,1d,38,12,f1,9d,97, 02,e5,86,37,08,c7,6b,3b,0b,78,35,a4,a7 "{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}"=hex:51,66,7a,6c,4c,1d,38,12,7c,f0,b1, 38,5c,21,3d,0e,d9,78,0d,25,e1,c9,8c,d4 "{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07, 72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57 "{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16, fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17 "{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9, b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration] @Denied: (2) (LocalSystem) "Timestamp"=hex:e0,78,46,3d,56,26,cd,01 . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (LocalSystem) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,e9,b1,59,f1,8c,14,6f,40,a0,55,df,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,e9,b1,59,f1,8c,14,6f,40,a0,55,df,\ . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Completion time: 2013-06-05 22:05:35 ComboFix-quarantined-files.txt 2013-06-06 03:05 ComboFix2.txt 2013-06-03 23:46 ComboFix3.txt 2013-06-03 23:31 ComboFix4.txt 2013-06-03 02:33 ComboFix5.txt 2013-06-06 02:40 . Pre-Run: 210,910,158,848 bytes free Post-Run: 210,925,543,424 bytes free . - - End Of File - - FE8E49B16B9FD2307733DCD086CB7D23
  4. I downloaded fixlist.txt and ran FRST.exe I can now download files on the problem computer !! Thank you! Attached is the Fixlog.txt contents: Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 03-06-2013 02 Ran by wyoways at 2013-06-04 21:51:34 Run:1 Running from C:\Users\wyoways\Desktop Boot Mode: Normal ============================================== "C:\Program Files\Windows Defender\en-US" => Deleting reparse point and unlocking completed. "C:\Program Files\Windows Defender\MpAsDesc.dll" => Deleting reparse point and unlocking completed. "C:\Program Files\Windows Defender\MpClient.dll" => Deleting reparse point and unlocking completed. "C:\Program Files\Windows Defender\MpCmdRun.exe" => Deleting reparse point and unlocking completed. "C:\Program Files\Windows Defender\MpEvMsg.dll" => Deleting reparse point and unlocking completed. "C:\Program Files\Windows Defender\MpOAV.dll" => Deleting reparse point and unlocking completed. "C:\Program Files\Windows Defender\MpRtMon.dll" => Deleting reparse point and unlocking completed. "C:\Program Files\Windows Defender\MpRtPlug.dll" => Deleting reparse point and unlocking completed. "C:\Program Files\Windows Defender\MpSigDwn.dll" => Deleting reparse point and unlocking completed. "C:\Program Files\Windows Defender\MpSoftEx.dll" => Deleting reparse point and unlocking completed. "C:\Program Files\Windows Defender\MpSvc.dll" => Deleting reparse point and unlocking completed. "C:\Program Files\Windows Defender\MSASCui.exe" => Deleting reparse point and unlocking completed. "C:\Program Files\Windows Defender\MsMpCom.dll" => Deleting reparse point and unlocking completed. "C:\Program Files\Windows Defender\MsMpLics.dll" => Deleting reparse point and unlocking completed. "C:\Program Files\Windows Defender\MsMpRes.dll" => Deleting reparse point and unlocking completed. "C:\Program Files\Microsoft Security Client" => Not Found ========= Dir /b /a:l "C:\Program Files" /s ========= File Not Found ========= End of CMD: ========= ==== End of Fixlog ====
  5. I ran FRST.exe Thank you. Attached is FRST.txt and Addition.txt : Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-06-2013 02 Ran by wyoways (administrator) on 04-06-2013 19:01:42 Running from C:\Users\wyoways\Desktop Windows Vista Home Premium Service Pack 2 (X86) OS Language: English(US) Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) =================== (AVG Technologies CZ, s.r.o.) C:\PROGRA~1\AVG\AVG2012\avgrsx.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2012\avgcsrvx.exe (ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe (Microsoft Corporation) C:\Windows\system32\SLsvc.exe (ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe () C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2012\avgfws.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2012\avgwdsvc.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Garmin Ltd or its subsidiaries) C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe (Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe () C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe () C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe () C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2012\avgnsx.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2012\avgemcx.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2012\avgcsrvx.exe (Creative Technology Ltd) C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe (Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Google) C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Creative Technology Ltd) C:\Windows\SYSTEM32\CTXFISPI.EXE (Creative Technology Ltd) C:\Windows\System32\Ctxfihlp.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2012\avgtray.exe () C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe () C:\Program Files\XPSMiniViewGadget\XPSMiniViewGadget.exe (RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\Update\realsched.exe (Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe (Macrovision Corporation) C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe (Garmin Ltd or its subsidiaries) C:\Program Files\Garmin\Express Tray\ExpressTray.exe (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe ( ) C:\Program Files\D-Link\D-Link DWA-552 Xtreme N Desktop Adapter\wirelesscm.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation) C:\Windows\system32\wermgr.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2012\avgscanx.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2012\avgcsrvx.exe (Microsoft Corporation) \\?\C:\Windows\system32\wbem\WMIADAP.EXE ==================== Registry (Whitelisted) ================== HKLM\...\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r [184320 2007-04-17] (Creative Technology Ltd) HKLM\...\Run: [updReg] C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.) HKLM\...\Run: [iAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [178712 2007-10-03] (Intel Corporation) HKLM\...\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [61440 2008-01-21] (Advanced Micro Devices, Inc.) HKLM\...\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup [30192 2009-11-02] (Google) HKLM\...\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe" [67488 2007-09-10] (Adobe Systems Incorporated) HKLM\...\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript [887432 2013-04-04] (Malwarebytes Corporation) HKLM\...\Run: [CTxfiHlp] CTXFIHLP.EXE [x] HKLM\...\Run: [AVG_TRAY] "C:\Program Files\AVG\AVG2012\avgtray.exe" [2598520 2012-11-19] (AVG Technologies CZ, s.r.o.) HKLM\...\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe" [1151152 2013-02-19] () HKLM\...\Run: [HTC Sync Loader] "C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup [651264 2012-04-17] () HKLM\...\Run: [TkBellExe] "C:\Program Files\Real\RealPlayer\Update\realsched.exe" -osboot [295512 2013-04-18] (RealNetworks, Inc.) HKLM\...\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-10-11] (Apple Inc.) HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.) HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [919008 2012-07-27] (Adobe Systems Incorporated) HKCU\...\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation) HKCU\...\Run: [iSUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler [218032 2006-09-11] (Macrovision Corporation) HKCU\...\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation) HKCU\...\Run: [GarminExpressTrayApp] "C:\Program Files\Garmin\Express Tray\ExpressTray.exe" [1099608 2013-03-12] (Garmin Ltd or its subsidiaries) Startup: C:\ProgramData\Start Menu\Programs\Startup\Wireless Connection Manager.lnk ShortcutTarget: Wireless Connection Manager.lnk -> C:\Program Files\D-Link\D-Link DWA-552 Xtreme N Desktop Adapter\wirelesscm.exe ( ) Startup: C:\Users\wyoways\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) BootExecute: autocheck autochk * C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.foxnews.com/ HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch SearchScopes: HKCU - {70D46D94-BF1E-45ED-B567-48701376298E} URL = http://127.0.0.1:4664/search&s=K3g2SYJ7danQMMJ-o7dTFeCg-o0?q={searchTerms} SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={3F87057D-0EED-4651-AF71-65630371603A}&mid=9995194f9de67c86cac3966f9feaa7aa-06ce4fc639803a2e3563922518183d8e94088cb9〈=en&ds=AVG&pr=pr&d=2011-12-18 20:07:29&v=14.2.0.1&pid=avg&sg=&sap=dsp&q={searchTerms} SearchScopes: HKCU - {C04ABFB3-3C5E-409A-8224-11A88FE53F8F} URL = http://search.avg.com/route/?d=4b3d2cf0&i=23&tp=chrome&q={searchTerms}&lng={language}&ychte=us&nt=1 BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader) BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.) BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (Sun Microsystems, Inc.) BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll () Toolbar: HKLM - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll () PDF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab PDF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.) Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll () Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [147456] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 ========================== Services (Whitelisted) ================= S3 Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [68096 2009-08-08] () R2 AdobeActiveFileMonitor6.0; C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [124832 2007-09-10] () R2 avgfws; C:\Program Files\AVG\AVG2012\avgfws.exe [2321560 2012-12-05] (AVG Technologies CZ, s.r.o.) R2 AVGIDSAgent; C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe [5174392 2012-11-02] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files\AVG\AVG2012\avgwdsvc.exe [193288 2012-02-14] (AVG Technologies CZ, s.r.o.) R2 Garmin Core Update Service; C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [185688 2013-03-12] (Garmin Ltd or its subsidiaries) S3 GoogleDesktopManager-051210-111108; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2009-11-02] (Google) S3 jswpsapi; C:\Program Files\D-Link\D-Link DWA-552 Xtreme N Desktop Adapter\jswpsapi.exe [942080 2007-07-24] (Atheros Communications, Inc.) R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 PassThru Service; C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe [87040 2012-03-23] () R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-03-06] () R2 vToolbarUpdater14.2.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe [968880 2013-02-19] () S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-19] () S2 sprtsvc_dellsupportcenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe /service /p dellsupportcenter [x] ==================== Drivers (Whitelisted) ==================== R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6x.sys [47968 2011-05-23] (AVG Technologies CZ, s.r.o.) R3 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [142176 2012-12-10] (AVG Technologies CZ, s.r.o. ) R3 AVGIDSFilter; C:\Windows\System32\DRIVERS\avgidsfilterx.sys [24144 2011-12-23] (AVG Technologies CZ, s.r.o. ) R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [24896 2012-04-19] (AVG Technologies CZ, s.r.o. ) R3 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [17232 2011-12-23] (AVG Technologies CZ, s.r.o. ) R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [250080 2012-11-08] (AVG Technologies CZ, s.r.o.) R1 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [41040 2011-12-23] (AVG Technologies CZ, s.r.o.) R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [31952 2012-01-31] (AVG Technologies CZ, s.r.o.) R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [302368 2013-04-11] (AVG Technologies CZ, s.r.o.) R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [33112 2013-02-19] (AVG Technologies) R3 CT20XUT.DLL; C:\Windows\System32\CT20XUT.DLL [171032 2007-09-24] (Creative Technology Ltd.) R3 CTEXFIFX.DLL; C:\Windows\System32\CTEXFIFX.DLL [1324056 2007-09-24] (Creative Technology Ltd.) R3 CTHWIUT.DLL; C:\Windows\System32\CTHWIUT.DLL [72728 2007-09-24] (Creative Technology Ltd.) S3 htcnprot; C:\Windows\System32\DRIVERS\htcnprot.sys [23040 2010-06-23] (Windows ® Win 7 DDK provider) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation) S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x] S3 catchme; \??\C:\Users\wyoways\AppData\Local\Temp\catchme.sys [x] S3 IpInIp; system32\DRIVERS\ipinip.sys [x] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x] S3 PCDSRVC{E9D79540-57D5953E-06020101}_0; \??\c:\program files\dell support center\pcdsrvc.pkms [x] S3 SymIMMP; system32\DRIVERS\SymIM.sys [x] S3 USBAAPL; System32\Drivers\usbaapl.sys [x] S3 WSIMD; system32\DRIVERS\wsimd.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-06-04 19:01 - 2013-06-04 19:01 - 00000000 ____D C:\FRST 2013-06-04 19:00 - 2013-06-04 18:57 - 01356205 ____A (Farbar) C:\Users\wyoways\Desktop\FRST.exe 2013-06-03 19:05 - 2013-06-03 19:05 - 00002040 ____A C:\Users\wyoways\Desktop\RKreport[2]_D_06032013_02d1905.txt 2013-06-03 19:04 - 2013-06-03 19:04 - 00001985 ____A C:\Users\wyoways\Desktop\RKreport[1]_S_06032013_02d1904.txt 2013-06-03 19:01 - 2013-06-03 19:04 - 00000000 ____D C:\Users\wyoways\Desktop\RK_Quarantine 2013-06-03 18:50 - 2013-06-03 18:29 - 02237968 ____A (Kaspersky Lab ZAO) C:\Users\wyoways\Desktop\tdsskiller.exe 2013-06-03 18:50 - 2013-06-03 18:29 - 00816128 ____A C:\Users\wyoways\Desktop\RogueKiller.exe 2013-06-03 18:46 - 2013-06-03 18:46 - 00010987 ____A C:\ComboFix.txt 2013-06-03 18:38 - 2013-06-04 18:48 - 00000000 ____D C:\ComboFix 2013-06-02 21:12 - 2013-06-02 21:08 - 05076415 ____R (Swearware) C:\Users\wyoways\Desktop\ComboFix.exe 2013-06-02 07:12 - 2013-06-02 07:12 - 00009297 ____A C:\Users\wyoways\Desktop\attach.txt 2013-06-02 07:12 - 2013-06-02 07:11 - 00014015 ____A C:\Users\wyoways\Desktop\dds.txt 2013-06-01 20:42 - 2013-06-01 20:42 - 00000908 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2013-06-01 20:42 - 2013-04-04 14:50 - 00022856 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys 2013-05-31 20:26 - 2010-04-05 15:00 - 00221568 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\netio.sys 2013-05-31 20:16 - 2013-05-31 20:45 - 00001945 ____A C:\Windows\epplauncher.mif 2013-05-31 19:42 - 2011-06-26 01:45 - 00256000 ____A C:\Windows\PEV.exe 2013-05-31 19:42 - 2010-11-07 12:20 - 00208896 ____A C:\Windows\MBR.exe 2013-05-31 19:42 - 2009-04-19 23:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe 2013-05-31 19:42 - 2000-08-30 19:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe 2013-05-31 19:42 - 2000-08-30 19:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe 2013-05-31 19:42 - 2000-08-30 19:00 - 00098816 ____A C:\Windows\sed.exe 2013-05-31 19:42 - 2000-08-30 19:00 - 00080412 ____A C:\Windows\grep.exe 2013-05-31 19:42 - 2000-08-30 19:00 - 00068096 ____A C:\Windows\zip.exe 2013-05-31 19:41 - 2013-06-03 18:46 - 00000000 ____D C:\Qoobox 2013-05-31 19:40 - 2013-06-02 21:23 - 00000000 ____D C:\Windows\erdnt 2013-05-30 17:49 - 2013-05-30 17:49 - 00000000 ____D C:\Users\wyoways\AppData\Roaming\TuneUp Software 2013-05-15 12:06 - 2013-05-05 14:25 - 12324864 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2013-05-15 12:06 - 2013-05-05 14:12 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2013-05-15 12:00 - 2013-04-04 17:11 - 01800704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2013-05-15 12:00 - 2013-04-04 17:09 - 09738752 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2013-05-15 12:00 - 2013-04-04 17:02 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2013-05-15 12:00 - 2013-04-04 17:02 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2013-05-15 12:00 - 2013-04-04 17:02 - 01104384 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2013-05-15 12:00 - 2013-04-04 17:01 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2013-05-15 12:00 - 2013-04-04 16:59 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2013-05-15 12:00 - 2013-04-04 16:58 - 00717824 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2013-05-15 12:00 - 2013-04-04 16:58 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2013-05-15 12:00 - 2013-04-04 16:57 - 00420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll 2013-05-15 12:00 - 2013-04-04 16:56 - 00607744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2013-05-15 12:00 - 2013-04-04 16:55 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2013-05-15 12:00 - 2013-04-04 16:54 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2013-05-15 12:00 - 2013-04-04 16:50 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2013-05-15 05:13 - 2013-04-15 09:20 - 00638328 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys 2013-05-15 05:13 - 2013-04-13 05:56 - 00037376 ____A (Microsoft Corporation) C:\Windows\System32\cdd.dll 2013-05-15 05:13 - 2013-04-08 20:36 - 02049024 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys ==================== One Month Modified Files and Folders ======== 2013-06-04 19:01 - 2013-06-04 19:01 - 00000000 ____D C:\FRST 2013-06-04 18:57 - 2013-06-04 19:00 - 01356205 ____A (Farbar) C:\Users\wyoways\Desktop\FRST.exe 2013-06-04 18:55 - 2008-03-24 07:14 - 01283882 ____A C:\Windows\WindowsUpdate.log 2013-06-04 18:55 - 2006-11-02 05:33 - 00703516 ____A C:\Windows\System32\PerfStringBackup.INI 2013-06-04 18:52 - 2011-12-18 21:06 - 00000000 ____D C:\Windows\System32\Drivers\AVG 2013-06-04 18:48 - 2013-06-03 18:38 - 00000000 ____D C:\ComboFix 2013-06-04 18:48 - 2013-01-24 14:28 - 00000342 ____A C:\Windows\Tasks\ROC_JAN2013_TB_rmv.job 2013-06-04 18:48 - 2011-06-26 18:47 - 00000000 ____D C:\Users\wyoways\AppData\Local\Htc 2013-06-04 18:48 - 2006-11-02 08:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2013-06-04 18:48 - 2006-11-02 07:47 - 00003696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2013-06-04 18:48 - 2006-11-02 07:47 - 00003696 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2013-06-03 21:22 - 2006-11-02 08:01 - 00032548 ____A C:\Windows\Tasks\SCHEDLGU.TXT 2013-06-03 19:05 - 2013-06-03 19:05 - 00002040 ____A C:\Users\wyoways\Desktop\RKreport[2]_D_06032013_02d1905.txt 2013-06-03 19:04 - 2013-06-03 19:04 - 00001985 ____A C:\Users\wyoways\Desktop\RKreport[1]_S_06032013_02d1904.txt 2013-06-03 19:04 - 2013-06-03 19:01 - 00000000 ____D C:\Users\wyoways\Desktop\RK_Quarantine 2013-06-03 19:04 - 2012-04-05 05:22 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-06-03 18:47 - 2008-03-24 07:57 - 00144116 ____A C:\Windows\PFRO.log 2013-06-03 18:46 - 2013-06-03 18:46 - 00010987 ____A C:\ComboFix.txt 2013-06-03 18:46 - 2013-05-31 19:41 - 00000000 ____D C:\Qoobox 2013-06-03 18:45 - 2006-11-02 05:23 - 00000215 ____A C:\Windows\system.ini 2013-06-03 18:29 - 2013-06-03 18:50 - 02237968 ____A (Kaspersky Lab ZAO) C:\Users\wyoways\Desktop\tdsskiller.exe 2013-06-03 18:29 - 2013-06-03 18:50 - 00816128 ____A C:\Users\wyoways\Desktop\RogueKiller.exe 2013-06-02 22:36 - 2011-12-18 21:07 - 00000000 ____D C:\Program Files\AVG Secure Search 2013-06-02 21:23 - 2013-05-31 19:40 - 00000000 ____D C:\Windows\erdnt 2013-06-02 21:08 - 2013-06-02 21:12 - 05076415 ____R (Swearware) C:\Users\wyoways\Desktop\ComboFix.exe 2013-06-02 07:12 - 2013-06-02 07:12 - 00009297 ____A C:\Users\wyoways\Desktop\attach.txt 2013-06-02 07:11 - 2013-06-02 07:12 - 00014015 ____A C:\Users\wyoways\Desktop\dds.txt 2013-06-01 21:04 - 2008-04-19 14:49 - 00000680 ____A C:\Users\wyoways\AppData\Local\d3d9caps.dat 2013-06-01 20:42 - 2013-06-01 20:42 - 00000908 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2013-06-01 20:42 - 2009-09-13 19:54 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2013-05-31 20:45 - 2013-05-31 20:16 - 00001945 ____A C:\Windows\epplauncher.mif 2013-05-31 19:53 - 2006-11-02 06:18 - 00000000 ___RD C:\users\Public 2013-05-30 21:20 - 2012-08-04 23:01 - 00006574 ____A C:\Users\wyoways\Desktop\avgrep.txt 2013-05-30 17:49 - 2013-05-30 17:49 - 00000000 ____D C:\Users\wyoways\AppData\Roaming\TuneUp Software 2013-05-29 20:01 - 2009-04-16 21:18 - 00000000 ____D C:\Program Files\AVG 2013-05-26 21:08 - 2011-03-09 19:03 - 00000564 ____A C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job 2013-05-15 12:31 - 2006-11-02 06:18 - 00000000 ____D C:\Windows\Microsoft.NET 2013-05-15 12:24 - 2006-11-02 07:47 - 00315016 ____A C:\Windows\System32\FNTCACHE.DAT 2013-05-15 12:01 - 2006-11-02 05:24 - 72607752 ____A (Microsoft Corporation) C:\Windows\System32\mrt.exe 2013-05-15 06:05 - 2012-04-05 05:22 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe 2013-05-15 06:05 - 2012-04-05 05:22 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl 2013-05-14 17:43 - 2011-12-18 21:06 - 00000000 ____D C:\ProgramData\AVG2012 2013-05-14 09:39 - 2011-12-18 21:07 - 00000844 ____A C:\Users\Public\Desktop\AVG 2012.lnk 2013-05-14 09:39 - 2011-12-18 20:53 - 00000000 ____D C:\ProgramData\MFAData 2013-05-12 16:44 - 2008-03-24 07:33 - 00000000 ____D C:\ProgramData\Adobe 2013-05-12 16:43 - 2008-04-16 19:04 - 00000000 ____D C:\Users\wyoways\AppData\Roaming\Adobe 2013-05-05 14:25 - 2013-05-15 12:06 - 12324864 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2013-05-05 14:12 - 2013-05-15 12:06 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit C:\Program Files\Windows Defender\mpsvc.dll => ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Windows Defender Last Boot: 2013-06-04 18:53 ==================== End Of Log ============================ Additional scan result of Farbar Recovery Scan Tool (x86) Version: 03-06-2013 02 Ran by wyoways at 2013-06-04 19:02:29 Run: Running from C:\Users\wyoways\Desktop Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= Update for Microsoft Office 2007 (KB2508958) Adobe AIR (Version: 3.2.0.2070) Adobe Anchor Service CS3 (Version: 1.0) Adobe Asset Services CS3 (Version: 3) Adobe Bridge CS3 (Version: 2) Adobe Bridge Start Meeting (Version: 1.0) Adobe Camera Raw 4.0 (Version: 4.0) Adobe CMaps (Version: 1.0) Adobe Default Language CS3 (Version: 1.0) Adobe Device Central CS3 (Version: 1.0) Adobe Elements Studio Launcher (Version: 1.00.0000) Adobe ExtendScript Toolkit 2 (Version: 2.0.2) Adobe Flash Player 11 ActiveX (Version: 11.7.700.202) Adobe Help Viewer CS3 (Version: 1) Adobe PDF Library Files (Version: 8.0) Adobe Photoshop CS (Version: CS) Adobe Photoshop Elements 6.0 (Version: 6.0) Adobe Premiere Elements 4.0 (Version: 4.0) Adobe Premiere Elements 4.0 Templates (Version: 4.0.0) Adobe Reader X (10.1.4) (Version: 10.1.4) Adobe Setup (Version: 1.0) Adobe Soundbooth CS3 (Version: 1) Adobe Soundbooth CS3 Codecs (Version: 3) Adobe Soundbooth CS3 Scores (Version: 1) Adobe Type Support (Version: 1.0) Adobe Update Manager CS3 (Version: 5.1.0) Adobe Version Cue CS3 Client (Version: 3) Adobe XMP DVA Panels CS3 (Version: 1.0) Adobe XMP Panels CS3 (Version: 1.0) Apple Application Support (Version: 2.3) Apple Software Update (Version: 2.1.3.127) ATI Catalyst Control Center (Version: 2.007.0731.2233) ATI Catalyst Install Manager (Version: 3.0.664.0) AVG 2012 (Version: 12.0.3184) AVG 2012 (Version: 12.1.2242) AVG 2012 (Version: 2012.1.2242) AVG Security Toolbar (Version: 14.2.0.1) Catalyst Control Center - Branding (Version: 1.00.0000) Catalyst Control Center Core Implementation (Version: 2007.0731.2234.38497) Catalyst Control Center Core Implementation (Version: 2008.0328.2322.39969) Catalyst Control Center Graphics Full Existing (Version: 2007.0731.2234.38497) Catalyst Control Center Graphics Full Existing (Version: 2008.0328.2322.39969) Catalyst Control Center Graphics Full New (Version: 2007.0731.2234.38497) Catalyst Control Center Graphics Full New (Version: 2008.0328.2322.39969) Catalyst Control Center Graphics Light (Version: 2007.0731.2234.38497) Catalyst Control Center Graphics Light (Version: 2008.0328.2322.39969) Catalyst Control Center Graphics Previews Common (Version: 2007.0731.2234.38497) Catalyst Control Center Graphics Previews Common (Version: 2008.0328.2322.39969) Catalyst Control Center Graphics Previews Vista (Version: 2007.0731.2234.38497) Catalyst Control Center Graphics Previews Vista (Version: 2008.0328.2322.39969) Catalyst Control Center HydraVision Full (Version: 2008.0328.2322.39969) Catalyst Control Center Localization Chinese Standard (Version: 2007.0731.2234.38497) Catalyst Control Center Localization Chinese Traditional (Version: 2007.0731.2234.38497) Catalyst Control Center Localization French (Version: 2007.0731.2234.38497) Catalyst Control Center Localization German (Version: 2007.0731.2234.38497) Catalyst Control Center Localization Hungarian (Version: 2007.0731.2234.38497) Catalyst Control Center Localization Italian (Version: 2007.0731.2234.38497) Catalyst Control Center Localization Japanese (Version: 2007.0731.2234.38497) Catalyst Control Center Localization Korean (Version: 2007.0731.2234.38497) Catalyst Control Center Localization Polish (Version: 2007.0731.2234.38497) Catalyst Control Center Localization Portuguese (Version: 2007.0731.2234.38497) Catalyst Control Center Localization Spanish (Version: 2007.0731.2234.38497) Catalyst Control Center Localization Thai (Version: 2007.0731.2234.38497) Catalyst Control Center Localization Turkish (Version: 2007.0731.2234.38497) CCC Help Chinese Standard (Version: 2007.0731.2233.38497) CCC Help Chinese Traditional (Version: 2007.0731.2233.38497) CCC Help English (Version: 2007.0731.2233.38497) CCC Help English (Version: 2008.0328.2321.39969) CCC Help French (Version: 2007.0731.2233.38497) CCC Help German (Version: 2007.0731.2233.38497) CCC Help Hungarian (Version: 2007.0731.2233.38497) CCC Help Italian (Version: 2007.0731.2233.38497) CCC Help Japanese (Version: 2007.0731.2233.38497) CCC Help Korean (Version: 2007.0731.2233.38497) CCC Help Polish (Version: 2007.0731.2233.38497) CCC Help Portuguese (Version: 2007.0731.2233.38497) CCC Help Spanish (Version: 2007.0731.2233.38497) CCC Help Thai (Version: 2007.0731.2233.38497) CCC Help Turkish (Version: 2007.0731.2233.38497) ccc-core-static (Version: 2007.0731.2234.38497) ccc-core-static (Version: 2008.0328.2322.39969) ccc-utility (Version: 2007.0731.2234.38497) ccc-utility (Version: 2008.0328.2322.39969) Creative MediaSource 5 (Version: 5.00) Dell DataSafe Online (Version: 1.0.21) Dell Getting Started Guide (Version: 1.00.0000) Dell Support Center (Version: 3.0.5744.02) D-Link DWA-552 Xtreme N Desktop Adapter (Version: 1.11b01) Elevated Installer (Version: 2.1.11) Garmin Communicator Plugin (Version: 2.7.1) Garmin Express (Version: 2.1.11) Garmin Express Tray (Version: 2.1.11) Garmin Update Service (Version: 2.1.11) Garmin USB Drivers (Version: 1.0.0.0) Garmin WebUpdater (Version: 2.4.2) Google Desktop (Version: 5.9.0909.30391) HTC BMP USB Driver (Version: 1.0.5375) HTC Driver Installer (Version: 3.0.0.021) HTC Sync (Version: 3.2.20) Intel® Matrix Storage Manager Intel® PRO Network Connections 12.1.12.4 (Version: ) Java SE Runtime Environment 6 (Version: 1.6.0.0) Malwarebytes Anti-Malware version 1.75.0.1300 (Version: 1.75.0.1300) Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Office File Validation Add-In (Version: 14.0.5130.5003) Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000) Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000) Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014) Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Silverlight (Version: 5.1.20125.0) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161) MSXML 4.0 SP2 (KB936181) (Version: 4.20.9848.0) MSXML 4.0 SP2 (KB941833) (Version: 4.20.9849.0) MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0) MSXML 4.0 SP3 Parser (KB2721691) (Version: 4.30.2114.0) MSXML 4.0 SP3 Parser (KB2758694) (Version: 4.30.2117.0) MSXML 4.0 SP3 Parser (KB973685) (Version: 4.30.2107.0) MSXML 4.0 SP3 Parser (Version: 4.30.2100.0) Music, Photos & Videos Launcher (Version: 1.00.0000) OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0) OpenAL Product Documentation Launcher (Version: 1.00.0000) QuickTime (Version: 7.73.80.64) RealDownloader (Version: 1.3.1) RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0) RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0) RealPlayer (Version: 16.0.0) RealUpgrade 1.1 (Version: 1.1.0) Roxio Activation Module (Version: 1.0) Roxio Creator Audio (Version: 3.5.0) Roxio Creator BDAV Plugin (Version: 3.5.0) Roxio Creator Copy (Version: 3.5.0) Roxio Creator Data (Version: 3.5.0) Roxio Creator Premier (Version: 3.5.0) Roxio Creator Tools (Version: 3.5.0) Roxio EasyArchive (Version: 3.5.0) Roxio Express Labeler (Version: 3.2) Roxio MyDVD Premier (Version: 9.1.573) Roxio Update Manager (Version: 6.0.0) Skins (Version: 2007.0731.2234.38497) Skins (Version: 2008.0328.2322.39969) Sonic CinePlayer Decoder Pack (Version: 4.2.0) Sound Blaster X-Fi (Version: 1.0) Spelling Dictionaries Support For Adobe Reader 8 (Version: 8.0.0) Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office OneNote 2007 Help (KB963670) Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) User's Guides Windows Driver Package - Garmin (grmnusb) GARMIN Devices (03/08/2007 2.2.1.0) (Version: 03/08/2007 2.2.1.0) XPS MiniView Gadget (Version: 1.00.0000) ==================== Restore Points ========================= 27-05-2013 04:02:14 Scheduled Checkpoint 28-05-2013 05:00:01 Scheduled Checkpoint 29-05-2013 13:27:13 Scheduled Checkpoint 30-05-2013 05:00:01 Scheduled Checkpoint 01-06-2013 01:25:39 Windows Update 02-06-2013 13:02:01 Scheduled Checkpoint 03-06-2013 03:49:29 Scheduled Checkpoint 04-06-2013 23:54:19 Windows Update ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (06/04/2013 06:48:53 PM) (Source: Application Error) (User: ) Description: Faulting application avg-secure-search-installer.exe, version 15.2.0.5, time stamp 0x51824dd4, faulting module ntdll.dll, version 6.0.6002.18541, time stamp 0x4ec3e3d5, exception code 0xc00000fd, fault offset 0x0004a152, process id 0x1038, application start time 0xavg-secure-search-installer.exe0. Error: (06/03/2013 09:22:24 PM) (Source: EventSystem) (User: ) Description: 80070005EventSystem.EventSubscription{CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000} Error: (06/03/2013 09:12:28 PM) (Source: SideBySide) (User: ) Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1". Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (06/03/2013 08:48:17 PM) (Source: SideBySide) (User: ) Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1". Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (06/03/2013 07:10:27 PM) (Source: SideBySide) (User: ) Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1". Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (06/03/2013 06:53:47 PM) (Source: SideBySide) (User: ) Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1". Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (06/03/2013 06:46:57 PM) (Source: EventSystem) (User: ) Description: 80070005EventSystem.EventSubscription{CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000} Error: (06/02/2013 09:14:57 PM) (Source: SideBySide) (User: ) Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1". Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (06/02/2013 09:14:57 PM) (Source: SideBySide) (User: ) Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1". Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found. Please use sxstrace.exe for detailed diagnosis. Error: (06/02/2013 07:09:42 AM) (Source: SideBySide) (User: ) Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1". Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found. Please use sxstrace.exe for detailed diagnosis. System errors: ============= Error: (12/27/2008 03:15:34 PM) (Source: EventLog) (User: ) Description: The previous system shutdown at 2:04:01 PM on 12/27/2008 was unexpected. Error: (12/27/2008 08:43:50 AM) (Source: HTTP) (User: ) Description: \Device\Http\ReqQueueKerberos Error: (12/27/2008 07:25:32 AM) (Source: HTTP) (User: ) Description: \Device\Http\ReqQueueKerberos Error: (12/27/2008 02:38:48 AM) (Source: HTTP) (User: ) Description: \Device\Http\ReqQueueKerberos Error: (12/27/2008 02:38:47 AM) (Source: EventLog) (User: ) Description: The previous system shutdown at 1:36:11 AM on 12/27/2008 was unexpected. Error: (12/23/2008 07:58:12 PM) (Source: HTTP) (User: ) Description: \Device\Http\ReqQueueKerberos Error: (12/23/2008 07:58:11 PM) (Source: EventLog) (User: ) Description: The previous system shutdown at 6:55:50 PM on 12/23/2008 was unexpected. Error: (12/21/2008 07:03:42 PM) (Source: HTTP) (User: ) Description: \Device\Http\ReqQueueKerberos Error: (12/21/2008 07:03:41 PM) (Source: EventLog) (User: ) Description: The previous system shutdown at 4:38:46 PM on 12/21/2008 was unexpected. Error: (12/21/2008 05:17:22 PM) (Source: HTTP) (User: ) Description: \Device\Http\ReqQueueKerberos Microsoft Office Sessions: ========================= CodeIntegrity Errors: =================================== Date: 2013-06-04 19:02:05.876 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidshx.sys because the set of per-page image hashes could not be found on the system. Date: 2013-06-04 19:02:05.657 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidshx.sys because the set of per-page image hashes could not be found on the system. Date: 2013-06-04 19:02:05.439 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidshx.sys because the set of per-page image hashes could not be found on the system. Date: 2013-06-04 19:02:05.220 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidshx.sys because the set of per-page image hashes could not be found on the system. Date: 2013-06-04 19:02:04.628 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsdriverx.sys because the set of per-page image hashes could not be found on the system. Date: 2013-06-04 19:02:04.409 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsdriverx.sys because the set of per-page image hashes could not be found on the system. Date: 2013-06-04 19:02:04.175 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsdriverx.sys because the set of per-page image hashes could not be found on the system. Date: 2013-06-04 19:02:03.879 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsdriverx.sys because the set of per-page image hashes could not be found on the system. Date: 2013-06-03 18:40:13.561 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidshx.sys because the set of per-page image hashes could not be found on the system. Date: 2013-06-03 18:40:13.343 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidshx.sys because the set of per-page image hashes could not be found on the system. ==================== Memory info =========================== Percentage of memory in use: 51% Total physical RAM: 3325.03 MB Available physical RAM: 1625.86 MB Total Pagefile: 6859.07 MB Available Pagefile: 5269.24 MB Total Virtual: 2047.88 MB Available Virtual: 1902.95 MB ==================== Drives ================================ Drive c: (OS) (Fixed) (Total:283.04 GB) (Free:187.25 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive d: (RECOVERY) (Fixed) (Total:15 GB) (Free:4.38 GB) NTFS Drive f: (USB20FD) (Removable) (Total:60.94 GB) (Free:59.56 GB) FAT32 ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 28000000) Partition 1: (Not Active) - (Size=47 MB) - (Type=DE) Partition 2: (Not Active) - (Size=15 GB) - (Type=07 NTFS) Partition 3: (Active) - (Size=283 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (MBR Code: Windows XP) (Size: 61 GB) (Disk ID: C3072E18) Partition 1: (Active) - (Size=61 GB) - (Type=0C) ==================== End Of Log ============================
  6. I ran TDSSKiller and Roguekiller. I still cannot download any files. Thank you. Below is the TDSSKiller report: 18:55:06.0176 5168 ============================================================ 18:55:06.0176 5168 Scan finished 18:55:06.0176 5168 ============================================================ 18:55:06.0176 5160 Detected object count: 7 18:55:06.0176 5160 Actual detected object count: 7 18:55:26.0035 5160 Adobe LM Service ( UnsignedFile.Multi.Generic ) - skipped by user 18:55:26.0035 5160 Adobe LM Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 18:55:26.0035 5160 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - skipped by user 18:55:26.0035 5160 FLEXnet Licensing Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 18:55:26.0035 5160 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user 18:55:26.0035 5160 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip 18:55:26.0035 5160 jswpsapi ( UnsignedFile.Multi.Generic ) - skipped by user 18:55:26.0035 5160 jswpsapi ( UnsignedFile.Multi.Generic ) - User select action: Skip 18:55:26.0035 5160 jswpslwf ( UnsignedFile.Multi.Generic ) - skipped by user 18:55:26.0035 5160 jswpslwf ( UnsignedFile.Multi.Generic ) - User select action: Skip 18:55:26.0035 5160 PassThru Service ( UnsignedFile.Multi.Generic ) - skipped by user 18:55:26.0035 5160 PassThru Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 18:55:26.0051 5160 stllssvr ( UnsignedFile.Multi.Generic ) - skipped by user 18:55:26.0051 5160 stllssvr ( UnsignedFile.Multi.Generic ) - User select action: Skip 18:59:49.0543 3016 Deinitialize success Below is the Roguekiller report: RogueKiller V8.5.4 [Mar 18 2013] by Tigzy mail : tigzyRK<at>gmail<dot>com Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/ Website : http://tigzy.geekstogo.com/roguekiller.php Blog : http://tigzyrk.blogspot.com/ Operating System : Windows Vista (6.0.6002 Service Pack 2) 32 bits version Started in : Normal mode User : wyoways [Admin rights] Mode : Remove -- Date : 06/03/2013 19:05:25 | ARK || FAK || MBR | ¤¤¤ Bad processes : 0 ¤¤¤ ¤¤¤ Registry Entries : 3 ¤¤¤ [HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> DELETED [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0) [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0) ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver : [LOADED] ¤¤¤ ¤¤¤ Extern Hives: ¤¤¤ -> D:\windows\system32\config\SOFTWARE -> D:\windows\system32\config\SYSTEM -> D:\Users\Default\NTUSER.DAT ¤¤¤ HOSTS File: ¤¤¤ --> C:\Windows\system32\drivers\etc\hosts 127.0.0.1 localhost ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: WDC WD3200AAKS-75VYA0 +++++ --- User --- [MBR] b0de3516f76f101edbe164dfbf67305f [bSP] cb96dfa00f188250b5f4e01fecd4dba3 : Windows Vista MBR Code Partition table: 0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 47 Mo 1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 98304 | Size: 15360 Mo 2 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 31555584 | Size: 289836 Mo User = LL1 ... OK! User = LL2 ... OK! +++++ PhysicalDrive1: PNY USB 2.0 FD USB Device +++++ --- User --- [MBR] 9c5d0e5737e6076b3c7f472ef3158ac8 [bSP] 33a07a59d299ab4ea9f4ab0156f9d86f : Windows XP MBR Code Partition table: 0 - [ACTIVE] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 32 | Size: 62419 Mo User = LL1 ... OK! Error reading LL2 MBR! Finished : << RKreport[2]_D_06032013_02d1905.txt >> RKreport[1]_S_06032013_02d1904.txt ; RKreport[2]_D_06032013_02d1905.txt
  7. Downloaded and ran Combofix.exe. No problem with Combofix.exe until I tried to open Combofix.txt the first time. Received error "illegal operation attempted on a registry key that had been marked for deletion" Restarted the computer. I stil cannot download any files. Combofix.txt is as follows: ComboFix 13-06-02.02 - wyoways 06/02/2013 21:14:44.1.4 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3325.1631 [GMT -5:00] Running from: c:\users\wyoways\Desktop\ComboFix.exe AV: AVG Internet Security 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} FW: AVG Internet Security 2012 *Enabled* {621CC794-9486-F902-D092-0484E8EA828B} SP: AVG Internet Security 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2013-05-03 to 2013-06-03 ))))))))))))))))))))))))))))))) . . 2013-06-03 02:23 . 2013-06-03 02:23 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-06-02 01:42 . 2013-04-04 19:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys 2013-06-01 01:26 . 2010-04-05 20:00 221568 ----a-w- c:\windows\system32\drivers\netio.sys 2013-06-01 00:53 . 2013-06-03 02:26 -------- d-----w- c:\users\wyoways\AppData\Local\temp 2013-05-30 22:49 . 2013-05-30 22:49 -------- d-----w- c:\users\wyoways\AppData\Roaming\TuneUp Software 2013-05-15 17:06 . 2013-05-05 19:12 2382848 ----a-w- c:\windows\system32\mshtml.tlb 2013-05-15 10:13 . 2013-04-15 14:20 638328 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys 2013-05-15 10:13 . 2013-04-13 10:56 37376 ----a-w- c:\windows\system32\cdd.dll 2013-05-15 10:13 . 2013-04-09 01:36 2049024 ----a-w- c:\windows\system32\win32k.sys 2013-05-04 16:02 . 2013-05-04 16:02 -------- d-----w- C:\found.001 . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-05-15 11:05 . 2012-04-05 10:22 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-05-15 11:05 . 2012-04-05 10:22 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-05-02 07:06 . 2009-10-02 17:11 238872 ------w- c:\windows\system32\MpSigStub.exe 2013-04-19 03:16 . 2003-03-19 00:14 499712 ----a-w- c:\windows\system32\msvcp71.dll 2013-04-19 03:16 . 2003-02-21 08:42 348160 ----a-w- c:\windows\system32\msvcr71.dll 2013-04-11 08:18 . 2013-04-11 08:18 302368 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2013-03-11 13:25 . 2013-04-10 15:39 3603816 ----a-w- c:\windows\system32\ntkrnlpa.exe 2013-03-11 13:25 . 2013-04-10 15:39 3551080 ----a-w- c:\windows\system32\ntoskrnl.exe 2013-03-09 03:45 . 2013-04-10 15:39 49152 ----a-w- c:\windows\system32\csrsrv.dll 2013-03-09 01:28 . 2013-04-10 15:39 64000 ----a-w- c:\windows\system32\smss.exe 2013-03-08 03:53 . 2013-04-10 15:39 376320 ----a-w- c:\windows\system32\winsrv.dll 2013-03-08 03:52 . 2013-04-10 15:39 2067968 ----a-w- c:\windows\system32\mstscax.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}] 2013-02-19 08:12 1929392 ----a-w- c:\program files\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll" [2013-02-19 1929392] . [HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1] [HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952] "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240] "GarminExpressTrayApp"="c:\program files\Garmin\Express Tray\ExpressTray.exe" [2013-03-12 1099608] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2007-04-17 184320] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-11-02 30192] "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Elements 6.0\apdproxy.exe" [2007-09-11 67488] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2013-04-04 887432] "CTxfiHlp"="CTXFIHLP.EXE" [2007-09-24 23552] "AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-11-19 2598520] "vProt"="c:\program files\AVG Secure Search\vprot.exe" [2013-02-19 1151152] "HTC Sync Loader"="c:\program files\HTC\HTC Sync 3.0\htcUPCTLoader.exe" [2012-04-17 651264] "TkBellExe"="c:\program files\Real\RealPlayer\Update\realsched.exe" [2013-04-19 295512] "APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-12 59280] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] . c:\users\wyoways\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Wireless Connection Manager.lnk - c:\program files\D-Link\D-Link DWA-552 Xtreme N Desktop Adapter\wirelesscm.exe [2008-4-16 20803584] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2012-10-25 08:12 421888 ----a-w- c:\program files\QuickTime\QTTask.exe . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . Contents of the 'Scheduled Tasks' folder . 2013-06-03 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 11:05] . 2013-05-27 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job - c:\program files\Dell Support Center\uaclauncher.exe [2010-11-18 15:13] . 2013-06-03 c:\windows\Tasks\ROC_JAN2013_TB_rmv.job - c:\program files\AVG Secure Search\PostInstall\ROC.exe [2013-01-24 02:31] . 2011-04-11 c:\windows\Tasks\SystemToolsDailyTest.job - c:\program files\Dell Support Center\pcdrcui.exe [2010-11-18 15:13] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.foxnews.com/ uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.1.254 Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/4.0.1.0/GarminAxControl_32.CAB . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2013-06-02 21:26 Windows 6.0.6002 Service Pack 2 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . HKLM\Software\Microsoft\Windows\CurrentVersion\Run CTxfiHlp = CTXFIHLP.EXE? . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\PCDSRVC{E9D79540-57D5953E-06020101}_0] "ImagePath"="\??\c:\program files\dell support center\pcdsrvc.pkms" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions] @Denied: (2) (LocalSystem) "{95B7759C-8C7F-4BF1-B163-73684A933233}"=hex:51,66,7a,6c,4c,1d,38,12,f2,76,a4, 91,4d,c2,9f,0e,ce,75,30,28,4f,cd,76,27 "{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}"=hex:51,66,7a,6c,4c,1d,38,12,f1,9d,97, 02,e5,86,37,08,c7,6b,3b,0b,78,35,a4,a7 "{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}"=hex:51,66,7a,6c,4c,1d,38,12,7c,f0,b1, 38,5c,21,3d,0e,d9,78,0d,25,e1,c9,8c,d4 "{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07, 72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57 "{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16, fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17 "{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9, b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration] @Denied: (2) (LocalSystem) "Timestamp"=hex:e0,78,46,3d,56,26,cd,01 . [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (LocalSystem) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,e9,b1,59,f1,8c,14,6f,40,a0,55,df,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,e9,b1,59,f1,8c,14,6f,40,a0,55,df,\ . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . ------------------------ Other Running Processes ------------------------ . c:\progra~1\AVG\AVG2012\avgrsx.exe c:\program files\AVG\AVG2012\avgcsrvx.exe c:\windows\system32\Ati2evxx.exe c:\windows\System32\WUDFHost.exe c:\windows\system32\Ati2evxx.exe c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe c:\program files\AVG\AVG2012\avgfws.exe c:\program files\AVG\AVG2012\avgwdsvc.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe c:\program files\AVG\AVG2012\avgnsx.exe c:\program files\AVG\AVG2012\avgemcx.exe c:\program files\HTC\Internet Pass-Through\PassThruSvr.exe c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe c:\windows\System32\WUDFHost.exe c:\program files\AVG\AVG2012\AVGIDSAgent.exe c:\program files\XPSMiniViewGadget\XPSMiniViewGadget.exe c:\windows\System32\Ctxfihlp.exe c:\windows\ehome\ehmsas.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\windows\SYSTEM32\CTXFISPI.EXE c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe c:\windows\servicing\TrustedInstaller.exe c:\\?\c:\windows\system32\wbem\WMIADAP.EXE . ************************************************************************** . Completion time: 2013-06-02 21:33:51 - machine was rebooted ComboFix-quarantined-files.txt 2013-06-03 02:33 ComboFix2.txt 2013-06-01 00:53 . Pre-Run: 202,216,247,296 bytes free Post-Run: 202,557,124,608 bytes free . - - End Of File - - 82228CFA922C113F71DCB0B29459B6F5
  8. I cannot download anything. Mailwarebytes Pro does not find anything. Ran DDS.com with the attached results. DDS.txt Attach.txt
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.