Jump to content

Rigour

Members
  • Posts

    4
  • Joined

  • Last visited

Reputation

0 Neutral
  1. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 5.1.0 (07.15.2013:1) OS: Windows Vista Home Premium x86 Ran by The Batduck on 15/07/2013 at 22:21:34.71 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\interface\{6f43fa77-c18f-4d0c-9c7e-958876fe2061} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\interface\{df948646-8bf4-450e-a059-cf8a4e0fe2be} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\interface\{e96b49b0-e11f-48fc-984a-eec29a4f57e1} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\anchorfree Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\sweetim Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{2E417911-FC7F-0A76-F316-6E367806725F} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{3d29c02b-bf3e-4d3b-8a7a-e0e7d0f6dbab} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{8fe8d013-c3fd-4802-af48-79274e9f969e} ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\ProgramData\bcool" Successfully deleted: [Folder] "C:\ProgramData\fighters" Successfully deleted: [Folder] "C:\ProgramData\optimizerpro" Successfully deleted: [Folder] "C:\ProgramData\pc1data" Successfully deleted: [Folder] "C:\ProgramData\speedypc software" Successfully deleted: [Folder] "C:\Program Files\dll-files.com fixer" Successfully deleted: [Folder] "C:\Program Files\keybar_1.6" Successfully deleted: [Folder] "C:\Program Files\otshot" Successfully deleted: [Folder] "C:\Program Files\pc speed up" Successfully deleted: [Folder] "C:\Program Files\wiseconvert_b" Successfully deleted: [Folder] "C:\Windows\system32\ai_recyclebin" ~~~ FireFox Emptied folder: C:\Users\The Batduck\AppData\Roaming\mozilla\firefox\profiles\7pntvx3j.default\minidumps [2 files] ~~~ Chrome Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 15/07/2013 at 22:35:34.69 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Adware seems taken care of , The malwarebytes anti-rootkit is running and i'll post back with the results in the morning, so far one detection thanks again -Rigour
  2. # AdwCleaner v2.305 - Logfile created 07/15/2013 at 19:43:30# Updated 11/07/2013 by Xplode# Operating system : Windows Vista Home Premium Service Pack 2 (32 bits)# User : The Batduck - OWNER-PC# Boot Mode : Normal# Running from : C:\Users\The Batduck\Downloads\adwcleaner.exe# Option [search] ***** [services] ***** Found : DefaultTabUpdateFound : Zwinky_5qService ***** [Files / Folders] ***** File Found : C:\ENDFile Found : C:\Program Files\mozilla firefox\searchplugins\Web Search.xmlFile Found : C:\user.jsFile Found : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorageFile Found : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage-journalFile Found : C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\r0fsxocr.default\searchplugins\Web Search.xmlFile Found : C:\Users\user\Desktop\Optimizer Pro.lnkFile Found : C:\Users\The Batduck\AppData\Local\Google\Chrome\User Data\Default\bProtector Web DataFile Found : C:\Users\The Batduck\AppData\Local\Google\Chrome\User Data\Default\bprotectorpreferencesFile Found : C:\Windows\system32\roboot.exeFolder Found : C:\Program Files\Advanced System ProtectorFolder Found : C:\Program Files\BandooFolder Found : C:\Program Files\ConduitFolder Found : C:\Program Files\DefaultTabFolder Found : C:\Program Files\DomaIQ UninstallerFolder Found : C:\Program Files\Free Offers from Freeze.comFolder Found : C:\Program Files\GamesBarFolder Found : C:\Program Files\GameTap Web PlayerFolder Found : C:\Program Files\Gophoto.itFolder Found : C:\Program Files\iMesh ApplicationsFolder Found : C:\Program Files\optimizer proFolder Found : C:\Program Files\PerionFolder Found : C:\Program Files\PlaybryteFolder Found : C:\Program Files\Produtools_MapsFolder Found : C:\Program Files\Red SkyFolder Found : C:\Program Files\RegClean ProFolder Found : C:\Program Files\SearchProtectFolder Found : C:\Program Files\WinZip Registry OptimizerFolder Found : C:\Program Files\Zwinky_5qFolder Found : C:\ProgramData\APNFolder Found : C:\ProgramData\AskFolder Found : C:\ProgramData\BabylonFolder Found : C:\ProgramData\boost_interprocessFolder Found : C:\ProgramData\GameTap Web PlayerFolder Found : C:\ProgramData\GboxUpdaterFolder Found : C:\ProgramData\IBUpdaterServiceFolder Found : C:\ProgramData\InstallMateFolder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GamesBarFolder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media FinderFolder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\optimizer proFolder Found : C:\ProgramData\ParetoLogicFolder Found : C:\ProgramData\PremiumFolder Found : C:\ProgramData\SpeedMaxPcFolder Found : C:\ProgramData\Tarma InstallerFolder Found : C:\Users\Owner\AppData\Local\ConduitFolder Found : C:\Users\Owner\AppData\Local\PackageAwareFolder Found : C:\Users\Owner\AppData\LocalLow\alotappbarFolder Found : C:\Users\Owner\AppData\LocalLow\AVG Secure SearchFolder Found : C:\Users\Owner\AppData\LocalLow\BandooFolder Found : C:\Users\Owner\AppData\LocalLow\ConduitFolder Found : C:\Users\Owner\AppData\LocalLow\FunWebProductsFolder Found : C:\Users\Owner\AppData\LocalLow\mediabarimFolder Found : C:\Users\Owner\AppData\LocalLow\mediabarshFolder Found : C:\Users\Owner\AppData\LocalLow\MyWebSearchFolder Found : C:\Users\Owner\AppData\LocalLow\PriceGongFolder Found : C:\Users\Owner\AppData\LocalLow\SearchqutoolbarFolder Found : C:\Users\Owner\AppData\Roaming\BabylonFolder Found : C:\Users\Owner\AppData\Roaming\BandooFolder Found : C:\Users\Owner\AppData\Roaming\OpenCandyFolder Found : C:\Users\Owner\AppData\Roaming\PerformerSoftFolder Found : C:\Users\user\AppData\LocalLow\BabylonToolbarFolder Found : C:\Users\user\AppData\LocalLow\ConduitFolder Found : C:\Users\user\AppData\LocalLow\incredibar.comFolder Found : C:\Users\user\AppData\LocalLow\mediabarimFolder Found : C:\Users\user\AppData\LocalLow\mediabarshFolder Found : C:\Users\user\AppData\LocalLow\PriceGongFolder Found : C:\Users\user\AppData\LocalLow\Produtools_MapsFolder Found : C:\Users\user\AppData\LocalLow\Retrogamer_4wFolder Found : C:\Users\user\AppData\LocalLow\searchqubandFolder Found : C:\Users\user\AppData\LocalLow\SearchqutoolbarFolder Found : C:\Users\user\AppData\Local\ConduitFolder Found : C:\Users\user\AppData\Local\DownTangoFolder Found : C:\Users\user\AppData\Local\SmartbarFolder Found : C:\Users\user\AppData\LocalLow\AskToolbarFolder Found : C:\Users\user\AppData\LocalLow\BabylonToolbarFolder Found : C:\Users\user\AppData\LocalLow\ConduitFolder Found : C:\Users\user\AppData\LocalLow\GamingWonderlandFolder Found : C:\Users\user\AppData\LocalLow\incredibar.comFolder Found : C:\Users\user\AppData\LocalLow\mediabarimFolder Found : C:\Users\user\AppData\LocalLow\mixidjFolder Found : C:\Users\user\AppData\LocalLow\PriceGongFolder Found : C:\Users\user\AppData\LocalLow\Produtools_MapsFolder Found : C:\Users\user\AppData\LocalLow\Retrogamer_4wFolder Found : C:\Users\user\AppData\LocalLow\searchqubandFolder Found : C:\Users\user\AppData\LocalLow\SearchqutoolbarFolder Found : C:\Users\user\AppData\LocalLow\Zwinky_5qFolder Found : C:\Users\user\AppData\Roaming\DriverCureFolder Found : C:\Users\user\AppData\Roaming\optimizer proFolder Found : C:\Users\user\AppData\Roaming\ParetoLogicFolder Found : C:\Users\user\AppData\Roaming\PerformerSoftFolder Found : C:\Users\user\AppData\Roaming\SearchProtectFolder Found : C:\Users\The Batduck\AppData\Local\Google\Chrome\User Data\Default\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjgFolder Found : C:\Users\The Batduck\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfmopbbadnfoelckkcmjjeaaegjpjjbkFolder Found : C:\Users\The Batduck\AppData\LocalLow\ConduitFolder Found : C:\Users\The Batduck\AppData\LocalLow\PriceGongFolder Found : C:\Users\The Batduck\AppData\LocalLow\Produtools_MapsFolder Found : C:\Users\The Batduck\AppData\Roaming\BabylonFolder Found : C:\Windows\Installer\{EBE677C0-CBCB-4EBF-8098-E27E1B5271CF}Folder Found : C:\Windows\system32\WNLT ***** [Registry] ***** Key Found : HKCU\Software\Alexa InternetKey Found : HKCU\Software\AppDataLow\Software\ConduitKey Found : HKCU\Software\AppDataLow\Software\PriceGongKey Found : HKCU\Software\AppDataLow\Software\Produtools_MapsKey Found : HKCU\Software\AppDataLow\Software\SmartBarKey Found : HKCU\Software\AppDataLow\SProtectorKey Found : HKCU\Software\AskPartnerNetworkKey Found : HKCU\Software\BabSolutionKey Found : HKCU\Software\ConduitKey Found : HKCU\Software\DataMngrKey Found : HKCU\Software\e57888be169be43Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86C0E2A3-1EDA-4F01-A43D-80DA8642813C}_is1Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{EBE677C0-CBCB-4EBF-8098-E27E1B5271CF}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BandooKey Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\DefaultTabKey Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Optimizer Pro_is1Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Produtools_Maps ToolbarKey Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Zwinky_5qbar UninstallKey Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettingsKey Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{27488090-768A-4D20-A938-F223F71C344C}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3033124F-06BF-4829-873A-310A125B4D4C}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403A-B9D2-65C292C39087}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{575BDDF5-790A-4D01-A37D-2863DEC1C085}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6F282B65-56BF-4BD1-A8B2-A4449A05863D}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BD3EA7C2-3AF8-4463-9A9C-6EB8E136CB02}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1A93C934-025B-4C3A-B38E-9654A7003239}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{27488090-768A-4D20-A938-F223F71C344C}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3033124F-06BF-4829-873A-310A125B4D4C}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403A-B9D2-65C292C39087}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{575BDDF5-790A-4D01-A37D-2863DEC1C085}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6F282B65-56BF-4BD1-A8B2-A4449A05863D}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B939CF93-F2CB-443D-956C-DC523D85C9DB}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BD3EA7C2-3AF8-4463-9A9C-6EB8E136CB02}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}Key Found : HKCU\Software\SearchProtectKey Found : HKLM\Software\AskToolbarKey Found : HKLM\Software\BabylonKey Found : HKLM\Software\BandooKey Found : HKLM\SOFTWARE\Classes\AlxSSB.AlxTBSSBKey Found : HKLM\SOFTWARE\Classes\AlxSSB.AlxTBSSB.1Key Found : HKLM\SOFTWARE\Classes\AppID\{1301A8A5-3DFB-4731-A162-B357D00C9644}Key Found : HKLM\SOFTWARE\Classes\AppID\{1F02FB61-2BE5-4C16-8199-AEAA16EB0342}Key Found : HKLM\SOFTWARE\Classes\AppID\{3FC27B34-0C19-49DA-875E-1875DDD4A6B2}Key Found : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}Key Found : HKLM\SOFTWARE\Classes\AppID\{835315FC-1BF6-4CA9-80CD-F6C158D40692}Key Found : HKLM\SOFTWARE\Classes\AppID\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}Key Found : HKLM\SOFTWARE\Classes\AppID\{AC662AF2-4601-4A68-84DF-A3FE83F1A5F9}Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}Key Found : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}Key Found : HKLM\SOFTWARE\Classes\AppID\{C3110516-8EFC-49D6-8B72-69354F332062}Key Found : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}Key Found : HKLM\SOFTWARE\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}Key Found : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}Key Found : HKLM\SOFTWARE\Classes\AppID\BandooCore.EXEKey Found : HKLM\SOFTWARE\Classes\AppID\BrowserConnection.dllKey Found : HKLM\SOFTWARE\Classes\AppID\DefaultTabBHO.DLLKey Found : HKLM\SOFTWARE\Classes\AppID\DNSBHO.dllKey Found : HKLM\SOFTWARE\Classes\AppID\PriceGongIE.DLLKey Found : HKLM\SOFTWARE\Classes\BandooCore.BandooCoreKey Found : HKLM\SOFTWARE\Classes\BandooCore.BandooCore.1Key Found : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngrKey Found : HKLM\SOFTWARE\Classes\BandooCore.ResourcesMngr.1Key Found : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngrKey Found : HKLM\SOFTWARE\Classes\BandooCore.SettingsMngr.1Key Found : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngrKey Found : HKLM\SOFTWARE\Classes\BandooCore.StatisticMngr.1Key Found : HKLM\SOFTWARE\Classes\BrowserConnection.LoaderKey Found : HKLM\SOFTWARE\Classes\BrowserConnection.Loader.1Key Found : HKLM\SOFTWARE\Classes\CLSID\{13119113-0854-469D-807A-171568457991}Key Found : HKLM\SOFTWARE\Classes\CLSID\{148DCAEC-C91D-441D-A0E7-519A0673E7F5}Key Found : HKLM\SOFTWARE\Classes\CLSID\{27488090-768A-4D20-A938-F223F71C344C}Key Found : HKLM\SOFTWARE\Classes\CLSID\{27F69C85-64E1-43CE-98B5-3C9F22FB408E}Key Found : HKLM\SOFTWARE\Classes\CLSID\{3033124F-06BF-4829-873A-310A125B4D4C}Key Found : HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}Key Found : HKLM\SOFTWARE\Classes\CLSID\{33119133-0854-469D-807A-171568457991}Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}Key Found : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}Key Found : HKLM\SOFTWARE\Classes\CLSID\{575BDDF5-790A-4D01-A37D-2863DEC1C085}Key Found : HKLM\SOFTWARE\Classes\CLSID\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}Key Found : HKLM\SOFTWARE\Classes\CLSID\{6F282B65-56BF-4BD1-A8B2-A4449A05863D}Key Found : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}Key Found : HKLM\SOFTWARE\Classes\CLSID\{A00289B5-2C16-4EC7-9780-2B56977ADC65}Key Found : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}Key Found : HKLM\SOFTWARE\Classes\CLSID\{B543EF05-9758-464E-9F37-4C28525B4A4C}Key Found : HKLM\SOFTWARE\Classes\CLSID\{BB76A90B-2B4C-4378-8506-9A2B6E16943C}Key Found : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}Key Found : HKLM\SOFTWARE\Classes\CLSID\{BD3EA7C2-3AF8-4463-9A9C-6EB8E136CB02}Key Found : HKLM\SOFTWARE\Classes\CLSID\{C1545464-C77C-4130-A572-1C619E2895FE}Key Found : HKLM\SOFTWARE\Classes\CLSID\{C3AB94A4-BFD0-4BBA-A331-DE504F07D2DB}Key Found : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}Key Found : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}Key Found : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}Key Found : HKLM\SOFTWARE\Classes\CLSID\{ED0E67AD-926C-4008-87E5-03CF72AA2A7E}Key Found : HKLM\SOFTWARE\Classes\CLSID\{F443A627-5009-4323-9C1D-7FD598D0D712}Key Found : HKLM\SOFTWARE\Classes\CrossriderApp0004479.BHOKey Found : HKLM\SOFTWARE\Classes\CrossriderApp0004479.BHO.1Key Found : HKLM\SOFTWARE\Classes\CrossriderApp0004479.SandboxKey Found : HKLM\SOFTWARE\Classes\CrossriderApp0004479.Sandbox.1Key Found : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowserKey Found : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowser.1Key Found : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowserActiveXKey Found : HKLM\SOFTWARE\Classes\DefaultTabBHO.DefaultTabBrowserActiveX.1Key Found : HKLM\SOFTWARE\Classes\DnsBHO.BHOKey Found : HKLM\SOFTWARE\Classes\DnsBHO.BHO.1Key Found : HKLM\SOFTWARE\Classes\IESmartBar.BandObjectAttributeKey Found : HKLM\SOFTWARE\Classes\IESmartBar.BHOKey Found : HKLM\SOFTWARE\Classes\IESmartBar.DockingPanelKey Found : HKLM\SOFTWARE\Classes\IESmartBar.IESmartBarKey Found : HKLM\SOFTWARE\Classes\IESmartBar.IESmartBarBandObjectKey Found : HKLM\SOFTWARE\Classes\IESmartBar.SmartbarDisplayStateKey Found : HKLM\SOFTWARE\Classes\IESmartBar.SmartbarMenuFormKey Found : HKLM\Software\Classes\Installer\Features\0C776EBEBCBCFBE408892EE7B12517FCKey Found : HKLM\Software\Classes\Installer\Products\0C776EBEBCBCFBE408892EE7B12517FCKey Found : HKLM\Software\Classes\Installer\Products\7344DBA75A2144649A458FB3F3EBF7FBKey Found : HKLM\Software\Classes\Installer\Products\9EE58E3C298524145B73CBBED3CAC4D3Key Found : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEFKey Found : HKLM\Software\Classes\Installer\Products\B2FD9C0A5B9838449838816A28001F4BKey Found : HKLM\Software\Classes\Installer\Products\EB6AF8AEEB922FA4392548F13812E50BKey Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}Key Found : HKLM\SOFTWARE\Classes\Interface\{06DE5702-44CF-4B79-B4EF-3DDF653358F5}Key Found : HKLM\SOFTWARE\Classes\Interface\{23119123-0854-469D-807A-171568457991}Key Found : HKLM\SOFTWARE\Classes\Interface\{477F210A-2A86-4666-9C4B-1189634D2C84}Key Found : HKLM\SOFTWARE\Classes\Interface\{8DA8B89E-0C65-403B-8231-AB22ECFA0687}Key Found : HKLM\SOFTWARE\Classes\Interface\{98623C86-E768-4C5A-B23B-EE8CE3727CD3}Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}Key Found : HKLM\SOFTWARE\Classes\Interface\{A928E66C-F501-4E66-9953-855C712F93B2}Key Found : HKLM\SOFTWARE\Classes\Interface\{B0E28FA0-DF07-44B6-95CE-48BE26DB9266}Key Found : HKLM\SOFTWARE\Classes\Interface\{E6B4EE8F-C38E-4994-BE28-229A3F92262C}Key Found : HKLM\SOFTWARE\Classes\Interface\{FCA8936E-403A-4487-A966-70F80F1D5A6A}Key Found : HKLM\SOFTWARE\Classes\Interface\{FF871E51-2655-4D06-AED5-745962A96B32}Key Found : HKLM\SOFTWARE\Classes\MFKey Found : HKLM\SOFTWARE\Classes\Prod.capKey Found : HKLM\SOFTWARE\Classes\sim-packagesKey Found : HKLM\SOFTWARE\Classes\Toolbar.CT1320680Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT1561552Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3042917Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3106574Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3131886Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3196716Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3198785Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3201318Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3220468Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3272718Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3287819Key Found : HKLM\SOFTWARE\Classes\TypeLib\{03119103-0854-469D-807A-171568457991}Key Found : HKLM\SOFTWARE\Classes\TypeLib\{4A8AE59A-2F19-4777-B0B4-177188AB839B}Key Found : HKLM\SOFTWARE\Classes\TypeLib\{644413C0-4090-4A84-BC29-DC69E91A7D73}Key Found : HKLM\SOFTWARE\Classes\TypeLib\{8F5F1CB6-EA9E-40AF-A5CA-C7FD63CC1971}Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}Key Found : HKLM\SOFTWARE\Classes\TypeLib\{DA9FC525-41ED-4C00-B046-946DA7CDD305}Key Found : HKLM\SOFTWARE\Classes\wtb.BandKey Found : HKLM\SOFTWARE\Classes\wtb.Band.1Key Found : HKLM\SOFTWARE\Classes\wtb.NotificationSourceKey Found : HKLM\SOFTWARE\Classes\wtb.NotificationSource.1Key Found : HKLM\SOFTWARE\Classes\wtb.SourceSinkImplKey Found : HKLM\SOFTWARE\Classes\wtb.SourceSinkImpl.1Key Found : HKLM\SOFTWARE\Classes\wtb.ToolbarInfoKey Found : HKLM\SOFTWARE\Classes\wtb.ToolbarInfo.1Key Found : HKLM\SOFTWARE\Classes\Zwinky_5q.HTMLMenuKey Found : HKLM\SOFTWARE\Classes\Zwinky_5q.HTMLMenu.1Key Found : HKLM\SOFTWARE\Classes\Zwinky_5q.PseudoTransparentPluginKey Found : HKLM\SOFTWARE\Classes\Zwinky_5q.PseudoTransparentPlugin.1Key Found : HKLM\SOFTWARE\Classes\Zwinky_5q.RadioKey Found : HKLM\SOFTWARE\Classes\Zwinky_5q.Radio.1Key Found : HKLM\SOFTWARE\Classes\Zwinky_5q.SettingsPluginKey Found : HKLM\SOFTWARE\Classes\Zwinky_5q.SettingsPlugin.1Key Found : HKLM\SOFTWARE\Classes\Zwinky_5q.SkinLauncherKey Found : HKLM\SOFTWARE\Classes\Zwinky_5q.SkinLauncher.1Key Found : HKLM\Software\ConduitKey Found : HKLM\Software\DataMngrKey Found : HKLM\Software\Default TabKey Found : HKLM\Software\Freeze.comKey Found : HKLM\Software\FunmoodsKey Found : HKLM\SOFTWARE\Google\Chrome\Extensions\dednnpigldgdbpgcdpfppmlcnnbjcielKey Found : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfdKey Found : HKLM\SOFTWARE\Google\Chrome\Extensions\jbpkiefagocgkmemidfngdkamloieekfKey Found : HKLM\SOFTWARE\Google\Chrome\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjgKey Found : HKLM\SOFTWARE\Google\Chrome\Extensions\lpmkgpnbiojfaoklbkpfneikocaobfaiKey Found : HKLM\SOFTWARE\Google\Chrome\Extensions\ndkhncnongaclekkbelchmeafffimifjKey Found : HKLM\SOFTWARE\Google\Chrome\Extensions\pfmopbbadnfoelckkcmjjeaaegjpjjbkKey Found : HKLM\Software\IB UpdaterKey Found : HKLM\Software\IminentKey Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{1A93C934-025B-4C3A-B38E-9654A7003239}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{328D6F78-0DBB-4F17-ACD5-26A2EA4EF251}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{424624F4-C5DD-4E1D-BDD0-1E9C9B7799CC}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6F0B1972-589E-4437-9F4C-A18F2AF4BDC7}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7695996F-9846-4A09-A037-632E45737712}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F000001-DB8E-F89C-2FEC-49BF726F8C12}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{98623C86-E768-4C5A-B23B-EE8CE3727CD3}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C8A3CA5-889E-4554-BEEC-EC0876E4E96A}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B803084B-B069-485E-B5D0-F9A6D318AF02}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BFF6B2CA-366C-4A90-B685-D87776DEB0D2}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C2D64FF7-0AB8-4263-89C9-EA3B0F8F050C}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CFD485F0-96BD-47CD-BB6D-CD7DDA95F102}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E57091A7-B5F0-4C42-9329-72ED3E59ED31}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F9189560-573A-4FDE-B055-AE7B0F4CF080}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD21}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2101}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD22}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2426}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}Key Found : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Media FinderKey Found : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SearchSettingsKey Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{27488090-768A-4D20-A938-F223F71C344C}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{575BDDF5-790A-4D01-A37D-2863DEC1C085}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B939CF93-F2CB-443D-956C-DC523D85C9DB}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BD3EA7C2-3AF8-4463-9A9C-6EB8E136CB02}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{148DCAEC-C91D-441D-A0E7-519A0673E7F5}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6087829B-114F-42A1-A72B-B4AEDCEA4E5B}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F6AFBF1-E065-4627-A2FD-810366367D01}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8C775DBE-2382-4EAB-A48A-6859C3B9EF29}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A00289B5-2C16-4EC7-9780-2B56977ADC65}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F464A68D-1CF2-4991-93AB-A84351D7F676}Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0C776EBEBCBCFBE408892EE7B12517FCKey Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\0C776EBEBCBCFBE408892EE7B12517FCKey Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2F603A45-D956-496B-81B5-50D782424976}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7ABD4437-12A5-4644-A954-F83B3FBE7FBF}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86C0E2A3-1EDA-4F01-A43D-80DA8642813C}_is1Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A0C9DF2B-89B5-4483-8983-18A68200F1B4}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B85C4CB2-B352-4BD8-818C-BCE353599107}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C3E85EE9-5892-4142-B537-BCEB3DAC4C3D}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EA8FA6BE-29BE-4AF2-9352-841F83215EB0}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EBE677C0-CBCB-4EBF-8098-E27E1B5271CF}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BandooKey Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Produtools_Maps ToolbarKey Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Results ToolbarKey Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Zwinky_5qbar UninstallKey Found : HKLM\SOFTWARE\MozillaPlugins\@Zwinky_5q.com/PluginKey Found : HKLM\Software\PIPKey Found : HKLM\Software\PlaybryteKey Found : HKLM\Software\Produtools_MapsKey Found : HKLM\Software\SpeedMaxPCKey Found : HKLM\Software\SProtectorKey Found : HKLM\Software\systweakKey Found : HKLM\Software\Tarma InstallerKey Found : HKLM\Software\Web AssistantKey Found : HKU\S-1-5-21-397424738-1516466002-4240990644-1005\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}Value Found : HKCU\Software\Microsoft\Internet Explorer\Main [bprotector start page]Value Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{3033124F-06BF-4829-873A-310A125B4D4C}]Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{6F282B65-56BF-4BD1-A8B2-A4449A05863D}]Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{575BDDF5-790A-4D01-A37D-2863DEC1C085}]Value Found : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]Value Found : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}]Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [5qffxtbr@Zwinky_5q.com] ***** [internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16490 -\\ Mozilla Firefox v21.0 (en-US) File : C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\r0fsxocr.default\prefs.js Found : user_pref("browser.search.selectedEngine", "Web Search"); File : C:\Users\The Batduck\AppData\Roaming\Mozilla\Firefox\Profiles\7pntvx3j.default\prefs.js [OK] File is clean. -\\ Google Chrome v28.0.1500.72 File : C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Preferences File : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences Found [l.25] : keyword = "search.snap.do", File : C:\Users\The Batduck\AppData\Local\Google\Chrome\User Data\Default\Preferences ************************* AdwCleaner[R1].txt - [31309 octets] - [15/07/2013 19:43:30] ########## EOF - C:\AdwCleaner[R1].txt - [31370 octets] ########## Not that I personally set, but I do know what it is and I dont believe it to to be malicious. I believe it's somthing that was done automaticly by "OpenVPN" a Virtual private network I have used in the past. And I looked through the logs from adwcleaner and I believe its all adware and useless so I just went ahead and deleted it all. Now regarding the original issue after a very long virus scan aproximately 7 hours with malwarebytes PRO I found 17 objects some of which were false positives I removed them all. I have checked my ports again and am not currently seeing the ip's that had been connected. I'm not sure if the issue is entirely solved or what the case is. What is your professional opinion on this? do you believe the MOD had tapped me for some reason and had been invading my privacy? and if so why do you believe they may of done so? Also here is a picture of all the svchost.exe's Please tell me if anything looks wrong here And also thank you very much for all your assistance and fast replys you have helped so much I cannot thank you enough
  3. DDS (Ver_2012-11-20.01) - NTFS_x86 Internet Explorer: 9.0.8112.16490 BrowserJavaVersion: 10.21.2 Run by The Batduck at 14:35:52 on 2013-07-15 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.2.1033.18.2814.1401 [GMT -3:00] . AV: McAfee VirusScan Enterprise *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637} AV: Microsoft Security Essentials *Enabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: McAfee VirusScan Enterprise Antispyware Module *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A} SP: Microsoft Security Essentials *Enabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508} SP: COMODO Antivirus *Disabled/Outdated* {0C2D2636-923D-EE52-2A83-E643204A8275} FW: COMODO Firewall *Disabled* {8F7746F7-FE68-E084-3B6C-7404A51E8FB3} . ============== Running Processes ================ . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Program Files\Common Files\COMODO\launcher_service.exe C:\Program Files\Microsoft Security Client\MsMpEng.exe C:\Windows\system32\SLsvc.exe C:\Windows\System32\spoolsv.exe C:\Windows\System32\alg.exe C:\Program Files\SearchProtect\bin\CltMngSvc.exe C:\Windows\system32\dllhost.exe C:\Program Files\Comodo\Dragon\dragon_updater.exe C:\Windows\ehome\ehRecvr.exe C:\Windows\ehome\ehsched.exe C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Program Files\Common Files\COMODO\GeekBuddyRSP.exe C:\Program Files\LogMeIn Hamachi\hamachi-2.exe C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files\McAfee\Common Framework\FrameworkService.exe C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe C:\Windows\system32\mfevtps.exe C:\Windows\System32\msdtc.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe C:\Program Files\McAfee\Common Framework\naPrdMgr.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe C:\Windows\system32\locator.exe C:\Windows\System32\snmptrap.exe C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe C:\Windows\system32\UI0Detect.exe C:\Windows\System32\vds.exe C:\Windows\system32\vssvc.exe C:\Windows\system32\wbem\WmiApSrv.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\System32\WUDFHost.exe C:\Windows\system32\iashost.exe C:\Windows\system32\SearchProtocolHost.exe C:\Program Files\Microsoft Security Client\NisSrv.exe C:\Program Files\Common Files\COMODO\GeekBuddyRSP.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\McAfee\Common Framework\UdaterUI.exe C:\Program Files\McAfee\Common Framework\McTray.exe C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe C:\Windows\system32\conime.exe C:\Program Files\Google\Chrome\Application\chrome.exe C:\Users\The Batduck\Downloads\RogueKiller.exe C:\Windows\system32\taskmgr.exe C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\svchost.exe -k regsvc C:\Windows\system32\svchost.exe -k SDRSVC C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k swprv C:\Windows\system32\svchost.exe -k wcssvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\svchost.exe -k LocalService . ============== Pseudo HJT Report =============== . mURLSearchHooks: Produtools Maps Toolbar: {575bddf5-790a-4d01-a37d-2863dec1c085} - c:\program files\produtools_maps\prxtbProd.dll mURLSearchHooks: FLV Runner Toolbar: {3bbd3c14-4c16-4989-8366-95bc9179779d} - c:\program files\flv_runner\prxtbFLV0.dll BHO: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Toolbar BHO: {27488090-768a-4d20-a938-f223f71c344c} - c:\program files\zwinky_5q\bar\1.bin\5qbar.dll BHO: QuickShare WidgetEngine: {31ad400d-1b06-4e33-a59a-90c2c140cba0} - BHO: IB Updater: {336D0C35-8A85-403a-B9D2-65C292C39087} - c:\program files\web assistant\Extension32.dll BHO: FLV Runner Toolbar: {3bbd3c14-4c16-4989-8366-95bc9179779d} - c:\program files\flv_runner\prxtbFLV0.dll BHO: Produtools Maps Toolbar: {575bddf5-790a-4d01-a37d-2863dec1c085} - c:\program files\produtools_maps\prxtbProd.dll BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll BHO: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20120829193241.dll BHO: ShowBarObj Class: {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - c:\program files\acer\empowering technology\edatasecurity\x86\ActiveToolBand.dll BHO: {8d3ec233-b92d-4187-a506-284127cfba2d} - <orphaned> BHO: Arcadesafari BHO: {adff4c9a-4f49-4a1f-8885-360e107b7938} - BHO: {B939CF93-F2CB-443d-956C-DC523D85C9DB} - <orphaned> BHO: Search Assistant BHO: {bd3ea7c2-3af8-4463-9a9c-6eb8e136cb02} - c:\program files\zwinky_5q\bar\1.bin\5qSrcAs.dll BHO: delta Helper Object: {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - c:\program files\delta\delta\1.8.21.5\bh\delta.dll BHO: GamesBarBHO Class: {CB0D163C-E9F4-4236-9496-0597E24B23A5} - c:\program files\gamesbar\2.0.1.109\oberontb.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll BHO: Hotspot Shield Class: {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - c:\program files\hotspot shield\hssie\HssIE.dll TB: FLV Runner Toolbar: {3BBD3C14-4C16-4989-8366-95BC9179779D} - c:\program files\flv_runner\prxtbFLV0.dll TB: Acer eDataSecurity Management: {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - c:\program files\acer\empowering technology\edatasecurity\x86\eDStoolbar.dll TB: GamesBar: {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - c:\program files\gamesbar\2.0.1.109\oberontb.dll TB: QuickShare Widget: {ae07101b-46d4-4a98-af68-0333ea26e113} - TB: FLV Runner Toolbar: {3bbd3c14-4c16-4989-8366-95bc9179779d} - c:\program files\flv_runner\prxtbFLV0.dll TB: Zwinky: {3033124f-06bf-4829-873a-310a125b4d4c} - c:\program files\zwinky_5q\bar\1.bin\5qbar.dll TB: Delta Toolbar: {82E1477C-B154-48D3-9891-33D83C26BCD3} - c:\program files\delta\delta\1.8.21.5\deltaTlbr.dll TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll uRun: [skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrun mRun: [eRecoveryService] <no file> dRun: [Exetender] "c:\program files\free ride games\GPlayer.exe" /runonstartup StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\startg~1.lnk - c:\program files\comodo\geekbuddy\launcher.exe uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: {1A93C934-025B-4c3a-B38E-9654A7003239} - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} IE: {5f7f7e76-0f61-4de9-8ae6-e5ee565cd118} - {8d3ec233-b92d-4187-a506-284127cfba2d} LSP: c:\windows\system32\AVLib.dll DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} - TCP: NameServer = 192.168.2.1 142.166.145.137 TCP: Interfaces\{6786B44F-F874-420D-A66B-9B2E41AA405A} : NameServer = 156.154.70.22,156.154.71.22 TCP: Interfaces\{6786B44F-F874-420D-A66B-9B2E41AA405A} : DHCPNameServer = 192.168.2.1 142.166.145.137 TCP: Interfaces\{DF1A31B0-896B-42E9-806E-D4F426DF8E53} : NameServer = 156.154.70.22,156.154.71.22 TCP: Interfaces\{DF1A31B0-896B-42E9-806E-D4F426DF8E53} : DHCPNameServer = 192.168.2.1 142.166.145.137 Handler: intu-tt2012 - {02F985EF-502B-4597-993F-6BF9E004C138} - <orphaned> Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\28.0.1500.72\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome Hosts: 127.94.0.1 client.openvpn.net Hosts: 127.94.0.2 openvpn-client.us-ca-sj-001.privatetunnel.com . ================= FIREFOX =================== . FF - ProfilePath - c:\users\the batduck\appdata\roaming\mozilla\firefox\profiles\7pntvx3j.default\ FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll FF - plugin: c:\program files\common files\oberon media\ncadapter\1.0.0.8\npapicomadapter.dll FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll FF - plugin: c:\program files\free ride games\npExentCtl.dll FF - plugin: c:\program files\free ride games\npGameTreatWidget.dll FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\update\1.3.21.145\npGoogleUpdate3.dll FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll FF - plugin: c:\program files\microsoft silverlight\5.1.20125.0\npctrlui.dll FF - plugin: c:\program files\virtools\3d life player\npvirtools.dll FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_7_700_224.dll FF - ExtSQL: 2013-06-09 23:34; {D19CA586-DD6C-4a0a-96F8-14644F340D60}; c:\program files\common files\mcafee\SystemCore . ============= SERVICES / DRIVERS =============== . R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2012-8-29 461864] R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2013-1-20 195296] R1 CFRMD;CFRMD;c:\windows\system32\drivers\CFRMD.sys [2013-5-7 35064] R1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\drivers\cmderd.sys [2013-6-18 20072] R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2013-6-18 583448] R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2013-6-18 43216] R1 HssDRV6;Hotspot Shield Routing Driver 6;c:\windows\system32\drivers\hssdrv6.sys [2013-4-24 40648] R1 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2012-8-29 164840] R1 MpKsldf5eeff9;MpKsldf5eeff9;c:\programdata\microsoft\microsoft antimalware\definition updates\{3cd3d405-2f35-4ac1-b0ed-07936dc44886}\MpKsldf5eeff9.sys [2013-7-15 29904] R2 CLPSLauncher;COMODO LPS Launcher;c:\program files\common files\comodo\launcher_service.exe [2013-4-17 70344] R2 CltMngSvc;Search Protect by Conduit Updater;c:\program files\searchprotect\bin\CltMngSvc.exe [2013-5-8 97056] R2 DragonUpdater;COMODO Dragon Update Service;c:\program files\comodo\dragon\dragon_updater.exe [2013-6-20 2095752] R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504] R2 GeekBuddyRSP;GeekBuddyRSP Service;c:\program files\common files\comodo\GeekBuddyRSP.exe [2013-4-17 1851088] R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files\logmein hamachi\hamachi-2.exe [2013-6-28 1440080] R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2013-7-15 418376] R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2013-7-15 701512] R2 McAfeeFramework;McAfee Framework Service;c:\program files\mcafee\common framework\FrameworkService.exe [2011-1-12 120128] R2 McShield;McAfee McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2012-8-29 166024] R2 McTaskManager;McAfee Task Manager;c:\program files\mcafee\virusscan enterprise\vstskmgr.exe [2011-9-14 209760] R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2012-8-29 148520] R2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2011-4-27 100328] R2 TeamViewer8;TeamViewer 8;c:\program files\teamviewer\version8\TeamViewer_Service.exe [2013-6-25 4150112] R2 X6XSEx_Pr143;X6XSEx_Pr143;c:\program files\free ride games\X6XSEx_Pr143.sys [2013-2-9 47432] R3 ManyCam;ManyCam Virtual Webcam;c:\windows\system32\drivers\mcvidrv.sys [2012-1-11 34432] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-7-15 22856] R3 mcaudrv_simple;ManyCam Virtual Microphone;c:\windows\system32\drivers\mcaudrv.sys [2013-1-31 22656] R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2012-8-29 180072] R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2012-8-29 59288] R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\NisSrv.exe [2013-1-27 295232] R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\drivers\taphss6.sys [2013-4-24 37064] R3 tapoas;TAP-Win32 Adapter OAS;c:\windows\system32\drivers\tapoas.sys [2011-8-19 26112] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-6-3 162408] S2 vnccom;vnccom;c:\windows\system32\drivers\vnccom.SYS [2012-6-29 13384] S3 cmdvirth;COMODO Virtual Service Manager;c:\program files\comodo\comodo internet security\cmdvirth.exe [2013-6-18 127192] S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2012-8-29 87808] S3 NETw2v32;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\system32\drivers\NETw2v32.sys [2006-11-2 2589184] S3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\system32\drivers\Ph3xIB32.sys [2007-4-3 1131136] S3 SbieDrv;SbieDrv;c:\program files\sandboxie\SbieDrv.sys [2013-6-17 159208] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] S4 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\acer arcade live\acer homemedia connect\kernel\dms\CLMSServer.exe [2008-8-21 270422] S4 Acer TV Share Service;Acer TV Share Service;c:\program files\acer arcade live\acer tv share\kernel\dmstv\CLMSServer.exe [2012-1-10 270426] S4 AVRedirector;AVRedirector;c:\program files\hide the ip\data\AVLib.EXE [2013-5-14 3208096] S4 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\newtech infosystems\nti backup now 5\client\Agentsvc.exe [2008-3-3 16384] S4 CGVPNCliSrvc;CyberGhost VPN Client;c:\program files\cyberghost vpn\CGVPNCliService.exe [2012-7-25 2438696] S4 DefaultTabUpdate;DefaultTabUpdate;c:\users\mike\appdata\roaming\defaulttab\defaulttab\DTUpdate.exe [2012-9-26 107520] S4 ETService;Empowering Technology Service;c:\program files\acer\empowering technology\service\ETService.exe [2008-8-21 24576] S4 hshld;Hotspot Shield Service;c:\program files\hotspot shield\bin\openvpnas.exe [2013-4-26 570664] S4 HssWd;Hotspot Shield Monitoring Service;c:\program files\hotspot shield\bin\hsswd.exe [2013-4-26 390440] S4 htisvcfwm;Hide The IP Service;c:\program files\hide the ip\data\htisvc.exe [2011-7-1 1256360] S4 i2p;I2P Service;c:\program files\i2p\I2Psvc.exe [2013-5-17 384000] S4 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2008-4-25 45056] S4 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2008-4-25 131072] S4 OpenVPNAccessClient;OpenVPN Access Client;c:\program files\openvpn technologies\privatetunnel\core\capiws.exe [2012-10-12 24064] S4 Uvnc_service;Uvnc_service;c:\program files\ultravnc addons\uvnc_service.exe [2012-6-29 63296] S4 Zwinky_5qService;ZwinkyService;c:\progra~1\zwinky~2\bar\1.bin\5qbarsvc.exe [2012-12-15 42504] . =============== Created Last 30 ================ . 2013-07-15 17:24:31 15616 ----a-w- c:\windows\system32\TrueSight.sys 2013-07-15 16:37:16 29904 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{3cd3d405-2f35-4ac1-b0ed-07936dc44886}\MpKsldf5eeff9.sys 2013-07-15 10:45:37 47368 ----a-w- c:\windows\system32\certsentry.dll 2013-07-15 10:44:09 -------- d-s---w- c:\programdata\Shared Space 2013-07-15 10:41:42 -------- d-----w- c:\programdata\COMODO 2013-07-15 10:41:13 -------- d-----w- c:\program files\common files\COMODO 2013-07-15 10:40:58 -------- d-----w- c:\users\the batduck\appdata\local\Comodo 2013-07-15 10:40:28 -------- d-----w- c:\program files\Comodo 2013-07-15 10:40:19 -------- d-----w- c:\programdata\Comodo Downloader 2013-07-15 10:32:09 -------- d-----w- c:\users\the batduck\appdata\roaming\Malwarebytes 2013-07-15 10:31:21 22856 ----a-w- c:\windows\system32\drivers\mbam.sys 2013-07-15 10:31:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2013-07-15 09:03:09 5914 ----a-w- c:\windows\system32\cc_20130715_060306.reg 2013-07-13 17:27:45 -------- d-----w- c:\program files\OpenVPN 2013-07-13 06:56:28 7068072 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{3cd3d405-2f35-4ac1-b0ed-07936dc44886}\mpengine.dll 2013-07-12 19:29:49 -------- d-----w- c:\users\the batduck\appdata\local\LogMeIn Hamachi 2013-07-12 19:26:52 -------- d-----w- c:\program files\LogMeIn Hamachi 2013-07-09 08:41:17 -------- d-----w- c:\users\the batduck\appdata\local\Vitalwerks 2013-07-09 08:40:39 -------- d-----w- c:\program files\No-IP 2013-07-09 08:37:02 -------- d-----w- c:\users\the batduck\appdata\roaming\PhrozenSoft 2013-07-09 04:56:16 -------- dc----w- C:\Perl 2013-07-09 02:47:18 -------- d-----w- c:\windows\.wms32_32 2013-07-09 02:47:18 -------- d-----w- c:\users\the batduck\rw_cache 2013-07-08 11:21:20 -------- d-----w- c:\users\the batduck\project_destiny_474 2013-07-07 22:24:11 -------- d-----w- c:\users\the batduck\appdata\roaming\SearchProtect 2013-07-07 13:39:28 -------- d-----w- c:\program files\SearchProtect 2013-07-07 12:28:58 7068072 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll 2013-07-01 14:04:33 -------- d-----w- c:\program files\Dropbox 2013-07-01 14:02:26 -------- d-----w- c:\users\the batduck\appdata\roaming\Dropbox 2013-07-01 05:08:59 -------- d-----w- c:\users\the batduck\appdata\roaming\TechSmith 2013-07-01 05:08:35 -------- d-----w- c:\users\the batduck\appdata\local\TechSmith 2013-07-01 05:05:50 -------- d-----w- c:\program files\common files\TechSmith Shared 2013-06-29 07:17:41 -------- d-----w- c:\users\the batduck\appdata\local\join.me 2013-06-25 18:46:13 -------- d-----w- c:\program files\TeamViewer 2013-06-25 14:42:47 -------- d-----w- c:\program files\CCleaner 2013-06-25 01:11:25 724464 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{5df10f5a-18c6-42aa-ad0c-4c9eb7422df9}\gapaengine.dll 2013-06-24 04:17:23 -------- d-----w- c:\program files\Winamp Detect 2013-06-24 04:16:42 -------- d-----w- c:\program files\common files\PX Storage Engine 2013-06-24 02:30:10 -------- d-----w- c:\windows\system32\Data 2013-06-20 18:41:16 12800 ----a-w- c:\program files\mozilla firefox\plugins\npwachk.dll 2013-06-20 17:57:25 -------- d-----w- c:\users\the batduck\ForeverPkers03 2013-06-20 17:10:27 -------- d-----w- c:\users\the batduck\matrixiicache 2013-06-20 01:54:45 -------- dc----r- C:\Sandbox 2013-06-20 01:25:41 -------- d-----w- c:\program files\Sandboxie 2013-06-19 23:42:11 -------- d-----w- c:\users\the batduck\appdata\roaming\X-Chat 2 2013-06-19 23:41:58 -------- d-----w- c:\program files\xchat 2013-06-19 23:07:21 -------- d-----w- c:\users\the batduck\appdata\roaming\mIRC 2013-06-19 23:07:19 -------- d-----w- c:\program files\mIRC 2013-06-19 22:56:01 -------- d-----w- c:\program files\WinSCP 2013-06-18 19:15:58 583448 ----a-w- c:\windows\system32\drivers\cmdguard.sys 2013-06-18 19:15:58 43216 ----a-w- c:\windows\system32\drivers\cmdhlp.sys 2013-06-18 19:15:56 20072 ----a-w- c:\windows\system32\drivers\cmderd.sys 2013-06-18 19:15:50 35488 ----a-w- c:\windows\system32\cmdcsr.dll 2013-06-18 19:15:48 348584 ----a-w- c:\windows\system32\guard32.dll 2013-06-18 19:15:36 40664 ----a-w- c:\windows\system32\cmdkbd32.dll 2013-06-18 19:15:36 278232 ----a-w- c:\windows\system32\cmdvrt32.dll . ==================== Find3M ==================== . 2013-06-12 03:50:51 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-06-12 03:50:51 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-06-12 03:50:33 9089416 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe 2013-05-16 22:39:39 1800704 ----a-w- c:\windows\system32\jscript9.dll 2013-05-16 22:28:26 1129472 ----a-w- c:\windows\system32\wininet.dll 2013-05-16 22:27:30 1427968 ----a-w- c:\windows\system32\inetcpl.cpl 2013-05-16 22:21:37 142848 ----a-w- c:\windows\system32\ieUnatt.exe 2013-05-16 22:20:30 420864 ----a-w- c:\windows\system32\vbscript.dll 2013-05-16 22:16:57 2382848 ----a-w- c:\windows\system32\mshtml.tlb 2013-05-08 06:10:12 770384 ----a-w- c:\windows\system32\msvcr100.dll 2013-05-08 06:10:12 421200 ----a-w- c:\windows\system32\msvcp100.dll 2013-05-08 03:40:36 914792 ----a-w- c:\windows\system32\drivers\tcpip.sys 2013-05-08 01:58:22 31232 ----a-w- c:\windows\system32\drivers\tcpipreg.sys 2013-05-07 07:00:18 35064 ----a-w- c:\windows\system32\drivers\CFRMD.sys 2013-05-07 07:00:18 35064 ----a-w- c:\windows\inf\cfrmd\cfrmd.sys 2013-05-02 22:03:36 3603832 ----a-w- c:\windows\system32\ntkrnlpa.exe 2013-05-02 22:03:36 3551096 ----a-w- c:\windows\system32\ntoskrnl.exe 2013-05-02 05:06:08 238872 ------w- c:\windows\system32\MpSigStub.exe 2013-05-02 04:04:25 443904 ----a-w- c:\windows\system32\win32spl.dll 2013-05-02 04:03:42 37376 ----a-w- c:\windows\system32\printcom.dll 2013-04-24 19:25:44 37064 ----a-w- c:\windows\system32\drivers\taphss6.sys 2013-04-24 19:12:34 40648 ----a-w- c:\windows\system32\drivers\hssdrv6.sys 2013-04-24 04:00:30 985600 ----a-w- c:\windows\system32\crypt32.dll 2013-04-24 04:00:30 98304 ----a-w- c:\windows\system32\cryptnet.dll 2013-04-24 04:00:30 133120 ----a-w- c:\windows\system32\cryptsvc.dll 2013-04-24 04:00:24 41984 ----a-w- c:\windows\system32\certenc.dll 2013-04-24 01:46:29 812544 ----a-w- c:\windows\system32\certutil.exe 2013-04-17 12:30:06 24576 ----a-w- c:\windows\system32\cryptdlg.dll 2012-09-20 08:00:22 4096000 ----a-w- c:\program files\GUTE437.tmp . ============= FINISH: 14:52:55.61 =============== RogueKiller V8.6.2 [Jul 5 2013] by Tigzy mail : tigzyRK<at>gmail<dot>com Feedback : http://www.adlice.com/forum/ Website : http://www.adlice.com/softwares/roguekiller/ Blog : http://tigzyrk.blogspot.com/ Operating System : Windows Vista (6.0.6002 Service Pack 2) 32 bits version Started in : Normal mode User : The Batduck [Admin rights] Mode : Scan -- Date : 07/15/2013 15:10:15 | ARK || FAK || MBR | ¤¤¤ Bad processes : 0 ¤¤¤ ¤¤¤ Registry Entries : 5 ¤¤¤ [HJ POL] HKLM\[...]\System : DisableTaskMgr (0) -> FOUND [HJ POL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND [sCREENSVR][sUSP PATH] HKCU\[...]\Desktop : SCRNSAVE.EXE (C:\Windows\ACER(N~1.SCR [-]) -> FOUND ¤¤¤ Scheduled tasks : 6 ¤¤¤ [V1][bLPATH] OptimizerProUpdaterRefreshTask.job : C:\ProgramData\OptimizerPro\updater.exe - /profilepath "C:\ProgramData\OptimizerPro\profile.ini" [-][-] -> FOUND [V1][bLPATH] OptimizerProUpdaterLogonTask.job : C:\ProgramData\OptimizerPro\updater.exe - /schedule /profilepath "C:\ProgramData\OptimizerPro\profile.ini" [-][-] -> FOUND [V1][sUSP PATH] Arcadesafari.job : C:\Users\Stephy Robin\AppData\Local\Arcadesafari\ArcadesafariUpdater.exe [7] -> FOUND [V2][ROGUE ST] 4603 : wscript.exe - C:\Users\mike\AppData\Local\Temp\launchie.vbs //B -> FOUND [V2][sUSP PATH] Arcadesafari : C:\Users\Stephy Robin\AppData\Local\Arcadesafari\ArcadesafariUpdater.exe [7] -> FOUND [V2][sUSP PATH] EPUpdater : C:\Users\THEBAT~1\AppData\Roaming\BABSOL~1\Shared\BabMaint.exe [7] -> FOUND ¤¤¤ Startup Entries : 0 ¤¤¤ ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver : [LOADED] ¤¤¤ ¤¤¤ External Hives: ¤¤¤ ¤¤¤ Infection : ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ --> %SystemRoot%\System32\drivers\etc\hosts 127.0.0.1 localhost ::1 localhost 127.94.0.1 client.openvpn.net 127.94.0.2 openvpn-client.us-ca-sj-001.privatetunnel.com ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: WDC WD3200AAJS-22B4A0 ATA Device +++++ --- User --- [MBR] 8fc411bc33070c5972f0ca6bcd2279b9 [bSP] 8356a5a0938c5d425ba4ea4d1c4bbb55 : Acer MBR Code Partition table: 0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 63 | Size: 15005 Mo 1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 30734336 | Size: 116076 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 268457984 | Size: 174161 Mo User = LL1 ... OK! User = LL2 ... OK! Finished : << RKreport[0]_S_07152013_151015.txt >> RKreport[0]_S_07152013_143206.txt attach.rar
  4. Hello, Today I decided to check my computer over as I usially do after so long. I opened the command prompt and tryed netstat -a found that I had a weird connection so I tryed netstat -a -b and found it was from svchost.exe I downloaded "CurrPorts" and ran the file as an administrator and found somthing quite interesting. I took the IP i was connected to and traced it. and found it was registered to the United Kingdoms MOD (Ministry of Defence) yet... heres the turn of events. It was showing me the ips location was located at a CHURCH... Ok so now I'm totally unaware of whats going on am I being tapped by the UK's MOD? Well I went to there website there REAL website and apon loading it. My screen turned totally black. I tryed several things like Start keys, Ctrl+Alt+Delte.. Nothing I had to restart my pc now to be sure I tryed this two more times and its confirmed this site is what causes the screen to go black. Right now i'm running a full scan with malewarebytes PRO and I have installed comodo firewall and am using it to monitor any suspicious connections but so far absolutely none Please help me if you can becuase I do not know what to do.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.