Jump to content

oscar146

Members
 View Profile  See their activity

  • Posts

    7

  • Joined

  • Last visited

 Content Type 

Everything posted by oscar146

  1. oscar146
    Hi, I followed all your advice and.. ran fix ran anti root kit and it said no threats and no need to clean up still had problems with firewall and security centre so ran fixdamage and everything seems fine now, its all working as should be! pls find attached logs you requested, am I virus free for now?! thanks again for all your help! gina Fixlog.txt mbar-log-2013-10-27 (09-01-46).txt system-log.txt
  2. oscar146
    ive run the malware scan and it detected some Trojans I deleted these but it still wont let me download anything, turn on windows security centre or system restore?? but must go to bed and maybe pick this one up tomorrow? many thanks again gina
  3. oscar146
    im a bit lost now, I cant download anything from anywhere it keeps saying its a virus, these are the only files I have now, sorry, ill have to go into the other pc and get that frst and run it again? sorry, bet this is annoying you now!Addition.txtFRST.txt
  4. oscar146
    hi again! its worked, sorry! here are the files you wanted, I told you I was a bit dim! Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-10-2013 01 Ran by gina (administrator) on GINA-PC on 26-10-2013 19:03:10 Running from F:\ Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US) Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe (Acer Incorporated) C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe (Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE (Intel Corporation) C:\Windows\System32\igfxpers.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Spigot, Inc.) C:\Users\gina\AppData\Roaming\Search Protection\SearchProtection.exe (Google Inc.) C:\Users\gina\AppData\Local\Google\Chrome\Application\30.0.1599.101\chrome_frame_helper.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe (Google Inc.) C:\Users\gina\AppData\Local\Google\Update\1.3.21.165\GoogleCrashHandler.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe (Google Inc.) C:\Users\gina\AppData\Local\Google\Update\1.3.21.165\GoogleCrashHandler64.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Intel Corporation) C:\Windows\system32\igfxsrvc.exe ==================== Registry (Whitelisted) ================== Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-10-2013 01 Ran by gina at 2013-10-26 19:04:06 Running from F:\ Boot Mode: Normal ========================================================== ==================== Security Center ======================== ==================== Installed Programs ====================== µTorrent (x32 Version: 3.1.3) 7-Zip 9.20 (x32) Adobe AIR (x32 Version: 3.2.0.2070) Adobe Community Help (x32 Version: 3.2.1) Adobe Community Help (x32 Version: 3.2.1.650) Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117) Adobe Photoshop Elements 9 (x32 Version: 9.0) Adobe Premiere Elements 9 (x32 Version: 9.0) Adobe Reader X (10.1.0) MUI (x32 Version: 10.1.0) Adobe Shockwave Player 11.6 (x32 Version: 11.6.8.638) Agatha Christie - Death on the Nile (x32 Version: 2.2.0.98) Amazon Kindle (HKCU) Animal Genius (x32 Version: 2.2.0.97) Apple Application Support (x32 Version: 2.1.7) Apple Mobile Device Support (Version: 5.1.1.4) Apple Software Update (x32 Version: 2.1.3.127) BBC iPlayer Desktop (x32 Version: 3.2.15) Bejeweled 2 Deluxe (x32 Version: 2.2.0.95) BitTorrent (HKCU Version: 7.8.1.30016) Bonjour (Version: 3.0.0.10) Broadcom Card Reader Driver Installer (Version: 14.8.2.2) Broadcom NetLink Controller (Version: 14.8.4.1) Chuzzle Deluxe (x32 Version: 2.2.0.95) Crazy Chicken Kart 2 (x32 Version: 2.2.0.97) CSI - NY (x32 Version: 1.0) D3DX10 (x32 Version: 15.4.2368.0902) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32) eBay Worldwide (x32 Version: 2.2.0409) Elements 9 Organizer (x32 Version: 9.0) Elements STI Installer (x32 Version: 1.0) ETDWare PS/2-X64 8.0.6.3_WHQL (Version: 8.0.6.3) FATE (x32 Version: 2.2.0.97) Final Drive: Nitro (x32 Version: 2.2.0.95) foobar2000 v1.1.14 beta 2 (x32 Version: 1.1.14 beta 2) Fooz Kids (x32 Version: 3.0.8) Fooz Kids Platform (x32 Version: 2.1) Fotogalerija Windows Live (x32 Version: 15.4.3502.0922) Free Studio version 2013 (x32 Version: 6.1.10.812) Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922) Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922) Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922) Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922) Galerie de photos Windows Live (x32 Version: 15.4.3502.0922) Galerie foto Windows Live (x32 Version: 15.4.3502.0922) Gardenscapes: Mansion Makeover (x32 Version: 2.2.0.110) Gone Home (x32) Google Chrome (x32 Version: 30.0.1599.101) Google Chrome Frame (HKCU Version: 30.0.1599.101) Google Update Helper (x32 Version: 1.3.21.165) HomeMedia (x32 Version: 2.0.8920) Identity Card (x32 Version: 1.00.3501) ImgBurn (x32 Version: 2.5.4.0) Insaniquarium Deluxe (x32 Version: 2.2.0.97) Intel® Control Center (x32 Version: 1.2.1.1007) Intel® Management Engine Components (x32 Version: 7.0.0.1144) Intel® Processor Graphics (x32 Version: 8.15.10.2418) Intel® Rapid Storage Technology (x32 Version: 10.5.0.1026) iTunes (Version: 10.6.1.7) Java 7 Update 7 (x32 Version: 7.0.70) Java Auto Updater (x32 Version: 2.1.9.0) JavaFX 2.1.1 (x32 Version: 2.1.1) Jewel Match 3 (x32 Version: 2.2.0.97) Jewel Quest Solitaire (x32 Version: 2.2.0.95) John Deere Drive Green (x32 Version: 2.2.0.95) Junk Mail filter update (x32 Version: 15.4.3502.0922) Kobo (x32 Version: 2.1.7) Launch Manager (x32 Version: 5.1.7) Malwarebytes Anti-Malware version 1.75.0.1300 (x32 Version: 1.75.0.1300) Mesh Runtime (x32 Version: 15.4.5722.2) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Office 2010 (x32 Version: 14.0.4763.1000) Microsoft Office Access MUI (English) 2010 (x32 Version: 14.0.4734.1000) Microsoft Office Access Setup Metadata MUI (English) 2010 (x32 Version: 14.0.4734.1000) Microsoft Office Click-to-Run 2010 (Version: 14.0.4763.1000) Microsoft Office Click-to-Run 2010 (x32 Version: 14.0.4763.1000) Microsoft Office Excel MUI (English) 2010 (x32 Version: 14.0.4734.1000) Microsoft Office Groove MUI (English) 2010 (x32 Version: 14.0.4734.1000) Microsoft Office InfoPath MUI (English) 2010 (x32 Version: 14.0.4734.1000) Microsoft Office Office 64-bit Components 2010 (Version: 14.0.4734.1000) Microsoft Office OneNote MUI (English) 2010 (x32 Version: 14.0.4734.1000) Microsoft Office Outlook MUI (English) 2010 (x32 Version: 14.0.4734.1000) Microsoft Office PowerPoint MUI (English) 2010 (x32 Version: 14.0.4734.1000) Microsoft Office Professional Plus 2010 (x32 Version: 14.0.4734.1000) Microsoft Office Proof (English) 2010 (x32 Version: 14.0.4734.1000) Microsoft Office Proof (French) 2010 (x32 Version: 14.0.4734.1000) Microsoft Office Proof (Spanish) 2010 (x32 Version: 14.0.4734.1000) Microsoft Office Proofing (English) 2010 (x32 Version: 14.0.4734.1000) Microsoft Office Publisher MUI (English) 2010 (x32 Version: 14.0.4734.1000) Microsoft Office Shared 64-bit MUI (English) 2010 (Version: 14.0.4734.1000) Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010 (Version: 14.0.4734.1000) Microsoft Office Shared MUI (English) 2010 (x32 Version: 14.0.4734.1000) Microsoft Office Shared Setup Metadata MUI (English) 2010 (x32 Version: 14.0.4734.1000) Microsoft Office Starter 2010 - English (x32 Version: 14.0.5131.5000) Microsoft Office Word MUI (English) 2010 (x32 Version: 14.0.4734.1000) Microsoft Security Client (Version: 4.3.0219.0) Microsoft Security Essentials (Version: 4.3.219.0) Microsoft Silverlight (Version: 5.1.20913.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0) Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053) Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053) Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053) Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT_amd64 (x32 Version: 15.4.2862.0708) MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) MSXML 4.0 SP3 Parser (KB2721691) (x32 Version: 4.30.2114.0) MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0) MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0) Mystery of Mortlake Mansion (x32 Version: 2.2.0.98) Nero BackItUp 10 (x32 Version: 5.8.11000.8.100) Nero BackItUp 10 Help (CHM) (x32 Version: 10.6.10700) Nero Control Center 10 (x32 Version: 10.6.12700.0.7) Nero ControlCenter 10 Help (CHM) (x32 Version: 10.6.10700) Nero Core Components 10 (x32 Version: 2.0.19900.9.11) Nero DiscSpeed 10 (x32 Version: 6.2.10500.2.100) Nero DiscSpeed 10 Help (CHM) (x32 Version: 10.5.10000) Nero Express 10 (x32 Version: 10.6.10700.5.100) Nero Express 10 Help (CHM) (x32 Version: 10.6.10700) Nero Multimedia Suite 10 Essentials (x32 Version: 10.5.10300) Nero Multimedia Suite 10 Essentials (x32 Version: 10.6.10300) Nero RescueAgent 10 (x32 Version: 3.6.10500.3.100) Nero RescueAgent 10 Help (CHM) (x32 Version: 10.6.10700) Nero StartSmart 10 (x32 Version: 10.2.11600.14.100) Nero StartSmart 10 Help (CHM) (x32 Version: 10.5.10000) Nero Update (x32 Version: 1.0.10900.31.0) Packard Bell Games (x32 Version: 1.0.3.0) Packard Bell Power Management (x32 Version: 6.00.3008) Packard Bell Recovery Management (x32 Version: 5.00.3504) Packard Bell Registration (x32 Version: 1.04.3504) Packard Bell ScreenSaver (x32 Version: 1.1.0915.2011) Packard Bell Social Networks (x32 Version: 3.0.3106) Packard Bell Updater (x32 Version: 1.02.3500) Penguins! (x32 Version: 2.2.0.95) Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95) Poczta usługi Windows Live (x32 Version: 15.4.3502.0922) Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922) Polar Bowler (x32 Version: 2.2.0.97) Pošta Windows Live (x32 Version: 15.4.3502.0922) QuickTime (x32 Version: 7.71.80.42) Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922) Realtek High Definition Audio Driver (x32 Version: 6.0.1.6329) SanDisk ® Media Manager (x32 Version: 2.1.0.4) Search Protection (HKCU Version: 7.5.0.1) SearchAmong Toolbar version 1.0 (x32 Version: 1.0) Shared C Run-time for x64 (Version: 10.0.0) SimCity 4 Deluxe (x32) Sky Go Desktop (HKCU) Skype™ 5.10 (x32 Version: 5.10.116) Slingo Deluxe (x32 Version: 2.2.0.95) SpongeBob Typing (x32 Version: 2.2.0.98) swMSM (x32 Version: 12.0.0.1) The Sims™ 3 (x32 Version: 1.0.632) Torchlight (x32 Version: 2.2.0.97) Universal Extractor 1.6.1 (x32 Version: 1.6.1) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3) Update for Microsoft Office 2010 (KB2494150) (x32) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (x32) Update Installer for WildTangent Games App (x32) Video Web Camera (x32 Version: 1.0.1904) VIO Player version 1.2 (x32 Version: 1.2) Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.97) Visual Studio 2010 x64 Redistributables (Version: 13.0.0.1) Visual Studio 2012 x64 Redistributables (Version: 14.0.0.1) Visual Studio 2012 x86 Redistributables (x32 Version: 14.0.0.1) VLC media player 1.1.5 (x32 Version: 1.1.5) Wad2ISO (Version: 4.7.0.0) WBFS Manager 3.0 (x32 Version: 3.0) Wedding Dash (x32 Version: 2.2.0.95) Welcome Center (x32 Version: 1.02.3504) WildTangent Games App (Packard Bell Games) (x32 Version: 4.0.5.14) WinAVI Video Converter (x32 Version: 11.0.0.3995) Windows Live Communications Platform (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3538.0513) Windows Live Fotogaléria (x32 Version: 15.4.3502.0922) Windows Live Fotogalerie (x32 Version: 15.4.3502.0922) Windows Live Fotogalleri (x32 Version: 15.4.3502.0922) Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922) Windows Live Fotótár (x32 Version: 15.4.3502.0922) Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922) Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922) Windows Live ID Sign-in Assistant (Version: 7.250.4232.0) Windows Live Installer (x32 Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3538.0513) Windows Live Mail (x32 Version: 15.4.3502.0922) Windows Live Mesh (x32 Version: 15.4.3502.0922) Windows Live Messenger (x32 Version: 15.4.3538.0513) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Movie Maker (x32 Version: 15.4.3502.0922) Windows Live Photo Common (x32 Version: 15.4.3502.0922) Windows Live Photo Gallery (x32 Version: 15.4.3502.0922) Windows Live PIMT Platform (x32 Version: 15.4.3508.1109) Windows Live Remote Client (Version: 15.4.5722.2) Windows Live Remote Client Resources (Version: 15.4.5722.2) Windows Live Remote Service (Version: 15.4.5722.2) Windows Live Remote Service Resources (Version: 15.4.5722.2) Windows Live SOXE (x32 Version: 15.4.3502.0922) Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922) Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922) Windows Live UX Platform (x32 Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109) Windows Live Writer (x32 Version: 15.4.3502.0922) Windows Live Writer Resources (x32 Version: 15.4.3502.0922) Windows Live 影像中心 (x32 Version: 15.4.3502.0922) Windows Live 程式集 (x32 Version: 15.4.3502.0922) Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922) Windows Liven sähköposti (x32 Version: 15.4.3502.0922) Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922) WinRAR 4.00 (64-bit) (Version: 4.00.0) Yontoo 1.10.02 (Version: 1.10.02) Zuma Deluxe (x32 Version: 2.2.0.95) Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922) Основные компоненты Windows Live (x32 Version: 15.4.3502.0922) Почта Windows Live (x32 Version: 15.4.3502.0922) Фотоальбом Windows Live (x32 Version: 15.4.3502.0922) Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922) גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922) بريد Windows Live (x32 Version: 15.4.3502.0922) معرض صور Windows Live (x32 Version: 15.4.3502.0922) ==================== Restore Points ========================= 10-10-2013 06:39:52 Windows Update 13-10-2013 09:03:24 Windows Update 20-10-2013 17:17:18 Scheduled Checkpoint 26-10-2013 10:19:51 Removed AVG 2014 26-10-2013 10:21:23 Removed AVG 2014 ==================== Hosts content: ========================== 2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {1A4B555F-9D99-44C8-8D38-E1EA3911E40A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-10-05] (Google Inc.) Task: {1FEC7CE4-7A5C-44F1-93B9-31321E23863E} - System32\Tasks\Microsoft\Microsoft Antimalware\MpIdleTask => c:\Program Files\Microsoft Security Client\MpCmdRun.exe [2013-08-12] () Task: {329817B6-9CB8-43F7-B719-FE44F4A0EACD} - System32\Tasks\{2F334CA5-5107-4BC8-A7DC-2B2BCCDF4260} => C:\Program Files (x86)\VAG-COM\VagCom.exe [2004-11-11] (Ross-Tech, LLC) Task: {5ABEFE3E-DC46-4F7F-8DE0-02AF09ABA506} - System32\Tasks\{17A89D0C-C943-4D75-A9F6-1CCEF66298C4} => C:\Program Files (x86)\VAG-COM\VagCom.exe [2004-11-11] (Ross-Tech, LLC) Task: {5B733DFC-0CAC-41C6-A6A9-A65E850B69C9} - System32\Tasks\Malwarebytes' Scheduled Scan for gina => C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe [2013-04-04] (Malwarebytes Corporation) Task: {66250B8E-7285-46E5-ACA1-680A135E689D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-10-05] (Google Inc.) Task: {8964F59A-085D-4182-8D1E-481946576E3B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2556482551-3916483557-3486083999-1000UA => C:\Users\gina\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-13] (Google Inc.) Task: {89A5525E-BC69-47B6-A312-E17D944769C5} - System32\Tasks\Malwarebytes' Scheduled Update for gina => C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe [2013-04-04] (Malwarebytes Corporation) Task: {8B5E2A31-55A6-4644-B5C6-1DC8667751B1} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-09] (Adobe Systems Incorporated) Task: {91BF373A-20E9-4A39-9F28-F907D784DA84} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2556482551-3916483557-3486083999-1000Core => C:\Users\gina\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-13] (Google Inc.) Task: {96A49EA1-94AC-460C-B945-0C60B2323859} - System32\Tasks\Launch HTC Sync Loader => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe Task: {B7D2DABE-A713-4179-B42D-0FCB08136760} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc Task: {D94849C3-4595-4F16-88B7-B106AED20DA8} - System32\Tasks\NBAgent => C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe [2011-07-05] (Nero AG) Task: {F885945E-FA4A-4DC5-8E5B-D0266B74E569} - System32\Tasks\{9BD9699D-E26D-4CDF-B439-A40467941902} => C:\Program Files (x86)\VAG-COM\VagCom.exe [2004-11-11] (Ross-Tech, LLC) Task: {FF18225B-FDE9-4534-A51B-6F63659B925C} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\MpCmdRun.exe [2013-08-12] () Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2556482551-3916483557-3486083999-1000Core.job => C:\Users\gina\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2556482551-3916483557-3486083999-1000UA.job => C:\Users\gina\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\Malwarebytes' Scheduled Scan for gina.job => C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe Task: C:\Windows\Tasks\Malwarebytes' Scheduled Update for gina.job => C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe ==================== Loaded Modules (whitelisted) ============= 2012-05-27 18:54 - 2011-03-02 12:40 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll 2011-10-11 13:33 - 2011-06-10 18:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll 2013-08-15 16:24 - 2013-08-15 16:24 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\f60b3ee2de3f41a024920486d46d49f2\IsdiInterop.ni.dll 2011-10-11 12:50 - 2011-04-30 08:28 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll ==================== Alternate Data Streams (whitelisted) ========= AlternateDataStreams: C:\ProgramData\Temp:61B54B15 AlternateDataStreams: C:\ProgramData\Temp:F1DEA771 ==================== Safe Mode (whitelisted) =================== ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (10/26/2013 06:56:53 PM) (Source: CVHSVC) (User: ) Description: Information only. Error: Initialization failed 0x80070424 Type: 88::UnexpectedError. Error: (10/26/2013 06:51:29 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT AUTHORITY) Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code. Error: (10/26/2013 06:51:29 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT AUTHORITY) Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section. Error: (10/26/2013 06:47:13 PM) (Source: System Restore) (User: ) Description: An unspecified error occurred during System Restore: (Scheduled Checkpoint). Additional information: 0x80070091. Error: (10/26/2013 02:47:57 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (10/26/2013 02:29:49 PM) (Source: Application Error) (User: ) Description: Faulting application name: ConfigTskSchler.exe, version: 4.5.3003.0, time stamp: 0x4a8d4f9f Faulting module name: ConfigTskSchler.exe, version: 4.5.3003.0, time stamp: 0x4a8d4f9f Exception code: 0xc0000005 Fault offset: 0x00002013 Faulting process id: 0x6e0 Faulting application start time: 0xConfigTskSchler.exe0 Faulting application path: ConfigTskSchler.exe1 Faulting module path: ConfigTskSchler.exe2 Report Id: ConfigTskSchler.exe3 Error: (10/26/2013 02:29:22 PM) (Source: System Restore) (User: ) Description: Failed to create restore point (Process = D:\APP\Packard Bell Recovery Management\Recovery_Management.exe Bell Recovery Management\Recovery_Management.exe" ; Description = Installed Packard Bell Recovery Management; Error = 0x8007043c). Error: (10/26/2013 02:28:29 PM) (Source: Application Error) (User: ) Description: Faulting application name: ConfigTskSchler.exe, version: 4.5.3003.0, time stamp: 0x4a8d4f9f Faulting module name: ConfigTskSchler.exe, version: 4.5.3003.0, time stamp: 0x4a8d4f9f Exception code: 0xc0000005 Fault offset: 0x00001882 Faulting process id: 0x4d4 Faulting application start time: 0xConfigTskSchler.exe0 Faulting application path: ConfigTskSchler.exe1 Faulting module path: ConfigTskSchler.exe2 Report Id: ConfigTskSchler.exe3 Error: (10/26/2013 02:28:13 PM) (Source: System Restore) (User: ) Description: Failed to create restore point (Process = D:\APP\Packard Bell Recovery Management\Recovery_Management.exe Bell Recovery Management\Recovery_Management.exe" ; Description = Removed Packard Bell Recovery Management; Error = 0x8007043c). Error: (10/26/2013 01:33:06 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (10/26/2013 06:46:48 PM) (Source: Service Control Manager) (User: ) Description: The Function Discovery Resource Publication service terminated with the following error: %%-2147024891 Error: (10/26/2013 06:46:48 PM) (Source: Service Control Manager) (User: ) Description: The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed. Error: (10/26/2013 06:46:48 PM) (Source: Service Control Manager) (User: ) Description: The Computer Browser service terminated with the following error: %%1060 Error: (10/26/2013 06:46:46 PM) (Source: Service Control Manager) (User: ) Description: The Microsoft Antimalware Service service failed to start due to the following error: %%5 Error: (10/26/2013 03:47:49 PM) (Source: Service Control Manager) (User: ) Description: The following boot-start or system-start driver(s) failed to load: discache MpFilter spldr sptd Wanarpv6 Error: (10/26/2013 03:47:49 PM) (Source: Service Control Manager) (User: ) Description: The Client Virtualization Handler service depends on the Application Virtualization Client service which failed to start because of the following error: %%1068 Error: (10/26/2013 03:47:49 PM) (Source: Service Control Manager) (User: ) Description: The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed. Error: (10/26/2013 03:47:48 PM) (Source: Service Control Manager) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Error: (10/26/2013 03:47:35 PM) (Source: Service Control Manager) (User: ) Description: The Microsoft Antimalware Service service failed to start due to the following error: %%5 Error: (10/26/2013 03:47:20 PM) (Source: sptd) (User: ) Description: Driver detected an internal error in its data structures for . Microsoft Office Sessions: ========================= Error: (10/26/2013 06:56:53 PM) (Source: CVHSVC)(User: ) Description: Error: Initialization failed 0x80070424 Type: 88::UnexpectedError. Error: (10/26/2013 06:51:29 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT AUTHORITY) Description: WmiApRplWmiApRpl8F20300004D070000 Error: (10/26/2013 06:51:29 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT AUTHORITY) Description: Performance1637070000000000000000000009030000 Error: (10/26/2013 06:47:13 PM) (Source: System Restore)(User: ) Description: Scheduled Checkpoint0x80070091 Error: (10/26/2013 02:47:57 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (10/26/2013 02:29:49 PM) (Source: Application Error)(User: ) Description: ConfigTskSchler.exe4.5.3003.04a8d4f9fConfigTskSchler.exe4.5.3003.04a8d4f9fc0000005000020136e001ced24f68bfd069C:\Windows\OEMTemp\ConfigTskSchler.exeC:\Windows\OEMTemp\ConfigTskSchler.exeaf5e4711-3e42-11e3-80f1-f7582c476c63 Error: (10/26/2013 02:29:22 PM) (Source: System Restore)(User: ) Description: D:\APP\Packard Bell Recovery Management\Recovery_Management.exe Bell Recovery Management\Recovery_Management.exe" Installed Packard Bell Recovery Management0x8007043c Error: (10/26/2013 02:28:29 PM) (Source: Application Error)(User: ) Description: ConfigTskSchler.exe4.5.3003.04a8d4f9fConfigTskSchler.exe4.5.3003.04a8d4f9fc0000005000018824d401ced24f3907ba6bC:\Windows\OEMTemp\ConfigTskSchler.exeC:\Windows\OEMTemp\ConfigTskSchler.exe7fda8f59-3e42-11e3-80f1-f7582c476c63 Error: (10/26/2013 02:28:13 PM) (Source: System Restore)(User: ) Description: D:\APP\Packard Bell Recovery Management\Recovery_Management.exe Bell Recovery Management\Recovery_Management.exe" Removed Packard Bell Recovery Management0x8007043c Error: (10/26/2013 01:33:06 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 CodeIntegrity Errors: =================================== Date: 2013-05-17 15:45:23.025 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system. Date: 2013-05-17 15:45:23.025 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system. Date: 2013-05-17 15:45:23.025 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system. Date: 2013-03-19 19:04:48.226 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system. Date: 2013-03-19 19:04:48.226 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system. Date: 2013-03-19 19:04:48.226 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system. Date: 2013-01-01 12:23:57.349 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system. Date: 2013-01-01 12:23:57.349 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system. Date: 2013-01-01 12:23:57.349 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system. Date: 2012-06-27 18:36:48.369 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\PROGRA~2\McAfee\SITEAD~1\x64\saHook.dll because the set of per-page image hashes could not be found on the system. ==================== Memory info =========================== Percentage of memory in use: 29% Total physical RAM: 5995.86 MB Available physical RAM: 4230.15 MB Total Pagefile: 11989.9 MB Available Pagefile: 10018.03 MB Total Virtual: 8192 MB Available Virtual: 8191.84 MB ==================== Drives ================================ Drive c: (Packard Bell) (Fixed) (Total:445.66 GB) (Free:174.74 GB) NTFS Drive f: () (Removable) (Total:1.86 GB) (Free:1.86 GB) FAT32 ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 5F230415) Partition 1: (Not Active) - (Size=20 GB) - (Type=27) Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=446 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 2 GB) (Disk ID: C5759A16) Partition 1: (Not Active) - (Size=2 GB) - (Type=0B) ==================== End Of Log ============================ thanks! gina
  5. oscar146
    right! so ive run the first steps and now im typing from my infected pc so that worked, thank you! here is my log from the fix: Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 26-10-2013 01 Ran by SYSTEM at 2013-10-26 18:45:35 Run:1 Running from G:\ Boot Mode: Recovery ============================================== Content of fixlist: ***************** HKU\gina\...\Winlogon: [shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation) HKU\gina\...\Command Processor: "C:\Users\gina\AppData\Local\LT4JGd5xZnC\U3ySajgwS.exe" C:\Users\gina\AppData\Local\LT4JGd5xZnC\U3ySajgwS.exe C:\Users\gina\AppData\Roaming\0Z8jRw2v C:\Users\gina\AppData\Local\6lj5V92g7 C:\ProgramData\R1EvYenBk C:\Users\gina\AppData\Roaming\fPMVBNcZB C:\Users\gina\AppData\Local\KeSaacx2 C:\ProgramData\XKFB0FWX3h C:\Users\gina\AppData\Roaming\DZvh8M45T C:\Users\gina\AppData\Local\TvlkojlKFsK C:\ProgramData\YHHCtTSfoiH C:\Users\gina\AppData\Roaming\4scIYk7Wap C:\Users\gina\AppData\Local\L8Vqud87 C:\ProgramData\5pA32WGouh C:\Users\gina\AppData\Roaming\tIvmC1RWZY C:\Users\gina\AppData\Local\tm2YWhxCJDP C:\ProgramData\KHcGMdw8l3l C:\Users\gina\AppData\Roaming\hJ7POyqa C:\Users\gina\AppData\Local\6JBmA7fV C:\ProgramData\ijrYScvUGQ C:\Users\gina\AppData\Local\LT4JGd5xZnC C:\Users\gina\AppData\Roaming\iisecurity.exe C:\Users\gina\AppData\Roaming\mE36TJVKBV C:\Users\gina\AppData\Local\3JyTOxPVHdK C:\ProgramData\DLWQa62qCJA C:\Windows\assembly\GAC_32\Desktop.ini C:\Windows\assembly\GAC_64\Desktop.ini C:\Users\gina\AppData\Local\Google\Desktop\Install C:\Program Files (x86)\Google\Desktop\Install C:\Users\gina\8907001.exe C:\Users\gina\jagex_cl_oldschool_LIVE.dat C:\Users\gina\jagex_cl_runescape_LIVE.dat C:\Users\gina\jagex_cl_runescape_LIVE1.dat C:\Users\gina\jagex_cl_runescape_LIVE2.dat C:\Users\gina\random.dat C:\Users\gina\AppData\Local\Temp\InstallFlashPlayer.exe C:\Users\gina\AppData\Local\Temp\oi_{2F1B3F87-C302-43D8-946D-590EA88C7C0B}.exe C:\Users\gina\AppData\Local\Temp\SearchProtectionSetup.exe C:\Users\gina\AppData\Local\Temp\TUUUninstallHelper.exe C:\Users\gina\AppData\Local\Temp\UNINSTALL.EXE C:\Users\gina\AppData\Local\Temp\~tmf6294002116931952954.dll ***************** HKU\gina\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully. HKU\gina\Software\Microsoft\Command Processor\\AutoRun => Value deleted successfully. C:\Users\gina\AppData\Local\LT4JGd5xZnC\U3ySajgwS.exe => Moved successfully. C:\Users\gina\AppData\Roaming\0Z8jRw2v => Moved successfully. C:\Users\gina\AppData\Local\6lj5V92g7 => Moved successfully. C:\ProgramData\R1EvYenBk => Moved successfully. C:\Users\gina\AppData\Roaming\fPMVBNcZB => Moved successfully. C:\Users\gina\AppData\Local\KeSaacx2 => Moved successfully. C:\ProgramData\XKFB0FWX3h => Moved successfully. C:\Users\gina\AppData\Roaming\DZvh8M45T => Moved successfully. C:\Users\gina\AppData\Local\TvlkojlKFsK => Moved successfully. C:\ProgramData\YHHCtTSfoiH => Moved successfully. C:\Users\gina\AppData\Roaming\4scIYk7Wap => Moved successfully. C:\Users\gina\AppData\Local\L8Vqud87 => Moved successfully. C:\ProgramData\5pA32WGouh => Moved successfully. C:\Users\gina\AppData\Roaming\tIvmC1RWZY => Moved successfully. C:\Users\gina\AppData\Local\tm2YWhxCJDP => Moved successfully. C:\ProgramData\KHcGMdw8l3l => Moved successfully. C:\Users\gina\AppData\Roaming\hJ7POyqa => Moved successfully. C:\Users\gina\AppData\Roaming\iisecurity.exe => Moved successfully. C:\Users\gina\AppData\Roaming\mE36TJVKBV => Moved successfully. C:\Users\gina\AppData\Local\3JyTOxPVHdK => Moved successfully. C:\ProgramData\DLWQa62qCJA => Moved successfully. C:\Windows\assembly\GAC_32\Desktop.ini => Moved successfully. C:\Windows\assembly\GAC_64\Desktop.ini => Moved successfully. C:\Users\gina\AppData\Local\Google\Desktop\Install => Moved successfully. C:\Program Files (x86)\Google\Desktop\Install => Moved successfully. C:\Users\gina\8907001.exe => Moved successfully. C:\Users\gina\jagex_cl_oldschool_LIVE.dat => Moved successfully. C:\Users\gina\jagex_cl_runescape_LIVE.dat => Moved successfully. C:\Users\gina\jagex_cl_runescape_LIVE1.dat => Moved successfully. C:\Users\gina\jagex_cl_runescape_LIVE2.dat => Moved successfully. C:\Users\gina\random.dat => Moved successfully. C:\Users\gina\AppData\Local\Temp\InstallFlashPlayer.exe => Moved successfully. C:\Users\gina\AppData\Local\Temp\oi_{2F1B3F87-C302-43D8-946D-590EA88C7C0B}.exe => Moved successfully. C:\Users\gina\AppData\Local\Temp\SearchProtectionSetup.exe => Moved successfully. C:\Users\gina\AppData\Local\Temp\TUUUninstallHelper.exe => Moved successfully. C:\Users\gina\AppData\Local\Temp\UNINSTALL.EXE => Moved successfully. C:\Users\gina\AppData\Local\Temp\~tmf6294002116931952954.dll => Moved successfully. ==== End of Fixlog ==== unfortunately though ive tried to download the farbar recovery scan tool but my computer keeps deleting it as I download it as a virus? also windows defender wont turn back on, shall I update my membership to malwarebytes now do you think? thanks! gina
  6. oscar146
    thank yu thank you for getting back to me!! im currently on my secure work laptop so ill get on to all my banks now and change all my info, ill try your advice and follow the steps then hopefully i can get onto my computer and get what i need and look at a reformat, but ill try the steps above first fingers crossed here goes! ill let you know how i do.....!
  7. oscar146
    hi all, sorry im very new and have very basic knowledge i hope someone can help me!! i have had this ukash virus before and i managed to use safe mode with networking and fixed it. however! this time safe mode wont work at all and ive tried to system restore but its saying error! i have gone on earlier and found someone who had this make a txt file of FRST.exe and so ive done that and have my results, could someone please help and look at them for me i am really stuck now! ill be presumptious and post them but sorry if its totally the wrong thing to do! gina Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-10-2013 01 Ran by SYSTEM on MININT-PAJ33JR on 26-10-2013 15:35:53 Running from G:\ Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US) Internet Explorer Version 10 Boot Mode: Recovery The current controlset is ControlSet001 ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log. ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11785832 2011-03-10] (Realtek Semiconductor) HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-08-12] () HKLM\...\RunOnce: [*Restore] - C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-20] (Microsoft Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKLM\...\Policies\Explorer: [NoControlPanel] 0 HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-06-30] (Dritek System Inc.) HKU\Default\...\RunOnce: [scrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [162408 2011-09-12] () HKU\Default User\...\RunOnce: [scrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [162408 2011-09-12] () HKU\gina\...\Run: [searchProtection] - C:\Users\gina\AppData\Roaming\Search Protection\SearchProtection.EXE [832360 2013-09-03] (Spigot, Inc.) HKU\gina\...\Run: [Google Update] - C:\Users\gina\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-04-13] (Google Inc.) HKU\gina\...\Run: [Google Update] - C:\Users\gina\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-04-13] (Google Inc.) HKU\gina\...\Run: [ChromeFrameHelper] - C:\Users\gina\AppData\Local\Google\Chrome\Application\30.0.1599.101\chrome_frame_helper.exe [83408 2013-10-08] (Google Inc.) HKU\gina\...\Run: [u3ySajgwS.exe] - C:\Users\gina\AppData\Local\LT4JGd5xZnC\U3ySajgwS.exe [164592 2013-10-26] (Microsoft Corporation) HKU\gina\...\Run: [internet Security] - C:\Users\gina\AppData\Roaming\iisecurity.exe [836608 2013-10-26] (AVAZD Software) HKU\gina\...\Winlogon: [shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation) <==== ATTENTION HKU\gina\...\Command Processor: "C:\Users\gina\AppData\Local\LT4JGd5xZnC\U3ySajgwS.exe" <===== ATTENTION! BootExecute: autocheck autochk * regdefrag ==================== Services (Whitelisted) ================= S2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [872552 2011-08-02] (Acer Incorporated) S2 GREGService; C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [36456 2011-05-29] (Acer Incorporated) S2 Live Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [244624 2011-04-22] (Acer Incorporated) S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-08-12] () S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-08-12] () S2 *etadpug; "C:\Program Files (x86)\Google\Desktop\Install\{7373881a-857c-3e88-95e3-4fc3a16ac126}\ \...\???\{7373881a-857c-3e88-95e3-4fc3a16ac126}\GoogleUpdate.exe" < <==== ATTENTION (ZeroAccess) ==================== Drivers (Whitelisted) ==================== S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [32768 2010-04-28] (Google Inc) S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [39504 2013-04-11] (ThreatTrack Security) S0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-06-26] (GFI Software) S3 HTCAND64; C:\Windows\System32\Drivers\ANDROIDUSB.sys [32768 2010-04-28] (Google Inc) S3 libusb0; C:\Windows\System32\drivers\libusb0.sys [29184 2012-03-01] (http://libusb-win32.sourceforge.net) S3 libusb0; C:\Windows\SysWow64\drivers\libusb0.sys [21504 2011-05-25] (http://libusb-win32.sourceforge.net) S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation) S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation) S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited) S0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2012-05-27] (Duplex Secure Ltd.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-10-26 15:35 - 2013-10-26 15:35 - 00000000 ____D C:\FRST 2013-10-26 04:16 - 2013-10-26 04:15 - 00181760 _____ C:\Users\gina\AppData\Roaming\0Z8jRw2v 2013-10-26 04:16 - 2013-10-26 04:15 - 00181760 _____ C:\Users\gina\AppData\Local\6lj5V92g7 2013-10-26 04:16 - 2013-10-26 04:15 - 00181760 _____ C:\ProgramData\R1EvYenBk 2013-10-26 04:14 - 2013-10-26 04:14 - 00181760 _____ C:\Users\gina\AppData\Roaming\fPMVBNcZB 2013-10-26 04:14 - 2013-10-26 04:14 - 00181760 _____ C:\Users\gina\AppData\Local\KeSaacx2 2013-10-26 04:14 - 2013-10-26 04:14 - 00181760 _____ C:\ProgramData\XKFB0FWX3h 2013-10-26 04:08 - 2013-10-26 04:08 - 00181760 _____ C:\Users\gina\AppData\Roaming\DZvh8M45T 2013-10-26 04:08 - 2013-10-26 04:08 - 00181760 _____ C:\Users\gina\AppData\Local\TvlkojlKFsK 2013-10-26 04:08 - 2013-10-26 04:08 - 00181760 _____ C:\ProgramData\YHHCtTSfoiH 2013-10-26 04:05 - 2013-10-26 04:05 - 00181760 _____ C:\Users\gina\AppData\Roaming\4scIYk7Wap 2013-10-26 04:05 - 2013-10-26 04:05 - 00181760 _____ C:\Users\gina\AppData\Local\L8Vqud87 2013-10-26 04:05 - 2013-10-26 04:05 - 00181760 _____ C:\ProgramData\5pA32WGouh 2013-10-26 04:01 - 2013-10-26 04:01 - 00181760 _____ C:\Users\gina\AppData\Roaming\tIvmC1RWZY 2013-10-26 04:01 - 2013-10-26 04:01 - 00181760 _____ C:\Users\gina\AppData\Local\tm2YWhxCJDP 2013-10-26 04:01 - 2013-10-26 04:01 - 00181760 _____ C:\ProgramData\KHcGMdw8l3l 2013-10-26 02:38 - 2013-10-26 02:38 - 00181760 _____ C:\Users\gina\AppData\Roaming\hJ7POyqa 2013-10-26 02:38 - 2013-10-26 02:38 - 00181760 _____ C:\Users\gina\AppData\Local\6JBmA7fV 2013-10-26 02:38 - 2013-10-26 02:38 - 00181760 _____ C:\ProgramData\ijrYScvUGQ 2013-10-26 02:23 - 2013-10-26 15:18 - 00000000 ____D C:\Users\gina\AppData\Local\LT4JGd5xZnC 2013-10-26 02:23 - 2013-10-26 02:23 - 00836608 _____ (AVAZD Software) C:\Users\gina\AppData\Roaming\iisecurity.exe 2013-10-26 02:23 - 2013-10-26 02:23 - 00181760 _____ C:\Users\gina\AppData\Roaming\mE36TJVKBV 2013-10-26 02:23 - 2013-10-26 02:23 - 00181760 _____ C:\Users\gina\AppData\Local\3JyTOxPVHdK 2013-10-26 02:23 - 2013-10-26 02:23 - 00181760 _____ C:\ProgramData\DLWQa62qCJA 2013-10-26 02:23 - 2013-10-26 02:23 - 00000794 _____ C:\Users\gina\Desktop\Internet Security.lnk 2013-10-12 00:08 - 2013-10-12 00:11 - 00000000 ____D C:\Users\gina\Downloads\Cloudy With A Chance Of Meatballs 2 2013 CAM XviD-Srkfan 2013-10-09 23:36 - 2013-09-22 15:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-10-09 23:36 - 2013-09-22 15:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-10-09 23:36 - 2013-09-22 15:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-10-09 23:36 - 2013-09-22 15:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-10-09 23:36 - 2013-09-22 15:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-10-09 23:36 - 2013-09-22 15:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-10-09 23:36 - 2013-09-22 15:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-10-09 23:36 - 2013-09-22 15:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-10-09 23:36 - 2013-09-22 15:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-10-09 23:36 - 2013-09-22 15:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-10-09 23:36 - 2013-09-22 15:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-10-09 23:36 - 2013-09-22 15:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-10-09 23:36 - 2013-09-22 15:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-10-09 23:36 - 2013-09-22 14:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll 2013-10-09 23:36 - 2013-09-22 14:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2013-10-09 23:36 - 2013-09-22 14:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe 2013-10-09 23:36 - 2013-09-22 14:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2013-10-09 23:36 - 2013-09-22 14:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2013-10-09 23:36 - 2013-09-22 14:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2013-10-09 23:36 - 2013-09-22 14:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2013-10-09 23:36 - 2013-09-22 14:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll 2013-10-09 23:36 - 2013-09-22 14:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2013-10-09 23:36 - 2013-09-22 14:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll 2013-10-09 23:36 - 2013-09-22 14:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll 2013-10-09 23:36 - 2013-09-22 14:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll 2013-10-09 23:36 - 2013-09-22 14:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2013-10-09 23:36 - 2013-09-22 14:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll 2013-10-09 23:36 - 2013-09-20 19:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2013-10-09 23:36 - 2013-09-20 19:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-10-09 23:36 - 2013-09-20 18:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe 2013-10-09 23:36 - 2013-09-20 18:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-10-08 23:01 - 2013-09-07 18:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys 2013-10-08 23:01 - 2013-09-07 18:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\System32\mswsock.dll 2013-10-08 23:01 - 2013-07-12 02:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbvideo.sys 2013-10-08 23:01 - 2013-07-12 02:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbcir.sys 2013-10-08 23:01 - 2013-07-04 04:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\System32\WebClnt.dll 2013-10-08 23:01 - 2013-07-04 04:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\System32\comctl32.dll 2013-10-08 23:01 - 2013-07-04 04:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\System32\davclnt.dll 2013-10-08 23:01 - 2013-07-04 03:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll 2013-10-08 23:01 - 2013-07-04 03:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll 2013-10-08 23:01 - 2013-07-04 03:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll 2013-10-08 23:01 - 2013-07-04 02:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\mrxdav.sys 2013-10-08 23:01 - 2013-07-02 20:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\hidclass.sys 2013-10-08 23:01 - 2013-07-02 20:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\hidparse.sys 2013-10-08 23:01 - 2013-06-25 14:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\Wdf01000.sys 2013-10-08 23:01 - 2013-06-05 21:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\System32\lpk.dll 2013-10-08 23:01 - 2013-06-05 21:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\System32\fontsub.dll 2013-10-08 23:01 - 2013-06-05 21:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\System32\dciman32.dll 2013-10-08 23:01 - 2013-06-05 21:47 - 00046080 _____ (Adobe Systems) C:\Windows\System32\atmlib.dll 2013-10-08 23:01 - 2013-06-05 20:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll 2013-10-08 23:01 - 2013-06-05 20:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll 2013-10-08 23:01 - 2013-06-05 20:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll 2013-10-08 23:01 - 2013-06-05 19:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\System32\atmfd.dll 2013-10-08 23:01 - 2013-06-05 19:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll 2013-10-08 23:01 - 2013-06-05 19:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll 2013-10-08 23:00 - 2013-09-13 17:10 - 00497152 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\afd.sys 2013-10-08 23:00 - 2013-09-07 18:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll 2013-10-08 23:00 - 2013-09-04 04:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbhub.sys 2013-10-08 23:00 - 2013-09-04 04:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbport.sys 2013-10-08 23:00 - 2013-09-04 04:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbccgp.sys 2013-10-08 23:00 - 2013-09-04 04:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbehci.sys 2013-10-08 23:00 - 2013-09-04 04:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbuhci.sys 2013-10-08 23:00 - 2013-09-04 04:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbohci.sys 2013-10-08 23:00 - 2013-09-04 04:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbd.sys 2013-10-08 23:00 - 2013-08-28 18:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe 2013-10-08 23:00 - 2013-08-28 18:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll 2013-10-08 23:00 - 2013-08-28 18:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\System32\tdh.dll 2013-10-08 23:00 - 2013-08-28 18:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\System32\wow64.dll 2013-10-08 23:00 - 2013-08-28 18:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\System32\advapi32.dll 2013-10-08 23:00 - 2013-08-28 17:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2013-10-08 23:00 - 2013-08-28 17:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2013-10-08 23:00 - 2013-08-28 17:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2013-10-08 23:00 - 2013-08-28 17:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll 2013-10-08 23:00 - 2013-08-28 17:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2013-10-08 23:00 - 2013-08-28 17:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll 2013-10-08 23:00 - 2013-08-28 16:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2013-10-08 23:00 - 2013-08-28 16:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2013-10-08 23:00 - 2013-08-28 16:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2013-10-08 23:00 - 2013-08-28 16:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2013-10-08 23:00 - 2013-08-27 17:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys 2013-10-08 23:00 - 2013-08-27 17:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\System32\scavengeui.dll 2013-10-08 23:00 - 2013-08-01 04:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys 2013-10-08 23:00 - 2013-07-20 02:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll 2013-10-08 23:00 - 2013-07-20 02:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll 2013-10-05 12:03 - 2013-10-16 02:22 - 00002195 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2013-10-05 12:02 - 2013-10-26 06:12 - 00000890 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-10-05 12:02 - 2013-10-26 04:19 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-10-05 12:02 - 2013-10-11 00:14 - 00003890 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2013-10-05 12:02 - 2013-10-11 00:14 - 00003638 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2013-10-05 11:22 - 2013-10-26 04:12 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-10-05 11:22 - 2013-10-08 23:12 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2013-10-04 09:34 - 2013-10-26 15:10 - 00000000 ____D C:\Users\gina\Downloads\The Internship [2013] HDRip XViD-ETRG 2013-09-30 08:59 - 2013-10-08 23:12 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-09-30 08:59 - 2013-10-08 23:12 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-09-30 08:58 - 2013-09-30 08:59 - 00000000 ___HD C:\Windows\AxInstSV 2013-09-27 10:34 - 2013-09-27 10:39 - 00000000 ____D C:\Users\gina\Downloads\TURBO 2013 R6 DVDSCR X264 MP3 AVi MURDER ==================== One Month Modified Files and Folders ======= 2013-10-26 15:35 - 2013-10-26 15:35 - 00000000 ____D C:\FRST 2013-10-26 15:18 - 2013-10-26 02:23 - 00000000 ____D C:\Users\gina\AppData\Local\LT4JGd5xZnC 2013-10-26 15:18 - 2013-07-02 11:44 - 00000000 ____D C:\Program Files\Microsoft Security Client 2013-10-26 15:18 - 2012-05-13 05:06 - 00000000 ____D C:\Users\gina\AppData\Roaming\vlc 2013-10-26 15:18 - 2012-04-07 07:00 - 00000000 ____D C:\users\gina 2013-10-26 15:18 - 2011-10-11 04:31 - 00000000 ___HD C:\OEM 2013-10-26 15:18 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\Windows Defender 2013-10-26 15:11 - 2013-07-02 11:44 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client 2013-10-26 15:11 - 2012-04-07 08:30 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-10-26 15:11 - 2012-04-07 08:30 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2013-10-26 15:11 - 2009-07-13 19:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared 2013-10-26 15:10 - 2013-10-04 09:34 - 00000000 ____D C:\Users\gina\Downloads\The Internship [2013] HDRip XViD-ETRG 2013-10-26 15:10 - 2012-05-15 11:06 - 00000000 ____D C:\Users\gina\AppData\Roaming\BitTorrent 2013-10-26 15:10 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache 2013-10-26 06:12 - 2013-10-05 12:02 - 00000890 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-10-26 06:12 - 2013-05-27 13:21 - 00020832 _____ C:\Windows\setupact.log 2013-10-26 06:12 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-10-26 05:53 - 2009-07-13 20:45 - 00016976 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-10-26 05:53 - 2009-07-13 20:45 - 00016976 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-10-26 05:49 - 2013-06-26 11:24 - 00042080 _____ C:\Windows\PFRO.log 2013-10-26 05:40 - 2012-01-26 08:32 - 01713489 _____ C:\Windows\WindowsUpdate.log 2013-10-26 05:29 - 2012-04-16 11:47 - 00000000 ____D C:\Users\gina\AppData\Local\CrashDumps 2013-10-26 05:29 - 2011-10-11 04:04 - 00000000 ____D C:\Program Files\Packard Bell 2013-10-26 05:29 - 2011-10-11 03:50 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2013-10-26 04:19 - 2013-10-05 12:02 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-10-26 04:19 - 2009-07-13 21:13 - 00005024 _____ C:\Windows\System32\PerfStringBackup.INI 2013-10-26 04:15 - 2013-10-26 04:16 - 00181760 _____ C:\Users\gina\AppData\Roaming\0Z8jRw2v 2013-10-26 04:15 - 2013-10-26 04:16 - 00181760 _____ C:\Users\gina\AppData\Local\6lj5V92g7 2013-10-26 04:15 - 2013-10-26 04:16 - 00181760 _____ C:\ProgramData\R1EvYenBk 2013-10-26 04:14 - 2013-10-26 04:14 - 00181760 _____ C:\Users\gina\AppData\Roaming\fPMVBNcZB 2013-10-26 04:14 - 2013-10-26 04:14 - 00181760 _____ C:\Users\gina\AppData\Local\KeSaacx2 2013-10-26 04:14 - 2013-10-26 04:14 - 00181760 _____ C:\ProgramData\XKFB0FWX3h 2013-10-26 04:12 - 2013-10-05 11:22 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-10-26 04:08 - 2013-10-26 04:08 - 00181760 _____ C:\Users\gina\AppData\Roaming\DZvh8M45T 2013-10-26 04:08 - 2013-10-26 04:08 - 00181760 _____ C:\Users\gina\AppData\Local\TvlkojlKFsK 2013-10-26 04:08 - 2013-10-26 04:08 - 00181760 _____ C:\ProgramData\YHHCtTSfoiH 2013-10-26 04:06 - 2012-04-13 09:23 - 00000904 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2556482551-3916483557-3486083999-1000UA.job 2013-10-26 04:05 - 2013-10-26 04:05 - 00181760 _____ C:\Users\gina\AppData\Roaming\4scIYk7Wap 2013-10-26 04:05 - 2013-10-26 04:05 - 00181760 _____ C:\Users\gina\AppData\Local\L8Vqud87 2013-10-26 04:05 - 2013-10-26 04:05 - 00181760 _____ C:\ProgramData\5pA32WGouh 2013-10-26 04:01 - 2013-10-26 04:01 - 00181760 _____ C:\Users\gina\AppData\Roaming\tIvmC1RWZY 2013-10-26 04:01 - 2013-10-26 04:01 - 00181760 _____ C:\Users\gina\AppData\Local\tm2YWhxCJDP 2013-10-26 04:01 - 2013-10-26 04:01 - 00181760 _____ C:\ProgramData\KHcGMdw8l3l 2013-10-26 02:38 - 2013-10-26 02:38 - 00181760 _____ C:\Users\gina\AppData\Roaming\hJ7POyqa 2013-10-26 02:38 - 2013-10-26 02:38 - 00181760 _____ C:\Users\gina\AppData\Local\6JBmA7fV 2013-10-26 02:38 - 2013-10-26 02:38 - 00181760 _____ C:\ProgramData\ijrYScvUGQ 2013-10-26 02:23 - 2013-10-26 02:23 - 00836608 _____ (AVAZD Software) C:\Users\gina\AppData\Roaming\iisecurity.exe 2013-10-26 02:23 - 2013-10-26 02:23 - 00181760 _____ C:\Users\gina\AppData\Roaming\mE36TJVKBV 2013-10-26 02:23 - 2013-10-26 02:23 - 00181760 _____ C:\Users\gina\AppData\Local\3JyTOxPVHdK 2013-10-26 02:23 - 2013-10-26 02:23 - 00181760 _____ C:\ProgramData\DLWQa62qCJA 2013-10-26 02:23 - 2013-10-26 02:23 - 00000794 _____ C:\Users\gina\Desktop\Internet Security.lnk 2013-10-26 02:21 - 2013-05-17 06:24 - 00000000 ____D C:\ProgramData\MFAData 2013-10-26 02:17 - 2012-07-04 09:36 - 00000000 ____D C:\Program Files (x86)\Google 2013-10-24 11:06 - 2012-04-13 09:23 - 00000852 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2556482551-3916483557-3486083999-1000Core.job 2013-10-20 22:05 - 2009-07-13 21:08 - 00032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2013-10-19 16:06 - 2013-03-19 10:58 - 00000512 _____ C:\Windows\Tasks\Malwarebytes' Scheduled Scan for gina.job 2013-10-19 16:00 - 2013-03-19 10:58 - 00000498 _____ C:\Windows\Tasks\Malwarebytes' Scheduled Update for gina.job 2013-10-16 02:22 - 2013-10-05 12:03 - 00002195 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2013-10-13 11:47 - 2012-04-13 09:23 - 00000000 ____D C:\Users\gina\AppData\Local\Google 2013-10-12 15:16 - 2012-06-22 12:34 - 00000024 _____ C:\Users\gina\random.dat 2013-10-12 11:12 - 2013-03-09 10:56 - 00000043 _____ C:\Users\gina\jagex_cl_oldschool_LIVE.dat 2013-10-12 00:11 - 2013-10-12 00:08 - 00000000 ____D C:\Users\gina\Downloads\Cloudy With A Chance Of Meatballs 2 2013 CAM XviD-Srkfan 2013-10-11 00:14 - 2013-10-05 12:02 - 00003890 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2013-10-11 00:14 - 2013-10-05 12:02 - 00003638 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2013-10-10 11:01 - 2012-04-13 09:23 - 00003872 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2556482551-3916483557-3486083999-1000UA 2013-10-10 11:01 - 2012-04-13 09:23 - 00003476 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2556482551-3916483557-3486083999-1000Core 2013-10-10 10:23 - 2009-07-13 20:45 - 00292616 _____ C:\Windows\System32\FNTCACHE.DAT 2013-10-09 23:39 - 2012-05-11 07:37 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-10-09 22:53 - 2013-08-14 12:05 - 00000000 ____D C:\Windows\System32\MRT 2013-10-09 22:49 - 2012-06-22 07:05 - 80541720 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe 2013-10-09 22:42 - 2013-01-01 04:04 - 00001945 _____ C:\Windows\epplauncher.mif 2013-10-08 23:12 - 2013-10-05 11:22 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2013-10-08 23:12 - 2013-09-30 08:59 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-10-08 23:12 - 2013-09-30 08:59 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-10-05 12:03 - 2013-01-03 11:28 - 00000000 ____D C:\Users\gina\AppData\Local\Adobe 2013-10-04 09:30 - 2012-05-27 00:18 - 00000000 ____D C:\Users\gina\Downloads\films 2013-10-01 17:16 - 2012-04-16 11:51 - 00000000 ____D C:\Users\gina\AppData\Roaming\SoftGrid Client 2013-09-30 08:59 - 2013-09-30 08:58 - 00000000 ___HD C:\Windows\AxInstSV 2013-09-30 01:44 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\NDF 2013-09-27 10:39 - 2013-09-27 10:34 - 00000000 ____D C:\Users\gina\Downloads\TURBO 2013 R6 DVDSCR X264 MP3 AVi MURDER 2013-09-27 08:33 - 2012-06-05 01:28 - 00000000 ____D C:\Users\gina\Documents\WBFS Manager Covers ZeroAccess: C:\Windows\assembly\GAC_32\Desktop.ini ZeroAccess: C:\Windows\assembly\GAC_64\Desktop.ini Files to move or delete: ==================== C:\Users\gina\AppData\Local\LT4JGd5xZnC\U3ySajgwS.exe ZeroAccess: C:\Users\gina\AppData\Local\Google\Desktop\Install ZeroAccess: C:\Program Files (x86)\Google\Desktop\Install C:\Users\gina\8907001.exe C:\Users\gina\jagex_cl_oldschool_LIVE.dat C:\Users\gina\jagex_cl_runescape_LIVE.dat C:\Users\gina\jagex_cl_runescape_LIVE1.dat C:\Users\gina\jagex_cl_runescape_LIVE2.dat C:\Users\gina\random.dat Some content of TEMP: ==================== C:\Users\gina\AppData\Local\Temp\InstallFlashPlayer.exe C:\Users\gina\AppData\Local\Temp\oi_{2F1B3F87-C302-43D8-946D-590EA88C7C0B}.exe C:\Users\gina\AppData\Local\Temp\SearchProtectionSetup.exe C:\Users\gina\AppData\Local\Temp\TUUUninstallHelper.exe C:\Users\gina\AppData\Local\Temp\UNINSTALL.EXE C:\Users\gina\AppData\Local\Temp\~tmf6294002116931952954.dll ==================== Known DLLs (Whitelisted) ================ ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit C:\Program Files\Windows Defender\mpsvc.dll => ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Windows Defender C:\Program Files\Microsoft Security Client\MsMpEng.exe => ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Microsoft Security Client ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= 5 Restore point made on: 2013-10-09 22:39:53 Restore point made on: 2013-10-13 01:03:25 Restore point made on: 2013-10-20 09:17:19 Restore point made on: 2013-10-26 02:19:53 Restore point made on: 2013-10-26 02:21:24 ==================== Memory info =========================== Percentage of memory in use: 13% Total physical RAM: 5995.86 MB Available physical RAM: 5199.16 MB Total Pagefile: 5994.06 MB Available Pagefile: 5197.4 MB Total Virtual: 8192 MB Available Virtual: 8191.88 MB ==================== Drives ================================ Drive c: (Packard Bell) (Fixed) (Total:445.66 GB) (Free:174.74 GB) NTFS Drive e: (PQSERVICE) (Fixed) (Total:20 GB) (Free:2.37 GB) NTFS Drive g: () (Removable) (Total:1.86 GB) (Free:1.86 GB) FAT32 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 5F230415) Partition 1: (Not Active) - (Size=20 GB) - (Type=27) Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=446 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 2 GB) (Disk ID: C5759A16) Partition 1: (Not Active) - (Size=2 GB) - (Type=0B) LastRegBack: 2013-10-13 05:16
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.