Dbriem

December 10, 2013

Thank you!

December 9, 2013

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 02-12-2013

Ran by Owner at 2013-12-07 18:35:48 Run:1

Running from C:\Documents and Settings\Owner\Desktop

Boot Mode: Normal

==============================================

Content of fixlist:

*****************

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AMJ15OO2

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QF4ST24S

C:\Documents and Settings\Owner\Local Settings\Temp\dlm1D.tmp

C:\Documents and Settings\Owner\My Documents\cbsidlm-cbsi145-DownloadX_ActiveX_Download_Control-SEO-10911713.exe

C:\Documents and Settings\User\Local Settings\Temp\Optimizer_Pro.exe

C:\Documents and Settings\User\Local Settings\Temp\551BF67B-BAB0-7891-9472-782349FD0755

C:\Documents and Settings\User\Local Settings\Temp\ins2717\OptimizerPro.exe

C:\Documents and Settings\User\Local Settings\Temp\scoped_dir_5140_29369

C:\Program Files\Driver Pro

C:\WINDOWS\Temp\dpsetup.exe

C:\WINDOWS\Temp\INJ001\ExtensionUpdate.exe

*****************

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AMJ15OO2 => Moved successfully.

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QF4ST24S => Moved successfully.

C:\Documents and Settings\Owner\Local Settings\Temp\dlm1D.tmp => Moved successfully.

C:\Documents and Settings\Owner\My Documents\cbsidlm-cbsi145-DownloadX_ActiveX_Download_Control-SEO-10911713.exe => Moved successfully.

C:\Documents and Settings\User\Local Settings\Temp\Optimizer_Pro.exe => Moved successfully.

C:\Documents and Settings\User\Local Settings\Temp\551BF67B-BAB0-7891-9472-782349FD0755 => Moved successfully.

C:\Documents and Settings\User\Local Settings\Temp\ins2717\OptimizerPro.exe => Moved successfully.

C:\Documents and Settings\User\Local Settings\Temp\scoped_dir_5140_29369 => Moved successfully.

C:\Program Files\Driver Pro => Moved successfully.

C:\WINDOWS\Temp\dpsetup.exe => Moved successfully.

C:\WINDOWS\Temp\INJ001\ExtensionUpdate.exe => Moved successfully.

==== End of Fixlog ====

# AdwCleaner v3.014 - Report created 07/12/2013 at 18:39:44

# Updated 01/12/2013 by Xplode

# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)

# Username : Owner - CUSTOM

# Running from : C:\Documents and Settings\Owner\Desktop\adwcleaner.exe

# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\Documents and Settings\All Users\Application Data\Babylon

Folder Deleted : C:\Documents and Settings\All Users\Application Data\BitGuard

File Deleted : C:\END

File Deleted : C:\Program Files\Mozilla Firefox\user.js

***** [ Shortcuts ] *****

***** [ Registry ] *****

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702

-\\ Mozilla Firefox v

[ File : C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\gbcac4do.default\prefs.js ]

-\\ Google Chrome v

[ File : C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [1165 octets] - [07/12/2013 18:37:34]

AdwCleaner[s0].txt - [1098 octets] - [07/12/2013 18:39:44]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [1158 octets] ##########

Results of screen317's Security Check version 0.99.77

Windows XP Service Pack 3 x86

Internet Explorer 6 Out of date!

``````````````Antivirus/Firewall Check:``````````````

Windows Security Center service is not running! This report may not be accurate!

Windows Firewall Enabled!

ESET Online Scanner v3

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.75.0.1300

Google Chrome 30.0.1599.101

Google Chrome 30.0.1599.69

````````Process Check: objlist.exe by Laurent````````

Malwarebytes Anti-Malware mbamservice.exe

Malwarebytes Anti-Malware mbamgui.exe

Malwarebytes' Anti-Malware mbamscheduler.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C:: 44% Defragment your hard drive soon! (Do NOT defrag if SSD!)

````````````````````End of Log``````````````````````

December 6, 2013

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AMJ15OO2\WSSetup[1].exe multiple threats

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QF4ST24S\update[1] multiple threats

C:\Documents and Settings\Owner\Local Settings\Temp\dlm1D.tmp\DownloadXPro.exe Win32/OpenCandy application

C:\Documents and Settings\Owner\My Documents\cbsidlm-cbsi145-DownloadX_ActiveX_Download_Control-SEO-10911713.exe a variant of Win32/CNETInstaller.B application

C:\Documents and Settings\User\Local Settings\Temp\Optimizer_Pro.exe multiple threats

C:\Documents and Settings\User\Local Settings\Temp\551BF67B-BAB0-7891-9472-782349FD0755\Latest\ccp.exe Win32/Toolbar.Babylon.M application

C:\Documents and Settings\User\Local Settings\Temp\551BF67B-BAB0-7891-9472-782349FD0755\Latest\IEHelper.dll Win32/Toolbar.Babylon.E application

C:\Documents and Settings\User\Local Settings\Temp\ins2717\OptimizerPro.exe probably a variant of Win32/SpeedingUpMyPC.B application

C:\Documents and Settings\User\Local Settings\Temp\scoped_dir_5140_29369\CRX_INSTALL\background.html Win32/Toolbar.Perion.D application

C:\Program Files\Driver Pro\DPSmartScan.exe a variant of Win32/Adware.SpeedingUpMyPC.C application

C:\WINDOWS\Temp\dpsetup.exe a variant of Win32/Adware.SpeedingUpMyPC.C application

C:\WINDOWS\Temp\INJ001\ExtensionUpdate.exe multiple threats

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 02-12-2013

Ran by Owner (administrator) on CUSTOM on 01-12-2013 16:57:25

Running from C:\Documents and Settings\Owner\Desktop

Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: English(US)

Internet Explorer Version 6

Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Farbar) C:\Documents and Settings\Owner\Desktop\FRST (1).exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

MountPoints2: {b31247aa-5086-11e3-affb-806d6172696f} - D:\SETUP.EXE /AUTORUN

Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WNDA3100v2 Genie.lnk

ShortcutTarget: NETGEAR WNDA3100v2 Genie.lnk -> C:\Program Files\NETGEAR\WNDA3100v2\WNDA3100v2.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?ocid=OIE8MSE&PC=UP09

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com/?ocid=OIE8MSE&PC=UP09

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home

URLSearchHook: ATTENTION ==> Default URLSearchHook is missing.

SearchScopes: HKLM - DefaultScope value is missing.

ShellExecuteHooks: URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\system32\shell32.dll [8462848 2012-06-08] (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76 192.168.1.1

FireFox:

========

FF ProfilePath: C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\gbcac4do.default

Chrome:

=======

CHR Extension: (Google Docs) - C:\DOCUME~1\Owner\LOCALS~1\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0

CHR Extension: (Google Drive) - C:\DOCUME~1\Owner\LOCALS~1\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0

CHR Extension: (YouTube) - C:\DOCUME~1\Owner\LOCALS~1\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Google Search) - C:\DOCUME~1\Owner\LOCALS~1\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (Google Wallet) - C:\DOCUME~1\Owner\LOCALS~1\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0

CHR Extension: (Gmail) - C:\DOCUME~1\Owner\LOCALS~1\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

========================== Services (Whitelisted) =================

S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

R3 ac97intc; C:\Windows\System32\drivers\ac97intc.sys [96256 2001-08-17] (Intel Corporation)

R3 EL90XBC; C:\Windows\System32\DRIVERS\el90xbc5.sys [66591 2001-08-17] (3Com Corporation)

R3 gameenum; C:\Windows\System32\DRIVERS\gameenum.sys [10624 2008-04-13] (Microsoft Corporation)

R3 HPZid412; C:\Windows\System32\DRIVERS\HPZid412.sys [49920 2007-10-30] (HP)

R3 HPZipr12; C:\Windows\System32\DRIVERS\HPZipr12.sys [16496 2007-10-30] (HP)

R3 HPZius12; C:\Windows\System32\DRIVERS\HPZius12.sys [21568 2007-10-30] (HP)

S3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)

R3 ms_mpu401; C:\Windows\System32\drivers\msmpu401.sys [2944 2001-08-17] (Microsoft Corporation)

U1 WS2IFSL;

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-12-01 16:57 - 2013-12-01 16:58 - 00005292 ____C C:\Documents and Settings\Owner\Desktop\FRST.txt

2013-12-01 16:57 - 2013-12-01 16:57 - 00000000 ___DC C:\FRST

2013-12-01 16:56 - 2013-12-01 16:56 - 01092389 _____ (Farbar) C:\Documents and Settings\Owner\Desktop\FRST (1).exe

2013-12-01 02:22 - 2013-12-01 02:23 - 00000000 ____D C:\WINDOWS\system32\NtmsData

2013-11-30 02:38 - 2013-11-30 02:38 - 00000000 ____D C:\Program Files\ESET

2013-11-28 19:29 - 2013-11-28 19:29 - 00000000 __SHD C:\Documents and Settings\Owner\IECompatCache

2013-11-28 11:25 - 2013-11-28 11:25 - 00002020 ____C C:\Documents and Settings\Owner\Desktop\RKreport[0]_D_11282013_112539.txt

2013-11-28 11:24 - 2013-11-28 11:24 - 00001975 ____C C:\Documents and Settings\Owner\Desktop\RKreport[0]_S_11282013_112418.txt

2013-11-28 08:07 - 2013-11-28 08:07 - 00000000 ____D C:\Documents and Settings\Owner\Local Settings\Application Data\Google

2013-11-28 03:26 - 2013-11-28 03:26 - 00000000 _SHDC C:\Documents and Settings\LocalService.NT AUTHORITY\IETldCache

2013-11-27 15:42 - 2013-11-27 15:42 - 00001942 ____C C:\Documents and Settings\Owner\Desktop\RKreport[0]_S_11272013_154247.txt

2013-11-27 15:40 - 2013-11-28 11:26 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\RK_Quarantine

2013-11-27 12:24 - 2013-11-27 12:24 - 00000000 ___DC C:\Documents and Settings\All Users\Start Menu\Programs\DownloadX ActiveX Download Control 1.6

2013-11-27 12:24 - 2013-11-27 12:24 - 00000000 ____D C:\Program Files\DownloadXCtrl.com

2013-11-27 12:06 - 2013-11-27 12:23 - 00923784 _____ (CNET Download.com) C:\Documents and Settings\Owner\My Documents\cbsidlm-cbsi145-DownloadX_ActiveX_Download_Control-SEO-10911713.exe

2013-11-27 12:01 - 2013-11-27 12:01 - 00000000 __SHD C:\Documents and Settings\Owner\PrivacIE

2013-11-27 02:51 - 2013-11-27 02:53 - 00000000 ___DC C:\Documents and Settings\All Users\Application Data\MFAData

2013-11-27 02:51 - 2013-11-27 02:51 - 00000000 ____D C:\Documents and Settings\Owner\Local Settings\Application Data\MFAData

2013-11-27 02:51 - 2013-11-27 02:51 - 00000000 ____D C:\Documents and Settings\Owner\Local Settings\Application Data\Avg2014

2013-11-27 02:48 - 2013-11-27 02:48 - 00000000 ____D C:\Program Files\MSECache

2013-11-27 02:38 - 2013-11-27 02:38 - 00000104 ____C C:\Documents and Settings\Owner\Desktop\Shortcut to My Computer.lnk

2013-11-27 02:32 - 2013-11-27 02:49 - 00002497 ____C C:\Documents and Settings\Owner\Desktop\Microsoft Office Word 2003.lnk

2013-11-27 02:32 - 2013-11-27 02:32 - 00000000 ____D C:\Program Files\Microsoft ActiveSync

2013-11-27 02:28 - 2013-11-27 02:28 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2868626$

2013-11-27 02:27 - 2013-11-27 02:27 - 00006015 _____ C:\WINDOWS\KB2900986.log

2013-11-27 02:27 - 2013-11-27 02:27 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2900986$

2013-11-27 02:26 - 2013-11-27 02:26 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876331$

2013-11-27 02:26 - 2013-11-27 02:26 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862152$

2013-11-27 02:14 - 2013-11-27 02:28 - 00013000 _____ C:\WINDOWS\KB2868626.log

2013-11-27 02:13 - 2013-11-27 02:26 - 00011927 _____ C:\WINDOWS\KB2862152.log

2013-11-27 02:13 - 2013-11-27 02:26 - 00011748 _____ C:\WINDOWS\KB2876331.log

2013-11-27 01:38 - 2013-11-27 03:03 - 00000000 ___DC C:\Documents and Settings\Owner\Application Data\Apple Computer

2013-11-27 01:38 - 2013-11-27 01:38 - 00000000 ____D C:\Documents and Settings\Owner\Local Settings\Application Data\Apple Computer

2013-11-27 01:31 - 2013-11-27 01:31 - 00000000 ___DC C:\Documents and Settings\Owner\Application Data\WinRAR

2013-11-27 01:30 - 2013-11-27 01:30 - 00000000 ___DC C:\Documents and Settings\All Users\Start Menu\Programs\WinRAR

2013-11-27 01:30 - 2013-11-27 01:30 - 00000000 ____D C:\Program Files\WinRAR

2013-11-27 01:30 - 2013-11-27 01:30 - 00000000 ____D C:\Documents and Settings\Owner\Start Menu\Programs\WinRAR

2013-11-27 01:08 - 2013-11-27 01:16 - 00000000 ___DC C:\Documents and Settings\Owner\Application Data\Mozilla

2013-11-27 01:08 - 2013-11-27 01:08 - 00000000 ____D C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla

2013-11-27 01:07 - 2013-11-27 01:07 - 00000730 ____C C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk

2013-11-27 01:07 - 2013-11-27 01:07 - 00000724 ____C C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk

2013-11-27 01:07 - 2013-11-27 01:07 - 00000000 ___DC C:\Documents and Settings\All Users\Application Data\Mozilla

2013-11-27 01:07 - 2013-11-27 01:07 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service

2013-11-27 01:06 - 2013-11-27 01:06 - 00282904 _____ (Mozilla) C:\Documents and Settings\Owner\My Documents\Firefox Setup Stub 25.0.1.exe

2013-11-27 00:56 - 2013-11-27 00:56 - 00000000 ___DC C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)

2013-11-27 00:51 - 2013-11-27 11:35 - 00000000 ___DC C:\Documents and Settings\Owner\Desktop\mbar

2013-11-27 00:51 - 2013-11-27 00:51 - 00047064 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2013-11-27 00:43 - 2013-11-27 00:43 - 00000784 ____C C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk

2013-11-27 00:43 - 2013-11-27 00:43 - 00000000 ___DC C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware

2013-11-27 00:43 - 2013-11-27 00:43 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-11-27 00:43 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

2013-11-27 00:42 - 2013-11-27 02:50 - 00045912 _____ C:\Documents and Settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2013-11-27 00:41 - 2013-11-26 17:40 - 10285040 ____C (Malwarebytes Corporation ) C:\Documents and Settings\Owner\Desktop\mbam-setup-1.75.0.1300 (1).exe

2013-11-27 00:41 - 2013-11-26 17:37 - 00688992 ___RC (Swearware) C:\Documents and Settings\Owner\Desktop\dds.scr

2013-11-25 16:29 - 2013-11-25 16:29 - 00000000 ___DC C:\Documents and Settings\Owner\Application Data\Malwarebytes

2013-11-25 16:18 - 2013-11-25 16:18 - 00000000 ____D C:\Documents and Settings\Owner\Local Settings\Application Data\Apple

2013-11-18 12:24 - 2013-11-18 12:24 - 00000767 _____ C:\Documents and Settings\Owner\Start Menu\Programs\Internet Explorer.lnk

2013-11-18 12:23 - 2013-11-18 12:24 - 00000738 _____ C:\Documents and Settings\Owner\Start Menu\Programs\Outlook Express.lnk

2013-11-18 12:23 - 2013-11-18 12:23 - 00000000 __SHD C:\Documents and Settings\Owner\IETldCache

2013-11-18 12:22 - 2013-11-28 19:29 - 00000000 ___DC C:\Documents and Settings\Owner

2013-11-18 12:22 - 2013-11-28 03:26 - 00000000 _SHDC C:\Documents and Settings\LocalService.NT AUTHORITY

2013-11-18 12:22 - 2013-11-28 03:24 - 00000178 __SHC C:\Documents and Settings\Owner\ntuser.ini

2013-11-18 12:22 - 2013-11-18 12:43 - 00000788 _____ C:\Documents and Settings\Owner\Start Menu\Programs\Windows Media Player.lnk

2013-11-18 12:22 - 2013-11-18 12:23 - 00000000 ___RD C:\Documents and Settings\Owner\Start Menu\Programs\Accessories

2013-11-18 12:22 - 2013-11-18 12:22 - 00000020 __SHC C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.ini

2013-11-18 12:22 - 2013-11-18 12:22 - 00000020 __SHC C:\Documents and Settings\LocalService.NT AUTHORITY\ntuser.ini

2013-11-18 12:22 - 2013-11-18 12:22 - 00000000 _SHDC C:\Documents and Settings\NetworkService.NT AUTHORITY

2013-11-18 12:22 - 2012-11-25 03:12 - 00000000 ____D C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft Help

2013-11-18 12:22 - 2012-11-14 09:54 - 00000000 ___DC C:\Documents and Settings\Owner\Application Data\Macromedia

2013-11-18 12:22 - 2012-11-13 12:49 - 00001599 _____ C:\Documents and Settings\Owner\Start Menu\Programs\Remote Assistance.lnk

2013-11-18 04:49 - 2013-11-18 04:58 - 00000000 ____D C:\WINDOWS\tmp

2013-11-07 09:07 - 2013-11-07 09:07 - 00000023 ____C C:\.directory.lock

2013-11-07 09:07 - 2013-11-07 09:07 - 00000000 ____C C:\.directorycl5632.new

2013-11-06 19:57 - 2013-11-06 19:57 - 00001190 _____ C:\WINDOWS\system32\ServiceConfig.xml

2013-11-04 16:32 - 2013-11-04 16:32 - 00165121 ____C C:\Documents and Settings\All Users\Application Data\f8a04_l

2013-11-04 16:32 - 2013-11-04 16:32 - 00165121 _____ C:\Documents and Settings\User\Application Data\f8a04_l

2013-11-04 16:32 - 2013-11-04 16:32 - 00000393 ____C C:\Documents and Settings\All Users\Application Data\w9qqfrbn.reg

2013-11-04 16:26 - 2013-11-17 14:09 - 95025368 ___CT C:\Documents and Settings\All Users\Application Data\w9qqfrbn.bxx

2013-11-04 16:26 - 2013-11-17 14:09 - 00000000 ____C C:\Documents and Settings\All Users\Application Data\w9qqfrbn.fvv

==================== One Month Modified Files and Folders =======

2013-12-01 16:58 - 2013-12-01 16:57 - 00005292 ____C C:\Documents and Settings\Owner\Desktop\FRST.txt

2013-12-01 16:57 - 2013-12-01 16:57 - 00000000 ___DC C:\FRST

2013-12-01 16:56 - 2013-12-01 16:56 - 01092389 _____ (Farbar) C:\Documents and Settings\Owner\Desktop\FRST (1).exe

2013-12-01 16:56 - 2013-09-20 09:11 - 00000424 ____H C:\WINDOWS\Tasks\User_Feed_Synchronization-{11E5AB39-BE45-46BC-B1D3-C26FF6C355BF}.job

2013-12-01 16:56 - 2012-11-13 13:29 - 00000420 ____H C:\WINDOWS\Tasks\User_Feed_Synchronization-{3732893A-D075-4DDC-B360-266B24E44125}.job

2013-12-01 16:37 - 2012-11-13 13:04 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2013-12-01 16:20 - 2013-01-01 22:48 - 00000882 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2013-12-01 16:16 - 2012-11-13 12:53 - 00032244 _____ C:\WINDOWS\SchedLgU.Txt

2013-12-01 11:13 - 2012-11-13 12:47 - 01132027 _____ C:\WINDOWS\WindowsUpdate.log

2013-12-01 02:36 - 2013-09-20 06:22 - 00000384 ____H C:\WINDOWS\Tasks\Microsoft Antimalware Scheduled Scan.job

2013-12-01 02:23 - 2013-12-01 02:22 - 00000000 ____D C:\WINDOWS\system32\NtmsData

2013-12-01 02:18 - 2012-11-13 05:21 - 01217048 _____ C:\WINDOWS\FaxSetup.log

2013-12-01 02:18 - 2012-11-13 05:21 - 00605384 _____ C:\WINDOWS\ocgen.log

2013-12-01 02:18 - 2012-11-13 05:21 - 00473692 _____ C:\WINDOWS\tsoc.log

2013-12-01 02:18 - 2012-11-13 05:21 - 00415575 _____ C:\WINDOWS\comsetup.log

2013-12-01 02:18 - 2012-11-13 05:21 - 00252052 _____ C:\WINDOWS\ntdtcsetup.log

2013-12-01 02:18 - 2012-11-13 05:21 - 00193012 _____ C:\WINDOWS\iis6.log

2013-12-01 02:18 - 2012-11-13 05:21 - 00068403 _____ C:\WINDOWS\ocmsn.log

2013-12-01 02:18 - 2012-11-13 05:21 - 00061676 _____ C:\WINDOWS\msgsocm.log

2013-12-01 02:18 - 2012-11-13 05:21 - 00001917 _____ C:\WINDOWS\imsins.log

2013-12-01 02:18 - 2012-11-13 05:18 - 00669562 _____ C:\WINDOWS\setupapi.log

2013-12-01 02:17 - 2012-11-24 09:10 - 00000000 ___DC C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office

2013-12-01 02:16 - 2012-11-17 17:56 - 00000000 ____D C:\WINDOWS\SHELLNEW

2013-12-01 02:08 - 2012-11-13 05:18 - 00177942 _____ C:\WINDOWS\setupact.log

2013-12-01 02:05 - 2012-11-13 05:24 - 00000159 _____ C:\WINDOWS\wiadebug.log

2013-12-01 02:04 - 2013-01-01 22:48 - 00000878 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2013-12-01 02:04 - 2012-11-13 12:53 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2013-12-01 02:04 - 2012-11-13 05:24 - 00000049 _____ C:\WINDOWS\wiaservc.log

2013-12-01 02:04 - 2001-08-18 05:00 - 00013646 _____ C:\WINDOWS\system32\wpa.dbl

2013-11-30 02:38 - 2013-11-30 02:38 - 00000000 ____D C:\Program Files\ESET

2013-11-30 01:25 - 2013-01-01 22:54 - 00000000 ___DC C:\Documents and Settings\Owner\Desktop\Google Chrome

2013-11-28 19:29 - 2013-11-28 19:29 - 00000000 __SHD C:\Documents and Settings\Owner\IECompatCache

2013-11-28 19:29 - 2013-11-18 12:22 - 00000000 ___DC C:\Documents and Settings\Owner

2013-11-28 19:22 - 2012-11-13 12:44 - 00000000 __RDC C:\Documents and Settings\All Users\Start Menu\Programs\Games

2013-11-28 19:22 - 2012-11-13 12:44 - 00000000 ____D C:\Program Files\Online Services

2013-11-28 19:22 - 2012-11-13 05:21 - 00524218 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2013-11-28 19:22 - 2012-11-13 05:21 - 00004625 _____ C:\WINDOWS\imsins.BAK

2013-11-28 18:52 - 2012-11-13 05:12 - 00000000 ____D C:\WINDOWS\Help

2013-11-28 11:26 - 2013-11-27 15:40 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\RK_Quarantine

2013-11-28 11:25 - 2013-11-28 11:25 - 00002020 ____C C:\Documents and Settings\Owner\Desktop\RKreport[0]_D_11282013_112539.txt

2013-11-28 11:24 - 2013-11-28 11:24 - 00001975 ____C C:\Documents and Settings\Owner\Desktop\RKreport[0]_S_11282013_112418.txt

2013-11-28 08:45 - 2012-12-22 09:11 - 00000284 _____ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job

2013-11-28 08:07 - 2013-11-28 08:07 - 00000000 ____D C:\Documents and Settings\Owner\Local Settings\Application Data\Google

2013-11-28 03:26 - 2013-11-28 03:26 - 00000000 _SHDC C:\Documents and Settings\LocalService.NT AUTHORITY\IETldCache

2013-11-28 03:26 - 2013-11-18 12:22 - 00000000 _SHDC C:\Documents and Settings\LocalService.NT AUTHORITY

2013-11-28 03:24 - 2013-11-18 12:22 - 00000178 __SHC C:\Documents and Settings\Owner\ntuser.ini

2013-11-28 03:06 - 2012-11-13 12:46 - 00000000 ____D C:\WINDOWS\system32\Restore

2013-11-27 15:42 - 2013-11-27 15:42 - 00001942 ____C C:\Documents and Settings\Owner\Desktop\RKreport[0]_S_11272013_154247.txt

2013-11-27 15:21 - 2013-09-20 11:04 - 00000000 ___DC C:\Documents and Settings\All Users\Application Data\OMG Total Protection

2013-11-27 12:28 - 2012-11-14 09:43 - 00002404 _____ C:\WINDOWS\system32\d3d9caps.dat

2013-11-27 12:24 - 2013-11-27 12:24 - 00000000 ___DC C:\Documents and Settings\All Users\Start Menu\Programs\DownloadX ActiveX Download Control 1.6

2013-11-27 12:24 - 2013-11-27 12:24 - 00000000 ____D C:\Program Files\DownloadXCtrl.com

2013-11-27 12:23 - 2013-11-27 12:06 - 00923784 _____ (CNET Download.com) C:\Documents and Settings\Owner\My Documents\cbsidlm-cbsi145-DownloadX_ActiveX_Download_Control-SEO-10911713.exe

2013-11-27 12:01 - 2013-11-27 12:01 - 00000000 __SHD C:\Documents and Settings\Owner\PrivacIE

2013-11-27 11:47 - 2012-11-13 12:45 - 00000000 ____D C:\WINDOWS\Registration

2013-11-27 11:35 - 2013-11-27 00:51 - 00000000 ___DC C:\Documents and Settings\Owner\Desktop\mbar

2013-11-27 11:27 - 2012-11-13 17:32 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB982665$

2013-11-27 03:03 - 2013-11-27 01:38 - 00000000 ___DC C:\Documents and Settings\Owner\Application Data\Apple Computer

2013-11-27 03:01 - 2012-12-12 03:14 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2779030$

2013-11-27 03:01 - 2012-11-13 13:19 - 00014662 _____ C:\WINDOWS\spupdsvc.log

2013-11-27 03:01 - 2012-11-13 05:18 - 00204120 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2013-11-27 02:53 - 2013-11-27 02:51 - 00000000 ___DC C:\Documents and Settings\All Users\Application Data\MFAData

2013-11-27 02:51 - 2013-11-27 02:51 - 00000000 ____D C:\Documents and Settings\Owner\Local Settings\Application Data\MFAData

2013-11-27 02:51 - 2013-11-27 02:51 - 00000000 ____D C:\Documents and Settings\Owner\Local Settings\Application Data\Avg2014

2013-11-27 02:50 - 2013-11-27 00:42 - 00045912 _____ C:\Documents and Settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2013-11-27 02:49 - 2013-11-27 02:32 - 00002497 ____C C:\Documents and Settings\Owner\Desktop\Microsoft Office Word 2003.lnk

2013-11-27 02:48 - 2013-11-27 02:48 - 00000000 ____D C:\Program Files\MSECache

2013-11-27 02:38 - 2013-11-27 02:38 - 00000104 ____C C:\Documents and Settings\Owner\Desktop\Shortcut to My Computer.lnk

2013-11-27 02:33 - 2012-11-17 18:01 - 00000376 _____ C:\WINDOWS\ODBC.INI

2013-11-27 02:32 - 2013-11-27 02:32 - 00000000 ____D C:\Program Files\Microsoft ActiveSync

2013-11-27 02:32 - 2012-11-13 05:21 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared

2013-11-27 02:29 - 2012-11-17 17:56 - 00000000 ____D C:\Program Files\Microsoft Office

2013-11-27 02:28 - 2013-11-27 02:28 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2868626$

2013-11-27 02:28 - 2013-11-27 02:14 - 00013000 _____ C:\WINDOWS\KB2868626.log

2013-11-27 02:28 - 2013-07-12 02:31 - 00015966 _____ C:\WINDOWS\KB2834886.log

2013-11-27 02:28 - 2012-11-13 17:42 - 00041997 _____ C:\WINDOWS\KB2659262.log

2013-11-27 02:28 - 2012-11-13 17:42 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2659262$

2013-11-27 02:28 - 2012-11-13 13:18 - 00088597 _____ C:\WINDOWS\updspapi.log

2013-11-27 02:27 - 2013-11-27 02:27 - 00006015 _____ C:\WINDOWS\KB2900986.log

2013-11-27 02:27 - 2013-11-27 02:27 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2900986$

2013-11-27 02:27 - 2013-07-12 02:31 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834886$

2013-11-27 02:27 - 2012-11-13 17:43 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2686509$

2013-11-27 02:27 - 2012-11-13 17:42 - 00047487 _____ C:\WINDOWS\KB2686509.log

2013-11-27 02:26 - 2013-11-27 02:26 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876331$

2013-11-27 02:26 - 2013-11-27 02:26 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862152$

2013-11-27 02:26 - 2013-11-27 02:13 - 00011927 _____ C:\WINDOWS\KB2862152.log

2013-11-27 02:26 - 2013-11-27 02:13 - 00011748 _____ C:\WINDOWS\KB2876331.log

2013-11-27 02:26 - 2012-11-13 17:41 - 00044141 _____ C:\WINDOWS\KB2603381.log

2013-11-27 02:26 - 2012-11-13 17:41 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2603381$

2013-11-27 02:26 - 2012-11-13 17:39 - 00042734 _____ C:\WINDOWS\KB2570947.log

2013-11-27 02:26 - 2012-11-13 17:39 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2570947$

2013-11-27 02:26 - 2012-11-13 13:19 - 00051107 _____ C:\WINDOWS\KB2467659.log

2013-11-27 02:26 - 2012-11-13 13:19 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2467659$

2013-11-27 02:25 - 2013-09-20 05:06 - 00000000 ____D C:\WINDOWS\system32\MRT

2013-11-27 02:25 - 2012-11-26 03:11 - 00011289 _____ C:\WINDOWS\KB929399.log

2013-11-27 02:25 - 2012-11-26 03:11 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB929399$

2013-11-27 02:20 - 2012-11-13 13:15 - 80340640 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2013-11-27 02:19 - 2012-11-13 05:12 - 00000000 ____D C:\WINDOWS\system

2013-11-27 02:12 - 2012-11-13 16:55 - 00014088 _____ C:\WINDOWS\KB898461.log

2013-11-27 02:11 - 2012-11-13 16:55 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB898461$

2013-11-27 01:38 - 2013-11-27 01:38 - 00000000 ____D C:\Documents and Settings\Owner\Local Settings\Application Data\Apple Computer

2013-11-27 01:31 - 2013-11-27 01:31 - 00000000 ___DC C:\Documents and Settings\Owner\Application Data\WinRAR

2013-11-27 01:30 - 2013-11-27 01:30 - 00000000 ___DC C:\Documents and Settings\All Users\Start Menu\Programs\WinRAR

2013-11-27 01:30 - 2013-11-27 01:30 - 00000000 ____D C:\Program Files\WinRAR

2013-11-27 01:30 - 2013-11-27 01:30 - 00000000 ____D C:\Documents and Settings\Owner\Start Menu\Programs\WinRAR

2013-11-27 01:16 - 2013-11-27 01:08 - 00000000 ___DC C:\Documents and Settings\Owner\Application Data\Mozilla

2013-11-27 01:08 - 2013-11-27 01:08 - 00000000 ____D C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla

2013-11-27 01:07 - 2013-11-27 01:07 - 00000730 ____C C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk

2013-11-27 01:07 - 2013-11-27 01:07 - 00000724 ____C C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk

2013-11-27 01:07 - 2013-11-27 01:07 - 00000000 ___DC C:\Documents and Settings\All Users\Application Data\Mozilla

2013-11-27 01:07 - 2013-11-27 01:07 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service

2013-11-27 01:07 - 2012-11-20 23:26 - 00000000 ____D C:\Program Files\Mozilla Firefox

2013-11-27 01:06 - 2013-11-27 01:06 - 00282904 _____ (Mozilla) C:\Documents and Settings\Owner\My Documents\Firefox Setup Stub 25.0.1.exe

2013-11-27 00:56 - 2013-11-27 00:56 - 00000000 ___DC C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)

2013-11-27 00:51 - 2013-11-27 00:51 - 00047064 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2013-11-27 00:43 - 2013-11-27 00:43 - 00000784 ____C C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk

2013-11-27 00:43 - 2013-11-27 00:43 - 00000000 ___DC C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware

2013-11-27 00:43 - 2013-11-27 00:43 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2013-11-26 17:40 - 2013-11-27 00:41 - 10285040 ____C (Malwarebytes Corporation ) C:\Documents and Settings\Owner\Desktop\mbam-setup-1.75.0.1300 (1).exe

2013-11-26 17:37 - 2013-11-27 00:41 - 00688992 ___RC (Swearware) C:\Documents and Settings\Owner\Desktop\dds.scr

2013-11-25 16:29 - 2013-11-25 16:29 - 00000000 ___DC C:\Documents and Settings\Owner\Application Data\Malwarebytes

2013-11-25 16:26 - 2012-11-13 13:30 - 00013646 _____ C:\WINDOWS\system32\wpa.bak

2013-11-25 16:26 - 2012-11-13 12:53 - 00008192 _____ C:\WINDOWS\REGLOCS.OLD

2013-11-25 16:18 - 2013-11-25 16:18 - 00000000 ____D C:\Documents and Settings\Owner\Local Settings\Application Data\Apple

2013-11-25 08:29 - 2012-11-17 22:38 - 00000000 ____D C:\unzipped

2013-11-18 12:43 - 2013-11-18 12:22 - 00000788 _____ C:\Documents and Settings\Owner\Start Menu\Programs\Windows Media Player.lnk

2013-11-18 12:43 - 2012-11-13 12:44 - 00013616 _____ C:\WINDOWS\wmsetup.log

2013-11-18 12:24 - 2013-11-18 12:24 - 00000767 _____ C:\Documents and Settings\Owner\Start Menu\Programs\Internet Explorer.lnk

2013-11-18 12:24 - 2013-11-18 12:23 - 00000738 _____ C:\Documents and Settings\Owner\Start Menu\Programs\Outlook Express.lnk

2013-11-18 12:23 - 2013-11-18 12:23 - 00000000 __SHD C:\Documents and Settings\Owner\IETldCache

2013-11-18 12:23 - 2013-11-18 12:22 - 00000000 ___RD C:\Documents and Settings\Owner\Start Menu\Programs\Accessories

2013-11-18 12:23 - 2001-08-18 05:00 - 00000638 _____ C:\WINDOWS\win.ini

2013-11-18 12:22 - 2013-11-18 12:22 - 00000020 __SHC C:\Documents and Settings\NetworkService.NT AUTHORITY\ntuser.ini

2013-11-18 12:22 - 2013-11-18 12:22 - 00000020 __SHC C:\Documents and Settings\LocalService.NT AUTHORITY\ntuser.ini

2013-11-18 12:22 - 2013-11-18 12:22 - 00000000 _SHDC C:\Documents and Settings\NetworkService.NT AUTHORITY

2013-11-18 04:58 - 2013-11-18 04:49 - 00000000 ____D C:\WINDOWS\tmp

2013-11-18 03:30 - 2012-11-13 05:17 - 00000392 _RSHC C:\boot.ini

2013-11-17 14:09 - 2013-11-04 16:26 - 95025368 ___CT C:\Documents and Settings\All Users\Application Data\w9qqfrbn.bxx

2013-11-17 14:09 - 2013-11-04 16:26 - 00000000 ____C C:\Documents and Settings\All Users\Application Data\w9qqfrbn.fvv

2013-11-17 14:08 - 2012-11-13 05:17 - 08388608 _____ C:\WINDOWS\system32\config\system.bak

2013-11-16 01:43 - 2012-11-13 12:55 - 00000178 ___SH C:\Documents and Settings\User\ntuser.ini

2013-11-07 09:07 - 2013-11-07 09:07 - 00000023 ____C C:\.directory.lock

2013-11-07 09:07 - 2013-11-07 09:07 - 00000000 ____C C:\.directorycl5632.new

2013-11-06 19:57 - 2013-11-06 19:57 - 00001190 _____ C:\WINDOWS\system32\ServiceConfig.xml

2013-11-04 16:32 - 2013-11-04 16:32 - 00165121 ____C C:\Documents and Settings\All Users\Application Data\f8a04_l

2013-11-04 16:32 - 2013-11-04 16:32 - 00165121 _____ C:\Documents and Settings\User\Application Data\f8a04_l

2013-11-04 16:32 - 2013-11-04 16:32 - 00000393 ____C C:\Documents and Settings\All Users\Application Data\w9qqfrbn.reg

Some content of TEMP:

====================

C:\Documents and Settings\Owner\Local Settings\Temp\ntdll_dump.dll

C:\Documents and Settings\User\Local Settings\Temp\FLVPlayerSetup.exe

C:\Documents and Settings\User\Local Settings\Temp\jre-7u15-windows-i586-iftw.exe

C:\Documents and Settings\User\Local Settings\Temp\jre-7u17-windows-i586-iftw.exe

C:\Documents and Settings\User\Local Settings\Temp\jre-7u21-windows-i586-iftw.exe

C:\Documents and Settings\User\Local Settings\Temp\jre-7u25-windows-i586-iftw.exe

C:\Documents and Settings\User\Local Settings\Temp\Optimizer_Pro.exe

C:\Documents and Settings\User\Local Settings\Temp\ose00000.exe

C:\Documents and Settings\User\Local Settings\Temp\setup_wm.exe

C:\Documents and Settings\User\Local Settings\Temp\The_Weather_Channel_Application.exe

C:\Documents and Settings\User\Local Settings\Temp\uninst1.exe

C:\Documents and Settings\User\Local Settings\Temp\vlc-2.0.2-win32.exe

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================

December 2, 2013

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AMJ15OO2\WSSetup[1].exe   multiple threats
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QF4ST24S\update[1]   multiple threats
C:\Documents and Settings\Owner\Local Settings\Temp\dlm1D.tmp\DownloadXPro.exe   Win32/OpenCandy application
C:\Documents and Settings\Owner\My Documents\cbsidlm-cbsi145-DownloadX_ActiveX_Download_Control-SEO-10911713.exe   a variant of Win32/CNETInstaller.B application
C:\Documents and Settings\User\Local Settings\Temp\Optimizer_Pro.exe   multiple threats
C:\Documents and Settings\User\Local Settings\Temp\551BF67B-BAB0-7891-9472-782349FD0755\Latest\ccp.exe   Win32/Toolbar.Babylon.M application
C:\Documents and Settings\User\Local Settings\Temp\551BF67B-BAB0-7891-9472-782349FD0755\Latest\IEHelper.dll   Win32/Toolbar.Babylon.E application
C:\Documents and Settings\User\Local Settings\Temp\ins2717\OptimizerPro.exe   probably a variant of Win32/SpeedingUpMyPC.B application
C:\Documents and Settings\User\Local Settings\Temp\scoped_dir_5140_29369\CRX_INSTALL\background.html   Win32/Toolbar.Perion.D application
C:\Program Files\Driver Pro\DPSmartScan.exe   a variant of Win32/Adware.SpeedingUpMyPC.C application
C:\WINDOWS\Temp\dpsetup.exe   a variant of Win32/Adware.SpeedingUpMyPC.C application
C:\WINDOWS\Temp\INJ001\ExtensionUpdate.exe   multiple threats

November 30, 2013

Can it be the one downloaded or does it need to be through the browser? I don't have ActiveX running on that so it's giving me an error in IE.

November 29, 2013

I posted a new topic and right after noticed this was reopened but I was told to run Roguekiller so here it is if you need it.

RogueKiller V8.7.9 [Nov 25 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.adlice.com/forum/

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version

Started in : Normal mode

User : Owner [Admin rights]

Mode : Scan -- Date : 11/27/2013 15:42:47

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 1 ¤¤¤

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 1 ¤¤¤

[user][sUSP PATH] w9qqfrbn.lnk : C:\Documents and Settings\User\Start Menu\Programs\Startup\w9qqfrbn.lnk @C:\WINDOWS\system32\rundll32.exe C:\DOCUME~1\ALLUSE~1\APPLIC~1\nbrfqq9w.dss,XL200 [-][7][x] -> FOUND

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) MAXTOR 6L040J2 +++++

--- User ---

[MBR] 4ea0112aa27b3c54844a7d0e603ec229

[bSP] 28fcf281fff284a9967a63da059c1629 : Windows XP MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 38162 Mo

User = LL1 ... OK!

User = LL2 ... OK!

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ USB) Kingston DataTraveler 2.0 USB Device +++++

--- User ---

[MBR] dad67e4ea6a2a2714c741ed25da9c136

[bSP] d8f84a22f20915bddda5fc78877043df : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] FAT32 (0x0b) [VISIBLE] Offset (sectors): 63 | Size: 7396 Mo

User = LL1 ... OK!

Error reading LL2 MBR! ([0x32] The request is not supported. )

Finished : << RKreport[0]_S_11272013_154247.txt >>

November 29, 2013

Malwarebytes Anti-Malware (Trial) 1.75.0.1300

www.malwarebytes.org

Database version: v2013.11.28.05

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 6.0.2900.5512

Owner :: CUSTOM [administrator]

Protection: Enabled

11/27/2013 1:12:30 AM

mbam-log-2013-11-27 (01-12-30).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 252081

Time elapsed: 25 minute(s), 43 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 3

C:\Program Files\Optimizer Pro (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Documents and Settings\All Users\Start Menu\Programs\Optimizer Pro (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Program Files\WhiteSmoke_New_V4 (PUP.Optional.WhiteSmoke.A) -> No action taken.

Files Detected: 28

C:\Documents and Settings\User\Local Settings\Temp\Optimizer_Pro.exe (PUP.Optional.PCOptimizerPro) -> No action taken.

C:\Documents and Settings\User\Local Settings\Temp\ins2717\OptimizerPro.exe (PUP.Optional.OptimizePro.A) -> No action taken.

C:\Program Files\Optimizer Pro\OptimizerPro.chm (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Program Files\Optimizer Pro\English.ini (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Program Files\Optimizer Pro\file_id.diz (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Program Files\Optimizer Pro\HomePage.url (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Program Files\Optimizer Pro\OptimizerPro.exe (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Program Files\Optimizer Pro\OptProCrash.dll (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Program Files\Optimizer Pro\OptProGuard.exe (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Program Files\Optimizer Pro\OptProLauncher.exe (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Program Files\Optimizer Pro\OptProReminder.exe (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Program Files\Optimizer Pro\OptProSchedule.exe (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Program Files\Optimizer Pro\OptProSmartScan.exe (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Program Files\Optimizer Pro\OptProStart.exe (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Program Files\Optimizer Pro\OptProUninstaller.exe (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Program Files\Optimizer Pro\scan.gif (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Program Files\Optimizer Pro\sqlite3.dll (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Program Files\Optimizer Pro\unins000.dat (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Program Files\Optimizer Pro\unins000.exe (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Documents and Settings\All Users\Start Menu\Programs\Optimizer Pro\Optimizer Pro on the Web.lnk (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Documents and Settings\All Users\Start Menu\Programs\Optimizer Pro\Help.lnk (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Documents and Settings\All Users\Start Menu\Programs\Optimizer Pro\Optimizer Pro.lnk (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Documents and Settings\All Users\Start Menu\Programs\Optimizer Pro\Uninstall Optimizer Pro.lnk (PUP.Optional.OptimizerPro.A) -> No action taken.

C:\Program Files\WhiteSmoke_New_V4\tbWhit.dll (PUP.Optional.WhiteSmoke.A) -> No action taken.

C:\Program Files\WhiteSmoke_New_V4\toolbar.cfg (PUP.Optional.WhiteSmoke.A) -> No action taken.

C:\Program Files\WhiteSmoke_New_V4\WhiteSmoke_New_V4ToolbarHelper.exe (PUP.Optional.WhiteSmoke.A) -> No action taken.

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\AMJ15OO2\SkywalkerSetup[1].exe (PUP.Optional.InstallBrain.A) -> Quarantined and deleted successfully.

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QF4ST24S\WSSetup[2].exe (PUP.Optional.InstallBrain.A) -> Quarantined and deleted successfully.

(end)

November 28, 2013

Wow.. Sorry about the late reply I just saw the response to the mail regarding reopening this thread right after I posted a new topic, lol. Things have been hectic, my apologies.

I used the Kaspersky 10 Rescue Disk to remove the Ransomware and after being able to access the desktop I ran MBAM and DDS just to be safe but I want to know this system is good to go before all this happened as it's still being a bit sluggish. I've just attached the DDS logs but I can also post the MBAM if needed.

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 8.0.6001.18702

Run by Owner at 11:37:02 on 2013-11-27

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.608 [GMT -7:00]

.

AV: OMG Total Protection OMG Total Protection *Enabled/Updated* {964FCE60-0B18-4D30-ADD6-EB178909041C}

.

============== Running Processes ================

.

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\iTunes\iTunes.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalService

.

============== Pseudo HJT Report ===============

.

uWindow Title = Internet Explorer, optimized for Bing and MSN

mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wnda3100v2\WNDA3100v2.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-Explorer: NoDriveTypeAutoRun = dword:145

IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

TCP: NameServer = 75.75.75.75 75.75.76.76 192.168.1.1

TCP: Interfaces\{D0F1D738-F426-4D3A-B448-799ECFCD6B5C} : DHCPNameServer = 75.75.75.75 75.75.76.76 192.168.1.1

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\owner\application data\mozilla\firefox\profiles\gbcac4do.default\

.

============= SERVICES / DRIVERS ===============

.

R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2013-11-27 418376]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2013-11-27 701512]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-11-27 22856]

.

=============== Created Last 30 ================

.

2013-11-27 09:51:15 -------- d--h--w- c:\documents and settings\all users\application data\Common Files

2013-11-27 09:51:15 -------- d-----w- c:\documents and settings\owner\local settings\application data\MFAData

2013-11-27 09:51:15 -------- d-----w- c:\documents and settings\owner\local settings\application data\Avg2014

2013-11-27 09:51:15 -------- d-----w- c:\documents and settings\all users\application data\MFAData

2013-11-27 09:48:11 -------- d-----w- c:\program files\MSECache

2013-11-27 09:32:05 -------- d-----w- c:\program files\Microsoft ActiveSync

2013-11-27 08:38:55 -------- d-----w- c:\documents and settings\owner\local settings\application data\Apple Computer

2013-11-27 08:08:00 -------- d-----w- c:\documents and settings\owner\local settings\application data\Mozilla

2013-11-27 07:56:13 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes' Anti-Malware (portable)

2013-11-27 07:51:50 47064 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys

2013-11-27 07:43:36 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-11-27 07:43:36 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2013-11-25 23:29:53 -------- d-----w- c:\documents and settings\owner\application data\Malwarebytes

2013-11-25 23:18:44 -------- d-----w- c:\documents and settings\owner\local settings\application data\Apple

2013-11-18 19:23:49 -------- d-sh--w- c:\documents and settings\owner\IETldCache

2013-11-18 11:49:02 -------- d-----w- c:\windows\tmp

2013-11-05 03:00:58 -------- d---a-w- C:\Kaspersky Rescue Disk 10.0

2013-11-04 23:32:55 393 ----a-w- c:\documents and settings\all users\application data\w9qqfrbn.reg

2013-10-31 00:13:39 1034240 ----a-w- c:\windows\system32\drivers\bcmwlhigh5.sys

2013-10-29 16:44:08 53299 ----a-w- c:\windows\system32\pthreadVC.dll

2013-10-29 16:44:08 50704 ----a-w- c:\windows\system32\drivers\npf.sys

2013-10-29 16:44:08 281104 ----a-w- c:\windows\system32\wpcap.dll

2013-10-29 16:44:08 100880 ----a-w- c:\windows\system32\Packet.dll

2013-10-29 16:43:48 -------- d-----w- c:\program files\NETGEAR

.

==================== Find3M ====================

.

2013-10-12 15:56:19 278528 ----a-w- c:\windows\system32\oakley.dll

2013-10-09 13:12:48 287744 ----a-w- c:\windows\system32\gdi32.dll

2013-10-07 10:59:21 603136 ----a-w- c:\windows\system32\crypt32.dll

2013-10-05 01:14:01 7168 ----a-w- c:\windows\system32\xpsp4res.dll

2013-09-23 18:33:58 920064 ----a-w- c:\windows\system32\wininet.dll

2013-09-23 18:33:57 43520 ------w- c:\windows\system32\licmgr10.dll

2013-09-23 18:33:57 1469440 ------w- c:\windows\system32\inetcpl.cpl

2013-09-23 18:33:56 18944 ----a-w- c:\windows\system32\corpol.dll

2013-09-23 18:06:48 385024 ------w- c:\windows\system32\html.iec

2013-09-20 15:38:11 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-09-20 15:38:09 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-09-09 08:52:46 632656 ----a-w- c:\windows\system32\msvcr80.dll

2013-09-09 08:52:46 554832 ----a-w- c:\windows\system32\msvcp80.dll

2013-09-09 08:52:46 479232 ----a-w- c:\windows\system32\msvcm80.dll

.

============= FINISH: 11:37:59.82 ===============

_______________________________________________________________________________________________________________

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows XP Home Edition

Boot Device: \Device\HarddiskVolume1

Install Date: 11/13/2012 12:52:26 PM

System Uptime: 11/27/2013 11:27:19 AM (0 hours ago)

.

Motherboard: Micro-Star Inc. | | MS-6534

Processor: Intel® Pentium® 4 CPU 1.60GHz | PGA478 | 1600/100mhz

.

==== Disk Partitions =========================

.

A: is Removable

C: is FIXED (NTFS) - 37 GiB total, 0.558 GiB free.

D: is CDROM (CDFS)

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP1: 11/18/2013 12:24:23 PM - System Checkpoint

RP2: 11/27/2013 1:38:09 AM - Installed Apple Application Support

RP3: 11/27/2013 2:09:54 AM - Software Distribution Service 3.0

RP4: 11/27/2013 2:19:22 AM - Software Distribution Service 3.0

RP5: 11/27/2013 2:29:37 AM - Installed Microsoft Office Professional Edition 2003

RP6: 11/27/2013 2:49:08 AM - Installed Compatibility Pack for the 2007 Office system

.

==== Installed Programs ======================

.

Apple Application Support

Compatibility Pack for the 2007 Office system

Hotfix for Windows Media Format 11 SDK (KB929399)

Malwarebytes Anti-Malware version 1.75.0.1300

Microsoft Office Professional Edition 2003

Mozilla Firefox 25.0.1 (x86 en-US)

Mozilla Maintenance Service

Security Update for Windows XP (KB2570947)

Security Update for Windows XP (KB2603381)

Security Update for Windows XP (KB2659262)

Security Update for Windows XP (KB2686509)

Security Update for Windows XP (KB2834886)

Security Update for Windows XP (KB2862152)

Security Update for Windows XP (KB2868626)

Security Update for Windows XP (KB2876331)

Security Update for Windows XP (KB2900986)

Update for Windows XP (KB2467659)

Update for Windows XP (KB898461)

WebFldrs XP

WinRAR 5.01 beta 1 (32-bit)

.

==== Event Viewer Messages From Past Week ========

.

11/27/2013 3:01:42 AM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.

11/27/2013 12:50:30 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the MBAMScheduler service to connect.

11/27/2013 12:50:30 AM, error: Service Control Manager [7000] - The MBAMScheduler service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

11/25/2013 4:47:58 PM, error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 1 time(s).

.

==== End Of File ===========================

November 28, 2013