Jump to content

van692

Members
  • Posts

    6
  • Joined

  • Last visited

Reputation

0 Neutral
  1. Here's the FRST log: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-08-2014 01 Ran by Molly (administrator) on MOLLY-PC on 29-08-2014 17:49:52 Running from C:\Users\Molly\Desktop Platform: Windows Vista Home Premium Service Pack 2 (X64) OS Language: English (United States) Internet Explorer Version 9 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (Logitech, Inc.) C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (ThreatTrack Security, Inc.) C:\Program Files (x86)\VIPRE\SBPIMSvc.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Logitech Inc.) C:\Program Files\Logitech\SetPoint\LBTWiz.exe (Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe () C:\Program Files (x86)\Medialink\MWN-USB150N\UI.exe (Logitech, Inc.) C:\Program Files\Logitech\SetPoint\SetPoint.exe () C:\Program Files (x86)\NETGEAR\WG311T\wlancfg5.exe (IOI) C:\Program Files (x86)\Gateway Photo Frame\ButtonMonitor.exe (Creative) C:\Windows\CNYHKey.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe () C:\Program Files (x86)\REDRAGON GAMING MOUSE\PDMon.exe (CANON INC.) C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe () C:\Windows\mHotkey.exe (Chicony) C:\Windows\ModLEDKey.exe () C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe (Chicony) C:\Windows\ChiFuncExt.exe (Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe (ThreatTrack Security, Inc.) C:\Program Files (x86)\VIPRE\SBAMSvc.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7574048 2009-03-30] (Realtek Semiconductor) HKLM\...\Run: [skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-03-30] (Realtek Semiconductor Corp.) HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => C:\Windows\KHALMNPR.EXE [134160 2007-09-21] (Logitech, Inc.) HKLM\...\Run: [bluetooth Connection Assistant] => LBTWIZ.EXE -silent HKLM\...\Run: [sBRegRebootCleaner] => "C:\Program Files (x86)\Sunbelt Software\VIPRE\SBRC.exe" HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [10396440 2014-04-14] (Logitech Inc.) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403288 2014-08-08] (NVIDIA Corporation) HKLM-x32\...\Run: [Gateway Photo Frame] => C:\Program Files (x86)\Gateway Photo Frame\ButtonMonitor.exe [123904 2009-05-05] (IOI) HKLM-x32\...\Run: [LchDrvKey] => C:\Windows\LchDrvKey.exe [36864 2007-03-28] () HKLM-x32\...\Run: [LedKey] => C:\Windows\CNYHKey.exe [339968 2008-04-23] (Creative) HKLM-x32\...\Run: [AppleSyncNotifier] => C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [58656 2011-04-20] (Apple Inc.) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [sBAMTray] => C:\Program Files (x86)\VIPRE\SBAMTray.exe [3216272 2013-09-05] (ThreatTrack Security, Inc.) HKLM-x32\...\Run: [PerditiongmmouseRun] => C:\Program Files (x86)\REDRAGON GAMING MOUSE\pdmon.exe [3234304 2013-11-18] () HKLM-x32\...\Run: [iJNetworkScanUtility] => C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE [124256 2010-01-18] (CANON INC.) HKU\S-1-5-21-2426545472-3215525461-1865147296-1000\...\Run: [Medialink Utilty] => C:\Program Files (x86)\Medialink\MWN-USB150N\UI.exe [2281488 2009-08-21] () Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk ShortcutTarget: Logitech SetPoint.lnk -> C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WG311T Smart Wizard.lnk ShortcutTarget: NETGEAR WG311T Smart Wizard.lnk -> C:\Program Files (x86)\NETGEAR\WG311T\wlancfg5.exe () Startup: C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip () ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=0609&m=dx4300 HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=0609&m=dx4300 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=0609&m=dx4300 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=0609&m=dx4300 URLSearchHook: HKCU - (No Name) - {472734EA-242A-422b-ADF8-83D1E48CC825} - No File StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACGW SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACGW_enUS342 SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACGW_enUS342 SearchScopes: HKCU - {88FB16D2-04EA-4ffe-8079-CFF68F1B9CE6} URL = http://www.search-results.com/web?q={searchTerms}&o=15868&l=dis&prt=BDIE&chn=retail&geo=US&ver=3.0.0.1 SearchScopes: HKCU - {9FECCCE0-B67A-4589-9425-CE9E3D884DD6} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000031&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=TV&apn_dtid=OSJ000YYUS&apn_uid=9AD45D53-4373-427B-BA50-30FE178C2C6A&apn_sauid=553B8402-7ECC-433D-B725-2B6AA9638D1D& BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: VIPRE Search Guard Helper -> {963C8283-AE7F-4AA6-9B3B-847A8FC62C5E} -> C:\Program Files (x86)\VIPRE\VSG.dll () BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKLM-x32 - VIPRE Search Guard Toolbar - {A924C17A-5E94-4E02-BED5-49720BA6F7FA} - C:\Program Files (x86)\VIPRE\VSG.dll () Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKCU - No Name - {472734EA-242A-422B-ADF8-83D1E48CC825} - No File Handler: vipresg - {47BE2E5B-703B-444F-ABD3-05717D2191C6} - No File Handler-x32: vipresg - {47BE2E5B-703B-444F-ABD3-05717D2191C6} - C:\Program Files (x86)\VIPRE\VSG.dll () Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_35 -> C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.) FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @zylom.com/ZylomGamesPlayer -> C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-26] FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-07-04] FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 Chrome: ======= ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed] R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720792 2014-08-08] (NVIDIA Corporation) R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed] U2 SBAMSvc; C:\Program Files (x86)\VIPRE\SBAMSvc.exe [3937472 2013-09-05] (ThreatTrack Security, Inc.) R2 SBPIMSvc; C:\Program Files (x86)\VIPRE\SBPIMSvc.exe [176016 2013-09-05] (ThreatTrack Security, Inc.) R2 yksvc; C:\Windows\System32\ykx64mpcoinst.dll [382464 2009-01-08] (Marvell) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2008-01-20] (Microsoft Corporation) S1 Beep; No ImagePath S3 gfiutil; C:\Windows\System32\drivers\gfiutil.sys [31264 2013-09-04] (ThreatTrack Security) S3 GKUPRO2D; C:\Windows\System32\Drivers\GKUPRO2D.sys [120704 2005-02-18] (Gemplus) S3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [64280 2013-05-30] (Logitech Inc.) S3 LGSUsbFilt; C:\Windows\System32\DRIVERS\LGSUsbFilt.Sys [41752 2013-05-30] (Logitech Inc.) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-08-29] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\SysWOW64\drivers\MBAMSwissArmy.sys [38224 2009-12-30] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation) R2 sbapifs; C:\Windows\System32\DRIVERS\sbapifs.sys [88928 2013-06-18] (ThreatTrack Security, Inc.) S3 USBCCID; C:\Windows\System32\DRIVERS\usbccid.sys [38400 2008-01-20] (Microsoft Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] S1 SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-29 17:49 - 2014-08-29 17:50 - 00015834 _____ () C:\Users\Molly\Desktop\FRST.txt 2014-08-29 17:49 - 2014-08-29 17:50 - 00000000 ____D () C:\FRST 2014-08-29 17:49 - 2014-08-29 17:49 - 02103808 _____ (Farbar) C:\Users\Molly\Desktop\FRST64.exe 2014-08-29 17:40 - 2014-08-29 17:44 - 00000000 ____D () C:\AdwCleaner 2014-08-29 17:29 - 2014-08-29 17:40 - 00001074 _____ () C:\Users\Molly\Desktop\MalwareBytesResults.txt 2014-08-29 17:26 - 2014-08-29 17:26 - 00016342 _____ () C:\ComboFix.txt 2014-08-29 16:41 - 2011-06-26 01:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-08-29 16:41 - 2010-11-07 12:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-08-29 16:41 - 2009-04-19 23:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-08-29 16:41 - 2000-08-30 19:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-08-29 16:41 - 2000-08-30 19:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-08-29 16:41 - 2000-08-30 19:00 - 00098816 _____ () C:\Windows\sed.exe 2014-08-29 16:41 - 2000-08-30 19:00 - 00080412 _____ () C:\Windows\grep.exe 2014-08-29 16:41 - 2000-08-30 19:00 - 00068096 _____ () C:\Windows\zip.exe 2014-08-29 16:24 - 2014-08-29 16:30 - 00001684 _____ () C:\Users\Molly\Desktop\Rkill.txt 2014-08-29 16:24 - 2014-08-29 16:24 - 01063160 _____ (Bleeping Computer, LLC) C:\Users\Molly\Desktop\rkill64.exe 2014-08-29 16:23 - 2014-08-29 16:23 - 01944824 _____ (Bleeping Computer, LLC) C:\Users\Molly\Desktop\rkill.exe 2014-08-29 16:20 - 2014-08-29 16:20 - 01364531 _____ () C:\Users\Molly\Desktop\adwcleaner_3.308.exe 2014-08-29 16:14 - 2014-08-29 16:14 - 00000000 _____ () C:\Users\Molly\Desktop\RogueKillerX64_exe.05nas1h.partial 2014-08-29 15:48 - 2014-08-29 15:48 - 00001190 _____ () C:\Windows\SysWOW64\ServiceConfig.xml 2014-08-29 08:35 - 2014-08-29 08:36 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Ventrilo 2014-08-29 08:35 - 2014-08-29 08:35 - 00000754 _____ () C:\Users\Test\Desktop\Ventrilo.lnk 2014-08-29 08:35 - 2014-08-29 08:35 - 00000262 _____ () C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini 2014-08-29 08:35 - 2014-08-29 08:35 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ventrilo 2014-08-29 08:35 - 2014-08-29 08:35 - 00000000 ____D () C:\Program Files\Ventrilo 2014-08-29 08:33 - 2014-08-29 08:34 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Curse Advertising 2014-08-29 08:32 - 2014-08-29 15:11 - 00000000 ____D () C:\Users\Test\AppData\Local\Deployment 2014-08-29 08:32 - 2014-08-29 08:32 - 00000318 _____ () C:\Users\Test\Desktop\Curse Client.appref-ms 2014-08-29 08:32 - 2014-08-29 08:32 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Curse 2014-08-29 08:32 - 2014-08-29 08:32 - 00000000 ____D () C:\Users\Test\AppData\Local\Apps\2.0 2014-08-29 06:50 - 2014-08-29 06:50 - 00001846 _____ () C:\Users\Public\Desktop\Canon IJ Network Tool.lnk 2014-08-29 06:50 - 2014-08-29 06:50 - 00000000 ___HD () C:\ProgramData\CanonBJ 2014-08-29 06:50 - 2014-08-29 06:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon IJ Network Utilities 2014-08-29 06:49 - 2014-08-29 06:49 - 00000000 ___HD () C:\Windows\system32\CanonIJ Uninstaller Information 2014-08-29 06:49 - 2014-08-29 06:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP970 series 2014-08-29 06:48 - 2014-08-29 06:48 - 00000000 ___HD () C:\Program Files\CanonBJ 2014-08-29 06:48 - 2007-07-11 08:55 - 00261120 _____ (CANON INC.) C:\Windows\system32\CNC970L.DLL 2014-08-29 06:48 - 2007-05-22 05:00 - 00258560 _____ (CANON INC.) C:\Windows\system32\CNMLM91.DLL 2014-08-29 06:48 - 2007-04-17 09:10 - 01440256 _____ (CANON INC.) C:\Windows\system32\CNC970C.DLL 2014-08-29 06:48 - 2007-04-17 09:09 - 00092672 _____ (CANON INC.) C:\Windows\system32\CNC970I.DLL 2014-08-29 06:48 - 2007-03-15 14:13 - 00229888 _____ (Canon Inc.) C:\Windows\system32\CNC970O.DLL 2014-08-29 06:47 - 2014-08-29 06:50 - 00000000 ____D () C:\Program Files (x86)\Canon 2014-08-29 06:47 - 2012-08-30 11:18 - 00252416 _____ (CANON INC.) C:\Windows\system32\CNMN6PPM.DLL 2014-08-29 06:47 - 2012-08-30 11:18 - 00152064 _____ (CANON INC.) C:\Windows\system32\CNMN6UI.DLL 2014-08-29 06:47 - 2012-08-30 11:15 - 00366080 _____ (CANON INC.) C:\Windows\SysWOW64\CNMNPPM.DLL 2014-08-29 06:47 - 2007-03-20 00:14 - 00117850 _____ () C:\Windows\system32\Cnmnput.chm 2014-08-28 22:46 - 2014-08-28 22:46 - 00001077 _____ () C:\Users\Public\Desktop\World of Warcraft.lnk 2014-08-28 22:46 - 2014-08-28 22:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft 2014-08-28 22:44 - 2014-08-29 15:28 - 00000000 ____D () C:\Users\Test\AppData\Local\Battle.net 2014-08-28 22:44 - 2014-08-28 22:45 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Battle.net 2014-08-28 22:44 - 2014-08-28 22:44 - 00000985 _____ () C:\Users\Public\Desktop\Battle.net.lnk 2014-08-28 22:44 - 2014-08-28 22:44 - 00000000 ____D () C:\Users\Test\AppData\Roaming\NVIDIA 2014-08-28 22:44 - 2014-08-28 22:44 - 00000000 ____D () C:\Users\Test\AppData\Local\Blizzard Entertainment 2014-08-28 22:44 - 2014-08-28 22:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net 2014-08-28 22:44 - 2014-08-28 22:44 - 00000000 ____D () C:\Program Files (x86)\Battle.net 2014-08-28 22:38 - 2014-08-28 22:38 - 02942368 _____ (Blizzard Entertainment) C:\Users\Test\Downloads\World-of-Warcraft-Setup-enUS.exe 2014-08-28 22:35 - 2014-08-29 06:45 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Google 2014-08-28 22:35 - 2014-08-28 22:35 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Adobe 2014-08-28 22:35 - 2014-08-28 22:35 - 00000000 ____D () C:\Users\Test\AppData\Local\Google 2014-08-28 22:34 - 2014-08-28 22:34 - 00000000 ____D () C:\Users\Test\AppData\Roaming\deb27c1a-00e6-4263-94b2-8b78ea4d32ae 2014-08-28 22:31 - 2014-08-28 22:31 - 00071928 _____ () C:\Users\Test\AppData\Local\GDIPFONTCACHEV1.DAT 2014-08-28 22:31 - 2014-08-28 22:31 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Logitech 2014-08-28 22:31 - 2014-08-28 22:31 - 00000000 ____D () C:\Users\Test\AppData\Local\Logitech 2014-08-28 22:31 - 2014-08-28 22:31 - 00000000 ____D () C:\Users\Test\AppData\Local\IOI 2014-08-28 22:31 - 2014-08-28 22:31 - 00000000 ____D () C:\Users\Test\AppData\Local\Apple Computer 2014-08-28 22:30 - 2014-08-28 22:31 - 00000000 ____D () C:\Users\Test\Documents\Gaming Mouse Perdition 2014-08-28 22:30 - 2014-08-28 22:30 - 00000981 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-08-28 22:30 - 2014-08-28 22:30 - 00000976 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2014-08-28 22:30 - 2014-08-28 22:30 - 00000951 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk 2014-08-28 22:30 - 2014-08-28 22:30 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Macromedia 2014-08-28 22:30 - 2014-08-28 22:30 - 00000000 ____D () C:\Users\Test\AppData\Local\NVIDIA 2014-08-28 22:29 - 2014-08-29 06:49 - 00000000 ____D () C:\Users\Test 2014-08-28 22:29 - 2014-08-28 22:31 - 00000000 ____D () C:\Users\Test\AppData\Roaming\VIPRE 2014-08-28 22:29 - 2014-08-28 22:30 - 00000917 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk 2014-08-28 22:29 - 2014-08-28 22:29 - 00000020 ___SH () C:\Users\Test\ntuser.ini 2014-08-28 22:29 - 2009-09-09 03:02 - 00000000 ____D () C:\Users\Test\AppData\Local\Microsoft Help 2014-08-28 22:29 - 2009-06-13 13:54 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink Power2Go 2014-08-28 22:29 - 2008-01-20 22:20 - 00000000 ___RD () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2014-08-28 22:29 - 2008-01-20 22:20 - 00000000 ___RD () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2014-08-28 21:05 - 2014-08-29 17:26 - 00000000 ____D () C:\Qoobox 2014-08-28 21:05 - 2014-08-29 17:25 - 00000000 ____D () C:\Windows\erdnt 2014-08-28 20:35 - 2014-08-29 16:40 - 05576760 ____R (Swearware) C:\Users\Molly\Desktop\ComboFix.exe 2014-08-28 20:32 - 2014-08-28 20:32 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Molly\Desktop\tdsskiller.exe 2014-08-28 15:42 - 2014-08-29 17:46 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-28 15:40 - 2014-08-28 15:40 - 00000943 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2014-08-28 15:40 - 2014-08-28 15:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2014-08-28 15:40 - 2014-08-28 15:40 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2014-08-28 15:40 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-08-28 15:40 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-08-28 15:38 - 2014-08-28 15:39 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Molly\Downloads\mbam-setup-2.0.2.1012.exe 2014-08-28 15:29 - 2014-08-28 15:29 - 00000000 _____ () C:\Windows\setuperr.log 2014-08-28 15:29 - 2014-08-28 15:29 - 00000000 _____ () C:\Windows\setupact.log 2014-08-28 12:36 - 2014-08-28 12:36 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies 2014-08-28 12:30 - 2014-07-02 05:14 - 03826628 _____ () C:\Windows\system32\nvcoproc.bin 2014-08-28 12:16 - 2014-08-11 15:31 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys 2014-08-28 12:16 - 2014-08-11 15:31 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll 2014-08-28 12:16 - 2014-07-02 15:48 - 31512520 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll 2014-08-28 12:16 - 2014-07-02 15:48 - 24196896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll 2014-08-28 12:16 - 2014-07-02 15:48 - 22994208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll 2014-08-28 12:16 - 2014-07-02 15:48 - 18626304 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll 2014-08-28 12:16 - 2014-07-02 15:48 - 16122344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll 2014-08-28 12:16 - 2014-07-02 15:48 - 15294296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll 2014-08-28 12:16 - 2014-07-02 15:48 - 13922752 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll 2014-08-28 12:16 - 2014-07-02 15:48 - 13835208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll 2014-08-28 12:16 - 2014-07-02 15:48 - 12866008 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys 2014-08-28 12:16 - 2014-07-02 15:48 - 11283344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll 2014-08-28 12:16 - 2014-07-02 15:48 - 11222048 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll 2014-08-28 12:16 - 2014-07-02 15:48 - 04247000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll 2014-08-28 12:16 - 2014-07-02 15:48 - 03989960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll 2014-08-28 12:16 - 2014-07-02 15:48 - 02814656 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll 2014-08-28 12:16 - 2014-07-02 15:48 - 01890080 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434052.dll 2014-08-28 12:16 - 2014-07-02 15:48 - 01539928 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434052.dll 2014-08-28 12:16 - 2014-07-02 15:48 - 00391640 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll 2014-08-28 12:16 - 2014-07-02 15:48 - 00348120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll 2014-08-28 12:16 - 2014-07-02 15:48 - 00026353 _____ () C:\Windows\system32\nvinfo.pb 2014-08-28 10:49 - 2014-08-28 12:06 - 00000000 ____D () C:\Users\Molly\AppData\Local\NVIDIA 2014-08-28 08:44 - 2014-08-22 20:05 - 00304128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-08-28 08:44 - 2014-08-22 19:42 - 00390144 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-28 08:44 - 2014-08-22 18:38 - 02782208 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-23 23:07 - 2014-08-23 23:07 - 00000027 _____ () C:\Users\Molly\Documents\wow email.txt 2014-08-23 09:26 - 2014-08-23 09:27 - 49274981 _____ () C:\Users\Molly\Downloads\simc-548-8-win64.zip 2014-08-19 11:19 - 2014-08-19 12:07 - 00000000 ____D () C:\Users\Molly\Documents\StarCraft II 2014-08-16 03:04 - 2014-06-26 17:17 - 01389200 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe 2014-08-16 03:04 - 2014-06-26 17:17 - 00619664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe 2014-08-16 03:04 - 2014-06-26 17:17 - 00171152 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll 2014-08-16 03:04 - 2014-06-26 17:17 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll 2014-08-16 03:04 - 2014-06-26 17:17 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll 2014-08-16 03:04 - 2014-06-26 17:17 - 00008848 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll 2014-08-16 03:03 - 2014-06-05 23:29 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe 2014-08-16 03:03 - 2014-06-05 23:28 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe 2014-08-15 06:49 - 2014-06-13 19:56 - 00901568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2014-08-15 06:49 - 2014-06-13 19:51 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll 2014-08-15 06:48 - 2014-07-24 14:28 - 17861120 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-08-15 06:48 - 2014-07-24 14:12 - 02339328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-08-15 06:48 - 2014-07-24 14:10 - 10920960 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-08-15 06:48 - 2014-07-24 14:07 - 01384960 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-08-15 06:48 - 2014-07-24 14:06 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-08-15 06:48 - 2014-07-24 14:05 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-08-15 06:48 - 2014-07-24 14:05 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-08-15 06:48 - 2014-07-24 14:05 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-08-15 06:48 - 2014-07-24 14:04 - 02155520 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-08-15 06:48 - 2014-07-24 14:04 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-08-15 06:48 - 2014-07-24 14:04 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-08-15 06:48 - 2014-07-24 14:04 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-08-15 06:48 - 2014-07-24 14:04 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-08-15 06:48 - 2014-07-24 14:04 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-08-15 06:48 - 2014-07-24 14:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-08-15 06:48 - 2014-07-24 14:03 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-08-15 06:48 - 2014-07-24 14:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-08-15 06:48 - 2014-07-24 14:03 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2014-08-15 06:48 - 2014-07-24 14:03 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2014-08-15 06:48 - 2014-07-24 14:03 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2014-08-15 06:48 - 2014-07-24 14:02 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-08-15 06:48 - 2014-07-24 13:07 - 12356608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-08-15 06:48 - 2014-07-24 12:58 - 01810432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-08-15 06:48 - 2014-07-24 12:57 - 09739264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-08-15 06:48 - 2014-07-24 12:52 - 01137664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-08-15 06:48 - 2014-07-24 12:51 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-08-15 06:48 - 2014-07-24 12:51 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-08-15 06:48 - 2014-07-24 12:50 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2014-08-15 06:48 - 2014-07-24 12:50 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-08-15 06:48 - 2014-07-24 12:49 - 01802240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-08-15 06:48 - 2014-07-24 12:49 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2014-08-15 06:48 - 2014-07-24 12:49 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-08-15 06:48 - 2014-07-24 12:49 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-08-15 06:48 - 2014-07-24 12:49 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-08-15 06:48 - 2014-07-24 12:48 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-08-15 06:48 - 2014-07-24 12:48 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-08-15 06:48 - 2014-07-24 12:48 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-08-15 06:48 - 2014-07-24 12:48 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-08-15 06:48 - 2014-07-24 12:48 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2014-08-15 06:48 - 2014-07-24 12:48 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe 2014-08-15 06:48 - 2014-07-24 12:48 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe 2014-08-15 06:48 - 2014-07-24 12:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-08-15 06:47 - 2014-07-07 20:12 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-08-15 06:47 - 2014-07-07 19:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-08-15 06:47 - 2014-06-02 16:30 - 03137536 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2014-08-15 06:47 - 2014-06-02 16:30 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll 2014-08-15 06:47 - 2014-06-02 16:29 - 02280448 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2014-08-15 06:47 - 2014-06-02 16:29 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll 2014-08-15 06:47 - 2014-06-02 15:29 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe 2014-08-15 06:47 - 2014-06-02 05:31 - 02263552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll 2014-08-15 06:47 - 2014-06-02 05:31 - 00332800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll 2014-08-15 06:47 - 2014-06-02 05:30 - 01993728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2014-08-05 13:21 - 2014-08-05 13:22 - 00000000 ____D () C:\Users\Molly\Documents\Gaming Mouse Perdition 2014-08-05 13:20 - 2014-08-05 13:20 - 00000920 _____ () C:\Users\Public\Desktop\REDRAGON GAMING MOUSE.lnk 2014-08-05 13:20 - 2014-08-05 13:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\REDRAGON GAMING MOUSE 2014-08-05 13:20 - 2014-08-05 13:20 - 00000000 ____D () C:\Program Files (x86)\REDRAGON GAMING MOUSE 2014-08-01 18:37 - 2014-08-01 18:37 - 00003962 _____ () C:\Windows\System32\Tasks\{EDAF20EA-6C7C-C72C-65D7-A44828B615BB} 2014-08-01 18:37 - 2014-08-01 18:37 - 00000000 _____ () C:\Windows\system32\oxwvet.dll 2014-07-31 08:18 - 2014-07-31 08:18 - 00000373 _____ () C:\Users\Molly\Documents - Shortcut.lnk ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-29 17:50 - 2014-08-29 17:49 - 00015834 _____ () C:\Users\Molly\Desktop\FRST.txt 2014-08-29 17:50 - 2014-08-29 17:49 - 00000000 ____D () C:\FRST 2014-08-29 17:49 - 2014-08-29 17:49 - 02103808 _____ (Farbar) C:\Users\Molly\Desktop\FRST64.exe 2014-08-29 17:46 - 2014-08-28 15:42 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-29 17:46 - 2010-02-04 22:00 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-08-29 17:46 - 2008-01-20 22:26 - 01155928 _____ () C:\Windows\PFRO.log 2014-08-29 17:46 - 2006-11-02 10:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-08-29 17:46 - 2006-11-02 10:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2014-08-29 17:46 - 2006-11-02 10:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2014-08-29 17:44 - 2014-08-29 17:40 - 00000000 ____D () C:\AdwCleaner 2014-08-29 17:44 - 2011-10-08 23:04 - 00000012 _____ () C:\Windows\bthservsdp.dat 2014-08-29 17:44 - 2009-06-13 13:37 - 01939062 _____ () C:\Windows\WindowsUpdate.log 2014-08-29 17:44 - 2006-11-02 10:42 - 00032574 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-08-29 17:40 - 2014-08-29 17:29 - 00001074 _____ () C:\Users\Molly\Desktop\MalwareBytesResults.txt 2014-08-29 17:27 - 2010-02-04 22:00 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-08-29 17:26 - 2014-08-29 17:26 - 00016342 _____ () C:\ComboFix.txt 2014-08-29 17:26 - 2014-08-28 21:05 - 00000000 ____D () C:\Qoobox 2014-08-29 17:26 - 2006-11-02 08:33 - 00000000 __RHD () C:\Users\Default 2014-08-29 17:25 - 2014-08-28 21:05 - 00000000 ____D () C:\Windows\erdnt 2014-08-29 17:24 - 2006-11-02 07:34 - 00000215 _____ () C:\Windows\system.ini 2014-08-29 16:40 - 2014-08-28 20:35 - 05576760 ____R (Swearware) C:\Users\Molly\Desktop\ComboFix.exe 2014-08-29 16:30 - 2014-08-29 16:24 - 00001684 _____ () C:\Users\Molly\Desktop\Rkill.txt 2014-08-29 16:24 - 2014-08-29 16:24 - 01063160 _____ (Bleeping Computer, LLC) C:\Users\Molly\Desktop\rkill64.exe 2014-08-29 16:23 - 2014-08-29 16:23 - 01944824 _____ (Bleeping Computer, LLC) C:\Users\Molly\Desktop\rkill.exe 2014-08-29 16:20 - 2014-08-29 16:20 - 01364531 _____ () C:\Users\Molly\Desktop\adwcleaner_3.308.exe 2014-08-29 16:14 - 2014-08-29 16:14 - 00000000 _____ () C:\Users\Molly\Desktop\RogueKillerX64_exe.05nas1h.partial 2014-08-29 15:48 - 2014-08-29 15:48 - 00001190 _____ () C:\Windows\SysWOW64\ServiceConfig.xml 2014-08-29 15:28 - 2014-08-28 22:44 - 00000000 ____D () C:\Users\Test\AppData\Local\Battle.net 2014-08-29 15:11 - 2014-08-29 08:32 - 00000000 ____D () C:\Users\Test\AppData\Local\Deployment 2014-08-29 09:53 - 2009-08-24 19:43 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft 2014-08-29 08:36 - 2014-08-29 08:35 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Ventrilo 2014-08-29 08:35 - 2014-08-29 08:35 - 00000754 _____ () C:\Users\Test\Desktop\Ventrilo.lnk 2014-08-29 08:35 - 2014-08-29 08:35 - 00000262 _____ () C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini 2014-08-29 08:35 - 2014-08-29 08:35 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ventrilo 2014-08-29 08:35 - 2014-08-29 08:35 - 00000000 ____D () C:\Program Files\Ventrilo 2014-08-29 08:34 - 2014-08-29 08:33 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Curse Advertising 2014-08-29 08:32 - 2014-08-29 08:32 - 00000318 _____ () C:\Users\Test\Desktop\Curse Client.appref-ms 2014-08-29 08:32 - 2014-08-29 08:32 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Curse 2014-08-29 08:32 - 2014-08-29 08:32 - 00000000 ____D () C:\Users\Test\AppData\Local\Apps\2.0 2014-08-29 06:50 - 2014-08-29 06:50 - 00001846 _____ () C:\Users\Public\Desktop\Canon IJ Network Tool.lnk 2014-08-29 06:50 - 2014-08-29 06:50 - 00000000 ___HD () C:\ProgramData\CanonBJ 2014-08-29 06:50 - 2014-08-29 06:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon IJ Network Utilities 2014-08-29 06:50 - 2014-08-29 06:47 - 00000000 ____D () C:\Program Files (x86)\Canon 2014-08-29 06:50 - 2006-11-02 08:33 - 00000000 __RSD () C:\Windows\Media 2014-08-29 06:49 - 2014-08-29 06:49 - 00000000 ___HD () C:\Windows\system32\CanonIJ Uninstaller Information 2014-08-29 06:49 - 2014-08-29 06:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP970 series 2014-08-29 06:49 - 2014-08-28 22:29 - 00000000 ____D () C:\Users\Test 2014-08-29 06:48 - 2014-08-29 06:48 - 00000000 ___HD () C:\Program Files\CanonBJ 2014-08-29 06:45 - 2014-08-28 22:35 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Google 2014-08-28 22:46 - 2014-08-28 22:46 - 00001077 _____ () C:\Users\Public\Desktop\World of Warcraft.lnk 2014-08-28 22:46 - 2014-08-28 22:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft 2014-08-28 22:45 - 2014-08-28 22:44 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Battle.net 2014-08-28 22:44 - 2014-08-28 22:44 - 00000985 _____ () C:\Users\Public\Desktop\Battle.net.lnk 2014-08-28 22:44 - 2014-08-28 22:44 - 00000000 ____D () C:\Users\Test\AppData\Roaming\NVIDIA 2014-08-28 22:44 - 2014-08-28 22:44 - 00000000 ____D () C:\Users\Test\AppData\Local\Blizzard Entertainment 2014-08-28 22:44 - 2014-08-28 22:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net 2014-08-28 22:44 - 2014-08-28 22:44 - 00000000 ____D () C:\Program Files (x86)\Battle.net 2014-08-28 22:38 - 2014-08-28 22:38 - 02942368 _____ (Blizzard Entertainment) C:\Users\Test\Downloads\World-of-Warcraft-Setup-enUS.exe 2014-08-28 22:35 - 2014-08-28 22:35 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Adobe 2014-08-28 22:35 - 2014-08-28 22:35 - 00000000 ____D () C:\Users\Test\AppData\Local\Google 2014-08-28 22:34 - 2014-08-28 22:34 - 00000000 ____D () C:\Users\Test\AppData\Roaming\deb27c1a-00e6-4263-94b2-8b78ea4d32ae 2014-08-28 22:34 - 2014-06-18 20:48 - 00000000 ____D () C:\ProgramData\VIPRE 2014-08-28 22:31 - 2014-08-28 22:31 - 00071928 _____ () C:\Users\Test\AppData\Local\GDIPFONTCACHEV1.DAT 2014-08-28 22:31 - 2014-08-28 22:31 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Logitech 2014-08-28 22:31 - 2014-08-28 22:31 - 00000000 ____D () C:\Users\Test\AppData\Local\Logitech 2014-08-28 22:31 - 2014-08-28 22:31 - 00000000 ____D () C:\Users\Test\AppData\Local\IOI 2014-08-28 22:31 - 2014-08-28 22:31 - 00000000 ____D () C:\Users\Test\AppData\Local\Apple Computer 2014-08-28 22:31 - 2014-08-28 22:30 - 00000000 ____D () C:\Users\Test\Documents\Gaming Mouse Perdition 2014-08-28 22:31 - 2014-08-28 22:29 - 00000000 ____D () C:\Users\Test\AppData\Roaming\VIPRE 2014-08-28 22:31 - 2010-08-01 18:23 - 00000000 ____D () C:\OEMSettings 2014-08-28 22:30 - 2014-08-28 22:30 - 00000981 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-08-28 22:30 - 2014-08-28 22:30 - 00000976 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2014-08-28 22:30 - 2014-08-28 22:30 - 00000951 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk 2014-08-28 22:30 - 2014-08-28 22:30 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Macromedia 2014-08-28 22:30 - 2014-08-28 22:30 - 00000000 ____D () C:\Users\Test\AppData\Local\NVIDIA 2014-08-28 22:30 - 2014-08-28 22:29 - 00000917 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk 2014-08-28 22:29 - 2014-08-28 22:29 - 00000020 ___SH () C:\Users\Test\ntuser.ini 2014-08-28 22:24 - 2006-11-02 08:33 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-08-28 21:44 - 2006-11-02 10:21 - 00306064 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-08-28 21:24 - 2014-05-04 18:17 - 00000000 ____D () C:\Windows\pss 2014-08-28 20:32 - 2014-08-28 20:32 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Molly\Desktop\tdsskiller.exe 2014-08-28 18:45 - 2012-10-05 07:35 - 00000000 ____D () C:\Users\Molly\AppData\Local\Deployment 2014-08-28 17:54 - 2009-08-24 19:38 - 00000000 ____D () C:\Users\Molly\AppData\Local\Google 2014-08-28 17:54 - 2009-08-24 19:24 - 00000000 ____D () C:\Program Files (x86)\Google 2014-08-28 15:40 - 2014-08-28 15:40 - 00000943 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2014-08-28 15:40 - 2014-08-28 15:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2014-08-28 15:40 - 2014-08-28 15:40 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2014-08-28 15:40 - 2010-01-01 09:24 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-08-28 15:39 - 2014-08-28 15:38 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Molly\Downloads\mbam-setup-2.0.2.1012.exe 2014-08-28 15:29 - 2014-08-28 15:29 - 00000000 _____ () C:\Windows\setuperr.log 2014-08-28 15:29 - 2014-08-28 15:29 - 00000000 _____ () C:\Windows\setupact.log 2014-08-28 14:29 - 2014-07-09 08:45 - 00000000 ____D () C:\Users\Molly\AppData\Local\Battle.net 2014-08-28 13:36 - 2012-12-06 08:16 - 00000000 ____D () C:\Windows\Minidump 2014-08-28 12:36 - 2014-08-28 12:36 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies 2014-08-28 12:36 - 2014-05-17 17:56 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation 2014-08-28 12:35 - 2009-08-24 19:24 - 00000000 ____D () C:\Users\Molly 2014-08-28 12:31 - 2014-05-17 17:56 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-08-28 12:31 - 2011-03-26 19:16 - 00000000 ____D () C:\Temp 2014-08-28 12:26 - 2014-05-17 17:51 - 00000000 ____D () C:\Program Files\NVIDIA Corporation 2014-08-28 12:06 - 2014-08-28 10:49 - 00000000 ____D () C:\Users\Molly\AppData\Local\NVIDIA 2014-08-28 12:04 - 2014-05-17 17:54 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation 2014-08-28 10:00 - 2012-12-06 01:57 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2014-08-28 08:55 - 2010-05-12 20:40 - 00000000 ____D () C:\Users\Molly\AppData\Local\Yahoo 2014-08-28 08:55 - 2010-05-12 20:39 - 00000000 ____D () C:\ProgramData\Yahoo! 2014-08-28 08:55 - 2010-05-12 20:37 - 00000000 ____D () C:\Program Files (x86)\Yahoo! 2014-08-28 08:53 - 2012-09-24 19:56 - 00000000 ____D () C:\ProgramData\Origin 2014-08-26 09:00 - 2010-07-04 21:58 - 00000000 ____D () C:\Users\Molly\AppData\Roaming\HpUpdate 2014-08-23 23:07 - 2014-08-23 23:07 - 00000027 _____ () C:\Users\Molly\Documents\wow email.txt 2014-08-23 09:27 - 2014-08-23 09:26 - 49274981 _____ () C:\Users\Molly\Downloads\simc-548-8-win64.zip 2014-08-22 20:05 - 2014-08-28 08:44 - 00304128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-08-22 19:42 - 2014-08-28 08:44 - 00390144 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-22 18:38 - 2014-08-28 08:44 - 02782208 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-19 12:07 - 2014-08-19 11:19 - 00000000 ____D () C:\Users\Molly\Documents\StarCraft II 2014-08-19 11:22 - 2009-08-25 06:58 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment 2014-08-16 04:31 - 2006-11-02 08:33 - 00000000 ____D () C:\Windows\rescache 2014-08-16 04:19 - 2006-11-02 07:46 - 00759582 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-08-16 03:51 - 2009-04-10 00:34 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-08-16 03:49 - 2013-08-15 03:04 - 00000000 ____D () C:\Windows\system32\MRT 2014-08-16 03:16 - 2006-11-02 07:35 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2014-08-11 15:31 - 2014-08-28 12:16 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys 2014-08-11 15:31 - 2014-08-28 12:16 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll 2014-08-11 15:31 - 2014-05-17 17:55 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll 2014-08-09 18:58 - 2010-05-31 18:38 - 00001356 _____ () C:\Users\Molly\AppData\Local\d3d9caps.dat 2014-08-05 13:22 - 2014-08-05 13:21 - 00000000 ____D () C:\Users\Molly\Documents\Gaming Mouse Perdition 2014-08-05 13:20 - 2014-08-05 13:20 - 00000920 _____ () C:\Users\Public\Desktop\REDRAGON GAMING MOUSE.lnk 2014-08-05 13:20 - 2014-08-05 13:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\REDRAGON GAMING MOUSE 2014-08-05 13:20 - 2014-08-05 13:20 - 00000000 ____D () C:\Program Files (x86)\REDRAGON GAMING MOUSE 2014-08-01 18:37 - 2014-08-01 18:37 - 00003962 _____ () C:\Windows\System32\Tasks\{EDAF20EA-6C7C-C72C-65D7-A44828B615BB} 2014-08-01 18:37 - 2014-08-01 18:37 - 00000000 _____ () C:\Windows\system32\oxwvet.dll 2014-07-31 08:18 - 2014-07-31 08:18 - 00000373 _____ () C:\Users\Molly\Documents - Shortcut.lnk Some content of TEMP: ==================== C:\Users\Molly\AppData\Local\temp\Quarantine.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-08-29 17:53 ==================== End Of Log ============================
  2. Here's the Malwarebytes Log: Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 8/29/2014 Scan Time: 5:29:00 PM Logfile: MalwareBytesResults.txt Administrator: Yes Version: 2.00.2.1012 Malware Database: v2014.08.29.07 Rootkit Database: v2014.08.21.01 License: Trial Malware Protection: Enabled Malicious Website Protection: Enabled Self-protection: Disabled OS: Windows Vista Service Pack 2 CPU: x64 File System: NTFS User: Molly Scan Type: Threat Scan Result: Completed Objects Scanned: 353839 Time Elapsed: 10 min, 36 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 0 (No malicious items detected) Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 0 (No malicious items detected) Physical Sectors: 0 (No malicious items detected) (end)
  3. Here's the ComboFix log: ComboFix 14-08-29.03 - Molly 08/29/2014 17:01:39.2.2 - x64 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.6142.4194 [GMT -5:00] Running from: c:\users\Molly\Desktop\ComboFix.exe AV: ThreatTrack Security VIPRE *Disabled/Updated* {FFE93D16-FD09-0282-C7D3-8B1731B6A051} SP: ThreatTrack Security VIPRE *Disabled/Updated* {4488DCF2-DB33-0D0C-FD63-B0654A31EAEC} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\uninstall.exe c:\users\Molly\AppData\Local\.# c:\windows\SysWow64\u c:\windows\wininit.ini . . CLSID={AB8902B4-09CA-4bb6-B78D-A8F59079A8D5} - infected with Poweliks and removed. You should verify if current CLSID data is correct: . HKEY_CLASSES_ROOT\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5} (Default) REG_SZ Thumbnail Cache Class Factory for Out of Proc Server AppID REG_SZ {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5} . HKEY_CLASSES_ROOT\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32 (Default) REG_SZ c:\windows\system32\thumbcache.dll ThreadingModel REG_SZ Apartment . . ((((((((((((((((((((((((( Files Created from 2014-07-28 to 2014-08-29 ))))))))))))))))))))))))))))))) . . 2014-08-29 22:18 . 2014-08-29 22:18 -------- d-----w- c:\users\Molly\AppData\Local\temp 2014-08-29 22:18 . 2014-08-29 22:18 -------- d-----w- c:\users\Default\AppData\Local\temp 2014-08-29 13:35 . 2014-08-29 13:35 -------- d-----w- c:\program files\Ventrilo 2014-08-29 13:34 . 2014-08-29 13:34 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard 2014-08-29 11:50 . 2014-08-29 11:50 -------- d--h--w- c:\programdata\CanonBJ 2014-08-29 03:44 . 2014-08-29 03:44 -------- d-----w- c:\program files (x86)\Battle.net 2014-08-29 03:29 . 2014-08-29 11:49 -------- d-----w- c:\users\Test 2014-08-28 20:42 . 2014-08-29 21:08 122584 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys 2014-08-28 20:40 . 2014-05-12 12:26 64216 ----a-w- c:\windows\system32\drivers\mwac.sys 2014-08-28 20:40 . 2014-05-12 12:26 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys 2014-08-28 20:40 . 2014-08-28 20:40 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware 2014-08-28 17:36 . 2014-08-28 17:36 -------- d-----w- c:\program files (x86)\AGEIA Technologies 2014-08-28 17:30 . 2014-07-02 10:14 3826628 ----a-w- c:\windows\system32\nvcoproc.bin 2014-08-28 15:49 . 2014-08-28 17:06 -------- d-----w- c:\users\Molly\AppData\Local\NVIDIA 2014-08-28 13:44 . 2014-08-23 01:05 304128 ----a-w- c:\windows\SysWow64\gdi32.dll 2014-08-28 13:44 . 2014-08-23 00:42 390144 ----a-w- c:\windows\system32\gdi32.dll 2014-08-28 13:44 . 2014-08-22 23:38 2782208 ----a-w- c:\windows\system32\win32k.sys 2014-08-16 08:04 . 2014-06-26 22:17 171152 ----a-w- c:\windows\system32\infocardapi.dll 2014-08-16 08:04 . 2014-06-26 22:17 99480 ----a-w- c:\windows\SysWow64\infocardapi.dll 2014-08-16 08:04 . 2014-06-26 22:17 8856 ----a-w- c:\windows\SysWow64\icardres.dll 2014-08-16 08:04 . 2014-06-26 22:17 8848 ----a-w- c:\windows\system32\icardres.dll 2014-08-16 08:04 . 2014-06-26 22:17 1389200 ----a-w- c:\windows\system32\icardagt.exe 2014-08-16 08:04 . 2014-06-26 22:17 619664 ----a-w- c:\windows\SysWow64\icardagt.exe 2014-08-16 08:03 . 2014-06-06 04:29 35480 ----a-w- c:\windows\system32\TsWpfWrp.exe 2014-08-16 08:03 . 2014-06-06 04:28 35480 ----a-w- c:\windows\SysWow64\TsWpfWrp.exe 2014-08-15 11:49 . 2014-06-14 00:56 901568 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys 2014-08-15 11:49 . 2014-06-14 00:51 47104 ----a-w- c:\windows\system32\cdd.dll 2014-08-15 11:47 . 2014-07-24 17:50 469504 ----a-w- c:\program files (x86)\Internet Explorer\ieinstal.exe 2014-08-15 11:47 . 2014-07-08 00:46 2048 ----a-w- c:\windows\SysWow64\tzres.dll 2014-08-15 11:47 . 2014-07-08 01:12 2048 ----a-w- c:\windows\system32\tzres.dll 2014-08-15 11:47 . 2014-06-02 21:30 3137536 ----a-w- c:\windows\system32\msi.dll 2014-08-15 11:47 . 2014-06-02 10:31 2263552 ----a-w- c:\windows\SysWow64\msi.dll 2014-08-15 11:47 . 2014-06-02 21:29 2280448 ----a-w- c:\windows\system32\authui.dll 2014-08-15 11:47 . 2014-06-02 10:30 1993728 ----a-w- c:\windows\SysWow64\authui.dll 2014-08-15 11:47 . 2014-06-02 20:29 87552 ----a-w- c:\windows\system32\consent.exe 2014-08-15 11:47 . 2014-06-02 21:30 503296 ----a-w- c:\windows\system32\msihnd.dll 2014-08-15 11:47 . 2014-06-02 21:29 45056 ----a-w- c:\windows\system32\appinfo.dll 2014-08-15 11:47 . 2014-06-02 10:31 332800 ----a-w- c:\windows\SysWow64\msihnd.dll 2014-08-05 18:20 . 2014-08-05 18:20 -------- d-----w- c:\program files (x86)\REDRAGON GAMING MOUSE 2014-08-01 23:37 . 2014-08-01 23:37 0 ----a-w- c:\windows\system32\oxwvet.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-08-28 22:12 . 2010-06-24 16:33 23256 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2014-08-16 08:16 . 2006-11-02 12:35 99218768 ----a-w- c:\windows\system32\mrt.exe 2014-08-11 20:31 . 2014-05-17 22:55 1515296 ----a-w- c:\windows\system32\nvhdagenco6420103.dll 2014-07-03 14:22 . 2014-07-03 14:21 18960 ----a-w- c:\windows\system32\drivers\LNonPnP.sys 2014-07-02 20:48 . 2014-05-17 22:54 75040 ----a-w- c:\windows\system32\OpenCL.dll 2014-07-02 20:48 . 2014-05-17 22:54 61912 ----a-w- c:\windows\SysWow64\OpenCL.dll 2014-07-02 20:48 . 2014-05-17 22:52 14498552 ----a-w- c:\windows\SysWow64\nvd3dum.dll 2014-07-02 20:48 . 2014-05-17 22:52 17555104 ----a-w- c:\windows\system32\nvd3dumx.dll 2014-07-02 20:48 . 2014-05-17 22:51 3196816 ----a-w- c:\windows\system32\nvapi64.dll 2014-07-02 18:55 . 2014-05-17 22:55 6783776 ----a-w- c:\windows\system32\nvcpl.dll 2014-07-02 18:55 . 2014-05-17 22:55 3522392 ----a-w- c:\windows\system32\nvsvc64.dll 2014-07-02 18:55 . 2014-05-17 22:55 935368 ----a-w- c:\windows\system32\nvvsvc.exe 2014-07-02 18:55 . 2014-05-17 22:55 62808 ----a-w- c:\windows\system32\nvshext.dll 2014-07-02 18:55 . 2014-05-17 22:55 386520 ----a-w- c:\windows\system32\nvmctray.dll 2014-06-06 08:59 . 2014-07-09 15:43 506880 ----a-w- c:\windows\SysWow64\qedit.dll 2014-06-06 07:13 . 2014-07-09 15:43 620032 ----a-w- c:\windows\system32\qedit.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Medialink Utilty"="c:\program files (x86)\Medialink\MWN-USB150N\UI.exe" [2009-08-21 2281488] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Gateway Photo Frame"="c:\program files (x86)\Gateway Photo Frame\ButtonMonitor.exe" [2009-05-05 123904] "LchDrvKey"="LchDrvKey.exe" [2007-03-29 36864] "LedKey"="CNYHKey.exe" [2008-04-24 339968] "AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656] "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208] "SBAMTray"="c:\program files (x86)\VIPRE\SBAMTray.exe" [2013-09-06 3216272] "PerditiongmmouseRun"="c:\program files (x86)\REDRAGON GAMING MOUSE\pdmon.exe" [2013-11-18 3234304] "IJNetworkScanUtility"="c:\program files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE" [2010-01-19 124256] . c:\users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ CurseClientStartup.ccip [2014-8-29 0] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-8-24 1148944] NETGEAR WG311T Smart Wizard.lnk - c:\program files (x86)\NETGEAR\WG311T\wlancfg5.exe /HIDE [2006-9-14 1503232] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBPIMSvc] @="Service" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc] @="Service" . --- Other Services/Drivers In Memory --- . *NewlyCreated* - GFIUTIL . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs Themes . Contents of the 'Scheduled Tasks' folder . 2014-08-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-05 03:00] . 2014-08-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-05 03:00] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Bluetooth Connection Assistant"="LBTWIZ.EXE -silent" [X] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-03-30 7574048] "Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-03-30 1833504] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 134160] "Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2014-04-15 10396440] "NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-08-09 2403288] . ------- Supplementary Scan ------- . uStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=0609&m=dx4300 uLocal Page = c:\windows\system32\blank.htm mStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=0609&m=dx4300 mDefault_Page_URL = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=0609&m=dx4300 mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.1.1 Handler: vipresg - {47BE2E5B-703B-444F-ABD3-05717D2191C6} - c:\program files (x86)\VIPRE\VSG.dll . - - - - ORPHANS REMOVED - - - - . Wow6432Node-HKLM-Run-<NO NAME> - (no file) SafeBoot-WudfPf SafeBoot-WudfRd HKLM-Run-SBRegRebootCleaner - c:\program files (x86)\Sunbelt Software\VIPRE\SBRC.exe HKLM-Run-Nvtmru - c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_206_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_206_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_206_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_206_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.13" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}] @Denied: (A 2) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0] @="Shockwave Flash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}] @Denied: (A 2) (Everyone) @="" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0] @="FlashBroker" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes] "SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\ . Completion time: 2014-08-29 17:26:30 ComboFix-quarantined-files.txt 2014-08-29 22:26 . Pre-Run: 478,184,337,408 bytes free Post-Run: 479,578,456,064 bytes free . - - End Of File - - 8E6CE460B2622FA95F1BCFFF3257F6B9 EF932EAA6EF4C94E66A7F6CEEC7EB422
  4. This can be considered resolved for now. I found it was a Poweliks infection and was able to remove it using the steps in a different users post.
  5. I have a PC that appears to be infected with something. Whenever using the internet numerous dllhost.exe processes start until CPU usage spikes at 100%. I have tried running virus scans (using Vipre antivirus) and also ran Malwarebytes normally and in safe mode several times, but the issue remains. I have been reading some of the other topics that sound like this issue as well that you've been able to help. I hope you're able to help me as well.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.