Jump to content

Search the Community

Showing results for tags 'Vosteran'.

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


Forums

  • Announcements
    • Malwarebytes News
    • Beta Testing Program
  • Malware Removal Help
    • Windows Malware Removal Help & Support
    • Mac Malware Removal Help & Support
    • Mobile Malware Removal Help & Support
    • Malware Removal Self-Help Guides
  • Malwarebytes for Home Support
    • Malwarebytes for Windows Support Forum
    • Malwarebytes for Mac Support Forum
    • Malwarebytes for Android Support Forum
    • Malwarebytes for iOS Support
    • Malwarebytes Privacy
    • Malwarebytes Browser Guard
    • False Positives
    • Comments and Suggestions
  • Malwarebytes for Business Support
    • Malwarebytes Endpoint Protection
    • Malwarebytes Incident Response (includes Breach Remediation)
    • Malwarebytes Endpoint Security
    • Malwarebytes Business Products Comments and Suggestions
  • Malwarebytes Tools and Other Products
    • Malwarebytes AdwCleaner
    • Malwarebytes Junkware Removal Tool Support
    • Malwarebytes Anti-Rootkit BETA Support
    • Malwarebytes Techbench USB (Legacy)
    • Malwarebytes Secure Backup discontinued
    • Other Tools
    • Malwarebytes Tools Comments and Suggestions
  • General Computer Help and Security Updates
    • BSOD, Crashes, Kernel Debugging
    • General Windows PC Help
  • Research Center
    • Newest Rogue-Ransomware Threats
    • Newest Malware Threats
    • Newest Mobile Threats
    • Newest IP or URL Threats
    • Newest Mac Threats
    • Report Scam Phone Numbers
  • General
    • General Chat
    • Forums Announcements & Feedback

Find results in...

Find results that contain...


Date Created

  • Start

    End


Last Updated

  • Start

    End


Filter by number of...

Joined

  • Start

    End


Group


AIM


MSN


Website URL


ICQ


Yahoo


Jabber


Location


Interests

Found 8 results

  1. I have quarantined this which feels like a dozen times, but it won't remove. What is the problem?
  2. Got vosteran recently, and followed prompts by malwarebytes to quarantine/delete it off my computer, cleaned up my browsers' extensions and such, and have run several scans afterwards and come up clean. Just wanted to see if there was any steps I missed? Here are the Farbar scan results: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-01-2015 01Ran by John (administrator) on JOHNMICHAELROA on 16-01-2015 17:22:27Running from C:\Users\John\DownloadsLoaded Profiles: John & (Available profiles: John)Platform: Windows Vista Home Premium Service Pack 2 (X64) OS Language: English (United States)Internet Explorer Version 9 (Default browser: Vosteran)Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe(Microsoft Corporation) C:\Windows\System32\SLsvc.exe(Microsoft Corporation) C:\Windows\System32\wlanext.exe(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe(Hewlett-Packard Company) C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe() C:\Windows\SysWOW64\UTSCSI.EXE(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE(Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio64.exe(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe(Intel Corporation) C:\Windows\System32\igfxtray.exe(Intel Corporation) C:\Windows\System32\hkcmd.exe(Intel Corporation) C:\Windows\System32\igfxsrvc.exe(Intel Corporation) C:\Windows\System32\igfxpers.exe(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe(Microsoft Corporation) C:\Windows\System32\mobsync.exe(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-20] (Microsoft Corporation)HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1234216 2008-03-28] (Synaptics, Inc.)HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3667472 2014-12-18] (AVG Technologies CZ, s.r.o.)HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-06] (Apple Inc.)HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54576 2009-11-18] (Hewlett-Packard)HKLM-x32\...\Run: [] => [X]HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-13] (Logitech Inc.)HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-06] (Apple Inc.)Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenterHKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenterHKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenterHKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenterHKU\S-1-5-21-78250143-3347497304-271033569-1000\...\Run: [Facebook Update] => C:\Users\John\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-11-10] (Facebook Inc.)HKU\S-1-5-21-78250143-3347497304-271033569-1000\...\Run: [AVG-Secure-Search-Update_1113a] => C:\Users\John\AppData\Roaming\AVG 1113a Campaign\AVG-Secure-Search-Update-1113a.exe /PROMPT /mid=219680c672ca47d38608d156503ec7b4-933cc99f44f4d08bd6c576e6e6fd5b4632e65d6d /CMPID=1113aHKU\S-1-5-21-78250143-3347497304-271033569-1000\...\Run: [WMPNSCFG] => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exeHKU\S-1-5-21-78250143-3347497304-271033569-1000\...\Run: [skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22066272 2014-10-01] (Skype Technologies S.A.)HKU\S-1-5-21-78250143-3347497304-271033569-1000\...\Run: [GoogleChromeAutoLaunch_3D5F645F54A4047679198B5962EEC18B] => "C:\Users\John\AppData\Local\Vosteran\Application\vosteran.exe" --auto-launch-at-startup --profile-directory="Default"HKU\S-1-5-21-78250143-3347497304-271033569-1000\...\MountPoints2: {f714490d-3be8-11e3-adaa-db4ac1cf14a8} - F:\Setup.exeHKU\S-1-5-21-78250143-3347497304-271033569-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Facebook Update] => C:\Users\John\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-11-10] (Facebook Inc.)HKU\S-1-5-21-78250143-3347497304-271033569-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [AVG-Secure-Search-Update_1113a] => C:\Users\John\AppData\Roaming\AVG 1113a Campaign\AVG-Secure-Search-Update-1113a.exe /PROMPT /mid=219680c672ca47d38608d156503ec7b4-933cc99f44f4d08bd6c576e6e6fd5b4632e65d6d /CMPID=1113aHKU\S-1-5-21-78250143-3347497304-271033569-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [WMPNSCFG] => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exeHKU\S-1-5-21-78250143-3347497304-271033569-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22066272 2014-10-01] (Skype Technologies S.A.)HKU\S-1-5-21-78250143-3347497304-271033569-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [GoogleChromeAutoLaunch_3D5F645F54A4047679198B5962EEC18B] => "C:\Users\John\AppData\Local\Vosteran\Application\vosteran.exe" --auto-launch-at-startup --profile-directory="Default"HKU\S-1-5-21-78250143-3347497304-271033569-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {f714490d-3be8-11e3-adaa-db4ac1cf14a8} - F:\Setup.exeAppInit_DLLs-x32: C:/PROGRA~3/{BC1A5~1/171~1.0/tene.dll => C:/PROGRA~3/{BC1A5~1/171~1.0/tene.dll [649216 2015-01-08] ()Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnkShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnkShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-78250143-3347497304-271033569-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/HKU\S-1-5-21-78250143-3347497304-271033569-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehpHKU\S-1-5-21-78250143-3347497304-271033569-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/HKU\S-1-5-21-78250143-3347497304-271033569-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehpStartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exeSearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_suma_15_02_ff&cd=2XzuyEtN2Y1L1QzutDtDtByEtB0Czz0DtBtCyE0AyBzzyE0DtN0D0Tzu0StCtCtDtAtN1L2XzutAtFyCtFtCyCtFyCtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEtB0C0EtDyB0F0EtGzzyEtA0AtGtC0D0F0BtGtByDzztAtGtD0FyC0D0EtC0D0C0DzytDyD2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0BtCyDyEyBtAyEtGtA0EyCzztGyEtAyEyDtGzy0A0CyDtGzzzytD0Azy0C0CyEtC0DyEyB2Q&cr=1476953371&ir=SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_suma_15_02_ff&cd=2XzuyEtN2Y1L1QzutDtDtByEtB0Czz0DtBtCyE0AyBzzyE0DtN0D0Tzu0StCtCtDtAtN1L2XzutAtFyCtFtCyCtFyCtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyEtB0C0EtDyB0F0EtGzzyEtA0AtGtC0D0F0BtGtByDzztAtGtD0FyC0D0EtC0D0C0DzytDyD2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0BtCyDyEyBtAyEtGtA0EyCzztGyEtAyEyDtGzy0A0CyDtGzzzytD0Azy0C0CyEtC0DyEyB2Q&cr=1476953371&ir=SearchScopes: HKU\S-1-5-21-78250143-3347497304-271033569-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-78250143-3347497304-271033569-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)Tcpip\Parameters: [DhcpNameServer] 104.131.237.53 107.170.245.37 75.75.75.75 FireFox:========FF ProfilePath: C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\6byffbla.defaultFF DefaultSearchEngine: GoogleFF SearchEngineOrder.3: Bing FF Homepage: hxxp://www.google.com/FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)FF Plugin HKU\S-1-5-21-78250143-3347497304-271033569-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\John\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)FF Plugin HKU\S-1-5-21-78250143-3347497304-271033569-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\John\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)FF SearchPlugin: C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\6byffbla.default\searchplugins\bingp.xmlFF Extension: WOT - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\6byffbla.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-10-17]FF Extension: Adblock Plus Pop-up Addon - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\6byffbla.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-10-17]FF Extension: Adblock Plus - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\6byffbla.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-10-17]FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtensionFF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2013-10-23]FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-11-07]FF HKU\S-1-5-21-78250143-3347497304-271033569-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3FF HKU\S-1-5-21-78250143-3347497304-271033569-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpiFF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]FF HKU\S-1-5-21-78250143-3347497304-271033569-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3FF HKU\S-1-5-21-78250143-3347497304-271033569-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi Chrome: =======CHR HomePage: Default -> https://www.google.com/CHR StartupUrls: Default -> "https://www.google.com/"CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}CHR Profile: C:\Users\John\AppData\Local\Google\Chrome\User Data\DefaultCHR Extension: (Google Docs) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-10-24]CHR Extension: (Google Drive) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-10-24]CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-26]CHR Extension: (YouTube) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-10-24]CHR Extension: (Google Search) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-10-24]CHR Extension: (AdBlock) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-01-16]CHR Extension: (Google Wallet) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-24]CHR Extension: (Gmail) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-10-24]CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - No Path ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3432976 2014-12-18] (AVG Technologies CZ, s.r.o.)R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [298080 2014-12-18] (AVG Technologies CZ, s.r.o.)R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [49464 2014-03-06] (Hewlett-Packard Company)S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2009-05-14] (Hewlett-Packard) [File not signed]R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2009-05-14] (Hewlett-Packard) [File not signed]R2 UTSCSI; C:\Windows\SysWOW64\UTSCSI.EXE [45056 2013-10-23] () [File not signed]S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [383544 2008-01-20] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 AM10; C:\Windows\System32\DRIVERS\am10va.sys [1020192 2010-02-13] (Ralink Technology Corp.)R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [260888 2014-12-08] (AVG Technologies CZ, s.r.o.)R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.)R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.)R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [313624 2014-07-18] (AVG Technologies CZ, s.r.o.)R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [124184 2014-10-05] (AVG Technologies CZ, s.r.o.)R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [274200 2014-10-10] (AVG Technologies CZ, s.r.o.)R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-16] (Malwarebytes Corporation)R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation)S3 PRESONUS_AUDIOBOX_MIDI; C:\Windows\System32\drivers\psabusbm.sys [37496 2009-12-04] (Ploytec GmbH)S3 PRESONUS_AUDIOBOX_USB; C:\Windows\System32\Drivers\psabusbu.sys [462968 2009-12-04] (Ploytec GmbH)S3 PRESONUS_AUDIOBOX_WDM; C:\Windows\System32\drivers\psabusba.sys [50808 2009-12-04] (Ploytec GmbH)S3 usbbus; C:\Windows\System32\DRIVERS\lgx64bus.sys [17920 2013-04-24] (LG Electronics Inc.)S3 UsbDiag; C:\Windows\System32\DRIVERS\lgx64diag.sys [28160 2013-04-24] (LG Electronics Inc.)S3 USBModem; C:\Windows\System32\DRIVERS\lgx64modem.sys [34816 2013-04-24] (LG Electronics Inc.)S3 IpInIp; system32\DRIVERS\ipinip.sys [X]S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]S3 RTL8192su; system32\DRIVERS\RTL8192su.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-16 17:22 - 2015-01-16 17:23 - 00022305 _____ () C:\Users\John\Downloads\FRST.txt2015-01-16 17:19 - 2015-01-16 17:22 - 00000000 ____D () C:\FRST2015-01-16 17:18 - 2015-01-16 17:18 - 02125312 _____ (Farbar) C:\Users\John\Desktop\FRST64.exe2015-01-16 11:34 - 2014-12-05 22:14 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll2015-01-16 11:34 - 2014-12-05 22:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll2015-01-16 11:34 - 2014-12-05 21:54 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll2015-01-16 11:34 - 2014-12-05 21:54 - 00178688 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll2015-01-16 11:34 - 2014-12-05 21:54 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll2015-01-14 22:35 - 2015-01-14 22:35 - 00000000 _____ () C:\autoexec.bat2015-01-14 21:28 - 2012-01-22 22:07 - 00018344 _____ () C:\Users\John\Downloads\gpl.txt2015-01-14 21:09 - 2015-01-14 21:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip2015-01-14 21:09 - 2015-01-14 21:09 - 00000000 ____D () C:\Program Files\7-Zip2015-01-14 21:06 - 2015-01-14 21:06 - 01513472 _____ () C:\Users\John\Downloads\7z938-x64.msi2015-01-14 21:02 - 2015-01-14 21:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox2015-01-08 22:07 - 2015-01-08 22:07 - 00000044 _____ () C:\Users\John\AppData\Roaming\WB.CFG2015-01-08 21:06 - 2015-01-08 21:06 - 00000000 ____D () C:\ProgramData\{BC1A54D9-EC98-855F-5D1E-F5DD8D9C2653}2014-12-26 18:14 - 2014-12-26 18:14 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-16 17:09 - 2014-09-07 19:54 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys2015-01-16 16:50 - 2013-10-24 09:30 - 00002025 _____ () C:\Users\Public\Desktop\Google Chrome.lnk2015-01-16 16:50 - 2013-10-24 09:27 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job2015-01-16 16:34 - 2006-11-02 10:22 - 00003760 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A02015-01-16 16:34 - 2006-11-02 10:22 - 00003760 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A02015-01-16 16:30 - 2013-11-10 22:25 - 00000924 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-78250143-3347497304-271033569-1000UA.job2015-01-16 15:50 - 2009-04-11 10:41 - 01260765 _____ () C:\Windows\WindowsUpdate.log2015-01-16 14:38 - 2013-10-24 09:24 - 00000000 ____D () C:\ProgramData\MFAData2015-01-16 14:36 - 2013-10-24 09:27 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job2015-01-16 14:34 - 2006-11-02 10:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2015-01-16 12:29 - 2006-11-02 10:42 - 00032552 _____ () C:\Windows\Tasks\SCHEDLGU.TXT2015-01-16 11:34 - 2013-10-23 14:13 - 00000000 ____D () C:\Windows\system32\MRT2015-01-16 11:25 - 2006-11-02 07:35 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe2015-01-14 23:34 - 2013-10-23 20:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service2015-01-14 23:34 - 2008-01-20 22:26 - 00781768 _____ () C:\Windows\PFRO.log2015-01-14 22:29 - 2013-11-10 22:24 - 00000902 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-78250143-3347497304-271033569-1000Core.job2015-01-14 21:44 - 2013-10-22 18:50 - 00000000 ____D () C:\Users\John2015-01-13 12:25 - 2014-01-15 18:09 - 00000000 ____D () C:\Users\John\Desktop\job stuff aka FML2015-01-13 12:23 - 2006-11-02 07:46 - 00762438 _____ () C:\Windows\system32\PerfStringBackup.INI2015-01-13 12:20 - 2013-11-19 15:48 - 00002637 _____ () C:\Users\John\Desktop\Microsoft Word 2010.lnk2015-01-13 12:19 - 2013-10-31 13:12 - 00000000 ____D () C:\Users\John\AppData\Roaming\Skype2015-01-13 08:19 - 2006-11-02 10:27 - 00043303 _____ () C:\Windows\setupact.log2015-01-11 20:18 - 2006-11-02 08:33 - 00000000 ____D () C:\Windows\PolicyDefinitions2015-01-09 12:37 - 2014-09-07 19:53 - 00000941 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk2015-01-09 12:37 - 2014-09-07 19:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware2015-01-09 12:37 - 2014-09-07 19:53 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware2015-01-09 12:30 - 2006-11-02 10:21 - 00406168 _____ () C:\Windows\system32\FNTCACHE.DAT2015-01-08 21:06 - 2013-10-23 20:04 - 00000888 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk2015-01-08 20:56 - 2014-10-19 20:52 - 00000872 _____ () C:\Users\Public\Desktop\AVG 2015.lnk2015-01-08 20:56 - 2014-04-09 16:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Some content of TEMP:====================C:\Users\John\AppData\Local\Temp\FP_AX_MSI_INSTALLER.exeC:\Users\John\AppData\Local\Temp\HSSB865.exeC:\Users\John\AppData\Local\Temp\ose00000.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\SysWOW64\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-16 14:48 ==================== End Of Log ============================ And the Addition report: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-01-2015 01Ran by John at 2015-01-16 17:24:04Running from C:\Users\John\DownloadsBoot Mode: Normal========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}AS: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) 64 Bit HP CIO Components Installer (Version: 6.2.2 - Hewlett-Packard) Hidden7500_7600_7700_Help1 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden7-Zip 9.38 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0938-000001000000}) (Version: 9.38.00.0 - Igor Pavlov)Adobe Flash Player 10 ActiveX (HKLM-x32\...\{B7B3E9B3-FB14-4927-894B-E9124509AF5A}) (Version: 10.0.32.18 - Adobe Systems, Inc.)Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)Adobe Reader X (10.1.9) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.9 - Adobe Systems Incorporated)Apple Application Support (HKLM-x32\...\{21FC2093-6E43-460B-B9B0-5F5AA35BBB0F}) (Version: 3.0 - Apple Inc.)Apple Mobile Device Support (HKLM\...\{FE86CB0C-FCB3-4358-B4B0-B0A41E33B3DD}) (Version: 7.1.0.32 - Apple Inc.)Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 5.2 - Atheros)AudioBox USB driver (HKLM\...\USB_AUDIO_DEusb-audio.depresonusAudioBoxUSB) (Version: - )AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5645 - AVG Technologies)AVG 2015 (Version: 15.0.4260 - AVG Technologies) HiddenAVG 2015 (Version: 15.0.5645 - AVG Technologies) HiddenBonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)bpd_scan_Carrier (x32 Version: 3.00.0000 - Hewlett-Packard) HiddenBPDSoftware (x32 Version: 140.0.000.000 - Hewlett-Packard) HiddenBPDSoftware_Ini (x32 Version: 1.00.0000 - Hewlett-Packard) HiddenBufferChm (x32 Version: 140.0.213.000 - Hewlett-Packard) HiddenCameraHelperMsi (x32 Version: 13.51.815.0 - Logitech) HiddenCessna Multimedia Version 6.0 (HKLM-x32\...\Cessna Multimedia Version 6.0) (Version: - King Schools, Inc.)Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.58.1.0 - Conexant)Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) HiddenDeviceDiscovery (x32 Version: 140.0.213.000 - Hewlett-Packard) HiddenDocProc (x32 Version: 140.0.100.000 - Hewlett-Packard) HiddenerLT (x32 Version: 1.20.138.34 - Logitech, Inc.) HiddenFacebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)Fax (x32 Version: 140.0.213.000 - Hewlett-Packard) HiddenGoogle Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.99 - Google Inc.)Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) HiddenGPBaseService2 (x32 Version: 140.0.212.000 - Hewlett-Packard) HiddenHDAUDIO Soft Data Fax Modem with SmartCP (HKLM\...\CNXT_MODEM_HDAUDIO_HERMOSA_HSF) (Version: - )HP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP)HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP)HP OfficeJet L7300/L7500/7600/7700 (HKLM\...\{9D6C64CC-EA60-47A6-9C97-82C38231EDAE}) (Version: 14.0 - HP)HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)HP Support Solutions Framework (HKLM-x32\...\{81E14A67-42ED-4DD0-AE08-366FE3D3102E}) (Version: 11.50.0012 - Hewlett-Packard Company)HP Update (HKLM-x32\...\{74DC0593-6BC6-4001-AD5F-D810AFB68D86}) (Version: 5.002.002.002 - Hewlett-Packard)HPProductAssistant (x32 Version: 140.0.213.000 - Hewlett-Packard) HiddenHPSSupply (x32 Version: 140.0.212.000 - Hewlett-Packard) HiddeniTunes (HKLM\...\{96B53CA8-5ABB-49D8-96F1-F6C0D73A76C6}) (Version: 11.1.4.62 - Apple Inc.)L7500 (x32 Version: 140.0.000.000 - Hewlett-Packard) HiddenLG United Mobile Driver (HKLM-x32\...\{2A3A4BD6-6CE0-4e2a-80D2-1D0FF6ACBFBA}) (Version: 3.10.1.0 - LG Electronics)Logitech Webcam Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.51 - Logitech Inc.)Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)MarketResearch (x32 Version: 140.0.214.000 - Hewlett-Packard) HiddenMcAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)Microsoft Office Standard 2010 (HKLM-x32\...\Office14.STANDARD) (Version: 14.0.7015.1000 - Microsoft Corporation)Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)Microsoft SQL Server Compact 3.5 SP1 English (HKLM-x32\...\{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}) (Version: 3.5.5692.0 - Microsoft Corporation)Microsoft SQL Server Compact 3.5 SP1 x64 English (HKLM\...\{F83779DF-E1F5-43A2-A7BE-732F856FADB7}) (Version: 3.5.5692.0 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Mozilla Firefox 35.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 35.0 (x86 en-US)) (Version: 35.0 - Mozilla)Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)MPM (HKLM-x32\...\{B5A4C902-1636-48DB-8E38-F0DB102DDB59}) (Version: 1.00.0000 - Hewlett-Packard)MSXML 4.0 SP2 (KB927978) (HKLM-x32\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)Network64 (Version: 140.0.215.000 - Hewlett-Packard) HiddenOCR Software by I.R.I.S. 14.0 (HKLM\...\HPOCR) (Version: 14.0 - HP)OEM Logo and Information (HKLM\...\OEMInformation) (Version: - Hewlett-Packard)OpenOffice 4.0.0 (HKLM-x32\...\{55E61709-D7D4-43C0-B45D-BFAF5C09A02D}) (Version: 4.00.9702 - Apache Software Foundation)PreSonus Studio One 2 (HKLM-x32\...\PreSonus Studio One 2) (Version: 2.6.2.25590 - PreSonus Audio Electronics)ProductContext (x32 Version: 140.0.000.000 - Hewlett-Packard) HiddenScan (x32 Version: 140.0.167.000 - Hewlett-Packard) HiddenService Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0012-0000-0000-0000000FF1CE}_Office14.STANDARD_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP)Skype™ 6.21 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.)SmartWebPrinting (x32 Version: 140.0.213.000 - Hewlett-Packard) HiddenSolutionCenter (x32 Version: 140.0.214.000 - Hewlett-Packard) HiddenStatus (x32 Version: 140.0.256.000 - Hewlett-Packard) HiddenSynaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 11.0.7.0 - Synaptics)ToolBook Neuron 9.5 (HKLM-x32\...\{782338D3-D262-4C96-B304-1AFAB42FAC2D}) (Version: 9.5.0.250 - SumTotal Systems, Inc.)Toolbox (x32 Version: 140.0.428.000 - Hewlett-Packard) HiddenTrayApp (x32 Version: 140.0.213.000 - Hewlett-Packard) HiddenVisual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)WebReg (x32 Version: 140.0.213.017 - Hewlett-Packard) HiddenWindows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-78250143-3347497304-271033569-1000_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}\localserver32 -> C:\Users\John\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)CustomCLSID: HKU\S-1-5-21-78250143-3347497304-271033569-1000_Classes\CLSID\{8B9F5BF4-0407-4BB2-9FED-4C0372DABD00}\localserver32 -> C:\Users\John\AppData\Local\Facebook\Video\Skype\FacebookVideoCallingProxy.exe (Skype Limited)CustomCLSID: HKU\S-1-5-21-78250143-3347497304-271033569-1000_Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}\localserver32 -> "C:\Users\John\AppData\Local\Vosteran\Application\31.0.1650.23\delegate_execute.exe" No File ==================== Restore Points ========================= 19-10-2014 20:49:14 Installed AVG 201519-10-2014 20:50:28 Installed AVG 201524-10-2014 17:39:30 Scheduled Checkpoint27-10-2014 12:51:35 Scheduled Checkpoint29-10-2014 20:17:13 Scheduled Checkpoint31-10-2014 12:28:28 Scheduled Checkpoint08-11-2014 18:31:59 Scheduled Checkpoint13-11-2014 18:49:26 Windows Update19-11-2014 17:56:54 Windows Update01-12-2014 17:49:47 Scheduled Checkpoint11-12-2014 17:34:06 Windows Update02-01-2015 13:34:16 Scheduled Checkpoint14-01-2015 21:08:00 Installed 7-Zip 9.38 (x64 edition)16-01-2015 11:23:04 Windows Update16-01-2015 14:41:38 Removed Visual Studio 2012 x64 Redistributables16-01-2015 14:43:06 Removed Bing Bar ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2006-11-02 07:34 - 2006-09-18 16:37 - 00000761 ____N C:\Windows\system32\Drivers\etc\hosts127.0.0.1 localhost::1 localhost ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {22811238-983D-4238-9A6F-D33C1CEFF329} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvcTask: {2825A454-AD7B-4F9E-BA57-79EEF17A2B5F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)Task: {94E82401-E763-4603-8630-192F777051A0} - \WSE_Vosteran No Task File <==== ATTENTIONTask: {A3C1020A-D98C-48E0-B615-2C7692DF1C83} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)Task: {BAF2B871-CA5A-4963-A17A-AE30389972D9} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-78250143-3347497304-271033569-1000Core => C:\Users\John\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-11-10] (Facebook Inc.)Task: {CE020A92-D23F-4D5B-8D62-A8307FE02853} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-10-24] (Google Inc.)Task: {F84BF24A-E187-4DDA-BF9D-CC510BA83039} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-10-24] (Google Inc.)Task: {F8DD611B-61E5-4CB8-8EFE-CF08C6975788} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-78250143-3347497304-271033569-1000UA => C:\Users\John\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-11-10] (Facebook Inc.)Task: {FB8D1D75-9505-46B3-8317-EFB949A1C02F} - System32\Tasks\{553A5A71-AD91-4F0B-BCB1-9DB090A70274} => pcalua.exe -a "C:\Users\John\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TV8I75VH\sp37903.exe" -d C:\Users\John\DesktopTask: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-78250143-3347497304-271033569-1000Core.job => C:\Users\John\AppData\Local\Facebook\Update\FacebookUpdate.exeTask: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-78250143-3347497304-271033569-1000UA.job => C:\Users\John\AppData\Local\Facebook\Update\FacebookUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2013-10-23 09:02 - 2013-10-23 09:02 - 00045056 _____ () C:\Windows\SysWOW64\UTSCSI.EXE ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) ========================= Accounts: ========================== Administrator (S-1-5-21-78250143-3347497304-271033569-500 - Administrator - Disabled)Guest (S-1-5-21-78250143-3347497304-271033569-501 - Limited - Disabled)John (S-1-5-21-78250143-3347497304-271033569-1000 - Administrator - Enabled) => C:\Users\John ==================== Faulty Device Manager Devices ============= Name: Officejet Pro L7500Description: Officejet Pro L7500Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}Manufacturer: HPService: Problem: : This device is disabled. (Code 22)Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. ==================== Event log errors: ========================= Application errors:==================Error: (01/16/2015 04:14:47 PM) (Source: Application Hang) (EventID: 1002) (User: )Description: The program Explorer.EXE version 6.0.6002.18005 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel.Process ID: fe8Start Time: 01d031c3a4fd927eTermination Time: 35 Error: (01/16/2015 00:25:15 PM) (Source: Application Hang) (EventID: 1002) (User: )Description: The program TB95RUN.exe version 9.5.0.247 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel.Process ID: d60Start Time: 01d031a858a4bd0aTermination Time: 9 Error: (01/16/2015 11:33:35 AM) (Source: Perflib) (EventID: 1008) (User: )Description: PNRPsvcC:\Windows\system32\pnrpperf.dll8 Error: (01/16/2015 11:33:34 AM) (Source: Perflib) (EventID: 1010) (User: )Description: EmdCacheC:\Windows\system32\emdmgmt.dll8 Error: (01/14/2015 10:46:24 PM) (Source: Application Hang) (EventID: 1002) (User: )Description: The program SpyHunter4.exe version 4.18.9.4384 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel.Process ID: 1a80Start Time: 01d030743d9b3f2eTermination Time: 7 Error: (01/14/2015 10:28:41 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: The entry <C:\USERS\JOHN\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\6BYFFBLA.DEFAULT\SAFEBROWSING-BACKUP> in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:A device attached to the system is not functioning. (0x8007001f) Error: (01/14/2015 09:32:40 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application VisualBoyAdvance-M.exe, version 1.8.0.0, time stamp 0x531ac31b, faulting module d3dx9_43.dll, version 6.0.6002.18881, time stamp 0x51da3e00, exception code 0xc0000135, fault offset 0x0006f52f,process id 0x1238, application start time 0xVisualBoyAdvance-M.exe0. Error: (01/14/2015 09:32:03 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application VisualBoyAdvance-M.exe, version 1.8.0.0, time stamp 0x531ac31b, faulting module d3dx9_43.dll, version 6.0.6002.18881, time stamp 0x51da3e00, exception code 0xc0000135, fault offset 0x0006f52f,process id 0x1734, application start time 0xVisualBoyAdvance-M.exe0. Error: (01/14/2015 09:29:24 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application VisualBoyAdvance-M.exe, version 1.8.0.0, time stamp 0x531ac31b, faulting module d3dx9_43.dll, version 6.0.6002.18881, time stamp 0x51da3e00, exception code 0xc0000135, fault offset 0x0006f52f,process id 0x15bc, application start time 0xVisualBoyAdvance-M.exe0. Error: (01/14/2015 09:18:22 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application VisualBoyAdvance-M.exe, version 1.8.0.0, time stamp 0x531ac31b, faulting module d3dx9_43.dll, version 6.0.6002.18881, time stamp 0x51da3e00, exception code 0xc0000135, fault offset 0x0006f52f,process id 0x938, application start time 0xVisualBoyAdvance-M.exe0. System errors:=============Error: (01/14/2015 10:46:33 PM) (Source: Service Control Manager) (EventID: 7034) (User: )Description: hpqcxs082 Error: (01/14/2015 10:32:10 PM) (Source: Service Control Manager) (EventID: 7034) (User: )Description: HP CUE DeviceDiscovery Service1 Error: (01/14/2015 10:32:10 PM) (Source: Service Control Manager) (EventID: 7034) (User: )Description: hpqcxs081 Error: (01/14/2015 07:59:58 PM) (Source: Service Control Manager) (EventID: 7011) (User: )Description: 30000ShellHWDetection Error: (01/13/2015 08:18:19 AM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: iPod Service%%1053 Error: (01/13/2015 08:18:19 AM) (Source: Service Control Manager) (EventID: 7009) (User: )Description: 30000iPod Service Error: (01/13/2015 08:17:46 AM) (Source: DCOM) (EventID: 10005) (User: )Description: 1053iPod Service{063D34A4-BF84-4B8D-B699-E8CA06504DDE} Error: (01/11/2015 07:45:17 PM) (Source: Service Control Manager) (EventID: 7011) (User: )Description: 30000ShellHWDetection Error: (01/05/2015 11:21:16 AM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: iPod Service%%1053 Error: (01/05/2015 11:21:16 AM) (Source: Service Control Manager) (EventID: 7009) (User: )Description: 30000iPod Service Microsoft Office Sessions:=========================Error: (01/16/2015 04:14:47 PM) (Source: Application Hang) (EventID: 1002) (User: )Description: Explorer.EXE6.0.6002.18005fe801d031c3a4fd927e35 Error: (01/16/2015 00:25:15 PM) (Source: Application Hang) (EventID: 1002) (User: )Description: TB95RUN.exe9.5.0.247d6001d031a858a4bd0a9 Error: (01/16/2015 11:33:35 AM) (Source: Perflib) (EventID: 1008) (User: )Description: PNRPsvcC:\Windows\system32\pnrpperf.dll8 Error: (01/16/2015 11:33:34 AM) (Source: Perflib) (EventID: 1010) (User: )Description: EmdCacheC:\Windows\system32\emdmgmt.dll8 Error: (01/14/2015 10:46:24 PM) (Source: Application Hang) (EventID: 1002) (User: )Description: SpyHunter4.exe4.18.9.43841a8001d030743d9b3f2e7 Error: (01/14/2015 10:28:41 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: Context: Application, SystemIndex Catalog Details:A device attached to the system is not functioning. (0x8007001f)C:\USERS\JOHN\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\6BYFFBLA.DEFAULT\SAFEBROWSING-BACKUP Error: (01/14/2015 09:32:40 PM) (Source: Application Error) (EventID: 1000) (User: )Description: VisualBoyAdvance-M.exe1.8.0.0531ac31bd3dx9_43.dll6.0.6002.1888151da3e00c00001350006f52f123801d0306b8743d6ee Error: (01/14/2015 09:32:03 PM) (Source: Application Error) (EventID: 1000) (User: )Description: VisualBoyAdvance-M.exe1.8.0.0531ac31bd3dx9_43.dll6.0.6002.1888151da3e00c00001350006f52f173401d0306b6f2bee8e Error: (01/14/2015 09:29:24 PM) (Source: Application Error) (EventID: 1000) (User: )Description: VisualBoyAdvance-M.exe1.8.0.0531ac31bd3dx9_43.dll6.0.6002.1888151da3e00c00001350006f52f15bc01d0306b1014d29e Error: (01/14/2015 09:18:22 PM) (Source: Application Error) (EventID: 1000) (User: )Description: VisualBoyAdvance-M.exe1.8.0.0531ac31bd3dx9_43.dll6.0.6002.1888151da3e00c00001350006f52f93801d03069873cbcee CodeIntegrity Errors:=================================== Date: 2015-01-16 17:25:22.893 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2015-01-16 17:25:22.715 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2015-01-16 17:25:22.528 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2015-01-16 17:25:22.351 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2015-01-16 17:23:10.559 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2015-01-16 17:23:10.368 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2015-01-16 17:23:10.153 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2015-01-16 17:23:09.936 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2015-01-16 17:22:49.849 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2015-01-16 17:22:49.455 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. ==================== Memory info =========================== Processor: Pentium® Dual-Core CPU T4300 @ 2.10GHzPercentage of memory in use: 55%Total physical RAM: 3998.25 MBAvailable physical RAM: 1778.67 MBTotal Pagefile: 8227.79 MBAvailable Pagefile: 5590.49 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.87 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:232.88 GB) (Free:134.88 GB) NTFS ==>[Drive with boot components (obtained from BCD)]Drive z: () (Network) (Total:3.73 GB) (Free:3.5 GB) ==================== MBR & Partition Table ================== ========================================================Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 232.9 GB) (Disk ID: 64577C4B)Partition 1: (Active) - (Size=232.9 GB) - (Type=07 NTFS) ==================== End Of Log ============================
  3. Hello, I apologize for the length of the post but I thought to much info was probably better than to little. What Happened: Recently I downloaded Mozilla firefox and ended up with both vosteran and Optimizer Pro being installed at the same time. This was on a system running windows 7 home pro from a striped 500gb ssd C: drive with an internal second 1Tb drive, and two usb WD My Book external drives . At the time I also had two usb sticks with various Flight Sim (FSX) scenery packages with installers plugged in. What I did: I had MSE running but It did not catch anything even with a full scan after I realized what had happened. I immediately updated and ran Malwarebytes free which detected about 970 vosteran files, folders and registry entries plus the Optimizer Pro files! I selected to quarantine all the files, then deleted the quarantine. At this point mbam requested a reboot which I selected. The system seemed to hang on the "shutting down" screen for a few minutes then blue screened and finally gave me the "Windows did not shut down properly..." message. I chose to restart normally and the system came up seemingly fine. Then I noticed I had no internet connection. When I attempted to reconnect I got a strange message box stating it needed my network security code. I certainly was not about to do that, so I closed it and looked around some. I noticed that all the vosteran stuff seemed to be removed but Optimizer Pro was still there. I googled it and, using a suggestion from various forums, I simply uninstalled it. Results: A reboot worked fine, both vosteran & OP seem to be gone, my network connection automatically re-established and is working. Questions: Even though I thought I had gotten the firefox download from the official Mozilla.org site did I get "redirected" at some point in the download process? I did have to go through several pages to identify what package to download (i.e. 32 bit or 64 bit & win version). Is mbam alone, capable of completely removing vosteran as it appears to have done? Should I uninstall firefox before using it, then go back to the mozilla site and, carefully, download and install firefox again? I greatly appreciate your help and advice!
  4. I was infected with Vosteran via a download of the Firefox broswer. I purchased and ran Malwarebytes Premium which successfully quarantined several associated files. I uninstalled the Firefox files and reset my browser to the basic Microsoft Explorer. However, I notice that when I type a search in the top browser window (not the Google search box on my set home page), it still redirects to Vosteran. From another similar recent topic posted here, I downloaded and ran Farbar's Recovery Scan Tool. Psychotic/Marius or any other trusted advisors here, please help! Thank you. Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-12-2014 01 Ran by David (administrator) on LAPTOP on 07-12-2014 12:46:10 Running from C:\Program Files (x86)\Malwarebytes Anti-Malware\FARBAR removal tool Loaded Profile: David (Available profiles: David) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Lenovo.) C:\Windows\System32\ibmpmsvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (Andrea Electronics Corporation) C:\Windows\System32\AEADISRV.EXE (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe (Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (Intel Corporation) C:\Windows\System32\igfxext.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation) HKLM-x32\...\Run: [soundMAXPnP] => C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1314816 2009-05-18] (Analog Devices, Inc.) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-384272583-3986194935-2048666408-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-10-17] (Apple Inc.) HKU\S-1-5-21-384272583-3986194935-2048666408-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-10-17] (Apple Inc.) HKU\S-1-5-21-384272583-3986194935-2048666408-1000\...\Run: [AppleIEDAV] => C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [1080104 2014-08-04] (Apple Inc.) HKU\S-1-5-21-384272583-3986194935-2048666408-1000\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2014-10-20] (Apple Inc.) HKU\S-1-5-21-384272583-3986194935-2048666408-1000\...\RunOnce: [uninstall C:\Users\David\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910_1\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\David\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910_1\amd64" HKU\S-1-5-21-384272583-3986194935-2048666408-1000\...\MountPoints2: {69ea5869-8082-11e3-9ebe-001c26dbfeee} - "E:\WD SmartWare.exe" autoplay=true HKU\S-1-5-21-384272583-3986194935-2048666408-1000\...\MountPoints2: {fb70a435-860b-11e3-b5dd-001c26dbfeee} - G:\LaunchU3.exe -a ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-384272583-3986194935-2048666408-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/?gws_rd=ssl HKU\S-1-5-21-384272583-3986194935-2048666408-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp HKU\S-1-5-21-384272583-3986194935-2048666408-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x3593B64C470BCF01 HKU\S-1-5-21-384272583-3986194935-2048666408-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US StartMenuInternet: IEXPLORE.EXE - iexplore.exe SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_dnldstr_14_48_ie&cd=2XzuyEtN2Y1L1QzutDyCtC0D0DzyyEtAtDtB0ByCtAyE0DyBtN0D0Tzu0StCtDyCtBtN1L2XzutAtFyCtFyCtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StAyD0AyEtDyC0DyEtG0F0C0CtBtG0FtDyEyDtGyE0C0DyCtGyDyD0CyE0E0AyDtByEtDzzyC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0DzytCtD0DyB0DyEtG0FyB0BtDtGyE0CzyzztGzzzzyB0AtGyE0CyCtDyD0EyB0C0F0E0F0C2Q&cr=1844892333&ir= SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_dnldstr_14_48_ie&cd=2XzuyEtN2Y1L1QzutDyCtC0D0DzyyEtAtDtB0ByCtAyE0DyBtN0D0Tzu0StCtDyCtBtN1L2XzutAtFyCtFyCtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StAyD0AyEtDyC0DyEtG0F0C0CtBtG0FtDyEyDtGyE0C0DyCtGyDyD0CyE0E0AyDtByEtDzzyC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0DzytCtD0DyB0DyEtG0FyB0BtDtGyE0CzyzztGzzzzyB0AtGyE0CyCtDyD0EyB0C0F0E0F0C2Q&cr=1844892333&ir= SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-384272583-3986194935-2048666408-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_dnldstr_14_48_ie&cd=2XzuyEtN2Y1L1QzutDyCtC0D0DzyyEtAtDtB0ByCtAyE0DyBtN0D0Tzu0StCtDyCtBtN1L2XzutAtFyCtFyCtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StAyD0AyEtDyC0DyEtG0F0C0CtBtG0FtDyEyDtGyE0C0DyCtGyDyD0CyE0E0AyDtByEtDzzyC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0DzytCtD0DyB0DyEtG0FyB0BtDtGyE0CzyzztGzzzzyB0AtGyE0CyCtDyD0EyB0C0F0E0F0C2Q&cr=1844892333&ir= SearchScopes: HKU\S-1-5-21-384272583-3986194935-2048666408-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://Vosteran.com/results.php?f=4&q={searchTerms}&a=vst_dnldstr_14_48_ie&cd=2XzuyEtN2Y1L1QzutDyCtC0D0DzyyEtAtDtB0ByCtAyE0DyBtN0D0Tzu0StCtDyCtBtN1L2XzutAtFyCtFyCtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StAyD0AyEtDyC0DyEtG0F0C0CtBtG0FtDyEyDtGyE0C0DyCtGyDyD0CyE0E0AyDtByEtDzzyC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0DzytCtD0DyB0DyEtG0FyB0BtDtGyE0CzyzztGzzzzyB0AtGyE0CyCtDyD0EyB0C0F0E0F0C2Q&cr=1844892333&ir= SearchScopes: HKU\S-1-5-21-384272583-3986194935-2048666408-1000 -> {7C226025-B493-4854-817E-87E0079DBB6D} URL = http://www.search.ask.com/web?tpid=ORJ-ST-SPE&o=APN11460&pf=V7&p2=^BE6^OSJ000^YY^US&gct=&itbv=12.18.0.81&apn_uid=4F5D274B-D4FF-4EAA-9D9D-3BED26C253A7&apn_ptnrs=BE6&apn_dtid=^OSJ000^YY^US&apn_dbr=ie_11.0.9600.17280&doi=2014-10-18&trgb=IE&q={searchTerms}&psv=&pt=tb BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 64.233.222.2 64.233.222.7 FireFox: ======== FF ProfilePath: C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\ybgeul38.default FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found] Chrome: ======= ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AEADIFilters; C:\Windows\system32\AEADISRV.EXE [111616 2008-07-15] (Andrea Electronics Corporation) R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2443960 2014-10-30] (Microsoft Corporation) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation) R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation) S2 51cdb72; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro 3.11\OptProCrash.dll",ENT ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 DPIDEFil; C:\Windows\system32\drivers\DPIDEFil.sys [45152 2011-10-05] (NEC Personal Computers, Ltd.) S3 IFCoEMP; C:\Windows\system32\drivers\ifM60x64.sys [387344 2012-04-20] (Intel® Corporation) S3 IFCoEVB; C:\Windows\system32\drivers\ifP60X64.sys [77584 2012-04-20] (Intel® Corporation) R0 ioatdma; C:\Windows\System32\Drivers\ioatdma.sys [46792 2009-11-16] (Intel Corporation) S3 ioatdma2; C:\Windows\System32\Drivers\qd260x64.sys [41168 2009-11-16] (Intel Corporation) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-07] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation) R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-07 12:45 - 2014-12-07 12:46 - 00000000 ____D () C:\FRST 2014-11-28 22:55 - 2014-12-07 12:44 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2014-11-28 22:55 - 2014-12-04 15:17 - 00001109 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2014-11-28 22:55 - 2014-12-04 15:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2014-11-28 22:55 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-11-28 22:55 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-11-28 22:55 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-11-28 20:58 - 2014-11-28 22:54 - 00000000 ____D () C:\Users\David\Malware Removal 2014-11-28 20:41 - 2014-11-28 20:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-11-28 20:41 - 2014-11-28 20:41 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-11-28 20:41 - 2014-11-28 20:41 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-11-28 20:40 - 2014-11-28 20:41 - 13087456 _____ (Microsoft Corporation) C:\Users\David\Silverlight_x64.exe 2014-11-28 20:40 - 2014-11-28 20:40 - 00000000 ____D () C:\Program Files\Silverlight 2014-11-28 19:41 - 2014-11-28 19:41 - 00000000 ____D () C:\Users\David\Documents\Optimizer Pro 2014-11-28 19:39 - 2014-11-28 19:42 - 00000000 ____D () C:\Users\David\AppData\Roaming\Mozilla 2014-11-28 19:39 - 2014-11-28 19:42 - 00000000 ____D () C:\Users\David\AppData\Local\Mozilla 2014-11-28 19:39 - 2014-11-28 19:39 - 00004008 _____ () C:\Windows\System32\Tasks\LaunchSignup 2014-11-28 19:39 - 2014-11-28 19:39 - 00000000 ____D () C:\ProgramData\Mozilla 2014-11-28 19:37 - 2014-11-28 19:37 - 00000000 ____D () C:\ProgramData\Unchecky 2014-11-28 19:36 - 2014-12-07 12:37 - 00000292 _____ () C:\Windows\Tasks\UpdaterEX.job 2014-11-28 19:36 - 2014-11-29 01:05 - 00000000 ____D () C:\Users\David\AppData\Roaming\UpdaterEX 2014-11-28 19:36 - 2014-11-28 19:37 - 00003228 _____ () C:\Windows\System32\Tasks\UpdaterEX 2014-11-21 19:57 - 2014-11-10 22:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-11-21 19:57 - 2014-11-10 22:08 - 00241152 _____ (Microsoft Corporation) C:\Windows\system32\pku2u.dll 2014-11-21 19:57 - 2014-11-10 21:44 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-11-21 19:57 - 2014-11-10 21:44 - 00186880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pku2u.dll 2014-11-16 14:55 - 2014-10-18 14:53 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-11-16 14:54 - 2014-10-18 14:53 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-11-16 14:54 - 2014-10-18 14:53 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-11-16 11:04 - 2014-11-16 11:04 - 00000000 __SHD () C:\Users\David\AppData\Local\EmieBrowserModeList 2014-11-11 20:09 - 2014-11-07 14:49 - 00388272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-11-11 20:09 - 2014-11-07 14:23 - 00341168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-11-11 20:09 - 2014-11-05 23:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-11-11 20:09 - 2014-11-05 23:03 - 25110016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-11-11 20:09 - 2014-11-05 23:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-11-11 20:09 - 2014-11-05 22:47 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-11-11 20:09 - 2014-11-05 22:46 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-11-11 20:09 - 2014-11-05 22:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-11-11 20:09 - 2014-11-05 22:44 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-11-11 20:09 - 2014-11-05 22:43 - 02884096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-11-11 20:09 - 2014-11-05 22:36 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-11-11 20:09 - 2014-11-05 22:35 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-11-11 20:09 - 2014-11-05 22:31 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-11-11 20:09 - 2014-11-05 22:30 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-11-11 20:09 - 2014-11-05 22:30 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-11-11 20:09 - 2014-11-05 22:29 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-11-11 20:09 - 2014-11-05 22:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-11-11 20:09 - 2014-11-05 22:23 - 06040064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-11-11 20:09 - 2014-11-05 22:20 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-11-11 20:09 - 2014-11-05 22:16 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-11-11 20:09 - 2014-11-05 22:13 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-11-11 20:09 - 2014-11-05 22:13 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-11-11 20:09 - 2014-11-05 22:12 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-11-11 20:09 - 2014-11-05 22:10 - 19781632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-11-11 20:09 - 2014-11-05 22:10 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-11-11 20:09 - 2014-11-05 22:07 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-11-11 20:09 - 2014-11-05 22:05 - 02277376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-11-11 20:09 - 2014-11-05 22:04 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-11-11 20:09 - 2014-11-05 22:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-11-11 20:09 - 2014-11-05 22:02 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-11-11 20:09 - 2014-11-05 22:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-11-11 20:09 - 2014-11-05 22:00 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-11-11 20:09 - 2014-11-05 21:59 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-11-11 20:09 - 2014-11-05 21:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-11-11 20:09 - 2014-11-05 21:57 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-11-11 20:09 - 2014-11-05 21:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-11-11 20:09 - 2014-11-05 21:42 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-11-11 20:09 - 2014-11-05 21:41 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-11-11 20:09 - 2014-11-05 21:41 - 00716800 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-11-11 20:09 - 2014-11-05 21:39 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-11-11 20:09 - 2014-11-05 21:38 - 02124288 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-11-11 20:09 - 2014-11-05 21:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-11-11 20:09 - 2014-11-05 21:36 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-11-11 20:09 - 2014-11-05 21:34 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-11-11 20:09 - 2014-11-05 21:30 - 14390272 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-11-11 20:09 - 2014-11-05 21:22 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-11-11 20:09 - 2014-11-05 21:21 - 04298240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-11-11 20:09 - 2014-11-05 21:21 - 02051072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-11-11 20:09 - 2014-11-05 21:20 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-11-11 20:09 - 2014-11-05 21:17 - 02365440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-11-11 20:09 - 2014-11-05 21:04 - 01550336 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-11-11 20:09 - 2014-11-05 21:03 - 12819456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-11-11 20:09 - 2014-11-05 20:53 - 00799232 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-11-11 20:09 - 2014-11-05 20:52 - 01892864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-11-11 20:09 - 2014-11-05 20:48 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-11-11 20:09 - 2014-11-05 20:47 - 00708096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-11-11 20:09 - 2014-11-05 12:56 - 00304640 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2014-11-11 20:09 - 2014-11-05 12:56 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-11-11 20:09 - 2014-11-05 12:52 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-11-11 20:09 - 2014-10-13 21:16 - 00155064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2014-11-11 20:09 - 2014-10-13 21:13 - 00683520 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll 2014-11-11 20:09 - 2014-10-13 21:12 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-11-11 20:09 - 2014-10-13 21:09 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2014-11-11 20:09 - 2014-10-13 21:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2014-11-11 20:09 - 2014-10-13 20:50 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-11-11 20:09 - 2014-10-13 20:49 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-11-11 20:09 - 2014-10-13 20:47 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2014-11-11 20:09 - 2014-10-13 20:46 - 00681984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2014-11-11 20:08 - 2014-10-24 20:57 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll 2014-11-11 20:08 - 2014-10-24 20:32 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll 2014-11-11 20:08 - 2014-10-13 21:13 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2014-11-11 20:08 - 2014-10-13 20:50 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll 2014-11-11 20:08 - 2014-10-09 19:57 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-11-11 20:08 - 2014-10-02 21:12 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll 2014-11-11 20:08 - 2014-10-02 21:11 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll 2014-11-11 20:08 - 2014-10-02 21:11 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll 2014-11-11 20:08 - 2014-10-02 21:11 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll 2014-11-11 20:08 - 2014-10-02 21:11 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll 2014-11-11 20:08 - 2014-10-02 20:44 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll 2014-11-11 20:08 - 2014-10-02 20:44 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll 2014-11-11 20:08 - 2014-10-02 20:44 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll 2014-11-11 20:08 - 2014-09-19 04:42 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-11-11 20:08 - 2014-09-19 04:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2014-11-11 20:08 - 2014-09-19 04:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2014-11-11 20:08 - 2014-09-19 04:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2014-11-11 20:08 - 2014-09-19 04:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2014-11-11 20:08 - 2014-09-19 04:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2014-11-11 20:08 - 2014-09-19 04:23 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2014-11-11 20:08 - 2014-09-19 04:23 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-11-11 20:08 - 2014-09-19 04:23 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2014-11-11 20:08 - 2014-09-19 04:23 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2014-11-11 20:08 - 2014-09-19 04:23 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2014-11-11 20:08 - 2014-09-19 04:23 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2014-11-11 20:08 - 2014-08-21 01:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-11-11 20:08 - 2014-08-21 01:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll 2014-11-11 20:08 - 2014-08-21 01:26 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2014-11-11 20:08 - 2014-08-21 01:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll 2014-11-11 20:08 - 2014-08-11 21:02 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL 2014-11-11 20:08 - 2014-08-11 20:36 - 00701440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IMJP10K.DLL 2014-11-11 20:06 - 2014-10-17 21:05 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2014-11-11 20:06 - 2014-10-17 20:33 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2014-11-09 19:21 - 2014-11-16 15:16 - 00004966 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Laptop-David Laptop 2014-11-08 15:09 - 2014-11-08 15:10 - 00000000 ____D () C:\Users\David\AppData\OICE_15_974FA576_32C1D314_37B8 2014-11-07 20:45 - 2014-11-07 20:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-07 12:42 - 2009-07-13 23:45 - 00028944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-12-07 12:42 - 2009-07-13 23:45 - 00028944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-12-07 12:38 - 2014-02-15 12:39 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-12-07 12:23 - 2014-05-04 21:43 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-12-07 12:23 - 2014-01-06 19:43 - 01158828 _____ () C:\Windows\WindowsUpdate.log 2014-12-07 10:11 - 2014-09-19 15:39 - 00000000 ___RD () C:\Users\David\iCloudDrive 2014-12-07 10:09 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-12-07 10:09 - 2009-07-13 23:51 - 00055007 _____ () C:\Windows\setupact.log 2014-12-05 07:34 - 2010-11-20 22:47 - 00455222 _____ () C:\Windows\PFRO.log 2014-11-29 01:12 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\LiveKernelReports 2014-11-28 20:58 - 2014-01-06 19:52 - 00000000 ____D () C:\Users\David 2014-11-27 11:38 - 2014-02-15 12:39 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-11-27 11:38 - 2014-01-14 19:41 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-11-27 11:38 - 2014-01-14 19:41 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-11-21 19:53 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-11-16 15:10 - 2014-07-15 21:21 - 00000000 ____D () C:\Program Files\Microsoft Office 15 2014-11-16 14:55 - 2014-09-12 23:23 - 00000000 ____D () C:\ProgramData\Oracle 2014-11-16 14:54 - 2014-09-12 23:18 - 00000000 ____D () C:\Program Files (x86)\Java 2014-11-16 14:52 - 2013-06-25 17:05 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office 2014-11-16 14:44 - 2014-01-19 09:41 - 00000000 ____D () C:\Users\David\Documents\NURS 2014-11-16 14:36 - 2009-07-14 00:13 - 00782810 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-11-16 13:00 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\rescache 2014-11-16 10:58 - 2009-07-13 23:45 - 00437848 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-11-16 10:56 - 2014-05-07 06:19 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-11-11 21:58 - 2014-01-20 22:25 - 00000000 ____D () C:\Windows\system32\MRT 2014-11-09 13:41 - 2014-09-19 15:39 - 00000000 ____D () C:\Users\David\AppData\Local\B4A39A56-7F79-4306-BB2E-D1BC6D49A9AE.aplzod Files to move or delete: ==================== C:\Users\David\Silverlight_x64.exe Some content of TEMP: ==================== C:\Users\David\AppData\Local\Temp\APNSetup.exe C:\Users\David\AppData\Local\Temp\CloudBackup9388.exe C:\Users\David\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe C:\Users\David\AppData\Local\Temp\OfficeSetup.exe C:\Users\David\AppData\Local\Temp\optprosetup.exe C:\Users\David\AppData\Local\Temp\Setup.X86.en-US_O365HomePremRetail_92dc294d-3038-4046-bc19-36d1d076cac6_TX_PR_.exe C:\Users\David\AppData\Local\Temp\vcredist_x64.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-12-05 00:55 ==================== End Of Log ============================
  5. Just recently got infected w/vosteran search, and was alerted by malwarebytes that I have on my laptop.(running vista) I judiciously scanned and quarantined any/everything vosteran, and went on to delete the extensions, etc. from all of my browsers, but am unsure if all infected files were deleted. Any suggestions for followup/cleanup procedures?
  6. Hello, from reading a prior topic I believe I have removed the Vosteran Malware, but I wanted to ask for some help to make sure. I'd also like to thank you (in advance) as well as Malwarebytes for making such an outstanding product and providing such a great service. My first MWB log: Malwarebytes Anti-Malwarewww.malwarebytes.org Scan Date: 1/1/2015Scan Time: 11:04:47 PMLogfile: MWB Log 1.txtAdministrator: Yes Version: 2.00.4.1028Malware Database: v2015.01.02.03Rootkit Database: v2014.12.30.01License: FreeMalware Protection: DisabledMalicious Website Protection: DisabledSelf-protection: Disabled OS: Windows 7 Service Pack 1CPU: x64File System: NTFSUser: snadle01 Scan Type: Threat ScanResult: CompletedObjects Scanned: 435493Time Elapsed: 8 min, 17 sec Memory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: DisabledHeuristics: EnabledPUP: WarnPUM: Enabled Processes: 0(No malicious items detected) Modules: 0(No malicious items detected) Registry Keys: 0(No malicious items detected) Registry Values: 0(No malicious items detected) Registry Data: 0(No malicious items detected) Folders: 0(No malicious items detected) Files: 0(No malicious items detected) Physical Sectors: 0(No malicious items detected) (end) Then I downloaded and ran Adware Cleaner and here is that log: # AdwCleaner v4.106 - Report created 01/01/2015 at 23:16:28# Updated 21/12/2014 by Xplode# Database : 2015-01-01.1 [Live]# Operating System : Windows 7 Professional Service Pack 1 (64 bits)# Username : snadle01 - BLB7CW1# Running from : C:\Users\snadle01\Downloads\AdwCleaner.exe# Option : Clean ***** [ Services ] ***** Service Deleted : PCKeeper2ServiceService Deleted : PCKeeperOcfService ***** [ Files / Folders ] ***** Folder Deleted : C:\ProgramData\apnFolder Deleted : C:\ProgramData\Driver SupportFolder Deleted : C:\ProgramData\KromtechFolder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileOpenerFolder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KromtechFolder Deleted : C:\Program Files (x86)\TweaksFolder Deleted : C:\Program Files (x86)\Driver SupportFolder Deleted : C:\Users\snadle01\AppData\Local\Temp\apnFolder Deleted : C:\Users\snadle01\AppData\Local\Temp\Framed DisplayFolder Deleted : C:\Program Files\KromtechFolder Deleted : C:\Users\snadle01\AppData\Local\KromtechFolder Deleted : C:\Users\snadle01\AppData\Roaming\DigitalSitesFolder Deleted : C:\Users\snadle01\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Driver SupportFolder Deleted : C:\Users\snadle01\Documents\Optimizer ProFile Deleted : C:\Users\snadle01\AppData\Local\Temp\DriverSupport.exeFile Deleted : C:\Users\snadle01\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_lyrics.wikia.com_0.localstorageFile Deleted : C:\Users\snadle01\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_lyrics.wikia.com_0.localstorage-journalFile Deleted : C:\Users\snadle01\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorageFile Deleted : C:\Users\snadle01\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journalFile Deleted : C:\Users\snadle01\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.superfish.com_0.localstorageFile Deleted : C:\Users\snadle01\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.superfish.com_0.localstorage-journalFile Deleted : C:\Users\snadle01\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.olark.com_0.localstorage-journal ***** [ Scheduled Tasks ] ***** Task Deleted : Driver Support-RTMRulesTask Deleted : Driver Support-RTMScanTask Deleted : Driver Support-RTMUpdaterTask Deleted : LaunchSignup ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{62C968DD-0E2A-43E2-B93F-EADB45AA9C0F}Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77}Key Deleted : HKCU\Software\Bitberry SoftwareKey Deleted : HKCU\Software\BitberryKey Deleted : HKCU\Software\Optimizer ProKey Deleted : HKCU\Software\Framed DisplayKey Deleted : HKCU\Software\DriverSupportKey Deleted : HKCU\Software\VosteranKey Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}Key Deleted : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}Key Deleted : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}Key Deleted : HKLM\SOFTWARE\InstallCoreKey Deleted : HKLM\SOFTWARE\Framed DisplayKey Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\File Opener PackagesKey Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DriverSupportKey Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Tweaks FileOpener ***** [ Browsers ] ***** -\\ Internet Explorer v9.0.8112.16592 -\\ Google Chrome v39.0.2171.95 [C:\Users\snadle01\AppData\Local\Google\Chrome\User Data\Default\preferences] - Deleted [Extension] : aaaaaiabcopkplhgaedhbloeejhhankf[C:\Users\snadle01\AppData\Local\Google\Chrome\User Data\Default\preferences] - Deleted [Extension] : oilkkkefbalmbfppgjmgjoefbclebkce ************************* AdwCleaner[R0].txt - [4513 octets] - [01/01/2015 23:15:21]AdwCleaner[s0].txt - [4245 octets] - [01/01/2015 23:16:28] ########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [4305 octets] ########## Then I downloaded and ran Junkware Removal Tool (JRT) and here is that log: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Junkware Removal Tool (JRT) by ThisisuVersion: 6.4.1 (12.28.2014:1)OS: Windows 7 Professional x64Ran by snadle01 on Thu 01/01/2015 at 23:21:17.75~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\Users\snadle01\appdata\local\pc_drivers_headquarters" ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Scan was completed on Thu 01/01/2015 at 23:23:52.24End of JRT log~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Then I ran MalwareBytes again following prior instruction to another user to: - Enable Scan for rootkit - Set both PUP and PUM to Treat detections as malware Here is the MWB log after that: Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 1/1/2015Scan Time: 11:28:18 PMLogfile: MWB Log 2.txtAdministrator: Yes Version: 2.00.4.1028Malware Database: v2015.01.02.03Rootkit Database: v2014.12.30.01License: FreeMalware Protection: DisabledMalicious Website Protection: DisabledSelf-protection: Disabled OS: Windows 7 Service Pack 1CPU: x64File System: NTFSUser: snadle01 Scan Type: Threat ScanResult: CompletedObjects Scanned: 436857Time Elapsed: 7 min, 42 sec Memory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: EnabledHeuristics: EnabledPUP: EnabledPUM: Enabled Processes: 0(No malicious items detected) Modules: 0(No malicious items detected) Registry Keys: 2PUP.Optional.AceRace.A, HKU\S-1-5-21-1216698204-1542668753-1093625069-611774-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{68182220-3C75-49D9-A9C4-4093D3986279}, Quarantined, [e12082e7acd095a16db028b2cc3636ca], PUP.Optional.AceRace.A, HKU\S-1-5-21-1216698204-1542668753-1093625069-611774-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{68182220-3C75-49D9-A9C4-4093D3986279}, Quarantined, [e12082e7acd095a16db028b2cc3636ca], Registry Values: 0(No malicious items detected) Registry Data: 0(No malicious items detected) Folders: 0(No malicious items detected) Files: 0(No malicious items detected) Physical Sectors: 0(No malicious items detected) (end) That is as far as I have gone and everything seems to be clean and the system appears to operating normally. I look forward to your response and any further suggestions. By the way, I believe I obtained this from downloading a .zip program to open .rar files Thanks, Steve
  7. Got a new SSD hard drive and while I was trying to update my Flash plugins for Mozilla Firefox, I selected a website at the top of my Google search that turned out to install Vosteran on my pc. I interrupted the install and manually deleted the Vosteran software using Windows Uninstall feature from the Control Panel, but whenever I run my MalwareBytes Premium, it finds about 18 examples of "C:\Users\Darin\AppData\Roaming\Mozilla\Firefox\Profiles\8v0u1qzo.default\user.js". I would very much like this to go away. Is there anything more that can be done?
  8. This is odd. Vosteran.com hijack google chrome on my computer a couple of days ago when a Russian web developer sent me it along with a file he shared with me on Skype... (yeah, stupid me), but this was a guy from whom I bought a theme.... anyways, spyhunter has a fix but my premium malwarebytes does not even have any subject related to it for the least... Does anyone know how to remove this? Whenever I click google chrome, it activates vosteran.com. I need help to remove this, guys. Thanks
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.