Google Search Redirect Virus

BigKev · November 9, 2012

My computer was infected with the S.M.A.R.T virus. I ran Malwarebytes and PC Doctor and it seems to have removed the S.M.A.R.T. virus. I was able to unhide all my files and desktop, but my browser runs very slow and when I click on any Google or Yahoo search result I get re-directed to random web pages.

Here is dds.txt:

DDS (Ver_2012-11-07.01) - NTFS_AMD64

Internet Explorer: 9.0.8112.16450

Run by Olsons at 10:45:34 on 2012-11-09

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.2815.1262 [GMT -8:00]

.

AV: PC Tools Spyware Doctor with AntiVirus *Disabled/Updated* {2F668A56-D5E0-2DF1-A0AE-CB1284F42AB2}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: PC Tools Spyware Doctor with AntiVirus *Disabled/Updated* {94076BB2-F3DA-227F-9A1E-F060FF73600F}

FW: ZoneAlarm Free Firewall Firewall *Disabled* {E6380B7E-D4B2-19F1-083E-56486607704B}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\atieclxx.exe

C:\Program Files\Dell\DellDock\DockLogin.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe

C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe

C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE

C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\WUDFHost.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\svchost.exe -k swprv

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.yahoo.com/

uURLSearchHooks: PC Tools Browser Guard: {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll

mWinlogon: Userinit = C:\WINDOWS\SYSWOW64\Userinit.exe,

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: PC Tools Browser Guard BHO: {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll

BHO: ZoneAlarm Security Engine Registrar: {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL

BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB: PC Tools Browser Guard: {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll

TB: ZoneAlarm Security Engine: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll

TB: PC Tools Browser Guard: {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\PCTBrowserDefender.dll

TB: ZoneAlarm Security Engine: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll

mRun: [Carbonite Backup] C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe

mRun: [intuit SyncManager] C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe startup

mRun: [ZoneAlarm] "C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe"

mRunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MIF5BA~1\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - C:\PROGRA~2\MIF5BA~1\Office14\ONBttnIE.dll/105

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

LSP: C:\Program Files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {BEA7310D-06C4-4339-A784-DC3804819809} - hxxp://images3.pnimedia.com/ProductAssets/costcous/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: NameServer = 192.168.1.178 192.168.1.179

TCP: Interfaces\{BEEDD3D7-5BD2-480A-8109-8B616329EAAB} : DHCPNameServer = 192.168.1.178 192.168.1.179

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

Handler: intu-help-qb5 - {867FCB77-9823-4cd6-8210-D85F968D466F} - C:\Program Files (x86)\Intuit\QuickBooks 2012\HelpAsyncPluggableProtocol.dll

Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} -

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

SSODL: WebCheck - <orphaned>

x64-BHO: ZoneAlarm Security Engine Registrar: {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL

x64-BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

x64-TB: ZoneAlarm Security Engine: {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll

x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

x64-Run: [iSW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe /icon="hidden"

x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

x64-DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

x64-DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

x64-Handler: intu-help-qb5 - {867FCB77-9823-4cd6-8210-D85F968D466F} - <orphaned>

x64-Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - <orphaned>

x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - <orphaned>

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

x64-Notify: GoToAssist - C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll

x64-SSODL: WebCheck - <orphaned>

Hosts: 188.119.151.113 www.google-analytics.com.

Hosts: 188.119.151.113 ad-emea.doubleclick.net.

Hosts: 188.119.151.113 www.statcounter.com.

.

============= SERVICES / DRIVERS ===============

.

R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\System32\drivers\mfehidk.sys [2010-1-5 647208]

R0 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\System32\drivers\mfewfpk.sys [2010-1-5 289664]

R0 PCTCore;PCTools KDS;C:\Windows\System32\drivers\PCTCore64.sys [2012-5-27 426616]

R0 pctDS;PC Tools Data Store;C:\Windows\System32\drivers\pctDS64.sys [2012-5-27 453896]

R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2010-9-23 55280]

R0 TfFsMon;TfFsMon;C:\Windows\System32\drivers\TfFsMon.sys [2012-5-27 65664]

R0 TFSysMon;TFSysMon;C:\Windows\System32\drivers\TfSysMon.sys [2012-5-27 706776]

R1 pctgntdi;pctgntdi;C:\Windows\System32\drivers\pctgntdi64.sys [2012-5-27 341168]

R1 PCTSD;PC Tools Spyware Doctor Driver;C:\Windows\System32\drivers\PCTSD64.sys [2012-5-27 251528]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-9-23 202752]

R2 Browser Defender Update Service;Browser Defender Update Service;C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe [2012-5-27 575416]

R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2009-6-9 155648]

R2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [2012-8-30 33712]

R2 IswSvc;ZoneAlarm LTD Toolbar IswSvc;C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe [2012-8-30 827560]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-9-26 399432]

R2 mfevtp;McAfee Validation Trust Protection Service;C:\Program Files\Common Files\mcafee\systemcore\mfevtps.exe [2010-9-23 162192]

R2 QBVSS;QBIDPService;C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe [2012-6-5 1248256]

R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2010-9-23 705856]

R3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;C:\Windows\System32\drivers\k57nd60a.sys [2010-9-23 320040]

R3 PCTBD;PC Tools Browser Defender Driver;C:\Windows\System32\drivers\PCTBD64.sys [2012-5-27 85192]

R3 TfNetMon;TfNetMon;C:\Windows\System32\drivers\TfNetMon.sys [2012-5-27 41968]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-9-26 676936]

S2 McMPFSvc;McAfee Personal Firewall Service;"C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc --> C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [?]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944]

S3 pctplsg;pctplsg;C:\Windows\System32\drivers\pctplsg64.sys [2012-5-27 92896]

S3 sdAuxService;PC Tools Auxiliary Service;C:\Program Files (x86)\PC Tools\PC Tools Security\pctsAuxs.exe [2012-5-27 402336]

S3 sdCoreService;PC Tools Security Service;C:\Program Files (x86)\PC Tools\PC Tools Security\pctsSvc.exe [2012-5-27 1118648]

S3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;C:\Windows\System32\drivers\silabenm.sys [2010-10-31 27336]

S3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;C:\Windows\System32\drivers\silabser.sys [2010-10-31 67584]

S3 ThreatFire;ThreatFire;C:\Program Files (x86)\PC Tools\PC Tools Security\TFEngine\TFService.exe service --> C:\Program Files (x86)\PC Tools\PC Tools Security\TFEngine\TFService.exe service [?]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-6-12 59392]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2011-8-2 51712]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-10-7 1255736]

.

=============== Created Last 30 ================

.

2012-11-08 22:28:29 -------- d-----w- C:\Program Files\Enigma Software Group

2012-11-08 22:27:24 -------- d-----w- C:\Windows\83B952C7F8F34CA3B4C533C85B24E478.TMP

2012-11-08 22:26:57 -------- d-----w- C:\Program Files (x86)\Common Files\Wise Installation Wizard

2012-11-08 20:17:42 -------- d-----w- C:\Program Files (x86)\RegistryNuke 2012

2012-11-08 11:19:50 -------- d-sh--w- C:\$RECYCLE.BIN

2012-11-07 23:42:50 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy

2012-11-07 23:42:50 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy

2012-11-07 21:35:52 -------- d-----w- C:\ProgramData\bgxmlvkivhwfpqg

2012-11-07 19:31:40 -------- d-----w- C:\Users\Olsons\AppData\Roaming\CheckPoint

2012-11-07 19:31:09 -------- d-----w- C:\Program Files\CheckPoint

2012-11-07 19:22:29 -------- d-----w- C:\Program Files (x86)\CheckPoint

2012-11-07 19:22:28 -------- d-----w- C:\ProgramData\CheckPoint

2012-11-07 18:16:28 -------- d-----w- C:\Windows\pss

2012-11-07 17:58:55 1659760 ----a-w- C:\Windows\System32\drivers\ntfs.sys

2012-11-07 17:51:14 5559664 ----a-w- C:\Windows\System32\ntoskrnl.exe

2012-11-07 17:51:00 3968880 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

2012-11-07 17:51:00 3914096 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

2012-11-07 17:49:59 4096 ---ha-w- C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll

2012-11-07 17:49:58 4096 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll

2012-11-07 17:49:58 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll

2012-11-07 17:49:57 4096 ---ha-w- C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll

2012-11-07 17:49:57 3072 ---ha-w- C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll

2012-11-07 17:49:56 2048 ----a-w- C:\Windows\SysWow64\user.exe

2012-11-07 17:28:20 220160 ----a-w- C:\Windows\System32\wintrust.dll

2012-11-07 17:28:19 172544 ----a-w- C:\Windows\SysWow64\wintrust.dll

2012-11-07 17:27:32 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

2012-11-07 17:27:32 2048 ----a-w- C:\Windows\System32\tzres.dll

2012-11-07 17:26:05 715776 ----a-w- C:\Windows\System32\kerberos.dll

2012-11-07 17:26:05 542208 ----a-w- C:\Windows\SysWow64\kerberos.dll

2012-11-07 00:43:42 1464320 ----a-w- C:\Windows\System32\crypt32.dll

2012-11-07 00:43:41 1159680 ----a-w- C:\Windows\SysWow64\crypt32.dll

2012-11-07 00:43:40 184320 ----a-w- C:\Windows\System32\cryptsvc.dll

2012-11-07 00:43:40 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll

2012-11-07 00:43:40 140288 ----a-w- C:\Windows\System32\cryptnet.dll

2012-11-07 00:43:39 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll

.

==================== Find3M ====================

.

2012-11-07 19:52:00 73656 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-11-07 19:52:00 696760 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2012-08-22 18:12:50 1913200 ----a-w- C:\Windows\System32\drivers\tcpip.sys

2012-08-22 18:12:40 950128 ----a-w- C:\Windows\System32\drivers\ndis.sys

2012-08-22 18:12:40 376688 ----a-w- C:\Windows\System32\drivers\netio.sys

2012-08-22 18:12:33 288624 ----a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS

2012-08-21 21:01:00 245760 ----a-w- C:\Windows\System32\OxpsConverter.exe

2012-08-20 18:48:44 362496 ----a-w- C:\Windows\System32\wow64win.dll

2012-08-20 18:48:44 243200 ----a-w- C:\Windows\System32\wow64.dll

2012-08-20 18:48:44 13312 ----a-w- C:\Windows\System32\wow64cpu.dll

2012-08-20 18:48:43 215040 ----a-w- C:\Windows\System32\winsrv.dll

2012-08-20 18:48:37 16384 ----a-w- C:\Windows\System32\ntvdm64.dll

2012-08-20 18:48:35 424448 ----a-w- C:\Windows\System32\KernelBase.dll

2012-08-20 18:46:22 338432 ----a-w- C:\Windows\System32\conhost.exe

2012-08-20 17:40:21 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll

2012-08-20 17:38:44 44032 ----a-w- C:\Windows\apppatch\acwow64.dll

2012-08-20 17:38:26 25600 ----a-w- C:\Windows\SysWow64\setup16.exe

2012-08-20 17:37:19 5120 ----a-w- C:\Windows\SysWow64\wow32.dll

2012-08-20 17:37:18 274944 ----a-w- C:\Windows\SysWow64\KernelBase.dll

2012-08-20 15:38:21 7680 ----a-w- C:\Windows\SysWow64\instnm.exe

2012-08-20 15:33:28 6144 ---ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll

2012-08-20 15:33:28 4608 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll

2012-08-20 15:33:28 3584 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll

2012-08-20 15:33:28 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll

.

============= FINISH: 10:48:54.93 ===============

And here is attach.txt:

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-07.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume2

Install Date: 10/5/2010 4:04:54 PM

System Uptime: 11/8/2012 3:20:50 PM (19 hours ago)

.

Motherboard: Dell Inc. | | 04GJJT

Processor: AMD Athlon™ II X2 240 Processor | CPU 1 | 784/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 586 GiB total, 494.831 GiB free.

D: is CDROM ()

E: is Removable

F: is Removable

G: is Removable

H: is Removable

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP122: 9/21/2012 - Scheduled Checkpoint

RP123: 9/27/2012 3:00:12 AM - Windows Update

RP124: 10/5/2012 12:00:01 AM - Scheduled Checkpoint

RP125: 11/6/2012 6:34:12 PM - Scheduled Checkpoint

RP126: 11/7/2012 3:00:37 AM - Windows Update

RP127: 11/7/2012 11:59:32 AM - Windows Update

RP128: 11/7/2012 1:56:22 PM - Windows Modules Installer

RP129: 11/7/2012 4:25:21 PM - Installed Microsoft Fix it 50267

RP130: 11/8/2012 3:00:12 AM - Windows Update

RP131: 11/8/2012 2:27:32 PM - Installed SpyHunter

RP132: 11/8/2012 3:17:35 PM - Removed SpyHunter

.

==== Installed Programs ======================

.

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader 9.5.0

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ATI Catalyst Control Center

Bing Rewards Client Installer

Bonjour

Browser Guard 4.0

CaddieSync Express 1.2.9

Carbonite

Catalyst Control Center - Branding

Catalyst Control Center Core Implementation

Catalyst Control Center Graphics Full Existing

Catalyst Control Center Graphics Full New

Catalyst Control Center Graphics Light

Catalyst Control Center Graphics Previews Common

Catalyst Control Center Graphics Previews Vista

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

ccc-core-static

ccc-utility64

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

Consumer In-Home Service Agreement

D3DX10

Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition

Dell DataSafe Local Backup

Dell DataSafe Local Backup - Support Software

Dell DataSafe Online

Dell Dock

Dell Edoc Viewer

Dell Getting Started Guide

GoToAssist 8.0.0.514

iTunes

Java Auto Updater

Java™ 6 Update 20 (64-bit)

Java™ 6 Update 22

Junk Mail filter update

Logitech Harmony Remote Software 7

Malwarebytes Anti-Malware version 1.65.1.1000

Microsoft .NET Framework 1.1

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Application Error Reporting

Microsoft Default Manager

Microsoft Office 2010 Service Pack 1 (SP1)

Microsoft Office Access MUI (English) 2010

Microsoft Office Access Setup Metadata MUI (English) 2010

Microsoft Office Excel MUI (English) 2010

Microsoft Office Home and Student 2010

Microsoft Office Office 64-bit Components 2010

Microsoft Office OneNote MUI (English) 2010

Microsoft Office Outlook MUI (English) 2010

Microsoft Office PowerPoint MUI (English) 2010

Microsoft Office Proof (English) 2010

Microsoft Office Proof (French) 2010

Microsoft Office Proof (Spanish) 2010

Microsoft Office Proofing (English) 2010

Microsoft Office Publisher MUI (English) 2010

Microsoft Office Shared 64-bit MUI (English) 2010

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010

Microsoft Office Shared MUI (English) 2010

Microsoft Office Shared Setup Metadata MUI (English) 2010

Microsoft Office Single Image 2010

Microsoft Office Word MUI (English) 2010

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft UI Engine

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

MSVCRT

MSVCRT_amd64

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 4.0 SP2 Parser and SDK

PC Tools Spyware Doctor with AntiVirus 9.0

QuickBooks

QuickBooks Premier: Accountant Edition 2007

QuickBooks Pro 2012

QuickBooks Product Listing Service

QuickTime

Realtek High Definition Audio Driver

Remote Control USB Driver

Roxio Burn

Security Update for CAPICOM (KB931906)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

Security Update for Microsoft .NET Framework 4 Extended (KB2656351)

Security Update for Microsoft Excel 2010 (KB2597166) 32-Bit Edition

Security Update for Microsoft InfoPath 2010 (KB2687417) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2553091)

Security Update for Microsoft Office 2010 (KB2553096)

Security Update for Microsoft Office 2010 (KB2553260) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2553447) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2589322) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2597986) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2598243) 32-Bit Edition

Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition

Security Update for Microsoft SharePoint Workspace 2010 (KB2566445)

Security Update for Microsoft Visio Viewer 2010 (KB2598287) 32-Bit Edition

Security Update for Microsoft Word 2010 (KB2553488) 32-Bit Edition

Silicon Laboratories CP210x USB to UART Bridge (Driver Removal)

Silicon Laboratories CP210x VCP Drivers for Windows XP/2003 Server/Vista/7

Skins

SkyCaddie Desktop

Skype Toolbars

Skype™ 5.10

SupportSoft Assisted Service

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft .NET Framework 4 Extended (KB2468871)

Update for Microsoft .NET Framework 4 Extended (KB2533523)

Update for Microsoft .NET Framework 4 Extended (KB2600217)

Update for Microsoft Office 2010 (KB2494150)

Update for Microsoft Office 2010 (KB2553065)

Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition

Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition

Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition

Update for Microsoft Office 2010 (KB2553272) 32-Bit Edition

Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition

Update for Microsoft Office 2010 (KB2566458)

Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition

Update for Microsoft Office 2010 (KB2598289) 32-Bit Edition

Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition

Update for Microsoft OneNote 2010 (KB2589345) 32-Bit Edition

Update for Microsoft Outlook 2010 (KB2553248) 32-Bit Edition

Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition

Windows Live Communications Platform

Windows Live Essentials

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Language Selector

Windows Live Mail

Windows Live Messenger

Windows Live MIME IFilter

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live Sync

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

ZoneAlarm Firewall

ZoneAlarm Free Firewall

ZoneAlarm LTD Toolbar

ZoneAlarm Security

.

==== Event Viewer Messages From Past Week ========

.

11/8/2012 3:21:22 PM, Error: Service Control Manager [7023] - The Function Discovery Resource Publication service terminated with the following error: %%-2147024891

11/8/2012 3:21:21 PM, Error: Service Control Manager [7003] - The McAfee Personal Firewall Service service depends the following service: MpsSvc. This service might not be installed.

11/8/2012 3:21:21 PM, Error: Service Control Manager [7001] - The MBAMService service depends on the MBAMProtector service which failed to start because of the following error: The system cannot find the file specified.

11/8/2012 3:21:18 PM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.

11/8/2012 3:21:07 PM, Error: Service Control Manager [7000] - The MBAMProtector service failed to start due to the following error: The system cannot find the file specified.

11/8/2012 3:02:54 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the SoftThinks Agent Service service to connect.

11/8/2012 3:02:54 PM, Error: Service Control Manager [7000] - The SoftThinks Agent Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

11/8/2012 3:02:24 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the PC Tools Security Service service to connect.

11/8/2012 3:02:24 PM, Error: Service Control Manager [7000] - The PC Tools Security Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

11/8/2012 12:14:26 PM, Error: Schannel [36888] - The following fatal alert was generated: 10. The internal error state is 10.

11/7/2012 4:29:13 PM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.

11/7/2012 4:29:12 PM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.

11/7/2012 3:33:38 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.

11/7/2012 12:26:54 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800f0826: Update for Windows 7 for x64-based Systems (KB2756822).

11/7/2012 12:26:54 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800f0826: Update for Windows 7 for x64-based Systems (KB2749655).

11/7/2012 12:26:54 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800f0826: Update for Windows 7 for x64-based Systems (KB2739159).

11/7/2012 12:26:54 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800f0826: Update for Windows 7 for x64-based Systems (KB2731771).

11/7/2012 12:26:54 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800f0826: Update for Windows 7 for x64-based Systems (KB2709981).

11/7/2012 12:26:54 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800f0826: Security Update for Windows 7 for x64-based Systems (KB2743555).

11/7/2012 12:26:54 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800f0826: Security Update for Windows 7 for x64-based Systems (KB2731847).

11/7/2012 12:26:54 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800f0826: Security Update for Windows 7 for x64-based Systems (KB2724197).

11/7/2012 12:26:54 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070002: Update for Windows 7 for x64-based Systems (KB2592687).

11/7/2012 12:18:11 PM, Error: VDS Basic Provider [1] - Unexpected failure. Error code: D@01010004

11/7/2012 11:31:57 AM, Error: Service Control Manager [7030] - The TrueVector Internet Monitor service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

11/7/2012 10:24:53 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}

11/7/2012 10:22:34 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}

11/7/2012 10:22:34 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

11/7/2012 10:22:33 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

11/7/2012 10:22:29 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service CarboniteService with arguments "" in order to run the server: {36471C67-6A93-4434-92CC-4C614CD06666}

11/7/2012 10:22:27 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache PCTSD spldr TfFsMon TFSysMon Wanarpv6

11/7/2012 10:22:27 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}

11/7/2012 10:22:03 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.

11/7/2012 10:19:23 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Apple Mobile Device service to connect.

11/7/2012 10:19:23 AM, Error: Service Control Manager [7000] - The Apple Mobile Device service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

11/7/2012 10:14:26 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the McAfee Proxy Service service, but this action failed with the following error: An instance of the service is already running.

11/7/2012 10:13:26 AM, Error: Service Control Manager [7031] - The McAfee Services service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

11/7/2012 10:13:26 AM, Error: Service Control Manager [7031] - The McAfee Proxy Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

11/7/2012 10:13:26 AM, Error: Service Control Manager [7031] - The McAfee Network Agent service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

11/7/2012 10:08:01 AM, Error: Service Control Manager [7031] - The McAfee McShield service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

11/6/2012 3:25:39 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service McNaiAnn with arguments "" in order to run the server: {DC7EF8E1-824F-4110-AB43-1604DA9B4F40}

.

==== End Of File ===========================

Any help is appreciated. I look forward to your response.

Kevin

gringo_pr · November 9, 2012

Greetings and Welcome to The Forums!!

My name is Gringo and I'll be glad to help you with your malware problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
[*]Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
[*]Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
[*]Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.

-Security Check-

Download Security Check by screen317 from

here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-AdwCleaner-

Please download

AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

--RogueKiller--

Download & SAVE to your Desktop RogueKiller or from here
- Quit all programs that you may have started.
- Please disconnect any USB or external drives from the computer before you run this scan!
- For Vista or Windows 7, right-click and select "Run as Administrator to start"
- For Windows XP, double-click to start.
- Wait until Prescan has finished ...
- Then Click on "Scan" button
- Wait until the Status box shows "Scan Finished"
- click on "delete"
- Wait until the Status box shows "Deleting Finished"
- Click on "Report" and copy/paste the content of the Notepad into your next reply.
- The log should be found in RKreport[1].txt on your Desktop
- Exit/Close RogueKiller+

Gringo

BigKev · November 9, 2012

Here are the logs:

Results of screen317's Security Check version 0.99.54

Windows 7 Service Pack 1 x64 (UAC is enabled)

Internet Explorer 9

``````````````Antivirus/Firewall Check:``````````````

PC Tools Spyware Doctor with AntiVirus

WMI entry may not exist for antivirus; attempting automatic update.

`````````Anti-malware/Other Utilities Check:`````````

PC Tools Spyware Doctor with AntiVirus 9.0

Malwarebytes Anti-Malware version 1.65.1.1000

Java 6 Update 22

Java version out of Date!

Adobe Flash Player 11.4.402.287

Adobe Reader 9 Adobe Reader out of Date!

````````Process Check: objlist.exe by Laurent````````

Malwarebytes' Anti-Malware mbamscheduler.exe

CheckPoint ZoneAlarm vsmon.exe

CheckPoint ZoneAlarm zatray.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 0%

````````````````````End of Log``````````````````````

# AdwCleaner v2.007 - Logfile created 11/09/2012 at 15:36:23

# Updated 06/11/2012 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Olsons - OLSONS-PC

# Boot Mode : Normal

# Running from : C:\Users\Olsons\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

***** [Registry] *****

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

*************************

AdwCleaner[s1].txt - [704 octets] - [09/11/2012 15:36:23]

########## EOF - C:\AdwCleaner[s1].txt - [763 octets] ##########

RogueKiller V8.2.3 [11/07/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website: http://tigzy.geekstogo.com/roguekiller.php

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Olsons [Admin rights]

Mode : Scan -- Date : 11/09/2012 15:40:38

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 14 ¤¤¤

[TASK][sUSP PATH] Carbonite Upgrade Check : "C:\ProgramData\Carbonite\Carbonite Backup\CarboniteUpgrade.exe" /silent -> FOUND

[TASK][sUSP PATH] {5F6010C8-60E5-41f3-BF5B-C3AF5DBE12D4} : "C:\ProgramData\Carbonite\Carbonite Backup\CarboniteUpgrade.exe" /silent -> FOUND

[HJPOL] HKCU\[...]\System : disableregistrytools (0) -> FOUND

[HJPOL] HKLM\[...]\System : DisableTaskMgr (0) -> FOUND

[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

[HJPOL] HKLM\[...]\Wow6432Node\System : DisableTaskMgr (0) -> FOUND

[HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> FOUND

[HJ DESK] HKCU\[...]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[HJ DESK] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-18\$42f8b41a722cb0f3e433f2558f879240\n.) -> FOUND

[HJ INPROC][ZeroAccess] HKLM\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-18\$42f8b41a722cb0f3e433f2558f879240\n.) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ Infection : Rans.Gendarm|Rans.Gendarm ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost

::1 localhost

188.119.151.113 www.google-analytics.com.

188.119.151.113 ad-emea.doubleclick.net.

188.119.151.113 www.statcounter.com.

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD6400AAKS-75A7B2 ATA Device +++++

--- User ---

[MBR] c351b0355ec5a2ace005552be9a53e96

[bSP] bd88243ba1753a8780c06e4eb19307c6 : Windows Vista MBR Code

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 10118 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 20803584 | Size: 600307 Mo

User != LL1 ... KO!

--- LL1 ---

[MBR] 337d0a0c80dd401b7154f9b94e162d9a

[bSP] bd88243ba1753a8780c06e4eb19307c6 : Windows Vista MBR Code [possible maxSST in 3!]

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 10118 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 20803584 | Size: 600307 Mo

3 - [ACTIVE] NTFS (0x17) [HIDDEN!] Offset (sectors): 1250234368 | Size: 10 Mo

User != LL2 ... KO!

--- LL2 ---

[MBR] 337d0a0c80dd401b7154f9b94e162d9a

[bSP] bd88243ba1753a8780c06e4eb19307c6 : Windows Vista MBR Code [possible maxSST in 3!]

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 10118 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 20803584 | Size: 600307 Mo

3 - [ACTIVE] NTFS (0x17) [HIDDEN!] Offset (sectors): 1250234368 | Size: 10 Mo

Finished : << RKreport[1]_S_11092012_02d1540.txt >>

RKreport[1]_S_11092012_02d1540.txt

RogueKiller V8.2.3 [11/07/2012] by Tigzy

mail: tigzyRK<at>gmail<dot>com

Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website: http://tigzy.geekstogo.com/roguekiller.php

Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Olsons [Admin rights]

Mode : Remove -- Date : 11/09/2012 15:41:31

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 11 ¤¤¤

[TASK][sUSP PATH] Carbonite Upgrade Check : "C:\ProgramData\Carbonite\Carbonite Backup\CarboniteUpgrade.exe" /silent -> DELETED

[TASK][sUSP PATH] {5F6010C8-60E5-41f3-BF5B-C3AF5DBE12D4} : "C:\ProgramData\Carbonite\Carbonite Backup\CarboniteUpgrade.exe" /silent -> DELETED

[HJPOL] HKCU\[...]\System : disableregistrytools (0) -> DELETED

[HJPOL] HKLM\[...]\System : DisableTaskMgr (0) -> DELETED

[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> DELETED

[HJ DESK] HKCU\[...]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)

[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

[HJ DESK] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> REPLACED (0)

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-18\$42f8b41a722cb0f3e433f2558f879240\n.) -> REPLACED (C:\Windows\system32\wbem\fastprox.dll)

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ Infection : Rans.Gendarm|Rans.Gendarm ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost

::1 localhost

188.119.151.113 www.google-analytics.com.

188.119.151.113 ad-emea.doubleclick.net.

188.119.151.113 www.statcounter.com.

Thanks.

Kevin

gringo_pr · November 10, 2012

Hello

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

gringo_pr · November 12, 2012

Greetings

I have not heard from you in a couple of days so I am coming by to check on you to see if you are having problems or you just need some more time.

Also to remind you that it is very important that we finish the process completely so as to not get reinfected. I will let you know when we are complete and I will ask to remove our tools

Gringo

BigKev · November 12, 2012

I apologize for not getting back to you for a few days. I had to leave town for the weekend. I will run the latest fix and post the results tomorrow.

Thanks.

gringo_pr · November 12, 2012

no problem

gringo

BigKev · November 12, 2012

Here is the Comofix log:

ComboFix 12-11-12.02 - Olsons 11/12/2012 8:39.1.2 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.2815.1076 [GMT -8:00]

Running from: c:\users\Olsons\Desktop\ComboFix.exe

AV: PC Tools Spyware Doctor with AntiVirus *Disabled/Updated* {2F668A56-D5E0-2DF1-A0AE-CB1284F42AB2}

FW: ZoneAlarm Free Firewall Firewall *Disabled* {E6380B7E-D4B2-19F1-083E-56486607704B}

SP: PC Tools Spyware Doctor with AntiVirus *Disabled/Updated* {94076BB2-F3DA-227F-9A1E-F060FF73600F}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\ANTIGEN.dll

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\ANTIGEN.tmp

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\CLSV.exe

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\delfile.dll

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\dudl.exe

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\dudl.tmp

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\eb.sys

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\energy.drv

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\energy.exe

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\energy.tmp

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\exec.exe

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\fan.dll

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\fix.drv

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\FW.drv

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\gid.tmp

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\grid.tmp

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\hymt.sys

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\kernel32.drv

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\pal.sys

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\PE.dll

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\PE.drv

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\PE.tmp

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\ppal.dll

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\ppal.exe

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\SICKBOY.drv

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\sld.dll

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\SM.drv

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\std.dll

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\std.tmp

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\tjd.drv

c:\users\Olsons\AppData\Roaming\Microsoft\Windows\Recent\tjd.sys

c:\users\Olsons\Documents\DPE.DUS

c:\windows\security\Database\tmp.edb

c:\windows\SysWow64\URTTemp

c:\windows\SysWow64\URTTemp\regtlib.exe

.

((((((((((((((((((((((((( Files Created from 2012-10-12 to 2012-11-12 )))))))))))))))))))))))))))))))

.

2012-11-12 17:16 . 2012-11-12 17:16 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-11-08 22:28 . 2012-11-08 22:28 -------- d-----w- c:\program files\Enigma Software Group

2012-11-08 22:27 . 2012-11-08 23:19 -------- d-----w- c:\windows\83B952C7F8F34CA3B4C533C85B24E478.TMP

2012-11-08 22:26 . 2012-11-08 22:26 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard

2012-11-08 20:17 . 2012-11-08 23:16 -------- d-----w- c:\program files (x86)\RegistryNuke 2012

2012-11-07 23:42 . 2012-11-08 23:17 -------- d-----w- c:\programdata\Spybot - Search & Destroy

2012-11-07 23:42 . 2012-11-08 23:16 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy

2012-11-07 21:35 . 2012-11-07 22:08 -------- d-----w- c:\programdata\bgxmlvkivhwfpqg

2012-11-07 19:31 . 2012-11-07 19:31 -------- d-----w- c:\users\Olsons\AppData\Roaming\CheckPoint

2012-11-07 19:31 . 2012-11-07 19:31 -------- d-----w- c:\program files\CheckPoint

2012-11-07 19:22 . 2012-11-07 19:30 -------- d-----w- c:\program files (x86)\CheckPoint

2012-11-07 19:22 . 2012-11-07 19:22 -------- d-----w- c:\programdata\CheckPoint

2012-11-07 17:58 . 2012-08-31 18:19 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys

2012-11-07 17:51 . 2012-08-30 18:03 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-11-07 17:51 . 2012-08-30 17:12 3968880 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

2012-11-07 17:51 . 2012-08-30 17:12 3914096 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

2012-11-07 17:49 . 2012-08-20 18:38 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2012-11-07 17:49 . 2012-08-20 17:32 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll

2012-11-07 17:49 . 2012-08-20 17:32 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-console-l1-1-0.dll

2012-11-07 17:49 . 2012-08-20 18:38 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll

2012-11-07 17:49 . 2012-08-20 18:38 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll

2012-11-07 17:49 . 2012-08-20 15:38 2048 ----a-w- c:\windows\SysWow64\user.exe

2012-11-07 17:28 . 2012-08-24 18:05 220160 ----a-w- c:\windows\system32\wintrust.dll

2012-11-07 17:28 . 2012-08-24 16:57 172544 ----a-w- c:\windows\SysWow64\wintrust.dll

2012-11-07 17:27 . 2012-09-14 19:19 2048 ----a-w- c:\windows\system32\tzres.dll

2012-11-07 17:27 . 2012-09-14 18:28 2048 ----a-w- c:\windows\SysWow64\tzres.dll

2012-11-07 17:26 . 2012-08-11 00:56 715776 ----a-w- c:\windows\system32\kerberos.dll

2012-11-07 17:26 . 2012-08-10 23:56 542208 ----a-w- c:\windows\SysWow64\kerberos.dll

2012-11-07 00:43 . 2012-06-02 05:41 1464320 ----a-w- c:\windows\system32\crypt32.dll

2012-11-07 00:43 . 2012-06-02 04:36 1159680 ----a-w- c:\windows\SysWow64\crypt32.dll

2012-11-07 00:43 . 2012-06-02 05:41 184320 ----a-w- c:\windows\system32\cryptsvc.dll

2012-11-07 00:43 . 2012-06-02 05:41 140288 ----a-w- c:\windows\system32\cryptnet.dll

2012-11-07 00:43 . 2012-06-02 04:36 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll

2012-11-07 00:43 . 2012-06-02 04:36 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-11-07 20:04 . 2010-11-10 15:48 65309168 ----a-w- c:\windows\system32\MRT.exe

2012-11-07 19:52 . 2012-06-13 15:09 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2012-11-07 19:52 . 2011-05-18 00:07 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-08-22 18:12 . 2012-09-13 05:51 1913200 ----a-w- c:\windows\system32\drivers\tcpip.sys

2012-08-22 18:12 . 2012-09-13 05:51 950128 ----a-w- c:\windows\system32\drivers\ndis.sys

2012-08-22 18:12 . 2012-09-13 05:51 376688 ----a-w- c:\windows\system32\drivers\netio.sys

2012-08-22 18:12 . 2012-09-13 05:51 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS

2012-08-21 21:01 . 2012-09-26 23:39 245760 ----a-w- c:\windows\system32\OxpsConverter.exe

2012-08-20 17:38 . 2012-11-07 17:50 44032 ----a-w- c:\windows\apppatch\acwow64.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]

@="{95A27763-F62A-4114-9072-E81D87DE3B68}"

[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]

2011-03-02 04:07 750736 ----a-r- c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]

@="{E300CD91-100F-4E67-9AF3-1384A6124015}"

[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]

2011-03-02 04:07 750736 ----a-r- c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]

@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"

[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]

2011-03-02 04:07 750736 ----a-r- c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Carbonite Backup"="c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe" [2011-03-02 931472]

"Intuit SyncManager"="c:\program files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2012-06-05 2215768]

"ZoneAlarm"="c:\program files (x86)\CheckPoint\ZoneAlarm\zatray.exe" [2012-10-09 73392]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]

"c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"="c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [2011-09-22 560128]

.

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-15 1324384]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux1"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdAuxService]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdCoreService]

@="Service"

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-30 676936]

R2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

R3 pctplsg;pctplsg;c:\windows\System32\drivers\pctplsg64.sys [2012-05-11 92896]

R3 sdAuxService;PC Tools Auxiliary Service;c:\program files (x86)\PC Tools\PC Tools Security\pctsAuxs.exe [2012-05-11 402336]

R3 silabenm;Silicon Labs CP210x USB to UART Bridge Serial Port Enumerator Driver;c:\windows\system32\DRIVERS\silabenm.sys [2010-07-28 27336]

R3 silabser;Silicon Labs CP210x USB to UART Bridge Driver;c:\windows\system32\DRIVERS\silabser.sys [2010-07-28 67584]

R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2012-05-11 41968]

R3 ThreatFire;ThreatFire;c:\program files (x86)\PC Tools\PC Tools Security\TFEngine\TFService.exe service [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2011-08-03 51712]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-10-07 1255736]

S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2012-02-22 289664]

S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore64.sys [2012-04-23 426616]

S0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS64.sys [2012-02-28 453896]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2009-07-09 55280]

S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2012-05-11 65664]

S0 TFSysMon;TFSysMon;c:\windows\system32\drivers\TfSysMon.sys [2012-05-11 706776]

S1 pctgntdi;pctgntdi;c:\windows\System32\drivers\pctgntdi64.sys [2012-05-11 341168]

S1 PCTSD;PC Tools Spyware Doctor Driver;c:\windows\system32\Drivers\PCTSD64.sys [2012-05-11 251528]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-07-15 202752]

S2 Browser Defender Update Service;Browser Defender Update Service;c:\program files (x86)\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe [2012-05-09 575416]

S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]

S2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [2012-08-30 33712]

S2 IswSvc;ZoneAlarm LTD Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\IswSvc.exe [2012-08-30 827560]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-30 399432]

S2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [2012-03-20 162192]

S2 QBVSS;QBIDPService;c:\program files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe [2012-06-05 1248256]

S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-01-13 705856]

S3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2009-08-06 320040]

S3 PCTBD;PC Tools Browser Defender Driver;c:\windows\system32\Drivers\PCTBD64.sys [2012-05-09 85192]

.

Contents of the 'Scheduled Tasks' folder

.

2012-11-12 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-13 19:52]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]

@="{95A27763-F62A-4114-9072-E81D87DE3B68}"

[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]

2011-03-02 03:52 1142928 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]

@="{E300CD91-100F-4E67-9AF3-1384A6124015}"

[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]

2011-03-02 03:52 1142928 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]

@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"

[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]

2011-03-02 03:52 1142928 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-11-10 8321568]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.yahoo.com/

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~2\MIF5BA~1\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~2\MIF5BA~1\Office14\ONBttnIE.dll/105

LSP: c:\program files (x86)\Common Files\PC Tools\Lsp\PCTLsp.dll

TCP: DhcpNameServer = 192.168.1.178 192.168.1.179

Handler: intu-help-qb5 - {867FCB77-9823-4cd6-8210-D85F968D466F} - c:\program files (x86)\Intuit\QuickBooks 2012\HelpAsyncPluggableProtocol.dll

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

HKLM-Run-ISW - (no file)

AddRemove-SLABCOMM&10C4&EA60 - c:\program files (x86)\Silabs\MCU\CP210x\DriverUninstaller.exe VCP CP210x Cardinal\SLABCOMM&10C4&EA60

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-237684633-2471800293-1906079666-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.Email.1"

.

[HKEY_USERS\S-1-5-21-237684633-2471800293-1906079666-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.VCard.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

c:\program files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE

c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe

c:\program files (x86)\Dell DataSafe Local Backup\Toaster.exe

.

**************************************************************************

.

Completion time: 2012-11-12 09:45:19 - machine was rebooted

ComboFix-quarantined-files.txt 2012-11-12 17:45

.

Pre-Run: 530,821,992,448 bytes free

Post-Run: 530,589,863,936 bytes free

.

- - End Of File - - 86A4ED7439CB3EBF682781033A7F5A85

As far as the computer goes, it starts up normally and everything seems to run fine. IE opens normally, but as soon as I start to navigate anywhere, it runs very slow. It take about 30 seconds for Google to return a search query. Then, when I click on any search result it still is re-directing me to malicious sites. I close IE as soon as I see that I am being re-directed.

Other programs such as Excel open quickly, but when I attempt to open a file, it takes a long time for the "Open File" dialog box to open. From the time I click the Open File icon, the list of files doesn't open for about 30 seconds.

I'm using a different PC to post on this forum.

Thanks.

gringo_pr · November 12, 2012

Greetings

I want you to run these next,

tdsskiller:

Please read carefully and follow these steps.

Download TDSSKiller and save it to your Desktop.
doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
If an infected file is detected, the default action will be Cure, click on Continue.
If a suspicious file is detected, the default action will be Skip, click on Continue.
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Please download aswMBR to your desktop.

Double click the aswMBR.exe icon to run it
it will ask to download extra definitions - ALLOW IT
Click the Scan button to start the scan
On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

If you have any problems running either one come back and let me know

please reply with the reports from TDSSKiller and aswMBR

Gringo

BigKev · November 12, 2012

I've tried running TDSS killer twice and it doesn't run. The Windows prompt appears asking me if I want to allow TDSS to make changes to the computer, I click "Yes" and then nothing happens. Do I need to disable other anti-virus programs first? Or should I skip TDSS and move on to aswMBR?

gringo_pr · November 12, 2012

Greetings

I need you to make a bootable usb and to make a screenshot for me - follow the instructions below to do this

How to create a bootable Puppy USB Drive

Download and save a copy of the latest Puppy ISO file
Download and save a copy of Unetbootin for Windows.
Insert an empty formatted USB drive into a USB port on the computer that's being used to create the bootable USB.
Launch Unetbootin ....
Ensure that Disk Image is selected.
Using the browse button ... browse to and select the Puppy ISO file.
Ensure that Type: is set to USB Drive and that the Drive: letter corresponds to the USB drive.
Click OK

Unetbootin will now copy the Puppy files to the USB and make it a bootable device.

Read HERE for instructions how to do this.

Now boot into Puppylinux

when you get to the desktop Click on each of the drive items found in the bottom left corner to mount them (when mounted they will have a red cross next to them)

Next - Launch GParted which is found at Menu > System > GParted partition manager,

Click to select All Drives then click Okay

I need you to take a screenshot of the window that opens up - to do this follow these instructions

To take a screenshot in Puppy ....

With the GParted window open ...

Click menu > Graphic > mtPaint-snapshot screen capture
A small window will open ....
- Click Capture Now
- Click OK
[*]The mtPaint program will open ....
- Click File > Save
- Double click on ../
- Double click on mnt/
- Double click on sdb1/
- Set File Format to JPEG
- Enter screenshot1 into the text box
- Click OK

This will save a file screenshot1.jpeg into the USB drive, paste or attach this to your next post

Click menu > shutdown > power off computer
If prompted to save the session click on No

Puppy will now close down.

remove the usb and save it - we will use it again - boot back into windows and send me the screen capture

gringo

BigKev · November 12, 2012

What am I trying to get a screenshot of? I'm sorry for asking, but I'm just not sure what you need to see and this looks like a lot of work. Also, every time I insert a thumb drive into the USB slot Windows tells me that it needs to format the disk before I can use it. I know the drive works because I can use it in other PCs just fine so I'm worried that the bootable USB drive won't work. Can you please confirm that you still want me to perform the steps above?

Thanks.

gringo_pr · November 12, 2012

Hello

yes it may be allot of work but this is a nasty virus

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 10118 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 20803584 | Size: 600307 Mo

3 - [ACTIVE] NTFS (0x17) [HIDDEN!] Offset (sectors): 1250234368 | Size: 10 Mo

this hidden partition is what is causing all the trouble - we need to work on this before windows starts so we need to use GParted to remove it

you can make the usb from any computer that works

BigKev · November 12, 2012

Got it. I'll get to work on it!

Thanks.

gringo_pr · November 12, 2012

get me the screenshot and then we can get to work

gringo

BigKev · November 12, 2012

I have the computer booted with Precise Puppy. When I click on the drives all of them will allow me to mount them and they will show the red cross except for "sda4" (which I assume is the hidden partition). When I select it, I get a window that says:

"DO NOT REMOVE MOUNTED MEDIA"

Then it lists the 4 drives.

Next to 3 of them and "UNMOUNT" button

The last one reads "sda4 ntfs 10M" with a MOUNT button nexxt to it.

At the bottom of the window are: "preferences" "refresh" "quit"

What should I do next?

Separate question: How do I post the screenshot to this forum?

Thanks.

BigKev · November 12, 2012

I tried to mount that hidden partition and I received an error message that said Puppy was unable to mount the disk. I went ahead and grabbed the screenshot (attached). Hope this helps.

Let me know where to go from here.

Thanks.

gringo_pr · November 13, 2012

hello

I need you to boot back into GParted and this time I want you to right click on the second (SDA2) and select manage flags and the select boot

click on apply and boot back into windows to report back here

If you have trouble booting into windows I want you to do the same process for the third partition (SDA3)

Gringo

BigKev · November 13, 2012

OK. I set SDA2 to boot and when I rebooted to Windows I got a Windows Error Recovery screen as shown below. It launched a Startup Repair utility that I cancelled.

I set SDA3 to boot and when that booted I received an error that "BOOTMGR is missing"

gringo_pr · November 13, 2012

Hello

download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

- Startup Repair
  System Restore
  Windows Complete PC Restore
  Windows Memory Diagnostic Tool
  Command Prompt

[*]Select Command Prompt

[*]In the command window type in notepad and press Enter.

[*]The notepad opens. Under File menu select Open.

[*]Select "Computer" and find your flash drive letter and close the notepad.

[*]In the command window type e:\frst64.exe and press Enter

Note: Replace letter e with the drive letter of your flash drive.

[*]The tool will start to run.

[*]When the tool opens click Yes to disclaimer.

[*]First Press the Scan button.

[*]It will make a log (FRST.txt)

[*]Second Type the following in the edit box after "Search:". services.exe

[*]Click the Search button

[*]It will make a log (Search.txt)

I want you to poste Both the FRST.txt report and the Search.txt into your reply to me

Gringo

BigKev · November 13, 2012

Does it matter which drive partition is set to "boot?" Currently it is set to sda3 but it won't boot normally. Let me know if I need to switch it to another drive. If not I'll leave it on sda3.

Thanks.

BigKev · November 13, 2012

Here is FRST.TXT

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 12-11-2012

Ran by SYSTEM at 13-11-2012 06:17:12

Running from J:\

Windows 7 Home Premium (X64) OS Language: English(US)

The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [8321568 2009-11-09] (Realtek Semiconductor)

HKLM\...\Run: [iSW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe /icon="hidden" [1127592 2012-08-30] (Check Point Software Technologies)

HKLM-x32\...\Run: [Carbonite Backup] C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe [931472 2011-03-01] (Carbonite, Inc.)

HKLM-x32\...\Run: [ZoneAlarm] "C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe" [73392 2012-10-09] (Check Point Software Technologies LTD)

HKLM-x32\...\Run: [iSTray] "C:\Program Files (x86)\PC Tools\PC Tools Security\pctsGui.exe" /hideGUI [2670520 2012-05-11] (PC Tools)

HKLM-x32\...\RunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [560128 2011-09-21] (Dell)

Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X]

Tcpip\Parameters: [DhcpNameServer] 192.168.1.178 192.168.1.179

Startup: C:\Users\Default\Start Menu\Programs\Startup\Dell Dock First Run.lnk

ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

Startup: C:\Users\Default User\Start Menu\Programs\Startup\Dell Dock First Run.lnk

ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

==================== Services (Whitelisted) ===================

2 Browser Defender Update Service; "C:\Program Files (x86)\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe" [575416 2012-05-08] (Threat Expert Ltd.)

2 IswSvc; "C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe" [827560 2012-08-30] (Check Point Software Technologies)

2 MBAMScheduler; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe" [399432 2012-09-29] (Malwarebytes Corporation)

2 MBAMService; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe" [676936 2012-09-29] (Malwarebytes Corporation)

2 mfevtp; "C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe" [162192 2012-03-20] (McAfee, Inc.)

2 sdAuxService; C:\Program Files (x86)\PC Tools\PC Tools Security\pctsAuxs.exe [402336 2012-05-11] (PC Tools)

2 sdCoreService; C:\Program Files (x86)\PC Tools\PC Tools Security\pctsSvc.exe [1118648 2012-05-11] (PC Tools)

3 ThreatFire; C:\Program Files (x86)\PC Tools\PC Tools Security\TFEngine\TFService.exe service [71008 2012-05-11] (PC Tools)

2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe -service [2447440 2012-10-09] (Check Point Software Technologies LTD)

2 McMPFSvc; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [x]

==================== Drivers (Whitelisted) =====================

2 ISWKL; \??\C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [33712 2012-08-30] (Check Point Software Technologies)

0 mfehidk; C:\Windows\System32\Drivers\mfehidk.sys [647208 2012-02-22] (McAfee, Inc.)

0 mfewfpk; C:\Windows\System32\Drivers\mfewfpk.sys [289664 2012-02-22] (McAfee, Inc.)

3 PCTBD; C:\Windows\System32\Drivers\PCTBD64.sys [85192 2012-05-08] (PC Tools)

0 PCTCore; C:\Windows\System32\drivers\PCTCore64.sys [426616 2012-04-23] (PC Tools)

0 pctDS; C:\Windows\System32\drivers\pctDS64.sys [453896 2012-02-28] (PC Tools)

1 pctgntdi; \??\C:\Windows\System32\drivers\pctgntdi64.sys [341168 2012-05-11] (PC Tools)

3 pctplsg; \??\C:\Windows\System32\drivers\pctplsg64.sys [92896 2012-05-11] (PC Tools)

1 PCTSD; C:\Windows\System32\Drivers\PCTSD64.sys [251528 2012-05-11] (PC Tools)

0 TfFsMon; C:\Windows\System32\Drivers\TfFsMon.sys [65664 2012-05-11] (PC Tools)

3 TfNetMon; C:\Windows\System32\Drivers\TfNetMon.sys [41968 2012-05-11] (PC Tools)

0 TFSysMon; C:\Windows\System32\Drivers\TFSysMon.sys [706776 2012-05-11] (PC Tools)

1 Vsdatant; C:\Windows\System32\Drivers\Vsdatant.sys [454232 2011-05-07] (Check Point Software Technologies LTD)

3 catchme; \??\C:\ComboFix\catchme.sys [x]

3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]

3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [x]

==================== NetSvcs (Whitelisted) ====================

==================== One Month Created Files and Folders ========

2012-11-13 06:16 - 2012-11-13 06:16 - 00000000 ____D C:\FRST

2012-11-12 12:42 - 2012-11-12 12:43 - 04301324 ____A C:\Users\Olsons\Desktop\tdsskiller.zip

2012-11-12 12:29 - 2012-11-12 12:44 - 04732416 ____A (AVAST Software) C:\Users\Olsons\Desktop\aswMBR.exe

2012-11-12 12:28 - 2012-11-12 12:43 - 02213976 ____A (Kaspersky Lab ZAO) C:\Users\Olsons\Desktop\tdsskiller.exe

2012-11-12 11:46 - 2012-11-12 11:46 - 00022464 ____A C:\Users\Olsons\Desktop\combofix.txt

2012-11-12 11:45 - 2012-11-12 11:45 - 00022464 ____A C:\ComboFix.txt

2012-11-12 10:32 - 2011-06-26 00:45 - 00256000 ____A C:\Windows\PEV.exe

2012-11-12 10:32 - 2010-11-07 11:20 - 00208896 ____A C:\Windows\MBR.exe

2012-11-12 10:32 - 2000-08-30 18:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe

2012-11-12 10:32 - 2000-08-30 18:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe

2012-11-12 10:32 - 2000-08-30 18:00 - 00098816 ____A C:\Windows\sed.exe

2012-11-12 10:32 - 2000-08-30 18:00 - 00080412 ____A C:\Windows\grep.exe

2012-11-12 10:32 - 2000-08-30 18:00 - 00068096 ____A C:\Windows\zip.exe

2012-11-12 10:31 - 2012-11-12 11:46 - 00000000 ____D C:\ComboFix

2012-11-12 10:27 - 2012-11-12 10:27 - 04997167 ____A C:\Users\Olsons\Desktop\ComboFix.zip

2012-11-12 10:23 - 2012-11-12 10:28 - 05000730 ____R (Swearware) C:\Users\Olsons\Desktop\ComboFix.exe

2012-11-12 10:21 - 2009-04-19 22:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe

2012-11-09 17:41 - 2012-11-09 17:41 - 00003586 ____A C:\Users\Olsons\Desktop\RKreport[2]_D_11092012_02d1541.txt

2012-11-09 17:40 - 2012-11-09 17:41 - 00000000 ____D C:\Users\Olsons\Desktop\RK_Quarantine

2012-11-09 17:40 - 2012-11-09 17:40 - 00003730 ____A C:\Users\Olsons\Desktop\RKreport[1]_S_11092012_02d1540.txt

2012-11-09 17:38 - 2012-11-09 17:38 - 00000829 ____A C:\Users\Olsons\Desktop\AdwCleaner[s1].txt

2012-11-09 17:36 - 2012-11-09 17:36 - 00000829 ____A C:\AdwCleaner[s1].txt

2012-11-09 17:33 - 2012-11-09 17:33 - 00001052 ____A C:\Users\Olsons\Desktop\checkup.txt

2012-11-09 17:25 - 2012-11-09 17:25 - 01953636 ____A C:\Users\Olsons\Desktop\adwcleaner.zip

2012-11-09 16:58 - 2012-11-09 17:25 - 00666112 ____A C:\Users\Olsons\Desktop\RogueKiller.exe

2012-11-09 16:57 - 2012-11-09 17:25 - 00881833 ____A C:\Users\Olsons\Desktop\SecurityCheck.exe

2012-11-09 16:57 - 2012-11-09 17:25 - 00541569 ____A C:\Users\Olsons\Desktop\adwcleaner.exe

2012-11-08 16:30 - 2012-11-08 16:30 - 00000000 ____A C:\autoexec.bat

2012-11-08 16:28 - 2012-11-08 16:28 - 00000000 ____D C:\Program Files\Enigma Software Group

2012-11-08 16:27 - 2012-11-08 17:19 - 00000000 ____D C:\Windows\83B952C7F8F34CA3B4C533C85B24E478.TMP

2012-11-08 14:17 - 2012-11-08 17:16 - 00000000 ____D C:\Program Files (x86)\RegistryNuke 2012

2012-11-07 18:35 - 2012-11-12 11:46 - 00000000 ____D C:\Qoobox

2012-11-07 18:34 - 2012-11-12 11:29 - 00000000 ____D C:\Windows\erdnt

2012-11-07 17:42 - 2012-11-08 17:17 - 00000000 ____D C:\Users\All Users\Spybot - Search & Destroy

2012-11-07 17:42 - 2012-11-08 17:17 - 00000000 ____D C:\Users\All Users\Application Data\Spybot - Search & Destroy

2012-11-07 17:42 - 2012-11-08 17:16 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy

2012-11-07 17:35 - 2012-11-07 17:41 - 16409960 ____A (Safer Networking Limited ) C:\Users\Olsons\Downloads\spybotsd162.exe

2012-11-07 16:03 - 2012-11-07 16:08 - 00097642 ____A C:\Users\All Users\gotleqmnrovyafk

2012-11-07 16:03 - 2012-11-07 16:08 - 00097642 ____A C:\Users\All Users\Application Data\gotleqmnrovyafk

2012-11-07 15:58 - 2012-11-07 15:58 - 17810944 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 12319744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 10925568 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 09738240 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 03695416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat

2012-11-07 15:58 - 2012-11-07 15:58 - 03695416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat

2012-11-07 15:58 - 2012-11-07 15:58 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2012-11-07 15:58 - 2012-11-07 15:58 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2012-11-07 15:58 - 2012-11-07 15:58 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl

2012-11-07 15:58 - 2012-11-07 15:58 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2012-11-07 15:58 - 2012-11-07 15:58 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00534528 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00452608 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00448512 ____A (Microsoft Corporation) C:\Windows\System32\html.iec

2012-11-07 15:58 - 2012-11-07 15:58 - 00434176 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00403248 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00367104 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec

2012-11-07 15:58 - 2012-11-07 15:58 - 00353792 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00353584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00282112 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00267776 ____A (Microsoft Corporation) C:\Windows\System32\ieaksie.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00249344 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00227840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieaksie.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00223232 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00222208 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00203776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe

2012-11-07 15:58 - 2012-11-07 15:58 - 00165888 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe

2012-11-07 15:58 - 2012-11-07 15:58 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieakui.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00163840 ____A (Microsoft Corporation) C:\Windows\System32\ieakui.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00162304 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00161792 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00160256 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe

2012-11-07 15:58 - 2012-11-07 15:58 - 00160256 ____A (Microsoft Corporation) C:\Windows\System32\ieakeng.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00152064 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe

2012-11-07 15:58 - 2012-11-07 15:58 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe

2012-11-07 15:58 - 2012-11-07 15:58 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00145920 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2012-11-07 15:58 - 2012-11-07 15:58 - 00135168 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00130560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieakeng.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00123392 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00118784 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00114176 ____A (Microsoft Corporation) C:\Windows\System32\admparse.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00111616 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00101888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\admparse.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00091648 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe

2012-11-07 15:58 - 2012-11-07 15:58 - 00089088 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe

2012-11-07 15:58 - 2012-11-07 15:58 - 00089088 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe

2012-11-07 15:58 - 2012-11-07 15:58 - 00086528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00082432 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00078848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00076800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe

2012-11-07 15:58 - 2012-11-07 15:58 - 00076800 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx

2012-11-07 15:58 - 2012-11-07 15:58 - 00074752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2012-11-07 15:58 - 2012-11-07 15:58 - 00074752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00074240 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe

2012-11-07 15:58 - 2012-11-07 15:58 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00066048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00063488 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx

2012-11-07 15:58 - 2012-11-07 15:58 - 00055296 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00054272 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00049664 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00041472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00035840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00031744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00023552 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll

2012-11-07 15:58 - 2012-11-07 15:58 - 00012288 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe

2012-11-07 15:58 - 2012-11-07 15:58 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe

2012-11-07 15:58 - 2012-11-07 15:58 - 00010752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe

2012-11-07 15:58 - 2012-11-07 15:58 - 00010752 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe

2012-11-07 15:35 - 2012-11-07 16:08 - 00000000 ____D C:\Users\All Users\bgxmlvkivhwfpqg

2012-11-07 15:35 - 2012-11-07 16:08 - 00000000 ____D C:\Users\All Users\Application Data\bgxmlvkivhwfpqg

2012-11-07 13:31 - 2012-11-07 13:39 - 00415877 ____A C:\Windows\System32\Drivers\vsconfig.xml

2012-11-07 13:31 - 2012-11-07 13:31 - 00000000 ____D C:\Users\Olsons\My Documents\ForceField Shared Files

2012-11-07 13:31 - 2012-11-07 13:31 - 00000000 ____D C:\Users\Olsons\Documents\ForceField Shared Files

2012-11-07 13:31 - 2012-11-07 13:31 - 00000000 ____D C:\Users\Olsons\Application Data\CheckPoint

2012-11-07 13:31 - 2012-11-07 13:31 - 00000000 ____D C:\Users\Olsons\AppData\Roaming\CheckPoint

2012-11-07 13:31 - 2012-11-07 13:31 - 00000000 ____D C:\Program Files\CheckPoint

2012-11-07 13:22 - 2012-11-07 13:30 - 00000000 ____D C:\Program Files (x86)\CheckPoint

2012-11-07 13:22 - 2012-11-07 13:22 - 00000000 ____D C:\Users\All Users\CheckPoint

2012-11-07 13:22 - 2012-11-07 13:22 - 00000000 ____D C:\Users\All Users\Application Data\CheckPoint

2012-11-07 12:16 - 2012-11-07 12:16 - 00000000 ____D C:\Windows\pss

2012-11-07 11:58 - 2012-08-31 12:19 - 01659760 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys

2012-11-07 11:51 - 2012-08-30 12:03 - 05559664 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe

2012-11-07 11:51 - 2012-08-30 11:12 - 03968880 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2012-11-07 11:51 - 2012-08-30 11:12 - 03914096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2012-11-07 11:50 - 2012-08-20 12:48 - 01162240 ____A (Microsoft Corporation) C:\Windows\System32\kernel32.dll

2012-11-07 11:50 - 2012-08-20 12:48 - 00424448 ____A (Microsoft Corporation) C:\Windows\System32\KernelBase.dll

2012-11-07 11:50 - 2012-08-20 12:48 - 00362496 ____A (Microsoft Corporation) C:\Windows\System32\wow64win.dll

2012-11-07 11:50 - 2012-08-20 12:48 - 00243200 ____A (Microsoft Corporation) C:\Windows\System32\wow64.dll

2012-11-07 11:50 - 2012-08-20 12:48 - 00215040 ____A (Microsoft Corporation) C:\Windows\System32\winsrv.dll

2012-11-07 11:50 - 2012-08-20 12:48 - 00016384 ____A (Microsoft Corporation) C:\Windows\System32\ntvdm64.dll

2012-11-07 11:50 - 2012-08-20 12:48 - 00013312 ____A (Microsoft Corporation) C:\Windows\System32\wow64cpu.dll

2012-11-07 11:50 - 2012-08-20 12:46 - 00338432 ____A (Microsoft Corporation) C:\Windows\System32\conhost.exe

2012-11-07 11:50 - 2012-08-20 12:38 - 00006144 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00005120 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00004608 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00004608 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 12:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 11:40 - 00014336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2012-11-07 11:50 - 2012-08-20 11:38 - 00025600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2012-11-07 11:50 - 2012-08-20 11:37 - 01114112 ____A (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2012-11-07 11:50 - 2012-08-20 11:37 - 00274944 ____A (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2012-11-07 11:50 - 2012-08-20 11:37 - 00005120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2012-11-07 11:50 - 2012-08-20 11:32 - 00005120 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 11:32 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 11:32 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 11:32 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 11:32 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 11:32 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 11:32 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 11:32 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 11:32 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 11:32 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 11:32 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 11:32 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 11:32 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 11:32 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 11:32 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 11:32 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 11:32 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 11:32 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 11:32 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 11:32 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 11:32 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 11:32 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 09:38 - 00007680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2012-11-07 11:50 - 2012-08-20 09:33 - 00006144 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 09:33 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 09:33 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll

2012-11-07 11:50 - 2012-08-20 09:33 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll

2012-11-07 11:49 - 2012-08-20 12:38 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll

2012-11-07 11:49 - 2012-08-20 12:38 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll

2012-11-07 11:49 - 2012-08-20 12:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll

2012-11-07 11:49 - 2012-08-20 11:32 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

2012-11-07 11:49 - 2012-08-20 11:32 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

2012-11-07 11:49 - 2012-08-20 09:38 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2012-11-07 11:28 - 2012-08-24 12:05 - 00220160 ____A (Microsoft Corporation) C:\Windows\System32\wintrust.dll

2012-11-07 11:28 - 2012-08-24 10:57 - 00172544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll

2012-11-07 11:27 - 2012-09-14 13:19 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\tzres.dll

2012-11-07 11:27 - 2012-09-14 12:28 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

2012-11-07 11:26 - 2012-08-10 18:56 - 00715776 ____A (Microsoft Corporation) C:\Windows\System32\kerberos.dll

2012-11-07 11:26 - 2012-08-10 17:56 - 00542208 ____A (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2012-11-06 18:43 - 2012-06-01 23:41 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll

2012-11-06 18:43 - 2012-06-01 23:41 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll

2012-11-06 18:43 - 2012-06-01 23:41 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll

2012-11-06 18:43 - 2012-06-01 22:36 - 01159680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2012-11-06 18:43 - 2012-06-01 22:36 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll

2012-11-06 18:43 - 2012-06-01 22:36 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

2012-11-06 18:31 - 2012-07-18 14:17 - 00002113 ____A C:\Users\Public\Desktop\QuickBooks Pro 2012.lnk

2012-11-06 18:31 - 2012-07-18 14:17 - 00002113 ____A C:\Users\All Users\Desktop\QuickBooks Pro 2012.lnk

2012-11-06 18:31 - 2012-07-17 18:04 - 00002183 ____A C:\Users\Public\Desktop\QuickBooks Premier - Accountant Edition 2007.lnk

2012-11-06 18:31 - 2012-07-17 18:04 - 00002183 ____A C:\Users\All Users\Desktop\QuickBooks Premier - Accountant Edition 2007.lnk

2012-11-06 18:31 - 2012-05-27 14:46 - 00002273 ____A C:\Users\Public\Desktop\PC Tools Spyware Doctor with AntiVirus.lnk

2012-11-06 18:31 - 2012-05-27 14:46 - 00002273 ____A C:\Users\All Users\Desktop\PC Tools Spyware Doctor with AntiVirus.lnk

2012-11-06 18:31 - 2012-01-24 16:25 - 00001785 ____A C:\Users\Public\Desktop\iTunes.lnk

2012-11-06 18:31 - 2012-01-24 16:25 - 00001785 ____A C:\Users\All Users\Desktop\iTunes.lnk

2012-11-06 18:31 - 2012-01-24 16:17 - 00001847 ____A C:\Users\Public\Desktop\QuickTime Player.lnk

2012-11-06 18:31 - 2012-01-24 16:17 - 00001847 ____A C:\Users\All Users\Desktop\QuickTime Player.lnk

2012-11-06 18:31 - 2012-01-20 19:54 - 00002016 ____A C:\Users\Public\Desktop\Adobe Reader 9.lnk

2012-11-06 18:31 - 2012-01-20 19:54 - 00002016 ____A C:\Users\All Users\Desktop\Adobe Reader 9.lnk

2012-11-06 18:31 - 2011-04-04 21:09 - 00002134 ____A C:\Users\Public\Desktop\Carbonite InfoCenter.lnk

2012-11-06 18:31 - 2011-04-04 21:09 - 00002134 ____A C:\Users\All Users\Desktop\Carbonite InfoCenter.lnk

==================== One Month Modified Files and Folders =======

2012-11-13 06:16 - 2012-11-13 06:16 - 00000000 ____D C:\FRST

2012-11-12 15:34 - 2010-10-05 17:05 - 00000000 ____D C:\Users\Olsons\Local Settings\SoftThinks

2012-11-12 15:34 - 2010-10-05 17:05 - 00000000 ____D C:\Users\Olsons\Local Settings\Application Data\SoftThinks

2012-11-12 15:34 - 2010-10-05 17:05 - 00000000 ____D C:\Users\Olsons\AppData\Local\SoftThinks

2012-11-12 15:34 - 2010-09-23 12:48 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup

2012-11-12 15:34 - 2009-07-13 23:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2012-11-12 15:34 - 2009-07-13 22:51 - 00038479 ____A C:\Windows\setupact.log

2012-11-12 15:27 - 2009-07-13 23:10 - 01108723 ____A C:\Windows\WindowsUpdate.log

2012-11-12 14:46 - 2012-06-13 09:09 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2012-11-12 13:08 - 2009-07-13 23:13 - 00792890 ____A C:\Windows\System32\PerfStringBackup.INI

2012-11-12 13:00 - 2009-07-13 22:45 - 00014240 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2012-11-12 13:00 - 2009-07-13 22:45 - 00014240 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2012-11-12 12:44 - 2012-11-12 12:29 - 04732416 ____A (AVAST Software) C:\Users\Olsons\Desktop\aswMBR.exe

2012-11-12 12:43 - 2012-11-12 12:42 - 04301324 ____A C:\Users\Olsons\Desktop\tdsskiller.zip

2012-11-12 12:43 - 2012-11-12 12:28 - 02213976 ____A (Kaspersky Lab ZAO) C:\Users\Olsons\Desktop\tdsskiller.exe

2012-11-12 11:46 - 2012-11-12 11:46 - 00022464 ____A C:\Users\Olsons\Desktop\combofix.txt

2012-11-12 11:46 - 2012-11-12 10:31 - 00000000 ____D C:\ComboFix

2012-11-12 11:46 - 2012-11-07 18:35 - 00000000 ____D C:\Qoobox

2012-11-12 11:46 - 2009-07-13 21:20 - 00000000 ___RD C:\users\Default

2012-11-12 11:45 - 2012-11-12 11:45 - 00022464 ____A C:\ComboFix.txt

2012-11-12 11:29 - 2012-11-07 18:34 - 00000000 ____D C:\Windows\erdnt

2012-11-12 11:24 - 2009-07-13 20:34 - 00000215 ____A C:\Windows\system.ini

2012-11-12 11:20 - 2010-09-23 14:38 - 00086614 ____A C:\Windows\PFRO.log

2012-11-12 10:28 - 2012-11-12 10:23 - 05000730 ____R (Swearware) C:\Users\Olsons\Desktop\ComboFix.exe

2012-11-12 10:27 - 2012-11-12 10:27 - 04997167 ____A C:\Users\Olsons\Desktop\ComboFix.zip

2012-11-09 17:41 - 2012-11-09 17:41 - 00003586 ____A C:\Users\Olsons\Desktop\RKreport[2]_D_11092012_02d1541.txt

2012-11-09 17:41 - 2012-11-09 17:40 - 00000000 ____D C:\Users\Olsons\Desktop\RK_Quarantine

2012-11-09 17:40 - 2012-11-09 17:40 - 00003730 ____A C:\Users\Olsons\Desktop\RKreport[1]_S_11092012_02d1540.txt

2012-11-09 17:38 - 2012-11-09 17:38 - 00000829 ____A C:\Users\Olsons\Desktop\AdwCleaner[s1].txt

2012-11-09 17:36 - 2012-11-09 17:36 - 00000829 ____A C:\AdwCleaner[s1].txt

2012-11-09 17:33 - 2012-11-09 17:33 - 00001052 ____A C:\Users\Olsons\Desktop\checkup.txt

2012-11-09 17:25 - 2012-11-09 17:25 - 01953636 ____A C:\Users\Olsons\Desktop\adwcleaner.zip

2012-11-09 17:25 - 2012-11-09 16:58 - 00666112 ____A C:\Users\Olsons\Desktop\RogueKiller.exe

2012-11-09 17:25 - 2012-11-09 16:57 - 00881833 ____A C:\Users\Olsons\Desktop\SecurityCheck.exe

2012-11-09 17:25 - 2012-11-09 16:57 - 00541569 ____A C:\Users\Olsons\Desktop\adwcleaner.exe

2012-11-08 17:19 - 2012-11-08 16:27 - 00000000 ____D C:\Windows\83B952C7F8F34CA3B4C533C85B24E478.TMP

2012-11-08 17:17 - 2012-11-07 17:42 - 00000000 ____D C:\Users\All Users\Spybot - Search & Destroy

2012-11-08 17:17 - 2012-11-07 17:42 - 00000000 ____D C:\Users\All Users\Application Data\Spybot - Search & Destroy

2012-11-08 17:16 - 2012-11-08 14:17 - 00000000 ____D C:\Program Files (x86)\RegistryNuke 2012

2012-11-08 17:16 - 2012-11-07 17:42 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy

2012-11-08 16:30 - 2012-11-08 16:30 - 00000000 ____A C:\autoexec.bat

2012-11-08 16:28 - 2012-11-08 16:28 - 00000000 ____D C:\Program Files\Enigma Software Group

2012-11-08 05:55 - 2009-07-13 21:20 - 00000000 ____D C:\Windows\rescache

2012-11-07 17:41 - 2012-11-07 17:35 - 16409960 ____A (Safer Networking Limited ) C:\Users\Olsons\Downloads\spybotsd162.exe

2012-11-07 16:08 - 2012-11-07 16:03 - 00097642 ____A C:\Users\All Users\gotleqmnrovyafk

2012-11-07 16:08 - 2012-11-07 16:03 - 00097642 ____A C:\Users\All Users\Application Data\gotleqmnrovyafk

2012-11-07 16:08 - 2012-11-07 15:35 - 00000000 ____D C:\Users\All Users\bgxmlvkivhwfpqg

2012-11-07 16:08 - 2012-11-07 15:35 - 00000000 ____D C:\Users\All Users\Application Data\bgxmlvkivhwfpqg

2012-11-07 16:00 - 2012-01-26 11:15 - 00006245 ____A C:\Windows\IE9_main.log

2012-11-07 16:00 - 2009-07-13 21:20 - 00000000 ____D C:\Windows\PolicyDefinitions

2012-11-07 15:59 - 2009-07-13 21:20 - 00000000 ____D C:\Windows\servicing