Ukash Virus won't let me start in safe mode - need help!

Charly19 · January 26, 2013

Hiya,

I'm not entirely sure how I got this virus but it almost scared the life out of me. I have gone through the phase of screaming and bashing the keys on the computer to no avail with just a white screen or if connected to the internet a screen showing the a fake metropolitan police page. I have now calmed down and am trying to sensibly get rid of this virus but being a girl who tends to break most computers she touches... I haven't got a clue!

I saw another topic on this virus from the 19th January with someone who had the same problem as me and gringo_pr replied and I followed the steps of downloading Farbar Recovery onto a flashdrive and used the scan tool but now I am stuck to what to do. Can someone please help me with this, preferably as soon as possible???

Thank You,

Charly

MrCharlie · January 26, 2013

Welcome to the forum.

What's the operating system and is it 32 or 64 bit.

MrC

Charly19 · January 26, 2013

It is Windows 7 and 64 bit.

MrCharlie · January 26, 2013

Here's how it goes....

Please download Farbar Recovery Scan Tool and save it to a flash drive.
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
Plug the flash drive into the infected PC.
If you are using Windows 8 consult How to use the Windows 8 System Recovery Environment Command Prompt to enter System Recovery Command prompt.
If you are using Vista or Windows 7 enter System Recovery Options.
To enter System Recovery Options from the Advanced Boot Options:
- Restart the computer.
- As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
- Use the arrow keys to select the Repair your computer menu item.
- Select US as the keyboard language settings, and then click Next.
- Select the operating system you want to repair, and then click Next.
- Select your user account an click Next.

Note: In case you can not enter System Recovery Options by using F8 method, you can use Windows installation disc, or make a repair disc. Any Windows installation disc or a repair disc made on another computer can be used.

To make a repair disk on Windows 7 consult: http://www.sevenforums.com/tutorials/2083-system-repair-disc-create.html

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

[*]On the System Recovery Options menu you will get the following options:

- Startup Repair
  System Restore
  Windows Complete PC Restore
  Windows Memory Diagnostic Tool
  Command Prompt
  Select Command Prompt
  Once in the Command Prompt:

[*]In the command window type in notepad and press Enter.

[*]The notepad opens. Under File menu select Open.

[*]Select "Computer" and find your flash drive letter and close the notepad.

[*]In the command window type e:\frst (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.

[*]The tool will start to run.

[*]When the tool opens click Yes to disclaimer.

[*]Press Scan button.

[*]It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

MrC

Charly19 · January 26, 2013

This is the log I got from the Farbar Recovery Scan Tool:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 21-01-2013 02

Ran by SYSTEM at 26-01-2013 21:12:37

Running from H:\

Windows 7 Home Premium (X64) OS Language: English(US)

The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [bTMTrayAgent] rundll32.exe "C:\Program Files\Motorola\Bluetooth\btmshell.dll",TrayApp [21705296 2010-10-25] ()

HKLM\...\Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe [487424 2011-01-16] (IDT, Inc.)

HKLM-x32\...\Run: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2010-06-21] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume [439568 2010-05-10] (Microsoft Corporation)

HKLM-x32\...\Run: [bCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices [91520 2010-03-13] (Microsoft Corporation)

HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [90448 2011-11-01] (Research In Motion Limited)

HKLM-x32\...\Run: [] [x]

HKLM-x32\...\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY [3147384 2012-12-10] (AVG Technologies CZ, s.r.o.)

HKLM-x32\...\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" [1101488 2013-01-22] ()

HKU\Charlotte\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-01-22] (Google Inc.)

HKU\Charlotte\...\Policies\system: [DisableLockWorkstation] 0

HKU\Charlotte\...\Policies\system: [DisableChangePassword] 0

HKU\Charlotte\...\Winlogon: [shell] explorer.exe,C:\Users\Charlotte\AppData\Roaming\skype.dat [43008 2011-11-16] ()

HKU\Default\...\Run: [HPAdvisorDock] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1712184 2010-02-09] ()

HKU\Default User\...\Run: [HPAdvisorDock] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1712184 2010-02-09] ()

Tcpip\Parameters: [DhcpNameServer] 129.234.4.13 129.234.4.9

Startup: C:\Users\Charlotte\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> (No File)

==================== Services (Whitelisted) ===================

2 AVGIDSAgent; "C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe" [5814904 2012-11-15] (AVG Technologies CZ, s.r.o.)

2 avgwd; "C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe" [196664 2012-10-22] (AVG Technologies CZ, s.r.o.)

2 vToolbarUpdater14.0.1; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.0.1\ToolbarUpdater.exe [945328 2013-01-22] ()

3 AVG Security Toolbar Service; C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [x]

==================== Drivers (Whitelisted) =====================

1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [154464 2012-10-22] (AVG Technologies CZ, s.r.o. )

0 AVGIDSHA; C:\Windows\System32\Drivers\AVGIDSHA.sys [63328 2012-10-14] (AVG Technologies CZ, s.r.o. )

1 Avgldx64; C:\Windows\System32\Drivers\Avgldx64.sys [185696 2012-10-01] (AVG Technologies CZ, s.r.o.)

0 Avgloga; C:\Windows\System32\Drivers\Avgloga.sys [225120 2012-09-20] (AVG Technologies CZ, s.r.o.)

0 Avgmfx64; C:\Windows\System32\Drivers\Avgmfx64.sys [111968 2012-11-15] (AVG Technologies CZ, s.r.o.)

0 Avgrkx64; C:\Windows\System32\Drivers\Avgrkx64.sys [40800 2012-09-13] (AVG Technologies CZ, s.r.o.)

1 Avgtdia; C:\Windows\System32\Drivers\Avgtdia.sys [200032 2012-09-20] (AVG Technologies CZ, s.r.o.)

1 avgtp; \??\C:\Windows\system32\drivers\avgtpx64.sys [37720 2013-01-22] (AVG Technologies)

==================== NetSvcs (Whitelisted) ====================

==================== One Month Created Files and Folders ========

2013-01-26 10:25 - 2013-01-26 12:01 - 00000004 ____A C:\Users\Charlotte\AppData\Roaming\skype.ini

2013-01-25 03:33 - 2013-01-25 10:39 - 00075776 ___AH C:\Users\Charlotte\AppData\Roaming\rbqt450.DLL

2013-01-25 03:33 - 2013-01-25 10:39 - 00064512 ___AH C:\Users\Charlotte\AppData\Roaming\rbap450.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00054272 ___AH C:\Users\Charlotte\AppData\Roaming\MBSQTImporterPlugin1635.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00053760 ___AH C:\Users\Charlotte\AppData\Roaming\MBSPicturePlugin1635.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00052224 ___AH C:\Users\Charlotte\AppData\Roaming\EHZComp.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00051712 ___AH C:\Users\Charlotte\AppData\Roaming\MBSWinPlugin1635.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00049664 ___AH C:\Users\Charlotte\AppData\Roaming\MBSQuickTimePlugin1636.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00048128 ___AH C:\Users\Charlotte\AppData\Roaming\MBSResPlugin1635.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00041984 ___AH C:\Users\Charlotte\AppData\Roaming\MBSMainPlugin1635.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00041472 ___AH C:\Users\Charlotte\AppData\Roaming\RBShell400.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00037376 ___AH C:\Users\Charlotte\AppData\Roaming\MBSPictureMacPlugin1635.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00036352 ___AH C:\Users\Charlotte\AppData\Roaming\MBSRegistryPlugin1636.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00036352 ___AH C:\Users\Charlotte\AppData\Roaming\MBSFolderitemsCreatePlugin1635.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00033280 ___AH C:\Users\Charlotte\AppData\Roaming\MBSEncryptPlugin1636.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00032256 ___AH C:\Users\Charlotte\AppData\Roaming\MBSProcessPlugin1636.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00032256 ___AH C:\Users\Charlotte\AppData\Roaming\MBSIconPlugin1635.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00029184 ___AH C:\Users\Charlotte\AppData\Roaming\MBSRectPlugin1635.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00029184 ___AH C:\Users\Charlotte\AppData\Roaming\MBSMemoryPlugin1635.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00028672 ___AH C:\Users\Charlotte\AppData\Roaming\MBSMacOSXPlugin1635.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00026624 ___AH C:\Users\Charlotte\AppData\Roaming\MBSUsernamePlugin1635.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00026112 ___AH C:\Users\Charlotte\AppData\Roaming\MBSResStreamPlugin1635.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00026112 ___AH C:\Users\Charlotte\AppData\Roaming\MBSRegistrationPlugin1636.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00025088 ___AH C:\Users\Charlotte\AppData\Roaming\MBSPluginVersionPlugin1635.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00019968 ___AH C:\Users\Charlotte\AppData\Roaming\EHMD5.dll

2013-01-25 03:33 - 2013-01-25 10:39 - 00018432 ___AH C:\Users\Charlotte\AppData\Roaming\EHEncrypt.dll

2013-01-23 14:51 - 2013-01-24 00:58 - 00000000 ____D C:\Program Files (x86)\VaudiX

2013-01-23 14:51 - 2013-01-23 15:18 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro

2013-01-23 14:51 - 2013-01-23 14:51 - 00000000 ____D C:\Users\All Users\CLSoft LTD

2013-01-23 14:50 - 2013-01-24 00:58 - 00000000 ____D C:\Program Files (x86)\WebSearch

2013-01-23 14:50 - 2013-01-23 14:55 - 00000000 ____D C:\Users\All Users\Vaudix

2013-01-23 14:50 - 2013-01-23 14:54 - 00000000 ____D C:\Users\All Users\Search-NewTab

2013-01-22 14:39 - 2013-01-26 11:58 - 00000354 ____A C:\Windows\Tasks\ROC_JAN2013_TB_rmv.job

2013-01-18 15:20 - 2013-01-18 15:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-01-15 02:13 - 2013-01-04 10:51 - 09376256 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2013-01-15 02:13 - 2013-01-04 10:11 - 06029824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-01-14 04:35 - 2013-01-26 10:25 - 00000000 ____D C:\Users\Charlotte\Documents\Outlook Files

2013-01-12 10:57 - 2012-12-06 21:41 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\Wpc.dll

2013-01-12 10:57 - 2012-12-06 21:35 - 02745856 ____A (Microsoft Corporation) C:\Windows\System32\gameux.dll

2013-01-12 10:57 - 2012-12-06 21:04 - 00308736 ____A (Microsoft Corporation) C:\Windows\SysWOW64\Wpc.dll

2013-01-12 10:57 - 2012-12-06 20:57 - 02576384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\gameux.dll

2013-01-12 10:57 - 2012-12-06 19:45 - 00055296 ____A (Microsoft) C:\Windows\System32\cero.rs

2013-01-12 10:57 - 2012-12-06 19:45 - 00051712 ____A (Microsoft) C:\Windows\System32\esrb.rs

2013-01-12 10:57 - 2012-12-06 19:45 - 00046592 ____A (Microsoft) C:\Windows\System32\fpb.rs

2013-01-12 10:57 - 2012-12-06 19:45 - 00045568 ____A (Microsoft) C:\Windows\System32\oflc-nz.rs

2013-01-12 10:57 - 2012-12-06 19:45 - 00044544 ____A (Microsoft) C:\Windows\System32\pegibbfc.rs

2013-01-12 10:57 - 2012-12-06 19:45 - 00043520 ____A (Microsoft) C:\Windows\System32\csrr.rs

2013-01-12 10:57 - 2012-12-06 19:45 - 00040960 ____A (Microsoft) C:\Windows\System32\cob-au.rs

2013-01-12 10:57 - 2012-12-06 19:45 - 00030720 ____A (Microsoft) C:\Windows\System32\usk.rs

2013-01-12 10:57 - 2012-12-06 19:45 - 00023552 ____A (Microsoft) C:\Windows\System32\oflc.rs

2013-01-12 10:57 - 2012-12-06 19:45 - 00021504 ____A (Microsoft) C:\Windows\System32\grb.rs

2013-01-12 10:57 - 2012-12-06 19:45 - 00020480 ____A (Microsoft) C:\Windows\System32\pegi-pt.rs

2013-01-12 10:57 - 2012-12-06 19:45 - 00020480 ____A (Microsoft) C:\Windows\System32\pegi-fi.rs

2013-01-12 10:57 - 2012-12-06 19:45 - 00020480 ____A (Microsoft) C:\Windows\System32\pegi.rs

2013-01-12 10:57 - 2012-12-06 19:45 - 00015360 ____A (Microsoft) C:\Windows\System32\djctq.rs

2013-01-12 10:57 - 2012-12-06 19:21 - 00055296 ____A (Microsoft) C:\Windows\SysWOW64\cero.rs

2013-01-12 10:57 - 2012-12-06 19:21 - 00051712 ____A (Microsoft) C:\Windows\SysWOW64\esrb.rs

2013-01-12 10:57 - 2012-12-06 19:21 - 00046592 ____A (Microsoft) C:\Windows\SysWOW64\fpb.rs

2013-01-12 10:57 - 2012-12-06 19:21 - 00045568 ____A (Microsoft) C:\Windows\SysWOW64\oflc-nz.rs

2013-01-12 10:57 - 2012-12-06 19:21 - 00044544 ____A (Microsoft) C:\Windows\SysWOW64\pegibbfc.rs

2013-01-12 10:57 - 2012-12-06 19:21 - 00043520 ____A (Microsoft) C:\Windows\SysWOW64\csrr.rs

2013-01-12 10:57 - 2012-12-06 19:21 - 00040960 ____A (Microsoft) C:\Windows\SysWOW64\cob-au.rs

2013-01-12 10:57 - 2012-12-06 19:21 - 00030720 ____A (Microsoft) C:\Windows\SysWOW64\usk.rs

2013-01-12 10:57 - 2012-12-06 19:21 - 00023552 ____A (Microsoft) C:\Windows\SysWOW64\oflc.rs

2013-01-12 10:57 - 2012-12-06 19:21 - 00021504 ____A (Microsoft) C:\Windows\SysWOW64\grb.rs

2013-01-12 10:57 - 2012-12-06 19:21 - 00020480 ____A (Microsoft) C:\Windows\SysWOW64\pegi-pt.rs

2013-01-12 10:57 - 2012-12-06 19:21 - 00020480 ____A (Microsoft) C:\Windows\SysWOW64\pegi-fi.rs

2013-01-12 10:57 - 2012-12-06 19:21 - 00020480 ____A (Microsoft) C:\Windows\SysWOW64\pegi.rs

2013-01-12 10:57 - 2012-12-06 19:21 - 00015360 ____A (Microsoft) C:\Windows\SysWOW64\djctq.rs

2013-01-12 10:56 - 2012-11-29 21:50 - 00362496 ____A (Microsoft Corporation) C:\Windows\System32\wow64win.dll

2013-01-12 10:56 - 2012-11-29 21:50 - 00243200 ____A (Microsoft Corporation) C:\Windows\System32\wow64.dll

2013-01-12 10:56 - 2012-11-29 21:50 - 00013312 ____A (Microsoft Corporation) C:\Windows\System32\wow64cpu.dll

2013-01-12 10:56 - 2012-11-29 21:49 - 00215040 ____A (Microsoft Corporation) C:\Windows\System32\winsrv.dll

2013-01-12 10:56 - 2012-11-29 21:46 - 00016384 ____A (Microsoft Corporation) C:\Windows\System32\ntvdm64.dll

2013-01-12 10:56 - 2012-11-29 21:43 - 01161216 ____A (Microsoft Corporation) C:\Windows\System32\kernel32.dll

2013-01-12 10:56 - 2012-11-29 21:43 - 00424960 ____A (Microsoft Corporation) C:\Windows\System32\KernelBase.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00006144 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00005120 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00004608 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00004608 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:41 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 21:06 - 01114112 ____A (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

2013-01-12 10:56 - 2012-11-29 21:06 - 00274944 ____A (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

2013-01-12 10:56 - 2012-11-29 21:06 - 00005120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00005120 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 20:56 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 19:33 - 00338432 ____A (Microsoft Corporation) C:\Windows\System32\conhost.exe

2013-01-12 10:56 - 2012-11-29 18:56 - 00025600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2013-01-12 10:56 - 2012-11-29 18:56 - 00014336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2013-01-12 10:56 - 2012-11-29 18:56 - 00007680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2013-01-12 10:56 - 2012-11-29 18:56 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2013-01-12 10:56 - 2012-11-29 18:51 - 00006144 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 18:51 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 18:51 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 18:51 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll

2013-01-12 10:56 - 2012-11-29 15:21 - 00420032 ____A C:\Windows\SysWOW64\locale.nls

2013-01-12 10:56 - 2012-11-29 15:19 - 00420032 ____A C:\Windows\System32\locale.nls

2013-01-12 10:56 - 2012-11-22 19:45 - 03147264 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys

2013-01-12 10:56 - 2012-11-22 02:32 - 00801280 ____A (Microsoft Corporation) C:\Windows\System32\usp10.dll

2013-01-12 10:56 - 2012-11-22 01:33 - 00627712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll

2013-01-12 10:56 - 2012-11-19 21:55 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll

2013-01-12 10:56 - 2012-11-19 21:10 - 00219136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2013-01-12 10:56 - 2012-11-08 21:34 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll

2013-01-12 10:56 - 2012-11-08 20:49 - 00492032 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll

2013-01-12 10:56 - 2012-11-01 21:30 - 02001408 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll

2013-01-12 10:56 - 2012-11-01 21:30 - 01880064 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll

2013-01-12 10:56 - 2012-11-01 20:50 - 01388544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2013-01-12 10:56 - 2012-11-01 20:50 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2013-01-07 04:49 - 2013-01-10 08:05 - 00000000 ____D C:\Users\Charlotte\Desktop\Snow

==================== One Month Modified Files and Folders =======

2013-01-26 20:27 - 2013-01-26 20:27 - 00000000 ____D C:\FRST

2013-01-26 12:01 - 2013-01-26 10:25 - 00000004 ____A C:\Users\Charlotte\AppData\Roaming\skype.ini

2013-01-26 12:01 - 2010-09-16 00:46 - 01605984 ____A C:\Windows\WindowsUpdate.log

2013-01-26 11:58 - 2013-01-22 14:39 - 00000354 ____A C:\Windows\Tasks\ROC_JAN2013_TB_rmv.job

2013-01-26 11:58 - 2012-01-26 04:06 - 00000000 ____D C:\Users\Charlotte\AppData\Roaming\Dropbox

2013-01-26 11:58 - 2011-01-27 08:38 - 00000300 ___AH C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job

2013-01-26 11:58 - 2011-01-27 08:38 - 00000300 ___AH C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job

2013-01-26 11:58 - 2011-01-27 08:38 - 00000254 ___AH C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job

2013-01-26 11:58 - 2011-01-22 10:56 - 00000900 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-01-26 11:58 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2013-01-26 11:58 - 2009-07-13 20:51 - 00130921 ____A C:\Windows\setupact.log

2013-01-26 11:36 - 2009-07-13 20:45 - 00023248 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-01-26 11:36 - 2009-07-13 20:45 - 00023248 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-01-26 11:29 - 2012-06-20 00:39 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-01-26 11:29 - 2012-01-26 04:08 - 00000000 ___RD C:\Users\Charlotte\Dropbox

2013-01-26 11:29 - 2011-03-10 07:10 - 00000924 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-37709631-230621832-1740521991-1000UA.job

2013-01-26 10:33 - 2010-12-17 05:03 - 00000000 ____D C:\Users\All Users\MFAData

2013-01-26 10:28 - 2011-01-22 10:56 - 00000904 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-01-26 10:26 - 2011-10-01 02:01 - 00000332 ____A C:\Windows\Tasks\HP Photo Creations Communicator.job

2013-01-26 10:25 - 2013-01-14 04:35 - 00000000 ____D C:\Users\Charlotte\Documents\Outlook Files

2013-01-26 08:35 - 2012-11-17 10:06 - 00000348 ____A C:\Windows\Tasks\HPCeeScheduleForCharlotte.job

2013-01-26 08:10 - 2011-10-08 03:07 - 00000942 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-37709631-230621832-1740521991-1000UA.job

2013-01-26 06:09 - 2011-03-10 07:10 - 00000872 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-37709631-230621832-1740521991-1000Core.job

2013-01-25 15:09 - 2011-10-08 03:07 - 00000920 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-37709631-230621832-1740521991-1000Core.job

2013-01-25 10:39 - 2013-01-25 03:33 - 00075776 ___AH C:\Users\Charlotte\AppData\Roaming\rbqt450.DLL

2013-01-25 10:39 - 2013-01-25 03:33 - 00064512 ___AH C:\Users\Charlotte\AppData\Roaming\rbap450.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00054272 ___AH C:\Users\Charlotte\AppData\Roaming\MBSQTImporterPlugin1635.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00053760 ___AH C:\Users\Charlotte\AppData\Roaming\MBSPicturePlugin1635.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00052224 ___AH C:\Users\Charlotte\AppData\Roaming\EHZComp.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00051712 ___AH C:\Users\Charlotte\AppData\Roaming\MBSWinPlugin1635.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00049664 ___AH C:\Users\Charlotte\AppData\Roaming\MBSQuickTimePlugin1636.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00048128 ___AH C:\Users\Charlotte\AppData\Roaming\MBSResPlugin1635.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00041984 ___AH C:\Users\Charlotte\AppData\Roaming\MBSMainPlugin1635.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00041472 ___AH C:\Users\Charlotte\AppData\Roaming\RBShell400.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00037376 ___AH C:\Users\Charlotte\AppData\Roaming\MBSPictureMacPlugin1635.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00036352 ___AH C:\Users\Charlotte\AppData\Roaming\MBSRegistryPlugin1636.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00036352 ___AH C:\Users\Charlotte\AppData\Roaming\MBSFolderitemsCreatePlugin1635.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00033280 ___AH C:\Users\Charlotte\AppData\Roaming\MBSEncryptPlugin1636.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00032256 ___AH C:\Users\Charlotte\AppData\Roaming\MBSProcessPlugin1636.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00032256 ___AH C:\Users\Charlotte\AppData\Roaming\MBSIconPlugin1635.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00029184 ___AH C:\Users\Charlotte\AppData\Roaming\MBSRectPlugin1635.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00029184 ___AH C:\Users\Charlotte\AppData\Roaming\MBSMemoryPlugin1635.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00028672 ___AH C:\Users\Charlotte\AppData\Roaming\MBSMacOSXPlugin1635.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00026624 ___AH C:\Users\Charlotte\AppData\Roaming\MBSUsernamePlugin1635.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00026112 ___AH C:\Users\Charlotte\AppData\Roaming\MBSResStreamPlugin1635.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00026112 ___AH C:\Users\Charlotte\AppData\Roaming\MBSRegistrationPlugin1636.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00025088 ___AH C:\Users\Charlotte\AppData\Roaming\MBSPluginVersionPlugin1635.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00019968 ___AH C:\Users\Charlotte\AppData\Roaming\EHMD5.dll

2013-01-25 10:39 - 2013-01-25 03:33 - 00018432 ___AH C:\Users\Charlotte\AppData\Roaming\EHEncrypt.dll

2013-01-25 00:59 - 2011-03-10 07:11 - 00002384 ____A C:\Users\Charlotte\Desktop\Google Chrome.lnk

2013-01-24 12:40 - 2009-07-13 21:13 - 00726444 ____A C:\Windows\System32\PerfStringBackup.INI

2013-01-24 00:59 - 2012-01-26 04:08 - 00001033 ____A C:\Users\Charlotte\Desktop\Dropbox.lnk

2013-01-24 00:58 - 2013-01-23 14:51 - 00000000 ____D C:\Program Files (x86)\VaudiX

2013-01-24 00:58 - 2013-01-23 14:50 - 00000000 ____D C:\Program Files (x86)\WebSearch

2013-01-24 00:58 - 2010-09-16 00:49 - 00277838 ____A C:\Windows\PFRO.log

2013-01-23 15:18 - 2013-01-23 14:51 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro

2013-01-23 15:10 - 2011-01-03 05:07 - 00000000 ____D C:\Users\Charlotte\Documents\Uni Work

2013-01-23 14:55 - 2013-01-23 14:50 - 00000000 ____D C:\Users\All Users\Vaudix

2013-01-23 14:55 - 2012-07-07 08:06 - 00000000 ____D C:\Users\All Users\InstallMate

2013-01-23 14:54 - 2013-01-23 14:50 - 00000000 ____D C:\Users\All Users\Search-NewTab

2013-01-23 14:51 - 2013-01-23 14:51 - 00000000 ____D C:\Users\All Users\CLSoft LTD

2013-01-22 14:44 - 2011-01-22 10:56 - 00000000 ____D C:\Users\Charlotte\AppData\Local\Google

2013-01-22 14:39 - 2012-10-08 16:21 - 00037720 ____A (AVG Technologies) C:\Windows\System32\Drivers\avgtpx64.sys

2013-01-22 14:39 - 2012-10-08 16:21 - 00000000 ____D C:\Program Files (x86)\AVG Secure Search

2013-01-22 01:10 - 2012-05-11 02:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-01-18 15:20 - 2013-01-18 15:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-01-14 05:21 - 2012-10-08 10:22 - 00000000 ____D C:\Users\Charlotte\AppData\Local\Avg2013

2013-01-14 00:50 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache

2013-01-13 04:37 - 2009-07-13 20:45 - 00425312 ____A C:\Windows\System32\FNTCACHE.DAT

2013-01-12 13:44 - 2010-12-29 03:48 - 00000000 ____D C:\Users\All Users\Microsoft Help

2013-01-12 12:29 - 2012-06-20 00:39 - 00697864 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-01-12 12:29 - 2011-07-02 14:36 - 00074248 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-01-12 10:51 - 2012-10-08 16:21 - 00000965 ____A C:\Users\Public\Desktop\AVG 2013.lnk

2013-01-10 08:05 - 2013-01-07 04:49 - 00000000 ____D C:\Users\Charlotte\Desktop\Snow

2013-01-04 10:51 - 2013-01-15 02:13 - 09376256 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2013-01-04 10:11 - 2013-01-15 02:13 - 06029824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-01-04 03:41 - 2011-06-30 12:29 - 00000000 ____D C:\Users\Charlotte\AppData\Local\CutePDF Writer

2012-12-27 08:35 - 2010-12-17 04:38 - 00000000 ____D C:\users\Charlotte

==================== Known DLLs (Whitelisted) =================

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys

[2012-12-11 23:58] - [2012-09-06 09:38] - 0295792 ____A (Microsoft Corporation) 9E425AC5C9A5A973273D169F43B4F5E1

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2013-01-15 19:00:44

==================== Memory info ===========================

Percentage of memory in use: 22%

Total physical RAM: 2933.86 MB

Available physical RAM: 2265.85 MB

Total Pagefile: 2932.01 MB

Available Pagefile: 2267.75 MB

Total Virtual: 8192 MB

Available Virtual: 8191.9 MB

==================== Partitions =============================

1 Drive c: () (Fixed) (Total:278.74 GB) (Free:159.73 GB) NTFS ==>[system with boot components (obtained from reading drive)]

2 Drive e: (RECOVERY) (Fixed) (Total:19.05 GB) (Free:2.76 GB) NTFS ==>[system with boot components (obtained from reading drive)]

3 Drive f: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.08 GB) FAT32

5 Drive h: (KINGSTON) (Removable) (Total:14.89 GB) (Free:8.74 GB) FAT32

6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

7 Drive y: (SYSTEM) (Fixed) (Total:0.19 GB) (Free:0.16 GB) NTFS ==>[system with boot components (obtained from reading drive)]

Disk ### Status Size Free Dyn Gpt

-------- ------------- ------- ------- --- ---

Disk 0 Online 298 GB 0 B

Disk 1 Online 14 GB 0 B

Partitions of Disk 0:

===============

Disk ID: E5539939

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Primary 199 MB 1024 KB

Partition 2 Primary 278 GB 200 MB

Partition 3 Primary 19 GB 278 GB

Partition 4 Primary 103 MB 297 GB

==================================================================================

Disk: 0

Partition 1

Type : 07

Hidden: No

Active: Yes

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 1 Y SYSTEM NTFS Partition 199 MB Healthy

=========================================================

Disk: 0

Partition 2

Type : 07

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 2 C NTFS Partition 278 GB Healthy

=========================================================

Disk: 0

Partition 3

Type : 07

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 3 E RECOVERY NTFS Partition 19 GB Healthy

=========================================================

Disk: 0

Partition 4

Type : 0C

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 4 F HP_TOOLS FAT32 Partition 103 MB Healthy

=========================================================

Partitions of Disk 1:

===============

Disk ID: 00000000

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Primary 14 GB 4032 KB

==================================================================================

Disk: 1

Partition 1

Type : 0C

Hidden: No

Active: Yes

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 5 H KINGSTON FAT32 Removable 14 GB Healthy

=========================================================

Last Boot: 2013-01-14 00:42

==================== End Of Log =============================

MrCharlie · January 26, 2013

When did you think you got this virus...date and time????

Charly19 · January 26, 2013

Well I accidently downloaded something called Vaudix that I didn't mean to on the 23rd January, I have no idea why I did because I never usually download things unless I am certain they are safe. I looked it up once downloaded (which I should have done beforehand...) and realised it contained viruses so immediately tried to delete all of it off my computer and ran several virus scans, one of which found a trojan horse which was quarantined. By the looks of the copied and pasted stuff in my last post though, its not deleted from my computer. It was earlier today however when my computer locked me out and started showing the white screen or message so I am unsure whether that is from 3 days ago or something else?

Charly19 · January 26, 2013

It was quite late on the 23rd that I stupidly downloaded vaudix, probably around 23:00 GMT, and earlier today when the message and white screen appeared, I think it was around 17:00 GMT.

MrCharlie · January 26, 2013

I don't see any malware in that log but i do see Vaudix

We can restore the computer back to 2013-01-14 00:42 and hopefully it boot up normally.

-------------------------------------------------

OK, here you go......Please carefully carry out this procedure!!!!!!

Please download the attached fixlist.txt and copy it to your flashdrive.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options. (as you did before)

Run FRST64 or FRST (which ever one you're using) and press the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

See if the computer boots normally now.

MrC

Charly19 · January 26, 2013

I can restore it to that date, but just want to check whether that will delete any word files I have created/modified between now and then?

MrCharlie · January 26, 2013

No, it shouldn't. That should just restore the registry back to that date.

MrC

Charly19 · January 26, 2013

This is the Fixlog:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 21-01-2013 02

Ran by SYSTEM at 2013-01-26 21:52:05 Run:1

Running from H:\

==============================================

DEFAULT hive was successfully copied to System32\config\HiveBackup

DEFAULT hive was successfully restored from registry back up.

SAM hive was successfully copied to System32\config\HiveBackup

SAM hive was successfully restored from registry back up.

SECURITY hive was successfully copied to System32\config\HiveBackup

SECURITY hive was successfully restored from registry back up.

SOFTWARE hive was successfully copied to System32\config\HiveBackup

SOFTWARE hive was successfully restored from registry back up.

SYSTEM hive was successfully copied to System32\config\HiveBackup

SYSTEM hive was successfully restored from registry back up.

==== End of Fixlog ====

I have restarted the computer now but unfortunately it is still showing a white screen???

MrCharlie · January 26, 2013

Can you run another scan with FRST as you first did and post the new log. MrC

Charly19 · January 26, 2013

Yep, this is it:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 21-01-2013 02

Ran by SYSTEM at 26-01-2013 22:00:01

Running from H:\

Windows 7 Home Premium (X64) OS Language: English(US)

The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [bTMTrayAgent] rundll32.exe "C:\Program Files\Motorola\Bluetooth\btmshell.dll",TrayApp [21705296 2010-10-25] ()

HKLM\...\Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe [487424 2011-01-16] (IDT, Inc.)

HKLM-x32\...\Run: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2010-06-21] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume [439568 2010-05-10] (Microsoft Corporation)

HKLM-x32\...\Run: [bCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices [91520 2010-03-13] (Microsoft Corporation)

HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [90448 2011-11-01] (Research In Motion Limited)

HKLM-x32\...\Run: [] [x]

HKLM-x32\...\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY [3147384 2012-12-10] (AVG Technologies CZ, s.r.o.)

HKLM-x32\...\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" [1101488 2013-01-22] ()

HKLM-x32\...\Run: [ROC_ROC_NT] "C:\Program Files (x86)\AVG Secure Search\ROC_ROC_NT.exe" / /PROMPT /CMPID=ROC_NT [856160 2012-10-08] ()

HKU\Charlotte\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-01-22] (Google Inc.)

HKU\Charlotte\...\Policies\system: [DisableLockWorkstation] 0

HKU\Charlotte\...\Policies\system: [DisableChangePassword] 0

HKU\Charlotte\...\Winlogon: [shell] explorer.exe,C:\Users\Charlotte\AppData\Roaming\skype.dat [43008 2011-11-16] ()

HKU\Default\...\Run: [HPAdvisorDock] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1712184 2010-02-09] ()

HKU\Default User\...\Run: [HPAdvisorDock] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1712184 2010-02-09] ()

Tcpip\Parameters: [DhcpNameServer] 129.234.4.13 129.234.4.9

Startup: C:\Users\Charlotte\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> (No File)

==================== Services (Whitelisted) ===================

2 AVGIDSAgent; "C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe" [5814904 2012-11-15] (AVG Technologies CZ, s.r.o.)

2 avgwd; "C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe" [196664 2012-10-22] (AVG Technologies CZ, s.r.o.)

2 vToolbarUpdater13.2.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe [711112 2012-11-08] ()