Jump to content

Infected: svchost trojan agent/winrscmde


Recommended Posts

Hi, thanks in advance for your help. I am trying to clean my 14-year-old's Win7 Home laptop. After clearing a lot of browser add-ons, toolbars and misc crap, I ran task manager and noticed a process, winrscmde, that was using tons of memory. After looking around here, I began to worry that it was a sign of a trojan.

I had already run ESET online; it discovered only cookies. When I ran MBAM it found more, including a trojan (log attached). But when I tried to reboot to complete the cleaning I got a blue screen. Then I went into Startup Repair, declined the option to use a restore point, and got a failure on attempted repairs. But the laptop then rebooted correctly. However, a second scan with MBAM once again shows the trojan. I did not try again to complete the disinfection because I am fearful of the consequences of the blue screen, startup repair, etc.

Per instructions, I ran DDS. Below are the contents of its log. Attached to this post are the attach.zip and MBAM logs. I look forward to hearing your suggestions. PS: I think the "backupPC" username in the computer profile is the result of a warranty return to Gateway, over a year ago.

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 9.0.8112.16464 BrowserJavaVersion: 10.9.2

Run by BackupPC at 6:52:47 on 2013-03-09

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3563.1460 [GMT -8:00]

.

AV: Norton Security Suite *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Norton Security Suite *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

FW: Norton Security Suite *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\atieclxx.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE

C:\Program Files (x86)\Launch Manager\dsiwmis.exe

C:\Program Files\Gateway\Gateway Power Management\ePowerSvc.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Launch Manager\LMutilps32.exe

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Program Files (x86)\Gateway\Registration\GREGsvc.exe

C:\Program Files\Gateway\Gateway Updater\UpdaterService.exe

C:\Program Files (x86)\Norton Security Suite\Engine\20.2.0.19\ccSvcHst.exe

C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe

C:\Program Files (x86)\NTI\Gateway MyBackup\IScheduleSvc.exe

C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.48\ccSvcHst.exe

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\Norton Security Suite\Engine\20.2.0.19\ccSvcHst.exe

C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.48\ccSvcHst.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\kwmain.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Elantech\ETDCtrl.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files\Gateway\Gateway Power Management\ePowerTray.exe

C:\Program Files\Microsoft IntelliPoint\ipoint.exe

C:\Program Files\Elantech\ETDCtrlHelper.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\Gateway\Gateway Power Management\ePowerEvent.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe

C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe

C:\Program Files (x86)\NTI\Gateway MyBackup\BackupManagerTray.exe

C:\Program Files (x86)\Launch Manager\LManager.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

\\.\globalroot\systemroot\svchost.exe -netsvcs

C:\Program Files (x86)\Launch Manager\LMworker.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files (x86)\Nero\Update\NASvc.exe

C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.48\SymcPCCULaunchSvc.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/

uDefault_Page_URL = hxxp://www.bing.com/?pc=MAGW

mStart Page = hxxp://www.bing.com/?pc=MAGW

mDefault_Page_URL = hxxp://www.bing.com/?pc=MAGW

mSearchAssistant = hxxp://start.facemoods.com/?a=adknlg&s={searchTerms}&f=4

mWinlogon: Userinit = userinit.exe,

BHO: MSS+ Identifier: {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll

BHO: Shopping Assistant Plugin: {1631550F-191D-4826-B069-D9439253D926} - C:\Program Files (x86)\PriceGong\2.5.3\PriceGongIE.dll

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Security Suite\Engine\20.2.0.19\coieplg.dll

BHO: CescrtHlpr Object: {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll

BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Security Suite\Engine\20.2.0.19\ips\ipsbho.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} -

BHO: DataMngr: {9D717F81-9148-4f12-8568-69135F087DB0} -

BHO: RewardsArcadeSuite: {B6EF6C45-5E8D-4c3b-B580-A5073261A381} - C:\Program Files (x86)\RewardsArcadeSuite\RewardsArcadeSuite.dll

BHO: Constant Guard Protection Suite: {B84CDBE7-1B46-494B-A188-01D4C52DEB61} - C:\ProgramData\White Sky, Inc\ID Vault\IEBHO1.13.111.1\NativeBHO.dll

BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

BHO: Download Manager: {E5C66DD8-308B-4a4f-AF0A-3D04F25B5343} -

TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\20.2.0.19\coieplg.dll

TB: facemoods Toolbar: {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll

TB: Searchqu Toolbar: {99079a25-328f-4bd4-be04-00955acaa0a7} -

TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\20.2.0.19\coieplg.dll

TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} -

uRun: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

mRun: [backupManagerTray] "C:\Program Files (x86)\NTI\Gateway MyBackup\BackupManagerTray.exe" -h -k

mRun: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe

mRun: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe

mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun: [RemoteControl10] "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe"

mRun: [facemoods] "C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe" /md I

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\CONSTA~1.LNK - C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:0

mPolicies-System: ConsentPromptBehaviorUser = dword:0

mPolicies-System: EnableLUA = dword:0

mPolicies-System: EnableUIADesktopToggle = dword:0

mPolicies-System: PromptOnSecureDesktop = dword:0

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

TCP: NameServer = 75.75.75.75 75.75.76.76

TCP: Interfaces\{07377933-027F-4841-BE8E-1920BF653684} : DHCPNameServer = 172.16.0.1

TCP: Interfaces\{F5C2F8E4-2AA1-44BC-8086-70A2A96AB02C} : DHCPNameServer = 75.75.75.75 75.75.76.76

TCP: Interfaces\{F5C2F8E4-2AA1-44BC-8086-70A2A96AB02C}\43A677962756C6563737 : DHCPNameServer = 158.165.1.26 158.165.1.20

TCP: Interfaces\{F5C2F8E4-2AA1-44BC-8086-70A2A96AB02C}\649444F4 : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{F5C2F8E4-2AA1-44BC-8086-70A2A96AB02C}\D4162796B616 : DHCPNameServer = 192.168.2.1 75.75.75.75 75.75.76.76

TCP: Interfaces\{F5C2F8E4-2AA1-44BC-8086-70A2A96AB02C}\D454B4F43535 : DHCPNameServer = 192.168.1.1

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

AppInit_DLLs= C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL

SSODL: WebCheck - <orphaned>

LSA: Notification Packages = scecli ickgw32i

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.152\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

x64-mStart Page = hxxp://www.bing.com/?pc=MAGW

x64-mDefault_Page_URL = hxxp://www.bing.com/?pc=MAGW

x64-BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

x64-Run: [ETDCtrl] C:\Program Files (x86)\Elantech\ETDCtrl.exe

x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

x64-Run: [Power Management] C:\Program Files\Gateway\Gateway Power Management\ePowerTray.exe

x64-Run: [intelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"

x64-Run: [drkly16j] rundll32.exe drkly16j.dll,ServiceCheck

x64-Run: [TCTray] C:\Program Files (x86)\Computer Business Solutions\KidsWatch\KWTray.exe

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

x64-SSODL: WebCheck - <orphaned>

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\BackupPC\AppData\Roaming\Mozilla\Firefox\Profiles\mf82nd3g.default\

FF - prefs.js: browser.search.selectedEngine - Ask.com

FF - prefs.js: keyword.URL -

FF - plugin: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL

FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

FF - plugin: C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMSS.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\NP4zStub.dll

FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_149.dll

FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll

FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

FF - ExtSQL: 2013-02-02 18:54; {BBDA0591-3099-440a-AA10-41764D9DB4DB}; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\IPSFFPlgn

FF - ExtSQL: 2013-02-02 18:58; {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\coFFPlgn

FF - ExtSQL: 2013-02-17 15:47; idvaultaddin@whitesky; C:\Users\BackupPC\AppData\Roaming\Mozilla\Firefox\Profiles\mf82nd3g.default\extensions\idvaultaddin@whitesky

.

============= SERVICES / DRIVERS ===============

.

R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\N360x64\1402000.013\symds64.sys [2013-2-18 493216]

R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\N360x64\1402000.013\symefa64.sys [2013-2-18 1133216]

R1 AntiLog32;AntiLog32;C:\Windows\System32\drivers\AntiLog64.sys [2013-2-11 45968]

R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130301.001\BHDrvx64.sys [2013-3-5 1388120]

R1 ccSet_N360;Norton Security Suite Settings Manager;C:\Windows\System32\drivers\N360x64\1402000.013\ccsetx64.sys [2013-2-18 168096]

R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130308.001\IDSviA64.sys [2013-3-8 513184]

R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]

R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]

R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\N360x64\1402000.013\ironx64.sys [2013-2-18 224416]

R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\N360x64\1402000.013\symnets.sys [2013-2-18 432800]

R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2012-7-11 140672]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2011-8-11 204288]

R2 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-5-12 249648]

R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624]

R2 DsiWMIService;Dritek WMI Service;C:\Program Files (x86)\Launch Manager\dsiwmis.exe [2011-8-11 353360]

R2 ePowerSvc;ePower Service;C:\Program Files\Gateway\Gateway Power Management\ePowerSvc.exe [2011-10-30 872552]

R2 GREGService;GREGService;C:\Program Files (x86)\Gateway\Registration\GREGsvc.exe [2011-5-29 36456]

R2 Live Updater Service;Live Updater Service;C:\Program Files\Gateway\Gateway Updater\UpdaterService.exe [2011-8-11 244624]

R2 N360;Norton Security Suite;C:\Program Files (x86)\Norton Security Suite\Engine\20.2.0.19\ccsvchst.exe [2013-2-18 143928]

R2 NAUpdate;Nero Update;C:\Program Files (x86)\Nero\Update\NASvc.exe [2010-5-4 503080]

R2 NOBU;Norton Online Backup;C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2010-6-1 2804568]

R2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.48\SymcPCCULaunchSvc.exe [2012-10-7 123320]

R2 NTI IScheduleSvc;NTI IScheduleSvc;C:\Program Files (x86)\NTI\Gateway MyBackup\IScheduleSvc.exe [2011-3-9 257344]

R2 PCCUJobMgr;Common Client Job Manager Service;C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.48\ccSvcHst.exe [2012-10-7 126392]

R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776]

R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2011-8-11 114704]

R3 b57xdbd;Broadcom xD Picture Bus Driver Service;C:\Windows\System32\drivers\b57xdbd.sys [2011-1-20 67624]

R3 b57xdmp;Broadcom xD Picture vstorp client drv;C:\Windows\System32\drivers\b57xdmp.sys [2011-1-20 19496]

R3 bScsiMSa;bScsiMSa;C:\Windows\System32\drivers\bScsiMSa.sys [2011-5-16 51240]

R3 bScsiSDa;bScsiSDa;C:\Windows\System32\drivers\bScsiSDa.sys [2011-5-6 86056]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-10-23 138912]

R3 ETD;ELAN PS/2 Port Input Device;C:\Windows\System32\drivers\ETD.sys [2011-8-11 138024]

R3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;C:\Windows\System32\drivers\k57nd60a.sys [2011-5-9 425000]

R3 keycrypt;keycrypt;C:\Windows\System32\drivers\KeyCrypt64.sys [2013-2-11 26448]

R3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2011-10-1 764264]

R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2011-10-1 268648]

R3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2011-10-1 25960]

R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2011-10-1 22376]

R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496]

R3 usbfilter;AMD USB Filter Driver;C:\Windows\System32\drivers\usbfilter.sys [2011-10-30 47232]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-11-9 160944]

S3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-6-7 191752]

S3 BEService;BattlEye Service;C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [2013-2-26 49152]

S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

S3 InternetConnectionService;InternetConnectionService;C:\Windows\System32\kwcaptur.exe [2011-1-31 1158552]

S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [2013-2-5 235216]

S3 PSSDK42;PSSDK42;C:\Windows\System32\drivers\pssdk42.sys [2012-1-20 53312]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-20 59392]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-20 31232]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-1-6 1255736]

S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

.

=============== Created Last 30 ================

.

2013-03-09 14:27:49 20480 ----a-w- C:\Windows\svchost.exe

2013-03-09 13:44:24 -------- d-----w- C:\Users\BackupPC\AppData\Roaming\Malwarebytes

2013-03-09 13:43:56 -------- d-----w- C:\ProgramData\Malwarebytes

2013-03-09 13:43:54 24176 ----a-w- C:\Windows\System32\drivers\mbam.sys

2013-03-09 13:43:54 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-03-09 13:43:39 -------- d-----w- C:\Users\BackupPC\AppData\Local\Programs

2013-03-09 05:22:57 -------- d-----w- C:\components

2013-03-08 19:12:58 -------- d-----w- C:\Program Files (x86)\Conduit

2013-03-04 01:30:02 -------- d-----w- C:\ProgramData\2394

2013-03-04 01:07:07 0 ----a-w- C:\Windows\SysWow64\shoAE9B.tmp

2013-02-27 00:34:00 -------- d-----w- C:\Program Files (x86)\Common Files\BattlEye

2013-02-27 00:30:28 -------- d-----w- C:\ProgramData\Bohemia Interactive Studio

2013-02-26 22:39:18 -------- d-----w- C:\Program Files (x86)\Dotjosh Studios

2013-02-25 23:55:42 0 ----a-w- C:\Windows\SysWow64\sho4E2.tmp

2013-02-24 23:16:10 -------- d-----w- C:\New Folder

2013-02-18 19:59:27 432800 ----a-r- C:\Windows\System32\drivers\N360x64\1402000.013\symnets.sys

2013-02-18 19:59:27 23448 ----a-r- C:\Windows\System32\drivers\N360x64\1402000.013\symelam.sys

2013-02-18 19:59:26 776864 ----a-w- C:\Windows\System32\drivers\N360x64\1402000.013\srtsp64.sys

2013-02-18 19:59:26 493216 ----a-w- C:\Windows\System32\drivers\N360x64\1402000.013\symds64.sys

2013-02-18 19:59:26 37496 ----a-r- C:\Windows\System32\drivers\N360x64\1402000.013\srtspx64.sys

2013-02-18 19:59:26 224416 ----a-r- C:\Windows\System32\drivers\N360x64\1402000.013\ironx64.sys

2013-02-18 19:59:26 168096 ----a-w- C:\Windows\System32\drivers\N360x64\1402000.013\ccsetx64.sys

2013-02-18 19:59:26 1133216 ----a-w- C:\Windows\System32\drivers\N360x64\1402000.013\symefa64.sys

2013-02-18 19:59:00 -------- d-----w- C:\Windows\System32\drivers\N360x64\1402000.013

2013-02-15 23:43:02 996352 ----a-w- C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll

2013-02-15 23:43:02 768000 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll

2013-02-15 02:51:07 5553512 ----a-w- C:\Windows\System32\ntoskrnl.exe

2013-02-15 02:51:07 3967848 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

2013-02-15 02:51:07 3913064 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

2013-02-15 02:51:00 3153408 ----a-w- C:\Windows\System32\win32k.sys

2013-02-15 02:50:59 215040 ----a-w- C:\Windows\System32\winsrv.dll

2013-02-15 02:50:58 7680 ----a-w- C:\Windows\SysWow64\instnm.exe

2013-02-15 02:50:58 5120 ----a-w- C:\Windows\SysWow64\wow32.dll

2013-02-15 02:50:58 25600 ----a-w- C:\Windows\SysWow64\setup16.exe

2013-02-15 02:50:58 2048 ----a-w- C:\Windows\SysWow64\user.exe

2013-02-15 02:50:58 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll

2013-02-15 02:50:56 288088 ----a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS

2013-02-15 02:50:56 1913192 ----a-w- C:\Windows\System32\drivers\tcpip.sys

2013-02-12 01:06:40 26448 ----a-w- C:\Windows\System32\drivers\KeyCrypt64.sys

2013-02-12 01:06:39 7369552 ----a-w- C:\Windows\SysWow64\ZALSDKCore.dll

2013-02-12 01:06:39 -------- d-----w- C:\Windows\SysWow64\ZALSDK_uninst

2013-02-12 01:06:36 45968 ----a-w- C:\Windows\System32\drivers\AntiLog64.sys

.

==================== Find3M ====================

.

2013-03-06 10:38:36 770384 ----a-w- C:\Windows\SysWow64\msvcr100.dll

2013-03-06 10:38:36 421200 ----a-w- C:\Windows\SysWow64\msvcp100.dll

2013-02-27 00:14:33 691568 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2013-02-27 00:14:32 71024 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2013-02-25 21:43:47 53312 ----a-w- C:\Windows\System32\drivers\pssdk42.sys

2013-02-17 03:57:14 177312 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS

2013-02-03 15:52:20 0 ----a-w- C:\Windows\System32\atiuxpag.dll

2013-02-03 15:52:20 0 ----a-w- C:\Windows\System32\atidxx32.dll

2013-02-03 15:52:19 0 ----a-w- C:\Windows\System32\GIDHook.dll

2013-02-03 15:52:19 0 ----a-w- C:\Windows\System32\EasyHook32.dll

2013-02-03 15:52:19 0 ----a-w- C:\Windows\System32\atiumdva.dll

2013-02-03 15:52:19 0 ----a-w- C:\Windows\System32\atiumdag.dll

2013-02-03 15:52:19 0 ----a-w- C:\Windows\System32\atiu9pag.dll

2013-02-03 15:52:19 0 ----a-w- C:\Windows\System32\aticfx32.dll

2013-01-24 00:24:46 127832 ----a-w- C:\Windows\System32\kwmain.exe

2013-01-17 02:05:11 0 ----a-w- C:\Windows\SysWow64\sho497E.tmp

2013-01-13 21:17:03 9728 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-01-13 21:17:02 2560 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll

2013-01-13 21:16:42 10752 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll

2013-01-13 21:12:46 3584 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll

2013-01-13 21:11:21 4096 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll

2013-01-13 21:11:08 5632 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll

2013-01-13 21:11:07 5632 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll

2013-01-13 21:11:07 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll

2013-01-13 21:11:07 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll

2013-01-13 20:35:31 9728 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-01-13 20:35:31 2560 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll

2013-01-13 20:35:18 10752 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll

2013-01-13 20:32:07 3584 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll

2013-01-13 20:31:48 4096 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll

2013-01-13 20:31:41 5632 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll

2013-01-13 20:31:40 5632 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll

2013-01-13 20:31:40 3072 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll

2013-01-13 20:31:40 3072 ---ha-w- C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll

2013-01-13 20:31:00 1247744 ----a-w- C:\Windows\SysWow64\DWrite.dll

2013-01-13 20:22:22 1988096 ----a-w- C:\Windows\SysWow64\d3d10warp.dll

2013-01-13 20:20:31 293376 ----a-w- C:\Windows\SysWow64\dxgi.dll

2013-01-13 20:09:00 249856 ----a-w- C:\Windows\SysWow64\d3d10_1core.dll

2013-01-13 20:08:43 220160 ----a-w- C:\Windows\SysWow64\d3d10core.dll

2013-01-13 20:08:35 1504768 ----a-w- C:\Windows\SysWow64\d3d11.dll

2013-01-13 19:59:04 1643520 ----a-w- C:\Windows\System32\DWrite.dll

2013-01-13 19:58:28 1175552 ----a-w- C:\Windows\System32\FntCache.dll

2013-01-13 19:54:01 604160 ----a-w- C:\Windows\SysWow64\d3d10level9.dll

2013-01-13 19:53:58 207872 ----a-w- C:\Windows\SysWow64\WindowsCodecsExt.dll

2013-01-13 19:53:14 187392 ----a-w- C:\Windows\SysWow64\UIAnimation.dll

2013-01-13 19:51:30 2565120 ----a-w- C:\Windows\System32\d3d10warp.dll

2013-01-13 19:49:17 363008 ----a-w- C:\Windows\System32\dxgi.dll

2013-01-13 19:48:47 161792 ----a-w- C:\Windows\SysWow64\d3d10_1.dll

2013-01-13 19:46:25 1080832 ----a-w- C:\Windows\SysWow64\d3d10.dll

2013-01-13 19:43:21 1230336 ----a-w- C:\Windows\SysWow64\WindowsCodecs.dll

2013-01-13 19:38:39 333312 ----a-w- C:\Windows\System32\d3d10_1core.dll

2013-01-13 19:38:32 1887232 ----a-w- C:\Windows\System32\d3d11.dll

2013-01-13 19:38:21 296960 ----a-w- C:\Windows\System32\d3d10core.dll

2013-01-13 19:37:57 3419136 ----a-w- C:\Windows\SysWow64\d2d1.dll

2013-01-13 19:25:04 245248 ----a-w- C:\Windows\System32\WindowsCodecsExt.dll

2013-01-13 19:24:33 648192 ----a-w- C:\Windows\System32\d3d10level9.dll

2013-01-13 19:24:30 221184 ----a-w- C:\Windows\System32\UIAnimation.dll

2013-01-13 19:20:42 194560 ----a-w- C:\Windows\System32\d3d10_1.dll

2013-01-13 19:20:04 1238528 ----a-w- C:\Windows\System32\d3d10.dll

2013-01-13 19:15:40 1424384 ----a-w- C:\Windows\System32\WindowsCodecs.dll

2013-01-13 19:10:36 3928064 ----a-w- C:\Windows\System32\d2d1.dll

2013-01-13 19:02:06 417792 ----a-w- C:\Windows\SysWow64\WMPhoto.dll

2013-01-13 18:34:58 364544 ----a-w- C:\Windows\SysWow64\XpsGdiConverter.dll

2013-01-13 18:32:43 465920 ----a-w- C:\Windows\System32\WMPhoto.dll

2013-01-13 18:09:52 522752 ----a-w- C:\Windows\System32\XpsGdiConverter.dll

2013-01-13 17:26:42 1158144 ----a-w- C:\Windows\SysWow64\XpsPrint.dll

2013-01-13 17:05:09 1682432 ----a-w- C:\Windows\System32\XpsPrint.dll

2013-01-09 01:19:09 2312704 ----a-w- C:\Windows\System32\jscript9.dll

2013-01-09 01:12:03 1392128 ----a-w- C:\Windows\System32\wininet.dll

2013-01-09 01:11:06 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl

2013-01-09 01:07:51 173056 ----a-w- C:\Windows\System32\ieUnatt.exe

2013-01-09 01:07:47 599040 ----a-w- C:\Windows\System32\vbscript.dll

2013-01-09 01:04:42 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

2013-01-08 22:11:21 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll

2013-01-08 22:03:20 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll

2013-01-08 22:03:12 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

2013-01-08 21:59:02 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe

2013-01-08 21:58:29 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll

2013-01-08 21:56:23 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2013-01-04 06:11:21 2284544 ----a-w- C:\Windows\SysWow64\msmpeg2vdec.dll

2013-01-04 06:11:13 2776576 ----a-w- C:\Windows\System32\msmpeg2vdec.dll

2013-01-04 04:43:21 44032 ----a-w- C:\Windows\apppatch\acwow64.dll

2013-01-01 01:03:29 356352 ----a-w- C:\Windows\eSellerateEngine.DLL

2012-12-16 17:11:22 46080 ----a-w- C:\Windows\System32\atmlib.dll

2012-12-16 14:45:03 367616 ----a-w- C:\Windows\System32\atmfd.dll

2012-12-16 14:13:28 295424 ----a-w- C:\Windows\SysWow64\atmfd.dll

2012-12-16 14:13:20 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll

.

============= FINISH: 6:55:11.12 ===============

attach.zip

mbam-log-2013-03-09 (05-46-55).txt

Link to post
Share on other sites

  • Staff

Please do the following:

Download the appropriate version for your system of the Farbar Recovery Scan Tool and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Choose your language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.

To enter System Recovery Options by using Windows installation disc:

  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Choose your language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.

On the System Recovery Options menu you will get the following options:


    • Startup Repair
      System Restore
      Windows Complete PC Restore
      Windows Memory Diagnostic Tool
      Command Prompt

[*]Select Command Prompt

[*]In the command window type in notepad and press Enter.

[*]The notepad opens. Under File menu select Open.

[*]Select "Computer" and find your flash drive letter and close the notepad.

[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.

[*]The tool will start to run.

[*]When the tool opens click Yes to the disclaimer.

[*]Place a check next to List Drivers MD5 as well as the default check marks that are already there

[*]Press Scan button.

[*]type exit and reboot the computer normally

[*]FRST will make a log (FRST.txt) on the flash drive, please copy and paste the log in your reply.

Link to post
Share on other sites

Thanks for the quick response. Below is the FRST log:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 09-03-2013

Ran by SYSTEM at 09-03-2013 09:21:30

Running from G:\

Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)

The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [ETDCtrl] %ProgramFiles%\Elantech\ETDCtrl.exe [2588968 2010-11-11] (ELAN Microelectronics Corp.)

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [11786344 2011-03-28] (Realtek Semiconductor)

HKLM\...\Run: [Power Management] C:\Program Files\Gateway\Gateway Power Management\ePowerTray.exe [1831016 2011-08-02] (Acer Incorporated)

HKLM\...\Run: [intelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2417032 2011-08-01] (Microsoft Corporation)

HKLM\...\Run: [drkly16j] rundll32.exe drkly16j.dll,ServiceCheck [x]

HKLM\...\Run: [TCTray] C:\Program Files (x86)\Computer Business Solutions\KidsWatch\KWTray.exe [502680 2012-05-04] (Computer Business Solutions, Inc.)

HKLM-x32\...\Run: [backupManagerTray] "C:\Program Files (x86)\NTI\Gateway MyBackup\BackupManagerTray.exe" -h -k [290112 2011-03-09] (NTI Corporation)

HKLM-x32\...\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)

HKLM-x32\...\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-06-30] (Dritek System Inc.)

HKLM-x32\...\Run: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [336384 2011-05-25] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [RemoteControl10] "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [87336 2010-02-02] (CyberLink Corp.)

HKLM-x32\...\Run: [facemoods] "C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe" /md I [362200 2011-09-05] (facemoods.com)

HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [946352 2012-12-02] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.)

HKU\BackupPC\...\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [5629312 2012-11-01] (SUPERAntiSpyware.com)

HKU\BackupPC\...\Policies\system: [LogonHoursAction] 2

HKU\BackupPC\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\Ben\...\Run: [DownloadManager] "C:\Program Files (x86)\Download Manager\DownloadManager.exe" /as [601600 2012-01-06] (DownloadManager)

HKU\Ben\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [x]

HKU\Ben\...\Run: [steam] "C:\Program Files (x86)\Steam\steam.exe" -silent [1602984 2013-02-25] (Valve Corporation)

HKU\Ben\...\Run: [Google Update] "C:\Users\Ben\AppData\Local\Google\Update\GoogleUpdate.exe" /c [116648 2012-03-28] (Google Inc.)

HKU\Ben\...\Run: [searchProtect] C:\Users\Ben\AppData\Roaming\SearchProtect\bin\cltmng.exe [2731296 2013-03-06] (Conduit)

HKU\Ben\...\Policies\system: [DisableTaskMgr] 1

HKU\bentime\...\Run: [DownloadManager] "C:\Program Files (x86)\Download Manager\DownloadManager.exe" /as [601600 2012-01-06] (DownloadManager)

HKU\Default\...\RunOnce: [scrSav] C:\Program Files (x86)\Gateway\Screensaver\run_Gateway.exe /default [154144 2010-07-29] ()

HKU\Default User\...\RunOnce: [scrSav] C:\Program Files (x86)\Gateway\Screensaver\run_Gateway.exe /default [154144 2010-07-29] ()

HKU\music\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [x]

Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76

AppInit_DLLs: C:\PROGRA~2\KEYCRY~1\KEYCRY~4.DLL,

Lsa: [Notification Packages] scecli ickgw32i

Startup: C:\ProgramData\Start Menu\Programs\Startup\Constant Guard.lnk

ShortcutTarget: Constant Guard.lnk -> C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe (White Sky, Inc.)

Startup: C:\ProgramData\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk

ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)

==================== Services (Whitelisted) ===================

2 !SASCORE; "C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE" [140672 2012-07-11] (SUPERAntiSpyware.com)

3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [49152 2013-02-26] ()

3 InternetConnectionService; C:\Windows\system32\kwcaptur.exe [1158552 2012-10-29] (Computer Business Solutions Software, Inc.)

3 McComponentHostService; "C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe" [235216 2013-02-05] (McAfee, Inc.)

2 N360; "C:\Program Files (x86)\Norton Security Suite\Engine\20.2.0.19\ccSvcHst.exe" /s "N360" /m "C:\Program Files (x86)\Norton Security Suite\Engine\20.2.0.19\diMaster.dll" /prefetch:1 [535416 2012-10-11] (Symantec Corporation)

2 NOBU; "C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe" SERVICE [2804568 2010-06-01] (Symantec Corporation)

2 Norton PC Checkup Application Launcher; C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.48\SymcPCCULaunchSvc.exe /s [123320 2012-10-07] (Symantec Corporation)

2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Gateway MyBackup\IScheduleSvc.exe [257344 2011-03-09] (NTI Corporation)

2 PCCUJobMgr; "C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.48\ccSvcHst.exe" /s "PCCUJobMgr" /m "C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.17.48\diMaster.dll" /prefetch:1 [132984 2011-12-14] (Symantec Corporation)

==================== Drivers (Whitelisted) =====================

1 AntiLog32; \??\C:\Windows\system32\drivers\AntiLog64.sys [45968 2013-02-11] (Zemana Ltd.)

2 atksgt; C:\Windows\System32\Drivers\atksgt.sys [314016 2012-01-21] ()

1 BHDrvx64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130301.001\BHDrvx64.sys [1388120 2013-02-08] (Symantec Corporation)

1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1402000.013\ccSetx64.sys [168096 2012-10-03] (Symantec Corporation)

1 eeCtrl; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2013-02-17] (Symantec Corporation)

3 EraserUtilRebootDrv; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2012-10-23] (Symantec Corporation)

1 IDSVia64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130308.001\IDSvia64.sys [513184 2013-02-15] (Symantec Corporation)

3 keycrypt; C:\Windows\System32\DRIVERS\KeyCrypt64.sys [26448 2013-01-05] (Zemana Ltd.)

2 lirsgt; C:\Windows\System32\Drivers\lirsgt.sys [43680 2012-01-21] ()

3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130309.003\ENG64.SYS [126192 2013-02-17] (Symantec Corporation)

3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130309.003\EX64.SYS [2087664 2013-02-17] (Symantec Corporation)

1 SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

1 SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

3 SRTSP; C:\Windows\System32\Drivers\N360x64\1402000.013\SRTSP64.SYS [776864 2012-10-08] (Symantec Corporation)

1 SRTSPX; C:\Windows\system32\drivers\N360x64\1402000.013\SRTSPX64.SYS [37496 2012-05-24] (Symantec Corporation)

0 SymDS; C:\Windows\System32\drivers\N360x64\1402000.013\SYMDS64.SYS [493216 2012-10-03] (Symantec Corporation)

0 SymEFA; C:\Windows\System32\drivers\N360x64\1402000.013\SYMEFA64.SYS [1133216 2012-10-03] (Symantec Corporation)

3 SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-02-16] (Symantec Corporation)

1 SymIRON; C:\Windows\system32\drivers\N360x64\1402000.013\Ironx64.SYS [224416 2012-07-27] (Symantec Corporation)

1 SymNetS; C:\Windows\System32\Drivers\N360x64\1402000.013\SYMNETS.SYS [432800 2012-07-22] (Symantec Corporation)

3 PcdrNdisuio; C:\Windows\SysWow64\drivers\pcdrndisuio.sys [x]

3 PCDSRVC{55A82D33-09B24F87-06020200}_0; \??\c:\users\ben\appdata\local\temp\msibgufmj.zd\pcdrdiag\bin\pcdsrvc_x64.pkms [x]

3 TCFilter; C:\Windows\System32\drivers\tcfilter.sys [x]

==================== NetSvcs (Whitelisted) ====================

==================== One Month Created Files and Folders ========

2013-03-09 07:40 - 2013-03-09 07:40 - 00275704 ____A C:\Windows\Minidump\030913-36363-01.dmp

2013-03-09 07:02 - 2013-03-09 07:02 - 00004836 ____A C:\Users\BackupPC\Desktop\attach.zip

2013-03-09 06:55 - 2013-03-09 06:55 - 00029304 ____A C:\Users\BackupPC\Desktop\dds.txt

2013-03-09 06:55 - 2013-03-09 06:55 - 00016201 ____A C:\Users\BackupPC\Desktop\attach.txt

2013-03-09 06:50 - 2013-03-09 06:50 - 00688992 ____R (Swearware) C:\Users\BackupPC\Desktop\dds.com

2013-03-09 06:27 - 2009-07-13 17:14 - 00020480 ____A (Microsoft Corporation) C:\Windows\svchost.exe

2013-03-09 06:26 - 2013-03-09 06:26 - 00272584 ____A C:\Windows\Minidump\030913-32276-01.dmp

2013-03-09 05:44 - 2013-03-09 05:44 - 00000000 ____D C:\Users\BackupPC\AppData\Roaming\Malwarebytes

2013-03-09 05:43 - 2013-03-09 05:44 - 00001116 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-03-09 05:43 - 2013-03-09 05:44 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-03-09 05:43 - 2013-03-09 05:43 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-03-09 05:43 - 2012-12-14 16:49 - 00024176 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys

2013-03-08 21:39 - 2013-03-08 21:39 - 00275704 ____A C:\Windows\Minidump\030813-51433-01.dmp

2013-03-08 21:33 - 2013-03-08 21:33 - 00275704 ____A C:\Windows\Minidump\030813-58796-01.dmp

2013-03-08 21:15 - 2013-03-08 21:15 - 00000000 ___SD C:\Users\BackupPC\Documents\Chica Passwords

2013-03-08 20:58 - 2013-03-08 20:59 - 00000632 _RASH C:\Users\BackupPC\ntuser.pol

2013-03-08 17:00 - 2013-03-08 19:36 - 00000000 ____D C:\Users\Ben\AppData\Roaming\.minecraft

2013-03-08 15:33 - 2013-03-08 15:33 - 01154048 ____A C:\Users\Ben\Downloads\TooManyPlants Mod Installer.exe

2013-03-08 13:56 - 2013-03-08 13:56 - 00196608 ____A (ICSharpCode.net) C:\Users\Ben\Desktop\ICSharpCode.SharpZipLib.dll

2013-03-08 13:15 - 2013-03-08 17:07 - 00281270 ____A C:\Users\Ben\Desktop\SPAS12.gun2

2013-03-08 13:15 - 2013-03-08 17:07 - 00133788 ____A C:\Users\Ben\Desktop\L118A.gun2

2013-03-08 13:15 - 2013-03-08 17:07 - 00119626 ____A C:\Users\Ben\Desktop\M60.gun2

2013-03-08 13:15 - 2013-03-08 17:07 - 00117528 ____A C:\Users\Ben\Desktop\M16.gun2

2013-03-08 13:15 - 2013-03-08 17:07 - 00111032 ____A C:\Users\Ben\Desktop\Intervention.gun2

2013-03-08 13:15 - 2013-03-08 17:07 - 00098408 ____A C:\Users\Ben\Desktop\44Magnum.gun2

2013-03-08 13:15 - 2013-03-08 17:07 - 00077320 ____A C:\Users\Ben\Desktop\AK47.gun2

2013-03-08 13:15 - 2013-03-08 17:07 - 00070228 ____A C:\Users\Ben\Desktop\M1911.gun2

2013-03-08 13:15 - 2013-03-08 17:07 - 00064516 ____A C:\Users\Ben\Desktop\M2-2.gun2

2013-03-08 13:15 - 2013-03-08 17:07 - 00058766 ____A C:\Users\Ben\Desktop\M4A1.gun2

2013-03-08 13:15 - 2013-03-08 17:07 - 00052520 ____A C:\Users\Ben\Desktop\FAL.gun2

2013-03-08 13:15 - 2013-03-08 17:07 - 00046250 ____A C:\Users\Ben\Desktop\MP5.gun2

2013-03-08 13:15 - 2013-03-08 17:07 - 00045080 ____A C:\Users\Ben\Desktop\MAC10.gun2

2013-03-08 13:15 - 2013-03-08 17:07 - 00037632 ____A C:\Users\Ben\Desktop\M203.gun2

2013-03-08 13:15 - 2013-03-08 17:07 - 00018832 ____A C:\Users\Ben\Desktop\SMAW.gun2

2013-03-08 13:14 - 2013-03-08 13:15 - 00000000 ____D C:\Users\Ben\Desktop\DESKTOP STUFF

2013-03-08 11:15 - 2013-03-08 11:15 - 00275760 ____A C:\Windows\Minidump\030813-52494-01.dmp

2013-03-08 11:13 - 2013-03-09 05:58 - 00000000 ____D C:\Users\Ben\AppData\Local\SwvUpdater

2013-03-08 11:12 - 2013-03-08 21:24 - 00000000 ____D C:\Users\Ben\AppData\Local\Conduit

2013-03-08 11:12 - 2013-03-08 11:12 - 00000000 ____D C:\Users\Ben\AppData\Local\CRE

2013-03-08 11:12 - 2013-03-08 11:12 - 00000000 ____D C:\Program Files (x86)\Conduit

2013-03-08 11:10 - 2013-03-08 11:10 - 00000000 ____D C:\Users\Ben\AppData\Roaming\SearchProtect

2013-03-08 11:09 - 2013-03-08 11:13 - 00000009 ____A C:\END

2013-03-03 17:30 - 2013-03-03 17:30 - 00000000 ____D C:\ProgramData\2394

2013-03-03 17:27 - 2013-03-03 17:27 - 00000000 ____D C:\Users\Ben\AppData\Roaming\ATI

2013-03-03 17:27 - 2013-03-03 17:27 - 00000000 ____D C:\Users\Ben\AppData\Local\ATI

2013-03-03 17:27 - 2013-03-03 17:27 - 00000000 ____D C:\ProgramData\ATI

2013-03-03 17:07 - 2013-03-03 17:07 - 00000000 ____A C:\Windows\SysWOW64\shoAE9B.tmp

2013-03-03 14:33 - 2013-03-03 15:00 - 40427096 ____A C:\Users\Ben\Downloads\1257_0.97.1.rar

2013-03-03 13:12 - 2013-03-03 13:12 - 00000222 ____A C:\Users\Ben\Desktop\Farming Simulator 2013.url

2013-03-01 15:30 - 2013-03-01 15:30 - 00000000 ____D C:\Users\Ben\AppData\Local\{78C20001-3125-413D-B477-CDA0EA214D28}

2013-02-28 15:35 - 2013-01-13 13:17 - 00009728 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-02-28 15:35 - 2013-01-13 13:17 - 00002560 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll

2013-02-28 15:35 - 2013-01-13 13:16 - 00010752 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll

2013-02-28 15:35 - 2013-01-13 13:12 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll

2013-02-28 15:35 - 2013-01-13 13:11 - 00005632 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll

2013-02-28 15:35 - 2013-01-13 13:11 - 00005632 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll

2013-02-28 15:35 - 2013-01-13 13:11 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll

2013-02-28 15:35 - 2013-01-13 13:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll

2013-02-28 15:35 - 2013-01-13 13:11 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll

2013-02-28 15:35 - 2013-01-13 12:35 - 00010752 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll

2013-02-28 15:35 - 2013-01-13 12:35 - 00009728 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-02-28 15:35 - 2013-01-13 12:35 - 00002560 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll

2013-02-28 15:35 - 2013-01-13 12:32 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll

2013-02-28 15:35 - 2013-01-13 12:31 - 01247744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2013-02-28 15:35 - 2013-01-13 12:31 - 00005632 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll

2013-02-28 15:35 - 2013-01-13 12:31 - 00005632 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll

2013-02-28 15:35 - 2013-01-13 12:31 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll

2013-02-28 15:35 - 2013-01-13 12:31 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll

2013-02-28 15:35 - 2013-01-13 12:31 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll

2013-02-28 15:35 - 2013-01-13 12:22 - 01988096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll

2013-02-28 15:35 - 2013-01-13 12:20 - 00293376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll

2013-02-28 15:35 - 2013-01-13 12:09 - 00249856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll

2013-02-28 15:35 - 2013-01-13 12:08 - 01504768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll

2013-02-28 15:35 - 2013-01-13 12:08 - 00220160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll

2013-02-28 15:35 - 2013-01-13 11:59 - 01643520 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll

2013-02-28 15:35 - 2013-01-13 11:58 - 01175552 ____A (Microsoft Corporation) C:\Windows\System32\FntCache.dll

2013-02-28 15:35 - 2013-01-13 11:54 - 00604160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll

2013-02-28 15:35 - 2013-01-13 11:53 - 00207872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll

2013-02-28 15:35 - 2013-01-13 11:53 - 00187392 ____A (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll

2013-02-28 15:35 - 2013-01-13 11:51 - 02565120 ____A (Microsoft Corporation) C:\Windows\System32\d3d10warp.dll

2013-02-28 15:35 - 2013-01-13 11:49 - 00363008 ____A (Microsoft Corporation) C:\Windows\System32\dxgi.dll

2013-02-28 15:35 - 2013-01-13 11:48 - 00161792 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll

2013-02-28 15:35 - 2013-01-13 11:46 - 01080832 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll

2013-02-28 15:35 - 2013-01-13 11:43 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll

2013-02-28 15:35 - 2013-01-13 11:38 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll

2013-02-28 15:35 - 2013-01-13 11:38 - 00333312 ____A (Microsoft Corporation) C:\Windows\System32\d3d10_1core.dll

2013-02-28 15:35 - 2013-01-13 11:38 - 00296960 ____A (Microsoft Corporation) C:\Windows\System32\d3d10core.dll

2013-02-28 15:35 - 2013-01-13 11:37 - 03419136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll

2013-02-28 15:35 - 2013-01-13 11:25 - 00245248 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecsExt.dll

2013-02-28 15:35 - 2013-01-13 11:24 - 00648192 ____A (Microsoft Corporation) C:\Windows\System32\d3d10level9.dll

2013-02-28 15:35 - 2013-01-13 11:24 - 00221184 ____A (Microsoft Corporation) C:\Windows\System32\UIAnimation.dll

2013-02-28 15:35 - 2013-01-13 11:20 - 01238528 ____A (Microsoft Corporation) C:\Windows\System32\d3d10.dll

2013-02-28 15:35 - 2013-01-13 11:20 - 00194560 ____A (Microsoft Corporation) C:\Windows\System32\d3d10_1.dll

2013-02-28 15:35 - 2013-01-13 11:15 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll

2013-02-28 15:35 - 2013-01-13 11:10 - 03928064 ____A (Microsoft Corporation) C:\Windows\System32\d2d1.dll

2013-02-28 15:35 - 2013-01-13 11:02 - 00417792 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll

2013-02-28 15:35 - 2013-01-13 10:34 - 00364544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll

2013-02-28 15:35 - 2013-01-13 10:32 - 00465920 ____A (Microsoft Corporation) C:\Windows\System32\WMPhoto.dll

2013-02-28 15:35 - 2013-01-13 10:09 - 00522752 ____A (Microsoft Corporation) C:\Windows\System32\XpsGdiConverter.dll

2013-02-28 15:35 - 2013-01-13 09:26 - 01158144 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll

2013-02-28 15:35 - 2013-01-13 09:05 - 01682432 ____A (Microsoft Corporation) C:\Windows\System32\XpsPrint.dll

2013-02-28 15:35 - 2013-01-03 22:11 - 02776576 ____A (Microsoft Corporation) C:\Windows\System32\msmpeg2vdec.dll

2013-02-28 15:35 - 2013-01-03 22:11 - 02284544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll

2013-02-26 16:30 - 2013-02-26 16:30 - 00000000 ____D C:\ProgramData\Bohemia Interactive Studio

2013-02-26 16:19 - 2013-02-26 16:21 - 00000000 ____D C:\Users\Ben\AppData\Local\ArmA 2

2013-02-26 16:15 - 2013-03-06 12:55 - 00000000 ____D C:\Users\Ben\AppData\Local\ArmA 2 OA

2013-02-26 16:15 - 2013-02-26 16:49 - 00000000 ____D C:\Users\Ben\Documents\ArmA 2

2013-02-26 14:40 - 2013-03-05 19:07 - 00000000 ____D C:\Users\Ben\AppData\Local\DayZCommander

2013-02-26 14:39 - 2013-02-26 14:39 - 00000000 ____D C:\Program Files (x86)\Dotjosh Studios

2013-02-25 15:55 - 2013-02-25 15:55 - 00000000 ____A C:\Windows\SysWOW64\sho4E2.tmp

2013-02-25 15:51 - 2013-02-25 15:51 - 00002238 ____A C:\Users\Ben\Desktop\pass.wlmp

2013-02-25 15:50 - 2013-02-25 15:50 - 00000000 ____D C:\Users\Ben\AppData\Local\{49F93D50-A0FA-4B7A-86CC-F08FE75D6EAA}

2013-02-24 15:16 - 2013-02-24 15:16 - 00000000 ____D C:\New Folder

2013-02-17 15:45 - 2013-02-17 15:45 - 00000193 ____A C:\Windows\WORDPAD.INI

2013-02-17 11:22 - 2013-02-17 11:22 - 02480255 ____A C:\Users\Ben\Downloads\Blood and Steel 1_54-3889-1-54.zip

2013-02-17 11:17 - 2013-02-17 11:22 - 179902884 ____A C:\Users\Ben\Downloads\Warband Enhanced v041-3774-v0-6.rar

2013-02-16 20:05 - 2010-06-02 04:55 - 00527192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll

2013-02-16 20:05 - 2010-06-02 04:55 - 00518488 ____A (Microsoft Corporation) C:\Windows\System32\XAudio2_7.dll

2013-02-16 20:05 - 2010-06-02 04:55 - 00239960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll

2013-02-16 20:05 - 2010-06-02 04:55 - 00176984 ____A (Microsoft Corporation) C:\Windows\System32\xactengine3_7.dll

2013-02-16 20:05 - 2010-06-02 04:55 - 00077656 ____A (Microsoft Corporation) C:\Windows\System32\XAPOFX1_5.dll

2013-02-16 20:05 - 2010-06-02 04:55 - 00074072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll

2013-02-16 20:05 - 2010-05-26 11:41 - 02526056 ____A (Microsoft Corporation) C:\Windows\System32\D3DCompiler_43.dll

2013-02-16 20:05 - 2010-05-26 11:41 - 02401112 ____A (Microsoft Corporation) C:\Windows\System32\D3DX9_43.dll

2013-02-16 20:05 - 2010-05-26 11:41 - 02106216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll

2013-02-16 20:05 - 2010-05-26 11:41 - 01998168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll

2013-02-16 20:05 - 2010-05-26 11:41 - 01907552 ____A (Microsoft Corporation) C:\Windows\System32\d3dcsx_43.dll

2013-02-16 20:05 - 2010-05-26 11:41 - 01868128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll

2013-02-16 20:05 - 2010-05-26 11:41 - 00511328 ____A (Microsoft Corporation) C:\Windows\System32\d3dx10_43.dll

2013-02-16 20:05 - 2010-05-26 11:41 - 00470880 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll

2013-02-16 20:05 - 2010-05-26 11:41 - 00276832 ____A (Microsoft Corporation) C:\Windows\System32\d3dx11_43.dll

2013-02-16 20:05 - 2010-05-26 11:41 - 00248672 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll

2013-02-16 20:05 - 2010-02-04 10:01 - 00530776 ____A (Microsoft Corporation) C:\Windows\System32\XAudio2_6.dll

2013-02-16 20:05 - 2010-02-04 10:01 - 00528216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll

2013-02-16 20:05 - 2010-02-04 10:01 - 00238936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll

2013-02-16 20:05 - 2010-02-04 10:01 - 00176984 ____A (Microsoft Corporation) C:\Windows\System32\xactengine3_6.dll

2013-02-16 20:05 - 2010-02-04 10:01 - 00078680 ____A (Microsoft Corporation) C:\Windows\System32\XAPOFX1_4.dll

2013-02-16 20:05 - 2010-02-04 10:01 - 00074072 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll

2013-02-16 20:05 - 2010-02-04 10:01 - 00024920 ____A (Microsoft Corporation) C:\Windows\System32\X3DAudio1_7.dll

2013-02-16 20:05 - 2010-02-04 10:01 - 00022360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll

2013-02-15 15:40 - 2013-01-08 17:48 - 17812992 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2013-02-15 15:40 - 2013-01-08 17:22 - 10925568 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2013-02-15 15:40 - 2013-01-08 17:19 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2013-02-15 15:40 - 2013-01-08 17:12 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll

2013-02-15 15:40 - 2013-01-08 17:12 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2013-02-15 15:40 - 2013-01-08 17:11 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl

2013-02-15 15:40 - 2013-01-08 17:10 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll

2013-02-15 15:40 - 2013-01-08 17:09 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2013-02-15 15:40 - 2013-01-08 17:07 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll

2013-02-15 15:40 - 2013-01-08 17:07 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll

2013-02-15 15:40 - 2013-01-08 17:07 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe

2013-02-15 15:40 - 2013-01-08 17:06 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll

2013-02-15 15:40 - 2013-01-08 17:05 - 02147840 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2013-02-15 15:40 - 2013-01-08 17:04 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2013-02-15 15:40 - 2013-01-08 17:04 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll

2013-02-15 15:40 - 2013-01-08 17:00 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2013-02-15 15:40 - 2013-01-08 14:23 - 12321280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-02-15 15:40 - 2013-01-08 14:11 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-02-15 15:40 - 2013-01-08 14:09 - 09738240 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-02-15 15:40 - 2013-01-08 14:03 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2013-02-15 15:40 - 2013-01-08 14:03 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-02-15 15:40 - 2013-01-08 14:03 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-02-15 15:40 - 2013-01-08 14:01 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll

2013-02-15 15:40 - 2013-01-08 14:00 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-02-15 15:40 - 2013-01-08 13:59 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2013-02-15 15:40 - 2013-01-08 13:58 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-02-15 15:40 - 2013-01-08 13:58 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2013-02-15 15:40 - 2013-01-08 13:57 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-02-15 15:40 - 2013-01-08 13:56 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-02-15 15:40 - 2013-01-08 13:56 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-02-15 15:40 - 2013-01-08 13:56 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2013-02-15 15:40 - 2013-01-08 13:53 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-02-14 18:51 - 2013-01-04 21:53 - 05553512 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe

2013-02-14 18:51 - 2013-01-04 21:00 - 03967848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2013-02-14 18:51 - 2013-01-04 21:00 - 03913064 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2013-02-14 18:51 - 2013-01-03 19:26 - 03153408 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys

2013-02-14 18:50 - 2013-01-03 21:46 - 00215040 ____A (Microsoft Corporation) C:\Windows\System32\winsrv.dll

2013-02-14 18:50 - 2013-01-03 20:51 - 00005120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2013-02-14 18:50 - 2013-01-03 18:47 - 00025600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2013-02-14 18:50 - 2013-01-03 18:47 - 00014336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2013-02-14 18:50 - 2013-01-03 18:47 - 00007680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2013-02-14 18:50 - 2013-01-03 18:47 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2013-02-14 18:50 - 2013-01-02 22:00 - 01913192 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys

2013-02-14 18:50 - 2013-01-02 22:00 - 00288088 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\FWPKCLNT.SYS

2013-02-11 17:06 - 2013-02-11 17:06 - 00045968 ____A (Zemana Ltd.) C:\Windows\System32\Drivers\AntiLog64.sys

2013-02-11 17:06 - 2013-02-11 17:06 - 00000000 ____D C:\Windows\SysWOW64\ZALSDK_uninst

2013-02-11 17:06 - 2013-01-05 20:39 - 07369552 ____A (Zemana Ltd.) C:\Windows\SysWOW64\ZALSDKCore.dll

2013-02-11 17:06 - 2013-01-05 20:39 - 00026448 ____A (Zemana Ltd.) C:\Windows\System32\Drivers\KeyCrypt64.sys

2013-02-11 17:00 - 2013-02-11 17:00 - 00272640 ____A C:\Windows\Minidump\021113-25225-01.dmp

==================== One Month Modified Files and Folders =======

2013-03-09 09:21 - 2013-03-09 09:21 - 00000000 ____D C:\FRST

2013-03-09 09:09 - 2012-09-24 11:09 - 00000466 ____A C:\Windows\Tasks\KWChat.job

2013-03-09 09:09 - 2012-09-24 11:09 - 00000464 ____A C:\Windows\Tasks\KWWeb.job

2013-03-09 09:09 - 2009-07-13 20:45 - 00016976 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-03-09 09:09 - 2009-07-13 20:45 - 00016976 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-03-09 09:08 - 2012-07-28 16:31 - 00000000 ____D C:\Users\BackupPC\AppData\Roaming\ID Vault

2013-03-09 09:08 - 2012-07-28 16:31 - 00000000 ____D C:\Users\BackupPC\AppData\Local\ID Vault

2013-03-09 09:08 - 2011-10-30 15:27 - 01484086 ____A C:\Windows\WindowsUpdate.log

2013-03-09 09:03 - 2012-01-07 16:29 - 00000888 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-03-09 08:51 - 2012-04-09 08:18 - 00000924 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1920678218-283744918-577706541-1004UA.job

2013-03-09 08:51 - 2012-04-09 08:18 - 00000872 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1920678218-283744918-577706541-1004Core.job

2013-03-09 08:42 - 2012-01-07 16:29 - 00000892 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-03-09 08:31 - 2012-06-15 14:56 - 00000900 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1920678218-283744918-577706541-1001UA.job

2013-03-09 08:14 - 2012-04-04 07:30 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-03-09 07:40 - 2013-03-09 07:40 - 00275704 ____A C:\Windows\Minidump\030913-36363-01.dmp

2013-03-09 07:40 - 2012-01-30 13:41 - 569049180 ____A C:\Windows\MEMORY.DMP

2013-03-09 07:40 - 2012-01-30 13:41 - 00000000 ____D C:\Windows\Minidump

2013-03-09 07:40 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2013-03-09 07:40 - 2009-07-13 20:51 - 00089077 ____A C:\Windows\setupact.log

2013-03-09 07:02 - 2013-03-09 07:02 - 00004836 ____A C:\Users\BackupPC\Desktop\attach.zip

2013-03-09 06:55 - 2013-03-09 06:55 - 00029304 ____A C:\Users\BackupPC\Desktop\dds.txt

2013-03-09 06:55 - 2013-03-09 06:55 - 00016201 ____A C:\Users\BackupPC\Desktop\attach.txt

2013-03-09 06:50 - 2013-03-09 06:50 - 00688992 ____R (Swearware) C:\Users\BackupPC\Desktop\dds.com

2013-03-09 06:26 - 2013-03-09 06:26 - 00272584 ____A C:\Windows\Minidump\030913-32276-01.dmp

2013-03-09 06:26 - 2010-11-20 19:47 - 00436348 ____A C:\Windows\PFRO.log

2013-03-09 05:58 - 2013-03-08 11:13 - 00000000 ____D C:\Users\Ben\AppData\Local\SwvUpdater

2013-03-09 05:44 - 2013-03-09 05:44 - 00000000 ____D C:\Users\BackupPC\AppData\Roaming\Malwarebytes

2013-03-09 05:44 - 2013-03-09 05:43 - 00001116 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-03-09 05:44 - 2013-03-09 05:43 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-03-09 05:43 - 2013-03-09 05:43 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-03-09 05:17 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache

2013-03-08 21:39 - 2013-03-08 21:39 - 00275704 ____A C:\Windows\Minidump\030813-51433-01.dmp

2013-03-08 21:33 - 2013-03-08 21:33 - 00275704 ____A C:\Windows\Minidump\030813-58796-01.dmp

2013-03-08 21:33 - 2012-01-07 16:29 - 00000000 ____D C:\Program Files\Google

2013-03-08 21:33 - 2012-01-07 16:29 - 00000000 ____D C:\Program Files (x86)\Google

2013-03-08 21:31 - 2012-05-29 15:15 - 00000000 ____D C:\Program Files (x86)\Constant Guard Protection Suite

2013-03-08 21:26 - 2012-06-07 06:55 - 00000000 ____D C:\Program Files (x86)\thinkTDA

2013-03-08 21:24 - 2013-03-08 11:12 - 00000000 ____D C:\Users\Ben\AppData\Local\Conduit

2013-03-08 21:18 - 2012-08-20 14:42 - 00000000 ____D C:\Users\BackupPC\AppData\Local\Google

2013-03-08 21:15 - 2013-03-08 21:15 - 00000000 ___SD C:\Users\BackupPC\Documents\Chica Passwords

2013-03-08 20:59 - 2013-03-08 20:58 - 00000632 _RASH C:\Users\BackupPC\ntuser.pol

2013-03-08 20:59 - 2012-07-28 16:30 - 00000000 ____D C:\users\BackupPC

2013-03-08 20:58 - 2009-07-13 19:20 - 00000000 ___HD C:\Windows\System32\GroupPolicy

2013-03-08 20:56 - 2012-01-28 06:18 - 00000050 ____A C:\Windows\KidsWatch.INI

2013-03-08 20:02 - 2012-05-29 15:40 - 00000000 ____D C:\Users\Ben\AppData\Roaming\ID Vault

2013-03-08 20:01 - 2012-01-21 09:58 - 00000000 ____D C:\Program Files (x86)\Steam

2013-03-08 19:36 - 2013-03-08 17:00 - 00000000 ____D C:\Users\Ben\AppData\Roaming\.minecraft

2013-03-08 17:50 - 2012-01-21 09:07 - 00000000 ____D C:\Users\Ben\AppData\Local\CrashDumps

2013-03-08 17:47 - 2012-11-17 15:51 - 00000000 ____D C:\Minecraft_Backup

2013-03-08 17:07 - 2013-03-08 13:15 - 00281270 ____A C:\Users\Ben\Desktop\SPAS12.gun2

2013-03-08 17:07 - 2013-03-08 13:15 - 00133788 ____A C:\Users\Ben\Desktop\L118A.gun2

2013-03-08 17:07 - 2013-03-08 13:15 - 00119626 ____A C:\Users\Ben\Desktop\M60.gun2

2013-03-08 17:07 - 2013-03-08 13:15 - 00117528 ____A C:\Users\Ben\Desktop\M16.gun2

2013-03-08 17:07 - 2013-03-08 13:15 - 00111032 ____A C:\Users\Ben\Desktop\Intervention.gun2

2013-03-08 17:07 - 2013-03-08 13:15 - 00098408 ____A C:\Users\Ben\Desktop\44Magnum.gun2

2013-03-08 17:07 - 2013-03-08 13:15 - 00077320 ____A C:\Users\Ben\Desktop\AK47.gun2

2013-03-08 17:07 - 2013-03-08 13:15 - 00070228 ____A C:\Users\Ben\Desktop\M1911.gun2

2013-03-08 17:07 - 2013-03-08 13:15 - 00064516 ____A C:\Users\Ben\Desktop\M2-2.gun2

2013-03-08 17:07 - 2013-03-08 13:15 - 00058766 ____A C:\Users\Ben\Desktop\M4A1.gun2

2013-03-08 17:07 - 2013-03-08 13:15 - 00052520 ____A C:\Users\Ben\Desktop\FAL.gun2

2013-03-08 17:07 - 2013-03-08 13:15 - 00046250 ____A C:\Users\Ben\Desktop\MP5.gun2

2013-03-08 17:07 - 2013-03-08 13:15 - 00045080 ____A C:\Users\Ben\Desktop\MAC10.gun2

2013-03-08 17:07 - 2013-03-08 13:15 - 00037632 ____A C:\Users\Ben\Desktop\M203.gun2

2013-03-08 17:07 - 2013-03-08 13:15 - 00018832 ____A C:\Users\Ben\Desktop\SMAW.gun2

2013-03-08 16:15 - 2012-11-25 17:44 - 00000000 ____D C:\Users\Ben\AppData\Roaming\BANDISOFT

2013-03-08 15:59 - 2012-09-24 11:10 - 00000474 ____A C:\Windows\Tasks\TCL0ben.job

2013-03-08 15:59 - 2012-09-24 11:10 - 00000474 ____A C:\Windows\Tasks\TCI0ben.job

2013-03-08 15:59 - 2012-09-24 11:10 - 00000474 ____A C:\Windows\Tasks\TCC0ben.job

2013-03-08 15:33 - 2013-03-08 15:33 - 01154048 ____A C:\Users\Ben\Downloads\TooManyPlants Mod Installer.exe

2013-03-08 13:56 - 2013-03-08 13:56 - 00196608 ____A (ICSharpCode.net) C:\Users\Ben\Desktop\ICSharpCode.SharpZipLib.dll

2013-03-08 13:53 - 2012-03-03 10:00 - 00000000 ____D C:\Users\Ben\AppData\Roaming\Skype

2013-03-08 13:15 - 2013-03-08 13:14 - 00000000 ____D C:\Users\Ben\Desktop\DESKTOP STUFF

2013-03-08 11:31 - 2012-06-15 14:56 - 00000848 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1920678218-283744918-577706541-1001Core.job

2013-03-08 11:15 - 2013-03-08 11:15 - 00275760 ____A C:\Windows\Minidump\030813-52494-01.dmp

2013-03-08 11:13 - 2013-03-08 11:09 - 00000009 ____A C:\END

2013-03-08 11:12 - 2013-03-08 11:12 - 00000000 ____D C:\Users\Ben\AppData\Local\CRE

2013-03-08 11:12 - 2013-03-08 11:12 - 00000000 ____D C:\Program Files (x86)\Conduit

2013-03-08 11:10 - 2013-03-08 11:10 - 00000000 ____D C:\Users\Ben\AppData\Roaming\SearchProtect

2013-03-08 11:08 - 2012-07-03 10:10 - 00000000 ____D C:\Users\Ben\Desktop\happy

2013-03-06 17:17 - 2009-07-13 21:13 - 00779724 ____A C:\Windows\System32\PerfStringBackup.INI

2013-03-06 16:32 - 2012-03-12 11:53 - 00000000 ____D C:\Users\Ben\AppData\Roaming\Mozilla

2013-03-06 12:55 - 2013-02-26 16:15 - 00000000 ____D C:\Users\Ben\AppData\Local\ArmA 2 OA

2013-03-06 02:38 - 2011-06-11 00:58 - 00770384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msvcr100.dll

2013-03-06 02:38 - 2011-06-11 00:58 - 00421200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msvcp100.dll

2013-03-05 19:07 - 2013-02-26 14:40 - 00000000 ____D C:\Users\Ben\AppData\Local\DayZCommander

2013-03-04 17:25 - 2012-09-24 11:07 - 00000478 ____A C:\Windows\Tasks\KWVacuum.job

2013-03-03 17:30 - 2013-03-03 17:30 - 00000000 ____D C:\ProgramData\2394

2013-03-03 17:27 - 2013-03-03 17:27 - 00000000 ____D C:\Users\Ben\AppData\Roaming\ATI

2013-03-03 17:27 - 2013-03-03 17:27 - 00000000 ____D C:\Users\Ben\AppData\Local\ATI

2013-03-03 17:27 - 2013-03-03 17:27 - 00000000 ____D C:\ProgramData\ATI

2013-03-03 17:07 - 2013-03-03 17:07 - 00000000 ____A C:\Windows\SysWOW64\shoAE9B.tmp

2013-03-03 16:21 - 2012-05-06 15:14 - 00000000 ____D C:\Users\Ben\Documents\Mount&Blade Warband Savegames

2013-03-03 15:00 - 2013-03-03 14:33 - 40427096 ____A C:\Users\Ben\Downloads\1257_0.97.1.rar

2013-03-03 13:18 - 2012-01-21 08:55 - 00000000 ____D C:\Users\Ben\Documents\My Games

2013-03-03 13:12 - 2013-03-03 13:12 - 00000222 ____A C:\Users\Ben\Desktop\Farming Simulator 2013.url

2013-03-01 17:33 - 2012-07-03 13:11 - 00000000 ____D C:\Users\Ben\AppData\Roaming\.techniclauncher

2013-03-01 15:30 - 2013-03-01 15:30 - 00000000 ____D C:\Users\Ben\AppData\Local\{78C20001-3125-413D-B477-CDA0EA214D28}

2013-02-28 16:34 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\zh-HK

2013-02-28 16:34 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\tr-TR

2013-02-28 16:34 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\zh-HK

2013-02-28 16:34 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\tr-TR

2013-02-26 16:49 - 2013-02-26 16:15 - 00000000 ____D C:\Users\Ben\Documents\ArmA 2

2013-02-26 16:30 - 2013-02-26 16:30 - 00000000 ____D C:\ProgramData\Bohemia Interactive Studio

2013-02-26 16:24 - 2011-08-11 11:09 - 00254215 ____A C:\Windows\DirectX.log

2013-02-26 16:21 - 2013-02-26 16:19 - 00000000 ____D C:\Users\Ben\AppData\Local\ArmA 2

2013-02-26 16:14 - 2012-04-04 07:30 - 00691568 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-02-26 16:14 - 2012-01-07 16:29 - 00071024 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-02-26 14:39 - 2013-02-26 14:39 - 00000000 ____D C:\Program Files (x86)\Dotjosh Studios

2013-02-25 15:55 - 2013-02-25 15:55 - 00000000 ____A C:\Windows\SysWOW64\sho4E2.tmp

2013-02-25 15:51 - 2013-02-25 15:51 - 00002238 ____A C:\Users\Ben\Desktop\pass.wlmp

2013-02-25 15:50 - 2013-02-25 15:50 - 00000000 ____D C:\Users\Ben\AppData\Local\{49F93D50-A0FA-4B7A-86CC-F08FE75D6EAA}

2013-02-25 13:43 - 2012-01-20 15:25 - 00053312 ____A (microOLAP Technologies LTD) C:\Windows\System32\Drivers\pssdk42.sys

2013-02-24 19:45 - 2012-02-09 15:16 - 00000000 ____D C:\Users\Ben\AppData\Roaming\SoftGrid Client

2013-02-24 19:44 - 2012-03-12 12:26 - 00000000 ____D C:\Users\Ben\Documents\zombe's_modpack-v6.0x_MC.1.2.3

2013-02-24 15:16 - 2013-02-24 15:16 - 00000000 ____D C:\New Folder

2013-02-23 14:18 - 2012-11-29 16:19 - 00000000 ____D C:\Users\Ben\Desktop\youtube

2013-02-18 15:16 - 2012-05-29 15:29 - 00000000 ____D C:\Windows\System32\Drivers\N360x64

2013-02-17 15:45 - 2013-02-17 15:45 - 00000193 ____A C:\Windows\WORDPAD.INI

2013-02-17 11:22 - 2013-02-17 11:22 - 02480255 ____A C:\Users\Ben\Downloads\Blood and Steel 1_54-3889-1-54.zip

2013-02-17 11:22 - 2013-02-17 11:17 - 179902884 ____A C:\Users\Ben\Downloads\Warband Enhanced v041-3774-v0-6.rar

2013-02-17 11:05 - 2011-08-11 11:19 - 00000000 ____D C:\ProgramData\Norton

2013-02-16 19:58 - 2012-05-29 15:30 - 00000000 ____D C:\Program Files\Symantec

2013-02-16 19:57 - 2012-05-29 15:30 - 00177312 ____A (Symantec Corporation) C:\Windows\System32\Drivers\SYMEVENT64x86.SYS

2013-02-16 19:57 - 2012-05-29 15:30 - 00007466 ____A C:\Windows\System32\Drivers\SYMEVENT64x86.CAT

2013-02-16 19:50 - 2012-02-20 10:14 - 00000000 ____D C:\Users\Public\Downloads\Norton

2013-02-16 19:46 - 2012-03-13 18:18 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan

2013-02-15 16:12 - 2009-07-13 20:45 - 00300256 ____A C:\Windows\System32\FNTCACHE.DAT

2013-02-15 15:50 - 2012-01-12 09:32 - 70004024 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe

2013-02-11 17:06 - 2013-02-11 17:06 - 00045968 ____A (Zemana Ltd.) C:\Windows\System32\Drivers\AntiLog64.sys

2013-02-11 17:06 - 2013-02-11 17:06 - 00000000 ____D C:\Windows\SysWOW64\ZALSDK_uninst

2013-02-11 17:06 - 2013-01-29 16:49 - 00000000 ____D C:\Program Files (x86)\KeyCryptSDK

2013-02-11 17:00 - 2013-02-11 17:00 - 00272640 ____A C:\Windows\Minidump\021113-25225-01.dmp

2013-02-11 16:58 - 2012-11-18 11:38 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-02-11 16:58 - 2012-03-13 18:18 - 00000000 ____D C:\ProgramData\McAfee Security Scan

2013-02-11 16:58 - 2012-01-20 11:31 - 00000000 ____D C:\users\bentime

2013-02-11 16:58 - 2012-01-06 16:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-02-11 16:58 - 2012-01-04 17:23 - 00000000 ____D C:\users\Ben

2013-02-11 16:58 - 2011-08-11 11:19 - 00000000 ____D C:\Windows\SysWOW64\Macromed

2013-02-11 16:58 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration

2013-02-11 16:57 - 2012-02-09 15:21 - 00000000 __RHD C:\MSOCache

ATTENTION: ========> Check for possible partition/boot infection:

C:\Windows\svchost.exe

==================== Known DLLs (Whitelisted) =================

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

TDL4: custom:26000022 <===== ATTENTION!

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2013-02-26 14:39:02

Restore point made on: 2013-02-26 16:19:36

Restore point made on: 2013-02-26 16:22:12

Restore point made on: 2013-02-28 15:35:05

Restore point made on: 2013-03-03 13:19:36

==================== Memory info ===========================

Percentage of memory in use: 18%

Total physical RAM: 3562.9 MB

Available physical RAM: 2899.09 MB

Total Pagefile: 3561.1 MB

Available Pagefile: 2882.73 MB

Total Virtual: 8192 MB

Available Virtual: 8191.9 MB

==================== Partitions =============================

1 Drive c: (Gateway) (Fixed) (Total:578.07 GB) (Free:342.02 GB) NTFS

2 Drive e: (PQSERVICE) (Fixed) (Total:18 GB) (Free:5.34 GB) NTFS

4 Drive g: (PENDRIVE) (Removable) (Total:0.48 GB) (Free:0.45 GB) FAT32

5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

6 Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from reading drive)]

ATTENTION: Malware custom entry on BCD on drive y: detected. Check for MBR/Partition infection.

Disk ### Status Size Free Dyn Gpt

-------- ------------- ------- ------- --- ---

Disk 0 Online 596 GB 0 B

Disk 1 Online 492 MB 0 B

Partitions of Disk 0:

===============

Disk ID: 6A10A1B8

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Recovery 18 GB 1024 KB

Partition 2 Primary 100 MB 18 GB

Partition 3 Primary 578 GB 18 GB

==================================================================================

Disk: 0

Partition 1

Type : 27

Hidden: Yes

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 3 E PQSERVICE NTFS Partition 18 GB Healthy Hidden

=========================================================

Disk: 0

Partition 2

Type : 07

Hidden: No

Active: Yes

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 1 Y SYSTEM RESE NTFS Partition 100 MB Healthy

=========================================================

Disk: 0

Partition 3

Type : 07

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 2 C Gateway NTFS Partition 578 GB Healthy

=========================================================

Partitions of Disk 1:

===============

Disk ID: 8E968C37

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Primary 491 MB 16 KB

==================================================================================

Disk: 1

Partition 1

Type : 0B

Hidden: No

Active: Yes

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 4 G PENDRIVE FAT32 Removable 491 MB Healthy

=========================================================

============================== MBR Partition Table ==================

==============================

Partitions of Disk 0:

===============

Disk ID: 6A10A1B8

Partition 1:

===========

Hex: 80003E00000000003D00000000000000

Active: YES

Type: 00

Size: 0 byte

ATTENTION ===> 0 byte partition bookit on partition 1

Partition 2:

===========

Hex: 0020210027FEFFFF0008000000004002

Active: NO

Type: 27

Size: 18 GB

Partition 3:

===========

Hex: 80FEFFFF07FEFFFF0008400200200300

Active: YES

Type: 07 (NTFS)

Size: 100 MB

Partition 4:

===========

Hex: 00FEFFFF07FEFFFF0028430200504248

Active: NO

Type: 07 (NTFS)

Size: 578 GB

==============================

Partitions of Disk 1:

===============

Disk ID: 8E968C37

Partition 1:

===========

Hex: 800101000B0FE0AF20000000E05F0F00

Active: YES

Type: 0B

Size: 492 MB

Last Boot: 2013-03-09 05:09

==================== End Of Log =============================

Link to post
Share on other sites

  • Staff

Please make sure you do all the steps in the order they are written.

  1. For 64bit systems, download Listparts64 and save it to your flashdrive
  2. Download (script removed )
    Save it to your flash drive.
  3. Please download (script removed)
    Save it to your flash drive.
  4. Boot to System Recovery Options and select "Command Prompt".
    Run FRST64 and press the fix button just once and wait.
    The tool will make a log on the flashdrive (Fixlog.txt) please post it later on to your reply. You may close the tool.
  5. While still in the recovery environment run ListParts by typing g:\listparts64 in the command prompt and pressing Enter
    Click Fix. Close the pop up after the fix is done.
  6. Please restart, let it boot normally and then post the FixLog.txt

Link to post
Share on other sites

Please make sure you do all the steps in the order they are written.

Will do.

Done (Step 1)


  • Done (Step 2)
    Done (Step 3)
    Done (Step 4)
  • Done (Step 5). Then dismissed listparts64 tool, typed "exit" at command prompt and restarted pc from System Recovery Options screen.
  • Done (Step 6). Log appears below. However, pc did not restart normally. It restarted to a "Gateway Recovery Management" console that allows: 1. Restore OS to Factory Defaults, 2. Restore OS and Retain User Data, or 3. Exit. I am leaving that screen open until you advise that I exit it.

Link to post
Share on other sites

  • Staff

ok,

please run the following:

Please create a new system restore point before running Malwarebytes Anti-Rootkit if you can.

MBAR tutorial

Download Malwarebytes Anti-Rootkit from HERE

  • Unzip the contents to a folder in a convenient location.
  • Open the folder where the contents were unzipped and run mbar.exe
  • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  • Wait while the system shuts down and the cleanup process is performed.
  • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot.

Verify that your system is now functioning normally.

Link to post
Share on other sites

When I start mbar I get the warning: "Registry value 'AppInit_Dlls' have been found, which may be caused by rootkit activity. Note: Press 'no' button if you're not sure. If the tool crashes or terminates unexpectedly during a system scan, restart the tool and press 'yes' should this message appear again. Do you want to remove this value and restart the tool? (options yes and no.)

Should I remove the value (press yes) to proceed or press no?

Link to post
Share on other sites

Please create a new system restore point before running Malwarebytes Anti-Rootkit if you can. Was able to; Done (step 1).

MBAR tutorial Read it; Done (step 2).

Download Malwarebytes Anti-Rootkit from HERE

Done (step 3).

  • Unzip the contents to a folder in a convenient location. Done (step 4).
  • Open the folder where the contents were unzipped and run mbar.exe Done (step 5), having removed the registry value as note in post above.
  • Follow the instructions in the wizard to update and allow the program to scan your computer for threats. Done (step 6).
  • Click on the Cleanup button to remove any threats and reboot if prompted to do so. Done (step 7); "NO MALWARE FOUND. NO CLEANUP REQUIRED."
  • Wait while the system shuts down and the cleanup process is performed. Restart performed (step 8).
  • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process. Not done, because no threats were found the first time (step 9).
  • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt Done (step 10):

Malwarebytes Anti-Rootkit BETA 1.01.0.1021

www.malwarebytes.org

Database version: v2013.03.09.10

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

BackupPC :: BEN-PC [administrator]

3/9/2013 11:43:21 AM

mbar-log-2013-03-09 (11-43-21).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P

Scan options disabled:

Objects scanned: 31876

Time elapsed: 39 minute(s), 39 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.01.0.1021

© Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 9.0.8112.16421

Java version: 1.6.0_31

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED, Q:\ DRIVE_FIXED

CPU speed: 1.397000 GHz

Memory total: 3735973888, free: 2226802688

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.01.0.1021

© Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 9.0.8112.16421

Java version: 1.6.0_31

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED, Q:\ DRIVE_FIXED

CPU speed: 1.397000 GHz

Memory total: 3735973888, free: 2391724032

------------ Kernel report ------------

03/09/2013 10:54:13

------------ Loaded modules -----------

\SystemRoot\system32\ntoskrnl.exe

\SystemRoot\system32\hal.dll

\SystemRoot\system32\kdcom.dll

\SystemRoot\system32\mcupdate_AuthenticAMD.dll

\SystemRoot\system32\PSHED.dll

\SystemRoot\system32\CLFS.SYS

\SystemRoot\system32\CI.dll

\SystemRoot\system32\drivers\Wdf01000.sys

\SystemRoot\system32\drivers\WDFLDR.SYS

\SystemRoot\system32\drivers\ACPI.sys

\SystemRoot\system32\drivers\WMILIB.SYS

\SystemRoot\system32\drivers\msisadrv.sys

\SystemRoot\system32\drivers\pci.sys

\SystemRoot\system32\drivers\vdrvroot.sys

\SystemRoot\System32\drivers\partmgr.sys

\SystemRoot\system32\drivers\compbatt.sys

\SystemRoot\system32\drivers\BATTC.SYS

\SystemRoot\system32\drivers\volmgr.sys

\SystemRoot\System32\drivers\volmgrx.sys

\SystemRoot\System32\drivers\mountmgr.sys

\SystemRoot\system32\drivers\atapi.sys

\SystemRoot\system32\drivers\ataport.SYS

\SystemRoot\system32\drivers\msahci.sys

\SystemRoot\system32\drivers\PCIIDEX.SYS

\SystemRoot\system32\drivers\amdxata.sys

\SystemRoot\system32\drivers\fltmgr.sys

\SystemRoot\system32\drivers\N360x64\1402000.013\SYMDS64.SYS

\SystemRoot\system32\drivers\fileinfo.sys

\SystemRoot\system32\drivers\N360x64\1402000.013\SYMEFA64.SYS

\SystemRoot\System32\Drivers\Ntfs.sys

\SystemRoot\System32\Drivers\msrpc.sys

\SystemRoot\System32\Drivers\ksecdd.sys

\SystemRoot\System32\Drivers\cng.sys

\SystemRoot\System32\drivers\pcw.sys

\SystemRoot\System32\Drivers\Fs_Rec.sys

\SystemRoot\system32\drivers\ndis.sys

\SystemRoot\system32\drivers\NETIO.SYS

\SystemRoot\System32\Drivers\ksecpkg.sys

\SystemRoot\System32\drivers\tcpip.sys

\SystemRoot\System32\drivers\fwpkclnt.sys

\SystemRoot\system32\drivers\volsnap.sys

\SystemRoot\System32\Drivers\spldr.sys

\SystemRoot\System32\drivers\rdyboost.sys

\SystemRoot\System32\Drivers\mup.sys

\SystemRoot\System32\drivers\hwpolicy.sys

\SystemRoot\System32\DRIVERS\fvevol.sys

\SystemRoot\system32\drivers\disk.sys

\SystemRoot\system32\drivers\CLASSPNP.SYS

\SystemRoot\system32\DRIVERS\cdrom.sys

\SystemRoot\system32\drivers\N360x64\1402000.013\ccSetx64.sys

\SystemRoot\system32\drivers\N360x64\1402000.013\Ironx64.SYS

\SystemRoot\System32\Drivers\Null.SYS

\SystemRoot\System32\Drivers\Beep.SYS

\SystemRoot\System32\drivers\vga.sys

\SystemRoot\System32\drivers\VIDEOPRT.SYS

\SystemRoot\System32\drivers\watchdog.sys

\SystemRoot\System32\DRIVERS\RDPCDD.sys

\SystemRoot\system32\drivers\rdpencdd.sys

\SystemRoot\system32\drivers\rdprefmp.sys

\SystemRoot\System32\Drivers\Msfs.SYS

\SystemRoot\System32\Drivers\Npfs.SYS

\SystemRoot\system32\DRIVERS\tdx.sys

\SystemRoot\system32\DRIVERS\TDI.SYS

\SystemRoot\system32\drivers\afd.sys

\SystemRoot\System32\DRIVERS\netbt.sys

\SystemRoot\system32\DRIVERS\wfplwf.sys

\SystemRoot\system32\DRIVERS\pacer.sys

\SystemRoot\system32\DRIVERS\vwififlt.sys

\SystemRoot\system32\DRIVERS\netbios.sys

\SystemRoot\system32\DRIVERS\wanarp.sys

\SystemRoot\system32\drivers\termdd.sys

\SystemRoot\System32\Drivers\N360x64\1402000.013\SYMNETS.SYS

\??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS

\SystemRoot\system32\drivers\N360x64\1402000.013\SRTSPX64.SYS

\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS

\??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS

\SystemRoot\system32\DRIVERS\rdbss.sys

\SystemRoot\system32\drivers\nsiproxy.sys

\SystemRoot\system32\drivers\mssmbios.sys

\??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130308.001\IDSvia64.sys

\??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys

\??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys

\SystemRoot\System32\drivers\discache.sys

\SystemRoot\System32\Drivers\dfsc.sys

\SystemRoot\system32\drivers\blbdrive.sys

\??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130301.001\BHDrvx64.sys

\??\C:\Windows\system32\drivers\AntiLog64.sys

\SystemRoot\system32\DRIVERS\tunnel.sys

\SystemRoot\system32\DRIVERS\amdppm.sys

\SystemRoot\system32\DRIVERS\atikmpag.sys

\SystemRoot\system32\DRIVERS\atikmdag.sys

\SystemRoot\System32\drivers\dxgkrnl.sys

\SystemRoot\System32\drivers\dxgmms1.sys

\SystemRoot\system32\drivers\HDAudBus.sys

\SystemRoot\system32\DRIVERS\k57nd60a.sys

\SystemRoot\system32\DRIVERS\bScsiSDa.sys

\SystemRoot\system32\DRIVERS\SCSIPORT.SYS

\SystemRoot\system32\DRIVERS\bScsiMSa.sys

\SystemRoot\system32\DRIVERS\b57xdbd.sys

\SystemRoot\system32\DRIVERS\athrx.sys

\SystemRoot\system32\DRIVERS\vwifibus.sys

\??\C:\Windows\system32\drivers\UBHelper.sys

\??\C:\Windows\system32\drivers\NTIDrvr.sys

\SystemRoot\system32\drivers\usbohci.sys

\SystemRoot\system32\drivers\USBPORT.SYS

\SystemRoot\system32\DRIVERS\usbfilter.sys

\SystemRoot\system32\drivers\usbehci.sys

\SystemRoot\system32\drivers\i8042prt.sys

\SystemRoot\system32\DRIVERS\KeyCrypt64.sys

\SystemRoot\system32\DRIVERS\kbdclass.sys

\SystemRoot\system32\DRIVERS\ETD.sys

\SystemRoot\system32\DRIVERS\mouclass.sys

\SystemRoot\system32\DRIVERS\wmiacpi.sys

\SystemRoot\system32\drivers\CmBatt.sys

\SystemRoot\system32\drivers\CompositeBus.sys

\SystemRoot\system32\DRIVERS\AgileVpn.sys

\SystemRoot\system32\DRIVERS\rasl2tp.sys

\SystemRoot\system32\DRIVERS\ndistapi.sys

\SystemRoot\system32\DRIVERS\ndiswan.sys

\SystemRoot\system32\DRIVERS\raspppoe.sys

\SystemRoot\system32\DRIVERS\raspptp.sys

\SystemRoot\system32\DRIVERS\rassstp.sys

\SystemRoot\system32\drivers\swenum.sys

\SystemRoot\system32\drivers\ks.sys

\SystemRoot\system32\DRIVERS\umbus.sys

\SystemRoot\system32\drivers\usbhub.sys

\SystemRoot\System32\Drivers\NDProxy.SYS

\SystemRoot\system32\drivers\AtihdW76.sys

\SystemRoot\system32\drivers\portcls.sys

\SystemRoot\system32\drivers\drmk.sys

\SystemRoot\system32\drivers\ksthunk.sys

\SystemRoot\system32\DRIVERS\b57xdmp.sys

\SystemRoot\system32\drivers\RTKVHD64.sys

\SystemRoot\system32\DRIVERS\cdfs.sys

\SystemRoot\System32\Drivers\crashdmp.sys

\SystemRoot\System32\Drivers\dump_dumpata.sys

\SystemRoot\System32\Drivers\dump_msahci.sys

\SystemRoot\System32\Drivers\dump_dumpfve.sys

\SystemRoot\system32\DRIVERS\usbccgp.sys

\SystemRoot\system32\DRIVERS\USBD.SYS

\SystemRoot\System32\Drivers\usbvideo.sys

\SystemRoot\System32\win32k.sys

\SystemRoot\System32\drivers\Dxapi.sys

\SystemRoot\system32\DRIVERS\monitor.sys

\SystemRoot\System32\TSDDD.dll

\SystemRoot\System32\cdd.dll

\SystemRoot\System32\ATMFD.DLL

\SystemRoot\system32\drivers\luafv.sys

\SystemRoot\system32\DRIVERS\Sftvollh.sys

\SystemRoot\system32\DRIVERS\lltdio.sys

\SystemRoot\system32\DRIVERS\nwifi.sys

\SystemRoot\system32\DRIVERS\ndisuio.sys

\SystemRoot\system32\DRIVERS\rspndr.sys

\SystemRoot\system32\drivers\HTTP.sys

\SystemRoot\system32\DRIVERS\bowser.sys

\SystemRoot\System32\drivers\mpsdrv.sys

\SystemRoot\system32\DRIVERS\mrxsmb.sys

\SystemRoot\system32\DRIVERS\mrxsmb10.sys

\SystemRoot\system32\DRIVERS\mrxsmb20.sys

\SystemRoot\system32\DRIVERS\vwifimp.sys

\SystemRoot\system32\DRIVERS\atksgt.sys

\SystemRoot\system32\DRIVERS\lirsgt.sys

\SystemRoot\system32\drivers\peauth.sys

\SystemRoot\System32\Drivers\secdrv.SYS

\SystemRoot\system32\DRIVERS\Sftfslh.sys

\SystemRoot\system32\DRIVERS\Sftplaylh.sys

\SystemRoot\System32\DRIVERS\srvnet.sys

\SystemRoot\System32\drivers\tcpipreg.sys

\SystemRoot\System32\DRIVERS\srv2.sys

\SystemRoot\System32\DRIVERS\srv.sys

\SystemRoot\system32\DRIVERS\Sftredirlh.sys

\SystemRoot\system32\DRIVERS\WSDPrint.sys

\SystemRoot\System32\Drivers\N360x64\1402000.013\SRTSP64.SYS

\??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130309.003\EX64.SYS

\??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130309.003\ENG64.SYS

\SystemRoot\system32\DRIVERS\USBSTOR.SYS

\SystemRoot\System32\Drivers\fastfat.SYS

\SystemRoot\system32\drivers\WudfPf.sys

\SystemRoot\system32\DRIVERS\WUDFRd.sys

\??\C:\Windows\system32\drivers\mbamchameleon.sys

\??\C:\Windows\system32\drivers\mbamswissarmy.sys

\Windows\System32\ntdll.dll

\Windows\System32\smss.exe

\Windows\System32\apisetschema.dll

\Windows\System32\autochk.exe

\Windows\System32\urlmon.dll

----------- End -----------

<<<1>>>

Upper Device Name: \Device\Harddisk1\DR1

Upper Device Object: 0xfffffa8004789060

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\0000008f\

Lower Device Object: 0xfffffa8004757060

Lower Device Driver Name: \Driver\USBSTOR\

Driver name found: USBSTOR

Initialization returned 0x0

Load Function returned 0x0

<<<1>>>

Upper Device Name: \Device\Harddisk0\DR0

Upper Device Object: 0xfffffa800470a060

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\

Lower Device Object: 0xfffffa80040d5060

Lower Device Driver Name: \Driver\atapi\

Driver name found: atapi

Initialization returned 0x0

Port sub-driver loaded: \??\C:\Windows\System32\drivers\ataport.sys (0x0)

Load Function returned 0x0

Downloaded database version: v2013.03.09.10

Initializing...

Done!

<<<2>>>

Device number: 0, partition: 3

Physical Sector Size: 512

Drive: 0, DevicePointer: 0xfffffa800470a060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa800470ab90, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa800470a060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa80040d5060, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\

------------ End ----------

Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

Upper DeviceData: 0xfffff8a0018566a0, 0xfffffa800470a060, 0xfffffa80039c7300

Lower DeviceData: 0xfffff8a001820230, 0xfffffa80040d5060, 0xfffffa8003b49180

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Scanning directory: C:\Windows\system32\drivers...

<<<2>>>

Device number: 0, partition: 3

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Done!

Drive 0

Scanning MBR on drive 0...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: 6A10A1B8

Partition information:

Partition 0 type is Other (0x27)

Partition is NOT ACTIVE.

Partition starts at LBA: 2048 Numsec = 37748736

Partition 1 type is Primary (0x7)

Partition is ACTIVE.

Partition starts at LBA: 37750784 Numsec = 204800

Partition file system is NTFS

Partition is bootable

Partition 2 type is Primary (0x7)

Partition is NOT ACTIVE.

Partition starts at LBA: 37955584 Numsec = 1212305408

Partition 3 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Disk Size: 640135028736 bytes

Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-1250243728-1250263728)...

Physical Sector Size: 512

Drive: 1, DevicePointer: 0xfffffa8004789060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa8004791500, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa8004789060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa8004757060, DeviceName: \Device\0000008f\, DriverName: \Driver\USBSTOR\

------------ End ----------

Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\

Upper DeviceData: 0xfffff8a0018f6350, 0xfffffa8004789060, 0xfffffa80037b0790

Lower DeviceData: 0xfffff8a0022e8be0, 0xfffffa8004757060, 0xfffffa8003b7b2c0

Drive 1

Scanning MBR on drive 1...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: 8E968C37

Partition information:

Partition 0 type is Other (0xb)

Partition is ACTIVE.

Partition starts at LBA: 32 Numsec = 1007584

Partition file system is FAT32

Partition is not bootable

Partition 1 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Disk Size: 515899392 bytes

Sector size: 512 bytes

Done!

Performing system, memory and registry scan...

Read File: File "c:\ProgramData\{54354A6F-DFEF-43FB-B54D-C03C4D79EED5}\iMesh_V11_en_Setup.dat" is compressed (flags = 1)

Read File: File "c:\ProgramData\{54354A6F-DFEF-43FB-B54D-C03C4D79EED5}\iMesh_V11_en_Setup.lnk" is compressed (flags = 1)

Read File: File "c:\ProgramData\{54354A6F-DFEF-43FB-B54D-C03C4D79EED5}\instance.dat" is compressed (flags = 1)

Read File: File "c:\ProgramData\{B49A644A-1076-4A3D-B124-DAA7862F2318}\iLividSetupV1.dat" is compressed (flags = 1)

Read File: File "c:\ProgramData\{B49A644A-1076-4A3D-B124-DAA7862F2318}\instance.dat" is compressed (flags = 1)

Read File: File "c:\ProgramData\{54354A6F-DFEF-43FB-B54D-C03C4D79EED5}\iMesh_V11_en_Setup.dat" is compressed (flags = 1)

Read File: File "c:\ProgramData\{54354A6F-DFEF-43FB-B54D-C03C4D79EED5}\iMesh_V11_en_Setup.lnk" is compressed (flags = 1)

Read File: File "c:\ProgramData\{54354A6F-DFEF-43FB-B54D-C03C4D79EED5}\instance.dat" is compressed (flags = 1)

Read File: File "c:\ProgramData\{B49A644A-1076-4A3D-B124-DAA7862F2318}\iLividSetupV1.dat" is compressed (flags = 1)

Read File: File "c:\ProgramData\{B49A644A-1076-4A3D-B124-DAA7862F2318}\instance.dat" is compressed (flags = 1)

Done!

Scan finished

=======================================

Link to post
Share on other sites

  • Staff

please run the following:

Refer to the ComboFix User's Guide

  1. Download ComboFix from the following location:
    Link
    * IMPORTANT !!! Place ComboFix.exe on your Desktop
  2. Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
    You can get help on disabling your protection programs here
  3. Double click on ComboFix.exe & follow the prompts.
  4. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  5. When finished, it shall produce a log for you. Post that log in your next reply
    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
    ---------------------------------------------------------------------------------------------
  6. Ensure your AntiVirus and AntiSpyware applications are re-enabled.
    ---------------------------------------------------------------------------------------------

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.

Link to post
Share on other sites

Took a couple tries to get my Norton AV disabled completely, then scan took some time. But it's done now and here is the log. Thanks, CatByte, for all your help.

ComboFix 13-03-09.01 - BackupPC 03/09/2013 13:22:34.1.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3563.2200 [GMT -8:00]

Running from: c:\users\BackupPC\Desktop\ComboFix.exe

AV: Norton Security Suite *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

FW: Norton Security Suite *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

SP: Norton Security Suite *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\install.exe

c:\program files (x86)\facemoods.com

c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll

c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoods.crx

c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoods.png

c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsApp.dll

c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsEng.dll

c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe

c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll

c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\uninstall.exe

c:\programdata\1EB

c:\programdata\1EB\{76A991A1-CDCB-4C4C-A424-AE8C41A4C29C}.swf

.

.

((((((((((((((((((((((((( Files Created from 2013-02-09 to 2013-03-09 )))))))))))))))))))))))))))))))

.

.

2013-03-09 21:31 . 2013-03-09 21:31 -------- d-----w- c:\users\music\AppData\Local\temp

2013-03-09 21:31 . 2013-03-09 21:31 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-03-09 17:21 . 2013-03-09 17:21 -------- d-----w- C:\FRST

2013-03-09 13:44 . 2013-03-09 13:44 -------- d-----w- c:\users\BackupPC\AppData\Roaming\Malwarebytes

2013-03-09 13:43 . 2013-03-09 13:43 -------- d-----w- c:\programdata\Malwarebytes

2013-03-09 13:43 . 2013-03-09 13:44 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2013-03-09 13:43 . 2012-12-15 00:49 24176 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-03-09 13:43 . 2013-03-09 13:43 -------- d-----w- c:\users\BackupPC\AppData\Local\Programs

2013-03-09 05:22 . 2013-03-09 05:22 -------- d-----w- C:\components

2013-03-09 01:00 . 2013-03-09 03:36 -------- d-----w- c:\users\Ben\AppData\Roaming\.minecraft

2013-03-08 19:13 . 2013-03-09 13:58 -------- d-----w- c:\users\Ben\AppData\Local\SwvUpdater

2013-03-08 19:12 . 2013-03-08 19:12 -------- d-----w- c:\program files (x86)\Conduit

2013-03-08 19:12 . 2013-03-09 05:24 -------- d-----w- c:\users\Ben\AppData\Local\Conduit

2013-03-08 19:12 . 2013-03-08 19:12 -------- d-----w- c:\users\Ben\AppData\Local\CRE

2013-03-08 19:10 . 2013-03-08 19:10 -------- d-----w- c:\users\Ben\AppData\Roaming\SearchProtect

2013-03-04 01:30 . 2013-03-04 01:30 -------- d-----w- c:\programdata\2394

2013-03-04 01:27 . 2013-03-04 01:27 -------- d-----w- c:\users\Ben\AppData\Roaming\ATI

2013-03-04 01:27 . 2013-03-04 01:27 -------- d-----w- c:\users\Ben\AppData\Local\ATI

2013-03-04 01:27 . 2013-03-04 01:27 -------- d-----w- c:\programdata\ATI

2013-03-04 01:07 . 2013-03-04 01:07 0 ----a-w- c:\windows\SysWow64\shoAE9B.tmp

2013-02-27 00:34 . 2013-02-27 00:34 -------- d-----w- c:\program files (x86)\Common Files\BattlEye

2013-02-27 00:30 . 2013-02-27 00:30 -------- d-----w- c:\programdata\Bohemia Interactive Studio

2013-02-27 00:19 . 2013-02-27 00:21 -------- d-----w- c:\users\Ben\AppData\Local\ArmA 2

2013-02-27 00:15 . 2013-03-06 20:55 -------- d-----w- c:\users\Ben\AppData\Local\ArmA 2 OA

2013-02-26 22:40 . 2013-03-06 03:07 -------- d-----w- c:\users\Ben\AppData\Local\DayZCommander

2013-02-26 22:39 . 2013-02-26 22:39 -------- d-----w- c:\program files (x86)\Dotjosh Studios

2013-02-25 23:55 . 2013-02-25 23:55 0 ----a-w- c:\windows\SysWow64\sho4E2.tmp

2013-02-24 23:16 . 2013-02-24 23:16 -------- d-----w- C:\New Folder

2013-02-18 19:59 . 2013-02-18 23:15 -------- d-----w- c:\windows\system32\drivers\N360x64\1402000.013

2013-02-15 23:43 . 2013-01-09 01:10 996352 ----a-w- c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll

2013-02-15 23:43 . 2013-01-08 22:01 768000 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll

2013-02-15 02:51 . 2013-01-05 05:53 5553512 ----a-w- c:\windows\system32\ntoskrnl.exe

2013-02-15 02:51 . 2013-01-05 05:00 3967848 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

2013-02-15 02:51 . 2013-01-05 05:00 3913064 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

2013-02-15 02:51 . 2013-01-04 03:26 3153408 ----a-w- c:\windows\system32\win32k.sys

2013-02-15 02:50 . 2013-01-04 05:46 215040 ----a-w- c:\windows\system32\winsrv.dll

2013-02-15 02:50 . 2013-01-04 04:51 5120 ----a-w- c:\windows\SysWow64\wow32.dll

2013-02-15 02:50 . 2013-01-04 02:47 25600 ----a-w- c:\windows\SysWow64\setup16.exe

2013-02-15 02:50 . 2013-01-04 02:47 7680 ----a-w- c:\windows\SysWow64\instnm.exe

2013-02-15 02:50 . 2013-01-04 02:47 2048 ----a-w- c:\windows\SysWow64\user.exe

2013-02-15 02:50 . 2013-01-04 02:47 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll

2013-02-15 02:50 . 2013-01-03 06:00 1913192 ----a-w- c:\windows\system32\drivers\tcpip.sys

2013-02-15 02:50 . 2013-01-03 06:00 288088 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS

2013-02-12 01:06 . 2013-01-06 04:39 7369552 ----a-w- c:\windows\SysWow64\ZALSDKCore.dll

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-03-06 10:38 . 2011-06-11 08:58 770384 ----a-w- c:\windows\SysWow64\msvcr100.dll

2013-03-06 10:38 . 2011-06-11 08:58 421200 ----a-w- c:\windows\SysWow64\msvcp100.dll

2013-02-27 00:14 . 2012-04-04 15:30 691568 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2013-02-27 00:14 . 2012-01-08 00:29 71024 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-02-25 21:43 . 2012-01-20 23:25 53312 ----a-w- c:\windows\system32\drivers\pssdk42.sys

2013-02-17 03:57 . 2012-05-29 23:30 177312 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS

2013-02-15 23:50 . 2012-01-12 17:32 70004024 ----a-w- c:\windows\system32\MRT.exe

2013-02-03 15:52 . 2013-02-03 15:52 0 ----a-w- c:\windows\system32\atiuxpag.dll

2013-02-03 15:52 . 2013-02-03 15:52 0 ----a-w- c:\windows\system32\atidxx32.dll

2013-02-03 15:52 . 2013-02-03 15:52 0 ----a-w- c:\windows\system32\GIDHook.dll

2013-02-03 15:52 . 2013-02-03 15:52 0 ----a-w- c:\windows\system32\EasyHook32.dll

2013-02-03 15:52 . 2013-02-03 15:52 0 ----a-w- c:\windows\system32\atiumdva.dll

2013-02-03 15:52 . 2013-02-03 15:52 0 ----a-w- c:\windows\system32\atiumdag.dll

2013-02-03 15:52 . 2013-02-03 15:52 0 ----a-w- c:\windows\system32\atiu9pag.dll

2013-02-03 15:52 . 2013-02-03 15:52 0 ----a-w- c:\windows\system32\aticfx32.dll

2013-01-24 00:24 . 2011-02-01 03:12 127832 ----a-w- c:\windows\system32\kwmain.exe

2013-01-17 02:05 . 2013-01-17 02:05 0 ----a-w- c:\windows\SysWow64\sho497E.tmp

2013-01-04 04:43 . 2013-02-15 02:50 44032 ----a-w- c:\windows\apppatch\acwow64.dll

2013-01-01 01:03 . 2011-02-01 03:11 356352 ----a-w- c:\windows\eSellerateEngine.DLL

2012-12-16 17:11 . 2012-12-29 23:12 46080 ----a-w- c:\windows\system32\atmlib.dll

2012-12-16 14:45 . 2012-12-29 23:12 367616 ----a-w- c:\windows\system32\atmfd.dll

2012-12-16 14:13 . 2012-12-29 23:12 295424 ----a-w- c:\windows\SysWow64\atmfd.dll

2012-12-16 14:13 . 2012-12-29 23:12 34304 ----a-w- c:\windows\SysWow64\atmlib.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{1631550F-191D-4826-B069-D9439253D926}]

2011-10-05 11:02 386424 ----a-w- c:\program files (x86)\PriceGong\2.5.3\PriceGongIE.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{B6EF6C45-5E8D-4c3b-B580-A5073261A381}]

2011-11-03 17:43 528216 ----a-w- c:\program files (x86)\RewardsArcadeSuite\RewardsArcadeSuite.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{E5C66DD8-308B-4a4f-AF0A-3D04F25B5343}]

2010-11-21 03:24 297808 ----a-w- c:\windows\System32\mscoree.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-11-01 5629312]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"BackupManagerTray"="c:\program files (x86)\NTI\Gateway MyBackup\BackupManagerTray.exe" [2011-03-09 290112]

"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]

"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2011-07-01 1103440]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-05-26 336384]

"RemoteControl10"="c:\program files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [2010-02-03 87336]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe [2013-2-5 272248]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 0 (0x0)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux2"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

R1 AntiLog32;AntiLog32;c:\windows\system32\drivers\AntiLog64.sys [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-11-09 160944]

R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-06-07 191752]

R3 BEService;BattlEye Service;c:\program files (x86)\Common Files\BattlEye\BEService.exe [2013-02-27 49152]

R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

R3 InternetConnectionService;InternetConnectionService;c:\windows\system32\kwcaptur.exe [2012-10-30 1158552]

R3 keycrypt;keycrypt;c:\windows\system32\DRIVERS\KeyCrypt64.sys [x]

R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [2013-02-05 235216]

R3 PCDSRVC{55A82D33-09B24F87-06020200}_0;PCDSRVC{55A82D33-09B24F87-06020200}_0 - PCDR Kernel Mode Service Helper Driver;c:\users\ben\appdata\local\temp\msibgufmj.zd\pcdrdiag\bin\pcdsrvc_x64.pkms [x]

R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2011-08-01 45416]

R3 PSSDK42;PSSDK42;c:\windows\system32\Drivers\pssdk42.sys [2013-02-25 53312]

R3 TCFilter;TCFilter;c:\windows\system32\drivers\tcfilter.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-01-06 1255736]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360x64\1402000.013\SYMDS64.SYS [2012-10-04 493216]

S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360x64\1402000.013\SYMEFA64.SYS [2012-10-04 1133216]

S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130301.001\BHDrvx64.sys [2013-02-08 1388120]

S1 ccSet_N360;Norton Security Suite Settings Manager;c:\windows\system32\drivers\N360x64\1402000.013\ccSetx64.sys [2012-10-04 168096]

S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130308.001\IDSvia64.sys [2013-02-16 513184]

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]

S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]

S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360x64\1402000.013\Ironx64.SYS [2012-07-28 224416]

S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\N360x64\1402000.013\SYMNETS.SYS [2012-07-23 432800]

S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2012-07-11 140672]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-05-25 204288]

S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-05-12 249648]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]

S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2011-07-01 353360]

S2 ePowerSvc;ePower Service;c:\program files\Gateway\Gateway Power Management\ePowerSvc.exe [2011-08-02 872552]

S2 GREGService;GREGService;c:\program files (x86)\Gateway\Registration\GREGsvc.exe [2011-05-30 36456]

S2 Live Updater Service;Live Updater Service;c:\program files\Gateway\Gateway Updater\UpdaterService.exe [2011-04-22 244624]

S2 N360;Norton Security Suite;c:\program files (x86)\Norton Security Suite\Engine\20.2.0.19\ccSvcHst.exe [2012-10-11 143928]

S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2010-05-04 503080]

S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]

S2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;c:\program files (x86)\Norton PC Checkup\Engine\2.0.17.48\SymcPCCULaunchSvc.exe [2012-10-08 123320]

S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NTI\Gateway MyBackup\IScheduleSvc.exe [2011-03-09 257344]

S2 PCCUJobMgr;Common Client Job Manager Service;c:\program files (x86)\Norton PC Checkup\Engine\2.0.17.48\ccSvcHst.exe [2011-12-14 126392]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]

S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2011-03-30 114704]

S3 b57xdbd;Broadcom xD Picture Bus Driver Service;c:\windows\system32\DRIVERS\b57xdbd.sys [2011-01-21 67624]

S3 b57xdmp;Broadcom xD Picture vstorp client drv;c:\windows\system32\DRIVERS\b57xdmp.sys [2011-01-21 19496]

S3 bScsiMSa;bScsiMSa;c:\windows\system32\DRIVERS\bScsiMSa.sys [2011-05-16 51240]

S3 bScsiSDa;bScsiSDa;c:\windows\system32\DRIVERS\bScsiSDa.sys [2011-05-06 86056]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-10-23 138912]

S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2010-11-12 138024]

S3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2011-05-10 425000]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2010-12-15 47232]

.

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-03-06 20:44 1630672 ----a-w- c:\program files (x86)\Google\Chrome\Application\25.0.1364.152\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2013-03-09 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 00:14]

.

2013-03-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-08 00:29]

.

2013-03-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-08 00:29]

.

2013-03-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1920678218-283744918-577706541-1001Core.job

- c:\users\Ben\AppData\Local\Google\Update\GoogleUpdate.exe [2012-06-15 18:22]

.

2013-03-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1920678218-283744918-577706541-1001UA.job

- c:\users\Ben\AppData\Local\Google\Update\GoogleUpdate.exe [2012-06-15 18:22]

.

2013-03-09 c:\windows\Tasks\KWChat.job

- c:\program files (x86)\Computer Business Solutions\KidsWatch\KidsWatch.exe [2012-01-11 04:24]

.

2013-03-05 c:\windows\Tasks\KWVacuum.job

- c:\program files (x86)\Computer Business Solutions\KidsWatch\KidsWatch.exe [2012-01-11 04:24]

.

2013-03-09 c:\windows\Tasks\KWWeb.job

- c:\program files (x86)\Computer Business Solutions\KidsWatch\KidsWatch.exe [2012-01-11 04:24]

.

2013-03-09 c:\windows\Tasks\TCC0ben.job

- c:\program files (x86)\Computer Business Solutions\KidsWatch\KidsWatch.exe [2012-01-11 04:24]

.

2013-03-09 c:\windows\Tasks\TCI0ben.job

- c:\program files (x86)\Computer Business Solutions\KidsWatch\KidsWatch.exe [2012-01-11 04:24]

.

2013-03-09 c:\windows\Tasks\TCL0ben.job

- c:\program files (x86)\Computer Business Solutions\KidsWatch\KidsWatch.exe [2012-01-11 04:24]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-03-28 11786344]

"Power Management"="c:\program files\Gateway\Gateway Power Management\ePowerTray.exe" [2011-08-02 1831016]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]

"drkly16j"="drkly16j.dll" [2012-05-12 1632152]

"TCTray"="c:\program files (x86)\Computer Business Solutions\KidsWatch\KWTray.exe" [2012-05-04 502680]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService

FontCache

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.com/

mDefault_Page_URL = hxxp://www.bing.com/?pc=MAGW

mStart Page = hxxp://www.bing.com/?pc=MAGW

mLocal Page = c:\windows\SysWOW64\blank.htm

mSearchAssistant = hxxp://start.facemoods.com/?a=adknlg&s={searchTerms}&f=4

TCP: DhcpNameServer = 75.75.75.75 75.75.76.76

FF - ProfilePath - c:\users\BackupPC\AppData\Roaming\Mozilla\Firefox\Profiles\mf82nd3g.default\

FF - prefs.js: browser.search.selectedEngine - Ask.com

FF - prefs.js: keyword.URL -

FF - ExtSQL: 2013-02-02 18:54; {BBDA0591-3099-440a-AA10-41764D9DB4DB}; c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\IPSFFPlgn

FF - ExtSQL: 2013-02-02 18:58; {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}; c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\coFFPlgn

FF - ExtSQL: 2013-02-17 15:47; idvaultaddin@whitesky; c:\users\BackupPC\AppData\Roaming\Mozilla\Firefox\Profiles\mf82nd3g.default\extensions\idvaultaddin@whitesky

.

- - - - ORPHANS REMOVED - - - -

.

BHO-{64182481-4F71-486b-A045-B233BD0DA8FC} - c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll

BHO-{99079a25-328f-4bd4-be04-00955acaa0a7} - c:\progra~2\WI3C8A~1\Datamngr\ToolBar\searchqudtx.dll

BHO-{9D717F81-9148-4f12-8568-69135F087DB0} - c:\progra~2\WI3C8A~1\Datamngr\BROWSE~1.DLL

Toolbar-Locked - (no file)

Toolbar-{DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll

Toolbar-{99079a25-328f-4bd4-be04-00955acaa0a7} - c:\progra~2\WI3C8A~1\Datamngr\ToolBar\searchqudtx.dll

Toolbar-10 - (no file)

Wow6432Node-HKLM-Run-facemoods - c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe

Toolbar-Locked - (no file)

Toolbar-10 - (no file)

HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe

AddRemove-BattlEye for A2 - c:\program files (x86)\Steam\steamapps\common\Arma 2BattlEye\UnInstallBE.exe

AddRemove-Download Manager - c:\program files (x86)\Download Manager\uninstall.exe

AddRemove-facemoods - c:\program files (x86)\facemoods.com\facemoods\1.4.17.11\uninstall.exe

AddRemove-Floris Mod Pack_is1 - c:\program files (x86)\Steam\steamapps\common\mountblade warband\Modules\New Folder\Modules\unins000.exe

AddRemove-Fraps - c:\users\BackupPC\Desktop\fraps\uninstall.exe

.

.

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\N360]

"ImagePath"="\"c:\program files (x86)\Norton Security Suite\Engine\20.2.0.19\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton Security Suite\Engine\20.2.0.19\diMaster.dll\" /prefetch:1"

--

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCCUJobMgr]

"ImagePath"="\"c:\program files (x86)\Norton PC Checkup\Engine\2.0.17.48\ccSvcHst.exe\" /s \"PCCUJobMgr\" /m \"c:\program files (x86)\Norton PC Checkup\Engine\2.0.17.48\diMaster.dll\" /prefetch:1"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCDSRVC{55A82D33-09B24F87-06020200}_0]

"ImagePath"="\??\c:\users\ben\appdata\local\temp\msibgufmj.zd\pcdrdiag\bin\pcdsrvc_x64.pkms"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_171_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_171_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_171_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_171_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Other Running Processes ------------------------

.

c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

c:\program files (x86)\Launch Manager\LMutilps32.exe

c:\program files (x86)\Launch Manager\LMworker.exe

c:\program files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe

.

**************************************************************************

.

Completion time: 2013-03-09 13:44:05 - machine was rebooted

ComboFix-quarantined-files.txt 2013-03-09 21:44

.

Pre-Run: 378,540,937,216 bytes free

Post-Run: 378,259,308,544 bytes free

.

- - End Of File - - 1C2480550D88AA736C03BACE697E7A31

Link to post
Share on other sites

  • Staff

Please run the following:

Please download Junkware Removal Tool to your desktop.

  • Shutdown your antivirus to avoid any conflicts.
  • Right-mouse click JRT.exe and select Run as administrator
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message

NEXT

Download AdwCleaner from here and save it to your desktop.

  • Run AdwCleaner and select Delete
  • Once done it will ask to reboot, allow the reboot
  • On reboot a log will be produced, please attach the content of the log to your next reply

NEXT

  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <-- very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Go here to run an online scanner from ESET.

  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activeX control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan completes, press the LIST OF THREATS FOUND button
  • Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
  • Include the contents of this report in your next reply.
  • Press the BACK button.
  • Press Finish

Link to post
Share on other sites

I have to go out for an hour or so. In the meantime, here are the logs from JRT and ADW. I'll proceed with the additional steps when I return.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 4.6.9 (03.06.2013:1)

OS: Windows 7 Home Premium x64

Ran by BackupPC on Sat 03/09/2013 at 14:03:03.97

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully deleted: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\toolbar\\{99079a25-328f-4bd4-be04-00955acaa0a7}

Successfully deleted: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\toolbar\\{db4e9724-f518-4dfd-9c7c-78b52103cab9}

~~~ Registry Keys

Successfully deleted: [Registry Key] hkey_classes_root\escort.escortiepane

Successfully deleted: [Registry Key] hkey_classes_root\escort.escortiepane.1

Successfully deleted: [Registry Key] hkey_local_machine\software\conduit

Successfully deleted: [Registry Key] hkey_local_machine\software\freeze.com

Successfully deleted: [Registry Key] hkey_local_machine\software\ilivid

Successfully deleted: [Registry Key] hkey_current_user\software\appdatalow\software\pricegong

Successfully deleted: [Registry Key] hkey_current_user\software\appdatalow\software\searchqutoolbar

Successfully deleted: [Registry Key] hkey_current_user\software\appdatalow\software\smartbar

Successfully deleted: [Registry Key] hkey_local_machine\software\classes\appid\discoveryhelper.dll

Successfully deleted: [Registry Key] hkey_local_machine\software\classes\appid\escort.dll

Successfully deleted: [Registry Key] hkey_local_machine\software\classes\appid\esrv.exe

Successfully deleted: [Registry Key] hkey_local_machine\software\classes\appid\gifanimator.dll

Successfully deleted: [Registry Key] hkey_local_machine\software\classes\appid\imtrprogress.dll

Successfully deleted: [Registry Key] hkey_local_machine\software\classes\appid\imweb.dll

Successfully deleted: [Registry Key] hkey_local_machine\software\classes\appid\pricegongie.dll

Successfully deleted: [Registry Key] hkey_local_machine\software\classes\appid\wmhelper.dll

Successfully deleted: [Registry Key] hkey_local_machine\software\classes\applications\ilividsetupv1.exe

Successfully deleted: [Registry Key] hkey_local_machine\software\classes\discoveryhelper.imesh6discovery

Successfully deleted: [Registry Key] hkey_local_machine\software\classes\discoveryhelper.imesh6discovery.1

Successfully deleted: [Registry Key] hkey_local_machine\software\classes\escort.escrtbtn.1

Successfully deleted: [Registry Key] hkey_local_machine\software\classes\esrv.escrtsrvc

Successfully deleted: [Registry Key] hkey_local_machine\software\classes\esrv.escrtsrvc.1

Successfully deleted: [Registry Key] hkey_local_machine\software\classes\facemoods.xtrnl

Successfully deleted: [Registry Key] hkey_local_machine\software\classes\facemoods.xtrnl.1

Successfully deleted: [Registry Key] hkey_local_machine\software\classes\facemoodsapp.appcore

Successfully deleted: [Registry Key] hkey_local_machine\software\classes\facemoodsapp.appcore.1

Successfully deleted: [Registry Key] hkey_local_machine\software\classes\imweb.imwebcontrol

Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\tracing\searchqumediabar_rasapi32

Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\tracing\searchqumediabar_rasmancs

Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\tracing\setupdatamngr_searchqu_rasapi32

Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\tracing\setupdatamngr_searchqu_rasmancs

Successfully deleted: [Registry Key] hkey_local_machine\software\wow6432node\microsoft\tracing\ilividsetupv1_rasapi32

Successfully deleted: [Registry Key] hkey_local_machine\software\wow6432node\microsoft\tracing\ilividsetupv1_rasmancs

Successfully deleted: [Registry Key-Heur] HKEY_LOCAL_MACHINE\software\classes\Toolbar.CT3289847

Successfully deleted: [Registry Key] hkey_classes_root\clsid\{1631550f-191d-4826-b069-d9439253d926}

Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\windows\currentversion\explorer\browser helper objects\{1631550f-191d-4826-b069-d9439253d926}

Successfully deleted: [Registry Key] hkey_classes_root\clsid\{3c471948-f874-49f5-b338-4f214a2ee0b1}

Successfully deleted: [Registry Key] hkey_classes_root\clsid\{64182481-4f71-486b-a045-b233bd0da8fc}

Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\windows\currentversion\explorer\browser helper objects\{64182481-4f71-486b-a045-b233bd0da8fc}

Successfully deleted: [Registry Key] hkey_classes_root\clsid\{99079a25-328f-4bd4-be04-00955acaa0a7}

Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\windows\currentversion\explorer\browser helper objects\{99079a25-328f-4bd4-be04-00955acaa0a7}

Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\internet explorer\searchscopes\{9bb47c17-9c68-4bb3-b188-dd9af0fd2406}

Successfully deleted: [Registry Key] hkey_classes_root\clsid\{9d717f81-9148-4f12-8568-69135f087db0}

Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\windows\currentversion\explorer\browser helper objects\{9d717f81-9148-4f12-8568-69135f087db0}

Successfully deleted: [Registry Key] hkey_classes_root\clsid\{a40dc6c5-79d0-4ca8-a185-8ff989af1115}

Successfully deleted: [Registry Key] hkey_classes_root\clsid\{b6ef6c45-5e8d-4c3b-b580-a5073261a381}

Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\windows\currentversion\explorer\browser helper objects\{b6ef6c45-5e8d-4c3b-b580-a5073261a381}

Successfully deleted: [Registry Key] hkey_classes_root\clsid\{cc1ac828-bb47-4361-afb5-96eee259dd87}

Successfully deleted: [Registry Key] hkey_classes_root\clsid\{d2a2595c-4fe4-4315-aa9b-19dbd6271b71}

Successfully deleted: [Registry Key] hkey_classes_root\clsid\{db4e9724-f518-4dfd-9c7c-78b52103cab9}

Successfully deleted: [Registry Key] hkey_classes_root\clsid\{e5c66dd8-308b-4a4f-af0a-3d04f25b5343}

Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\windows\currentversion\explorer\browser helper objects\{e5c66dd8-308b-4a4f-af0a-3d04f25b5343}

Successfully deleted: [Registry Key] hkey_classes_root\clsid\{fefd3af5-a346-4451-aa23-a3ad54915515}

~~~ Files

Successfully deleted: [File] C:\eula.1028.txt

Successfully deleted: [File] C:\eula.1031.txt

Successfully deleted: [File] C:\eula.1033.txt

Successfully deleted: [File] C:\eula.1036.txt

Successfully deleted: [File] C:\eula.1040.txt

Successfully deleted: [File] C:\eula.1041.txt

Successfully deleted: [File] C:\eula.1042.txt

Successfully deleted: [File] C:\eula.2052.txt

Successfully deleted: [File] C:\install.res.1028.dll

Successfully deleted: [File] C:\install.res.1031.dll

Successfully deleted: [File] C:\install.res.1033.dll

Successfully deleted: [File] C:\install.res.1036.dll

Successfully deleted: [File] C:\install.res.1040.dll

Successfully deleted: [File] C:\install.res.1041.dll

Successfully deleted: [File] C:\install.res.1042.dll

Successfully deleted: [File] C:\install.res.2052.dll

Successfully deleted: [File] C:\install.res.3082.dll

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\freerip"

Successfully deleted: [Folder] "C:\Users\BackupPC\appdata\locallow\conduit"

Successfully deleted: [Folder] "C:\Users\BackupPC\appdata\locallow\facemoods.com"

Successfully deleted: [Folder] "C:\Users\BackupPC\appdata\locallow\pricegong"

Successfully deleted: [Folder] "C:\Users\BackupPC\appdata\locallow\searchquband"

Successfully deleted: [Folder] "C:\Program Files (x86)\conduit"

Successfully deleted: [Folder] "C:\Program Files (x86)\free offers from freeze.com"

Successfully deleted: [Folder] "C:\Program Files (x86)\freerip"

Successfully deleted: [Folder] "C:\Program Files (x86)\ilivid"

Successfully deleted: [Folder] "C:\Program Files (x86)\imesh applications"

Successfully deleted: [Folder] "C:\Program Files (x86)\pricegong"

Successfully deleted: [Folder] "C:\Program Files (x86)\rewardsarcadesuite"

Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ilivid"

Successfully deleted: [Folder] "C:\ProgramData\ask"

~~~ FireFox

Successfully deleted: [File] "C:\Program Files (x86)\Mozilla Firefox\searchplugins\fcmdsrch.xml"

Successfully deleted the following from C:\Users\BackupPC\AppData\Roaming\mozilla\firefox\profiles\mf82nd3g.default\prefs.js

user_pref("browser.search.order.1", "Ask.com");

user_pref("browser.search.selectedEngine", "Ask.com");

Emptied folder: C:\Users\BackupPC\AppData\Roaming\mozilla\firefox\profiles\mf82nd3g.default\minidumps [1 files]

~~~ Chrome

Successfully deleted: [Folder] C:\Users\BackupPC\appdata\local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok

Successfully deleted: [Folder] C:\Users\BackupPC\appdata\local\Google\Chrome\User Data\Default\Extensions\ielefkgbofdpglioecfjcbikholflklb

Successfully deleted: [Registry Key] hkey_local_machine\software\google\chrome\extensions\bkomkajifikmkfnjgphkjcfeepbnojok

Successfully deleted: [Registry Key] hkey_local_machine\software\google\chrome\extensions\ielefkgbofdpglioecfjcbikholflklb

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Sat 03/09/2013 at 14:16:57.31

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# AdwCleaner v2.114 - Logfile created 03/09/2013 at 14:33:11

# Updated 05/03/2013 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : BackupPC - BEN-PC

# Boot Mode : Normal

# Running from : C:\Users\BackupPC\Desktop\AdwCleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

Deleted on reboot : C:\Users\BackupPC\AppData\Local\Google\Chrome\User Data\Default\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi

Deleted on reboot : C:\Users\BackupPC\AppData\Local\Google\Chrome\User Data\Default\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi

Deleted on reboot : C:\Users\BackupPC\AppData\Local\Google\Chrome\User Data\Default\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi

File Deleted : C:\END

File Deleted : C:\Users\Ben\AppData\Roaming\Mozilla\Firefox\Profiles\nzas2ez5.default\searchplugins\Askcom.xml

File Deleted : C:\Users\Ben\AppData\Roaming\Mozilla\Firefox\Profiles\nzas2ez5.default\searchplugins\Conduit.xml

Folder Deleted : C:\ProgramData\{B49A644A-1076-4A3D-B124-DAA7862F2318}

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PriceGong

Folder Deleted : C:\Users\BackupPC\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihflimipbcaljfnojhhknppphnnciiif

Folder Deleted : C:\Users\BackupPC\AppData\Local\Google\Chrome\User Data\Default\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi

Folder Deleted : C:\Users\BackupPC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FreeRIP

Folder Deleted : C:\Users\Ben\AppData\Local\Conduit

Folder Deleted : C:\Users\Ben\AppData\Local\Ilivid Player

Folder Deleted : C:\Users\Ben\AppData\Local\SwvUpdater

Folder Deleted : C:\Users\Ben\AppData\LocalLow\Conduit

Folder Deleted : C:\Users\Ben\AppData\LocalLow\facemoods.com

Folder Deleted : C:\Users\Ben\AppData\LocalLow\Playbryte

Folder Deleted : C:\Users\Ben\AppData\LocalLow\searchquband

Folder Deleted : C:\Users\Ben\AppData\LocalLow\Searchqutoolbar

Folder Deleted : C:\Users\Ben\AppData\LocalLow\VideoDownloadConverter_4z

Folder Deleted : C:\Users\Ben\AppData\Roaming\Mozilla\Firefox\Profiles\nzas2ez5.default\CT3289847

Folder Deleted : C:\Users\Ben\AppData\Roaming\Mozilla\Firefox\Profiles\nzas2ez5.default\extensions\{739df940-c5ee-4bab-9d7e-270894ae687a}

Folder Deleted : C:\Users\Ben\AppData\Roaming\Mozilla\Firefox\Profiles\nzas2ez5.default\Smartbar

Folder Deleted : C:\Users\Ben\AppData\Roaming\SearchProtect

Folder Deleted : C:\Users\bentime\AppData\LocalLow\facemoods.com

Folder Deleted : C:\Users\bentime\AppData\Roaming\Mozilla\Firefox\Profiles\uoz0wkb3.default\extensions\4zffxtbr@VideoDownloadConverter_4z.com

***** [Registry] *****

Key Deleted : HKCU\Software\facemoods.com

Key Deleted : HKCU\Software\GreenTree Applications

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FC41815-FA4C-4F8B-B143-2C045C8EA2FC}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{21493C1F-D071-496A-9C27-450578888291}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{403A885F-CB00-40C1-BDC1-EB09053194F7}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{55C1727F-5535-4C2A-9601-8C2458608B48}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{835315FC-1BF6-4CA9-80CD-F6C158D40692}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{A7DDCBDE-5C86-415C-8A37-763AE183E7E4}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{AD25754E-D76C-42B3-A335-2F81478B722F}

Key Deleted : HKLM\SOFTWARE\Classes\ilivid

Key Deleted : HKLM\Software\Classes\Installer\Features\2B1E51D87B2D71A44BB42DDD5E894160

Key Deleted : HKLM\Software\Classes\Installer\Products\2B1E51D87B2D71A44BB42DDD5E894160

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{12A5F606-B1EC-474C-83ED-95E99FD8058E}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{252C2315-CCE0-4446-8DA7-C00292A690BA}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{403A885F-CB00-40C1-BDC1-EB09053194F7}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{55C1727F-5535-4C2A-9601-8C2458608B48}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6A4BCABA-C437-4C76-A54E-AF31B8A76CB9}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{96F7FABC-5789-EFA4-B6ED-1272F4C1D27B}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{AD25754E-D76C-42B3-A335-2F81478B722F}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{B12E99ED-69BD-437C-86BE-C862B9E5444D}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Key Deleted : HKLM\Software\facemoods.com

Key Deleted : HKLM\Software\GreenTree Applications

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{872F3C0B-4462-424C-BB9F-74C6899B9F92}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B6F8DA9F-2696-419E-A8A3-19BE41EF51BD}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{2656B92B-0207-4AFB-BEBF-F5FD231ECD39}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{27BF8F8D-58B8-D41C-F913-B7EEB57EF6F6}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{34CB0620-E343-4772-BBA8-D3074BC47516}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3BF72F68-72D8-461D-A884-329D936C5581}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{412CD209-DDA4-4275-8C79-55F1C93FBD47}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{59570C1F-B692-48C9-91B4-7809E6945287}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{63A0F7FA-2C95-4D7E-AF25-EFCC303D20A1}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{6559E502-6EE1-46B8-A83C-F3A45BDA23EE}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{78E9D883-93CD-4072-BEF3-38EE581E2839}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{83AC1413-FCE4-4A46-9DD5-4F31F306E71F}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A2858A72-758F-4486-B6A1-7F1DCC0924FA}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A5B99E41-E157-4209-8AAC-DB003A816079}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{AD20D01C-C939-4DD2-8C55-56935A48987E}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B6F8DA9F-2696-419E-A8A3-19BE41EF51BD}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C63CA8A4-AB4E-49E5-A6C0-33FC86D80205}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C6A7847E-8931-4A9A-B4EF-72A91E3CCF4D}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DD0F1D24-E250-4E93-966C-65615720AEFB}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DDE2C74F-58CC-4D71-8CE1-09DEBB8CFB78}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E95EAD3F-18C6-4304-9DC6-BD6FD8E11D37}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EC1277BB-1C71-4C0D-BA6D-BFEA16E773A6}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{44B619BC-3D2B-4990-AA4F-9AA366921792}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{542FA950-C57A-4E17-B3E1-D935DFE15DEE}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5B035F86-41B5-40F1-AAAD-3D219F30244E}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5E8CD073-21DF-4117-9BBD-D03C45D36CAE}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6365AC7B-9920-4D8B-AF5D-3BDFEAC340A8}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6A934270-717F-4BC3-BA59-BC9BED47A8D2}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{74C012C4-00FB-4F04-9AFB-4AD5449D2018}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{78888F8B-D5E4-43CE-89F5-C8C18223AF64}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79B13431-CCAC-4097-8889-D0289E5E924F}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8B8558F6-DC26-4F39-8417-34B8934AA459}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8C8D5C57-3CAD-4CF9-BCAD-F873678DA883}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{981334CB-7B8B-431F-B86D-67B7426B125B}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E393F82-2644-4AB6-B994-1AD39D6C59EE}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A3A2A5C0-1306-4D1A-A093-9CECA4230002}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B37B4BA6-334E-72C1-B57E-6AFE8F8A5AF3}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B77AD4AC-C1C2-B293-7737-71E13A11FFEA}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C1C2FC43-F042-4F17-AEDB-C5ABF3B42E4B}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C8D424EF-CB21-49A0-8659-476FBAB0F8E8}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{CA1CE38C-F04C-471F-B9F3-083C58165C10}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E773F2CF-5E6E-FF2B-81A1-AC581A26B2B2}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F7EC6286-297C-4981-9DCC-FD7F57BC24C9}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ihflimipbcaljfnojhhknppphnnciiif

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{250BECD2-5C43-48CF-A3C6-666338526D67}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FFDF9EF3-3C3A-4F05-9A6E-5D3B778EC567}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8D15E1B2-D2B7-4A17-B44B-D2DDE5981406}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\facemoods

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ilivid

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PriceGong

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{17B10E59-09E1-4C39-A738-6774D7AB7778}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD2049E-E483-4425-8555-8E0775ACB631}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1B730ACF-26A3-447B-9994-14AEE0EB72CC}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{23119123-0854-469D-807A-171568457991}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2D73F2D0-2FAB-458E-977D-2F9050E0ED60}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3E9469AF-E866-4476-B767-810630F1F6E7}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{44B619BC-3D2B-4990-AA4F-9AA366921792}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{47700C35-9E3E-4DAD-934C-0CE28A87237C}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{542FA950-C57A-4E17-B3E1-D935DFE15DEE}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5B035F86-41B5-40F1-AAAD-3D219F30244E}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5E8CD073-21DF-4117-9BBD-D03C45D36CAE}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6365AC7B-9920-4D8B-AF5D-3BDFEAC340A8}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6A934270-717F-4BC3-BA59-BC9BED47A8D2}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{716E443D-7CAA-44F1-866B-F45D00E712CC}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{72063D77-7590-4DA9-A7F8-F5ECAF3632C4}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{74C012C4-00FB-4F04-9AFB-4AD5449D2018}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{78888F8B-D5E4-43CE-89F5-C8C18223AF64}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79B13431-CCAC-4097-8889-D0289E5E924F}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7FC87AC5-FA93-476E-A32C-A941229DED0B}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8B8558F6-DC26-4F39-8417-34B8934AA459}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8C8D5C57-3CAD-4CF9-BCAD-F873678DA883}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{981334CB-7B8B-431F-B86D-67B7426B125B}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E393F82-2644-4AB6-B994-1AD39D6C59EE}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A3A2A5C0-1306-4D1A-A093-9CECA4230002}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A9379648-F6EB-4F65-A624-1C10411A15D0}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B37B4BA6-334E-72C1-B57E-6AFE8F8A5AF3}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B77AD4AC-C1C2-B293-7737-71E13A11FFEA}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C1C2FC43-F042-4F17-AEDB-C5ABF3B42E4B}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C8D424EF-CB21-49A0-8659-476FBAB0F8E8}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{CA1CE38C-F04C-471F-B9F3-083C58165C10}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E773F2CF-5E6E-FF2B-81A1-AC581A26B2B2}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F16AB1DB-15C0-4456-A29E-4DF24FB9E3D2}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F7EC6286-297C-4981-9DCC-FD7F57BC24C9}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16464

Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://start.facemoods.com/?a=adknlg&s={searchTerms}&f=4 --> hxxp://www.google.com

-\\ Mozilla Firefox v10.0.2 (en-US)

File : C:\Users\Ben\AppData\Roaming\Mozilla\Firefox\Profiles\nzas2ez5.default\prefs.js

Deleted : user_pref("CT3289847.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");

Deleted : user_pref("CT3289847.FF19Solved", "true");

Deleted : user_pref("CT3289847.FirstTime", "true");

Deleted : user_pref("CT3289847.FirstTimeFF3", "true");

Deleted : user_pref("CT3289847.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT328[...]

Deleted : user_pref("CT3289847.UserID", "UN37454720441330372");

Deleted : user_pref("CT3289847.autoDisableScopes", -1);

Deleted : user_pref("CT3289847.browser.search.defaultthis.engineName", "true");

Deleted : user_pref("CT3289847.defaultSearch", "true");

Deleted : user_pref("CT3289847.enableAlerts", "always");

Deleted : user_pref("CT3289847.enableFix404ByUser", "TRUE");

Deleted : user_pref("CT3289847.enableSearchFromAddressBar", "true");

Deleted : user_pref("CT3289847.firstTimeDialogOpened", "true");

Deleted : user_pref("CT3289847.fixPageNotFoundError", "true");

Deleted : user_pref("CT3289847.fixPageNotFoundErrorByUser", "true");

Deleted : user_pref("CT3289847.fixUrls", true);

Deleted : user_pref("CT3289847.installDate", "8/3/2013 11:10:27");

Deleted : user_pref("CT3289847.installId", "9818");

Deleted : user_pref("CT3289847.installType", "conduitnsisintegration");

Deleted : user_pref("CT3289847.isCheckedStartAsHidden", true);

Deleted : user_pref("CT3289847.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");

Deleted : user_pref("CT3289847.isFirstTimeToolbarLoading", "false");

Deleted : user_pref("CT3289847.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");

Deleted : user_pref("CT3289847.keyword", "true");

Deleted : user_pref("CT3289847.lastVersion", "10.14.65.43");

Deleted : user_pref("CT3289847.mam_gk_installer_preapproved.enc", "ZmFsc2U=");

Deleted : user_pref("CT3289847.migrateAppsAndComponents", true);

Deleted : user_pref("CT3289847.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"\",\"[...]

Deleted : user_pref("CT3289847.openThankYouPage", "false");

Deleted : user_pref("CT3289847.openUninstallPage", "true");

Deleted : user_pref("CT3289847.revertSettingsEnabled", "true");

Deleted : user_pref("CT3289847.searchFromAddressBarEnabledByUser", "true");

Deleted : user_pref("CT3289847.searchInNewTabEnabledByUser", "true");

Deleted : user_pref("CT3289847.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");

Deleted : user_pref("CT3289847.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]

Deleted : user_pref("CT3289847.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]

Deleted : user_pref("CT3289847.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]

Deleted : user_pref("CT3289847.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]

Deleted : user_pref("CT3289847.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1362801763814");

Deleted : user_pref("CT3289847.serviceLayer_services_appsMetadata_lastUpdate", "1362801762587");

Deleted : user_pref("CT3289847.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1362801763732");

Deleted : user_pref("CT3289847.serviceLayer_services_location_lastUpdate", "1362801762031");

Deleted : user_pref("CT3289847.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1362801763774");

Deleted : user_pref("CT3289847.serviceLayer_services_searchAPI_lastUpdate", "1362801762042");

Deleted : user_pref("CT3289847.serviceLayer_services_serviceMap_lastUpdate", "1362801761750");

Deleted : user_pref("CT3289847.serviceLayer_services_setupAPI_lastUpdate", "1362801763825");

Deleted : user_pref("CT3289847.serviceLayer_services_toolbarContextMenu_lastUpdate", "1362801762595");

Deleted : user_pref("CT3289847.serviceLayer_services_toolbarSettings_lastUpdate", "1362801761973");

Deleted : user_pref("CT3289847.serviceLayer_services_translation_lastUpdate", "1362801762664");

Deleted : user_pref("CT3289847.settingsINI", true);

Deleted : user_pref("CT3289847.shouldFirstTimeDialog", "false");

Deleted : user_pref("CT3289847.smartbar.CTID", "CT3289847");

Deleted : user_pref("CT3289847.smartbar.Uninstall", "0");

Deleted : user_pref("CT3289847.smartbar.homepage", true);

Deleted : user_pref("CT3289847.smartbar.toolbarName", "WhiteSmoke New ");

Deleted : user_pref("CT3289847.startPage", "true");

Deleted : user_pref("CT3289847_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]

Deleted : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3289847&octid=CT328984[...]

Deleted : user_pref("Smartbar.ConduitSearchEngineList", "WhiteSmoke New Customized Web Search");

Deleted : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289847[...]

Deleted : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "hxxp://websearch.ask.com/redirect?client=ff&src=[...]

Deleted : user_pref("Smartbar.keywordURLSelectedCTID", "CT3289847");

Deleted : user_pref("browser.search.defaultengine", "Ask.com");

Deleted : user_pref("browser.search.defaultenginename", "Ask.com");

Deleted : user_pref("browser.search.defaultthis.engineName", "WhiteSmoke New Customized Web Search");

Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289847&CUI[...]

Deleted : user_pref("browser.search.order.1", "Ask.com");

Deleted : user_pref("browser.search.selectedEngine", "WhiteSmoke New Customized Web Search");

Deleted : user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3289847&octid=CT3289847&Sea[...]

Deleted : user_pref("extensions.asktb.ff-original-keyword-url", "hxxp://dts.search-results.com/sr?src=ffb&appi[...]

Deleted : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289847&SearchSource=2&CU[...]

Deleted : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3289847&octid=CT3289847[...]

Deleted : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT[...]

Deleted : user_pref("smartbar.originalHomepage", "hxxps://www.google.com/?sesinv=1");

Deleted : user_pref("smartbar.originalSearchAddressUrl", "hxxp://websearch.ask.com/redirect?client=ff&src=kw&t[...]

Deleted : user_pref("smartbar.originalSearchEngine", "Google");

File : C:\Users\bentime\AppData\Roaming\Mozilla\Firefox\Profiles\uoz0wkb3.default\prefs.js

Deleted : user_pref("keyword.URL", "hxxp://dts.search-results.com/sr?src=ffb&appid=101&systemid=406&sr=0&q=");

File : C:\Users\BackupPC\AppData\Roaming\Mozilla\Firefox\Profiles\mf82nd3g.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v25.0.1364.152

File : C:\Users\Ben\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.28] : icon_url = "hxxp://www.ask.com/favicon.ico",

Deleted [l.31] : keyword = "ask.com",

Deleted [l.34] : search_url = "hxxp://websearch.ask.com/redirect?client=cr&src=kw&tb=ORJ&o=100000031&locale=en[...]

Deleted [l.35] : suggest_url = "hxxp://ss.websearch.ask.com/query?qsrc=2922&li=ff&sstype=prefix&q={searchTerms[...]

Deleted [l.668] : homepage = "hxxp://search.conduit.com/?CUI=UN28861771772885173&ctid=CT3289847&SearchSource=48",

Deleted [l.867] : urls_to_restore_on_startup = [ "hxxp://search.conduit.com/?CUI=UN28861771772885173&ctid=CT328[...]

File : C:\Users\BackupPC\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[s1].txt - [21381 octets] - [09/03/2013 14:33:11]

########## EOF - C:\AdwCleaner[s1].txt - [21442 octets] ##########

Link to post
Share on other sites

MBAM ran clean again:

Malwarebytes Anti-Malware 1.70.0.1100

www.malwarebytes.org

Database version: v2013.03.09.13

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 9.0.8112.16421

BackupPC :: BEN-PC [administrator]

3/9/2013 3:47:43 PM

mbam-log-2013-03-09 (15-47-43).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 298176

Time elapsed: 2 minute(s), 49 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

ESET has hit an "unexpected error 2002" three times and failed to run. I will keep trying but thought I better post what I could.

Link to post
Share on other sites

  • Staff

how is the computer running now, are there any outstanding issues?

Visit ADOBE and download the latest version of Acrobat Reader (version XI)

Having the latest updates ensures there are no security vulnerabilities in your system.

NEXT

javaicon.jpg

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

  • Download the latest version of Java Runtime Environment (JRE) 7 and Save it to your Desktop.
  • Scroll down to where it says Java SE 7u17
  • Click the Download button under JRE to the right.
  • Read the License Agreement then select Accept License Agreement
  • Click on the link to download Windows x86 Offline and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-7u17-windows-i586.exe to install the newest version.

  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are three options in the window to clear the cache - Leave these two Checked

      • Trace and Log Files
        Cached Applications and Applets

    • Click OK on Delete Temporary Files Window
      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
    • Click OK to leave the Temporary Files Window
    • Click OK to leave the Java Control Panel.

Link to post
Share on other sites

Visit ADOBE and download the latest version of Acrobat Reader (version XI) Done (Step 1).

  • Download the latest version of Java Runtime Environment (JRE) 7 and Save it to your Desktop.
  • Scroll down to where it says Java SE 7u17
  • Click the Download button under JRE to the right.
  • Read the License Agreement then select Accept License Agreement
  • Click on the link to download Windows x86 Offline and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-7u17-windows-i586.exe to install the newest version.

Done (Step 2).

  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are three options in the window to clear the cache - Leave these two Checked
      • Click OK on Delete Temporary Files Window
        Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
      • Click OK to leave the Temporary Files Window
      • Click OK to leave the Java Control Panel.

Done (Step 3).

Computer seems to be running fine, as far as I can tell. I plan to create a new restore point and then create a backup disk image. Also to uninstall/delete the various tools and logs that we used during this process. Thank you very much for your help. I really appreciate it.

D

Link to post
Share on other sites

  • Staff

very good to hear

you had a nasty rootkit infection, so make sure you change your passwords and keep an eye on your personal information for the next little while

We just have some housekeeping to do now,

Please do the following:

You can delete the DDS, JRT, MBAR and Farbar logs and programs from your desktop.

NEXT

Follow these steps to uninstall Combofix

  • Make sure your security programs are totally disabled.
  • Press the WinKey +R to open a run box
  • Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

Combofix_uninstall_image.jpg

NEXT

  • Double click on adwcleaner.exe to run the tool.
  • Click on Uninstall.
  • Confirm with yes.

If there are any logs/tools remaining on your desktop > right click and delete them.

NEXT

------------------------------------------------------

Important

Due to continued exploits of zero-day vulnerabilities in Oracle's Java application, it is the recommendation of many security experts, as well as the TSF Security Team, that you disable Java in your web browsers.

Java

US-CERT Alert TA13-010A - Oracle Java 7 Security Manager Bypass Vulnerability

We recommend disabling Java in your browsers, and enabling it only when needed by certain websites.

Please disable Java in your browser(s) by following these instructions:

How do I disable Java in my web browser?

------------------------------------------------------

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them
    Then consider a password keeper, to keep all your passwords safe. KeePass is a small utility that allows you to manage all your passwords.
  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.
  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

    [*]Download TFC to your desktop

    • Close any open windows.
    • Double click the TFC icon to run the program
    • TFC will close all open programs itself in order to run,
    • Click the Start button to begin the process.
    • Allow TFC to run uninterrupted.
    • The program should not take long to finish it's job
    • Once its finished it should automatically reboot your machine,
    • if it doesn't, manually reboot to ensure a complete clean

    It's normal after running TFC cleaner that the PC will be slower to boot the first time.

    [*]WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

    • Green to go
    • Yellow for caution
    • Red to stop

    WOT has an addon available for both Firefox and IE

    [*]Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

    [*]In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:

    PC Safety and Security--What Do I Need?.

    [*]Simple and easy ways to keep your computer safe and secure on the Internet

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

Link to post
Share on other sites

My son has gone traveling with the pc for the day so I will not be able to complete these final steps until tomorrow. Please keep the thread open until I complete these steps tomorrow. Thank you for your patience and I apologize for the delay in closing the thread.

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.