I'm infected (dds.txt & attach.txt attached)

MaestroX101 · April 24, 2013

Hello, this is my first post. I've been having this annoying trojan infecting my computer and would like assistance in removing it. I checked out the "I'm infected - What do I do now?" post from 2009 and hoping that's still the standard way of beginning this kind of topic. Here are the text files that it asked for. If there's a different way, I will gladly follow whatever alternative instructions in hopes of getting this infection cleared. Thanks in advance.

dds.txt:

DDS (Ver_2012-11-20.01) - NTFS_x86 NETWORK

Internet Explorer: 8.0.7600.16766 BrowserJavaVersion: 1.6.0_20

Run by Altex at 22:41:49 on 2013-04-23

Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3001.2332 [GMT -5:00]

.

AV: McAfee VirusScan *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: McAfee VirusScan *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}

FW: McAfee Personal Firewall *Disabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}

.

============== Running Processes ================

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\ctfmon.exe

C:\Users\Altex\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k netsvcs

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=extensa_5635&r=27050210g706l03c3z295i49j5v24n

uDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=extensa_5635&r=27050210g706l03c3z295i49j5v24n

mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=extensa_5635&r=27050210g706l03c3z295i49j5v24n

mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=extensa_5635&r=27050210g706l03c3z295i49j5v24n

uURLSearchHooks: Dealio Toolbar: {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - c:\program files\dealio toolbar\ie\4.6\dealioToolbarIE.dll

uURLSearchHooks: YTNavAssistPlugin Class: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - c:\program files\yahoo!\companion\installs\cpn3\yt.dll

BHO: Dealio Toolbar: {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - c:\program files\dealio toolbar\ie\4.6\dealioToolbarIE.dll

BHO: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - c:\program files\yahoo!\companion\installs\cpn3\yt.dll

BHO: Lexmark Toolbar: {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - c:\program files\lexmark toolbar\toolband.dll

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\program files\mcafee\msk\mskapbho.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\programdata\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll

BHO: AVG Do Not Track: {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - c:\program files\avg\avg2012\avgdtiex.dll

BHO: PodcastBHO Class: {65134FDF-F8A5-4B3D-91D9-CDF273CFD578} - c:\program files\common files\doubletwist\IEPodcastPlugin.dll

BHO: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptsn.dll

BHO: Partner BHO Class: {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - c:\programdata\partner\Partner.dll

BHO: IEHlprObj Class: {8CA5ED52-F3FB-4414-A105-2E3491156990} - c:\program files\iwin games\iWinGamesHookIE.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Search Toolbar: {9D425283-D487-4337-BAB6-AB8354A81457} - c:\program files\search toolbar\SearchToolbar.dll

BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.7.7529.1424\swg.dll

BHO: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\program files\mcafee\siteadvisor\McIEPlg.dll

BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office\office14\URLREDIR.DLL

BHO: Lexmark Printable Web: {D2C5E510-BE6D-42CC-9F61-E4F939078474} - c:\program files\lexmark printable web\bho.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: Google Gears Helper: {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - c:\program files\google\google gears\internet explorer\0.5.36.0\gears.dll

BHO: ShopAtHomeIEHelper Class: {E8DAAA30-6CAA-4b58-9603-8E54238219E2} - c:\program files\selectrebates\toolbar\ShopAtHomeToolbar.dll

BHO: Yontoo Layers: {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - c:\program files\yontoo layers runtime\YontooIEClient.dll

BHO: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - c:\program files\yahoo!\companion\installs\cpn1\YTSingleInstance.dll

TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: Lexmark Toolbar: {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - c:\program files\lexmark toolbar\toolband.dll

TB: ShopAtHome Toolbar: {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - c:\program files\selectrebates\toolbar\ShopAtHomeToolbar.dll

TB: Search Toolbar: {9D425283-D487-4337-BAB6-AB8354A81457} - c:\program files\search toolbar\SearchToolbar.dll

TB: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\program files\mcafee\siteadvisor\McIEPlg.dll

TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn3\yt.dll

TB: Lexmark Toolbar: {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - c:\program files\lexmark toolbar\toolband.dll

TB: ShopAtHome Toolbar: {98279C38-DE4B-4bcf-93C9-8EC26069D6F4} - c:\program files\selectrebates\toolbar\ShopAtHomeToolbar.dll

TB: Search Toolbar: {9D425283-D487-4337-BAB6-AB8354A81457} - c:\program files\search toolbar\SearchToolbar.dll

TB: Dealio Toolbar: {01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - c:\program files\dealio toolbar\ie\4.6\dealioToolbarIE.dll

TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background

uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messenger\YahooMessenger.exe" -quiet

uRun: [sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun

uRun: [Aim] "c:\program files\aim\aim.exe" /d locale=en-US

uRun: [DW6] "c:\program files\the weather channel fw\desktop\DesktopWeather.exe"

uRun: [Facebook Update] "c:\users\altex\appdata\local\facebook\update\FacebookUpdate.exe" /c /nocrashserver

uRun: [EA Core] "c:\program files\electronic arts\eadm\Core.exe" -silent

uRun: [MobileDocuments] c:\program files\common files\apple\internet services\ubd.exe

uRun: [Google Update] "c:\users\altex\appdata\local\google\update\GoogleUpdate.exe" /c

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [deskPDF Creator] "c:\program files\docudesk\deskpdf creator\deskPDFCreator.exe" -minimize

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [bCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices

mRun: [dcmsvc] c:\program files\dcmsvc\dcmsvc.exe

mRun: [selectRebates] c:\program files\selectrebates\SelectRebates.exe

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [Mobile Connectivity Suite] "c:\program files\htc\htc sync\application launcher\Application Launcher.exe" /startoptions

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe

mRun: [Nikon Transfer Monitor] c:\program files\common files\nikon\monitor\NkMonitor.exe

mRun: [searchSettings] "c:\program files\common files\spigot\search settings\SearchSettings.exe"

mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [lxdumon.exe] "c:\program files\lexmark 5600-6600 series\lxdumon.exe"

mRun: [lxduamon] "c:\program files\lexmark 5600-6600 series\lxduamon.exe"

mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe"

mRunOnce: [Malwarebytes Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent

StartupFolder: c:\users\altex\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\altex\appdata\roaming\dropbox\bin\Dropbox.exe

StartupFolder: c:\users\altex\appdata\roaming\micros~1\windows\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe

StartupFolder: c:\users\altex\appdata\roaming\micros~1\windows\startm~1\programs\startup\warner~1.lnk - c:\program files\warner bros. digital copy manager\Warner Bros. Digital Copy Manager.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\office~1.lnk - c:\program files\microsoft office\office14\officesas\officeSASscheduler.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\pgptra~1.lnk - c:\windows\installer\{28e0f0a8-e555-4077-a6e1-63dbf2b29d32}\Icon6560581611.exe

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office12\EXCEL.EXE/3000

IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program files\google\google gears\internet explorer\0.5.36.0\gears.dll

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - c:\program files\avg\avg2012\avgdtiex.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

LSP: c:\windows\system32\PGPlsp.dll

LSP: mswsock.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

TCP: NameServer = 192.168.1.254

TCP: Interfaces\{700BE918-27E3-4EDB-89FA-B88CD028749F} : DHCPNameServer = 192.168.1.254

TCP: Interfaces\{700BE918-27E3-4EDB-89FA-B88CD028749F}\445656A797 : DHCPNameServer = 192.168.2.1

TCP: Interfaces\{700BE918-27E3-4EDB-89FA-B88CD028749F}\4514D4553434 : DHCPNameServer = 10.20.0.56 10.20.0.50 10.20.0.4

TCP: Interfaces\{700BE918-27E3-4EDB-89FA-B88CD028749F}\D46435233343 : DHCPNameServer = 66.90.130.101 216.82.202.14

Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\program files\mcafee\siteadvisor\McIEPlg.dll

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dll

Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\program files\mcafee\siteadvisor\McIEPlg.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll

Notify: igfxcui - igfxdev.dll

AppInit_DLLs= PGPmapih.dll

SSODL: WebCheck - <orphaned>

LSA: Notification Packages = scecli PGPpwflt

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\altex\appdata\roaming\mozilla\firefox\profiles\9r0jd02t.default\

FF - prefs.js: browser.search.selectedEngine - AVG Secure Search

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=374563&p=

FF - component: c:\program files\common files\spigot\wtxpcom\components\WidgiToolbarFF.dll

FF - component: c:\program files\google\google gears\firefox\lib\ff36\gears.dll

FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll

FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll

FF - component: c:\programdata\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll

FF - component: c:\users\altex\appdata\roaming\mozilla\firefox\profiles\9r0jd02t.default\extensions\{51ef49d2-624b-4194-8b97-1c468e9b0efe}\components\Engine.dll

FF - plugin: c:\progra~1\micros~1\office14\NPAUTHZ.DLL

FF - plugin: c:\progra~1\micros~1\office14\NPSPWRAP.DLL

FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\amazon\mp3 downloader\npAmazonMP3DownloaderPlugin.dll

FF - plugin: c:\program files\common files\doubletwist\NPPodcast.dll

FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: c:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll

FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll

FF - plugin: c:\program files\google\update\1.3.21.111\npGoogleUpdate3.dll

FF - plugin: c:\program files\google\update\1.3.21.115\npGoogleUpdate3.dll

FF - plugin: c:\program files\google\update\1.3.21.65\npGoogleUpdate3.dll

FF - plugin: c:\program files\google\update\1.3.21.69\npGoogleUpdate3.dll

FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft silverlight\4.1.10111.0\npctrlui.dll

FF - plugin: c:\program files\microsoft\web platform installer\NPWPIDetector.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll

FF - plugin: c:\program files\mozilla firefox\plugins\nprpplugin.dll

FF - plugin: c:\program files\real\realplayer\netscape6\nprpplugin.dll

FF - plugin: c:\program files\wildtangent games\app\browserintegration\registered\0\NP_wtapp.dll

FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll

FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll

FF - plugin: c:\users\altex\appdata\local\facebook\video\skype\npFacebookVideoCalling.dll

FF - plugin: c:\users\altex\appdata\local\google\update\1.3.21.115\npGoogleUpdate3.dll

FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_3_300_265.dll

.

---- FIREFOX POLICIES ----

FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(extentions.y2layers.installId, cb0073f0-e7ad-4f4a-ad3f-1d53f332a5ad

.

============= SERVICES / DRIVERS ===============

.

R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [2012-4-19 24896]

R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2012-1-31 31952]

R0 pgpfs;PGP File Sharing;c:\windows\system32\drivers\PGPfsfd.sys [2009-12-17 136312]

R0 Pgpwdefs;Pgpwdefs;c:\windows\system32\drivers\PGPwdefs.sys [2009-12-17 13432]

R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2012-3-19 301248]

R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\drivers\L1C62x86.sys [2009-11-13 58368]

R3 NETw5s32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\drivers\NETw5s32.sys [2009-10-28 6114816]

S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2012-2-22 235216]

S1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-12-23 41040]

S1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-10-28 214024]

S2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2012\avgidsagent.exe [2012-7-4 5160568]

S2 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2012-2-14 193288]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 iPodDrv;iPodDrv;c:\windows\system32\drivers\iPodDrv.sys [2010-11-4 6656]

S2 iWinTrusted;iWinTrusted;c:\program files\iwin games\iWinTrusted.exe [2010-9-27 176408]

S2 lxdu_device;lxdu_device;c:\windows\system32\lxducoms.exe -service --> c:\windows\system32\lxducoms.exe -service [?]

S2 lxduCATSCustConnectService;lxduCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxduserv.exe [2010-4-7 94208]

S2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2013-4-23 418376]

S2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-7-28 701512]

S2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2009-10-28 144704]

S2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-4-17 11032]

S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [2011-12-23 139856]

S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\avgidsfilterx.sys [2011-12-23 24144]

S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [2011-12-23 17232]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 GamesAppService;GamesAppService;c:\program files\wildtangent games\app\GamesAppService.exe [2010-10-12 206072]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-7-28 22856]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2013-4-23 40776]

S3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2009-10-28 79816]

S3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2009-10-28 35272]

S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2009-10-28 34248]

S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2009-10-28 40552]

S3 MsDepSvc;Web Deployment Agent Service;c:\program files\iis\microsoft web deploy\MsDepSvc.exe [2010-1-19 55184]

S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [2008-7-7 20480]

S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [2008-5-9 174336]

S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [2009-10-28 167424]

S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]

S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-3-5 1343400]

S4 ePowerSvc;Acer ePower Service;c:\program files\acer\acer epower management\ePowerSvc.exe [2009-10-28 727584]

S4 Greg_Service;GRegService;c:\program files\acer\registration\GregHSRW.exe [2009-8-28 1150496]

S4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2010-2-2 93320]

S4 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2009-10-28 359952]

S4 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2009-10-28 606736]

S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2008-7-10 47128]

S4 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2009-6-17 50432]

S4 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2009-6-17 144640]

S4 Partner Service;Partner Service;c:\programdata\partner\Partner.exe [2009-10-28 332272]

S4 RS_Service;Raw Socket Service;c:\program files\acer\acer vcm\RS_Service.exe [2009-10-28 253952]

S4 RsFx0102;RsFx0102 Driver;c:\windows\system32\drivers\RsFx0102.sys [2008-7-10 242712]

S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\microsoft sql server\mssql10.sqlexpress\mssql\binn\SQLAGENT.EXE [2008-7-10 369688]

S4 Updater Service;Updater Service;c:\program files\acer\acer updater\UpdaterService.exe [2009-10-28 240160]

.

=============== Created Last 30 ================

.

2013-04-24 03:27:12 -------- d-----w- c:\users\altex\appdata\local\{333A9F93-CB66-4124-812C-7F3AC9A02259}

2013-04-24 03:26:46 0 ----a-w- c:\program files\GUT49DC.tmp

2013-04-24 03:26:46 -------- d-----w- c:\program files\GUM49DB.tmp

2013-04-24 03:23:27 259072 ----a-w- c:\windows\system32\services.exe

2013-04-24 03:14:53 15616 ----a-w- c:\windows\system32\drivers\TrueSight.sys

2013-04-24 02:55:46 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2013-04-24 02:41:11 -------- d-----w- c:\users\altex\appdata\local\{69DD77C5-BE34-4C1A-8D23-B699CC90D6EE}

.

==================== Find3M ====================

.

2013-04-04 19:50:32 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-09-25 00:02:53 4096000 ----a-w- c:\program files\GUT983A.tmp

.

============= FINISH: 22:48:17.86 ===============

attach.txt:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Professional

Boot Device: \Device\HarddiskVolume2

Install Date: 2/2/2010 1:35:21 AM

System Uptime: 4/23/2013 10:33:51 PM (0 hours ago)

.

Motherboard: Acer | | BA50-MV

Processor: Intel® Core2 Duo CPU T6570 @ 2.10GHz | U2E1 | 2094/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 119 GiB total, 6.977 GiB free.

E: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Description: Security Processor Loader Driver

Device ID: ROOT\LEGACY_SPLDR\0000

Manufacturer:

Name: Security Processor Loader Driver

PNP Device ID: ROOT\LEGACY_SPLDR\0000

Service: spldr

.

==== System Restore Points ===================

.

No restore point in system.

.

==== Installed Programs ======================

.

Update for Microsoft Office 2007 (KB2508958)

2007 Microsoft Office Suite Service Pack 2 (SP2)

2007 Microsoft Office system

ABBYY FineReader 6.0 Sprint

Acer Assist

Acer Crystal Eye Webcam

Acer ePower Management

Acer eRecovery Management

Acer Games

Acer GridVista

Acer Registration

Acer ScreenSaver

Acer Updater

Acer VCM

Acrobat.com

Adobe AIR

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader 9.4.7 MUI

AIM 7

Amazon MP3 Downloader 1.0.15

Amazon MP3 Uploader

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ArcSoft Panorama Maker 5

Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver

AVG 2012

Bonjour

Business Contact Manager for Outlook 2007 SP2

Conexant HD Audio

Coupon Printer for Windows

D3DX10

dcmsvc 1.0

Dealio Toolbar v4.6

deskPDF Creator 2012

doPDF 7.3 printer

doubleTwist

Download Updater (AOL LLC)

Dropbox

eBay Worldwide

eSobi v2

Facebook Video Calling 1.2.0.159

ffdshow [rev 2527] [2008-12-19]

File Uploader

Free File Opener v2011.6.0.4

Google Chrome

Google Earth

Google Gears

Google SketchUp 7

Google SketchUp Pro 8

Google Toolbar for Internet Explorer

Google Update Helper

Hotfix for Microsoft Visual C++ 2008 Express Edition with SP1 - ENU (KB945282)

Hotfix for Microsoft Visual C++ 2008 Express Edition with SP1 - ENU (KB946040)

Hotfix for Microsoft Visual C++ 2008 Express Edition with SP1 - ENU (KB946308)

Hotfix for Microsoft Visual C++ 2008 Express Edition with SP1 - ENU (KB947540)

Hotfix for Microsoft Visual C++ 2008 Express Edition with SP1 - ENU (KB947789)

Hotfix for Microsoft Visual C++ 2008 Express Edition with SP1 - ENU (KB948127)

HTC Driver Installer

HTC Sync

iCloud

Identity Card

IIS Database Manager

IIS URL Rewrite Module 2

Intel® Graphics Media Accelerator Driver

Intel® TV Wizard

Intel® Matrix Storage Manager

InterVideo WinDVD 8

iTunes

iWin Games (remove only)

Java Auto Updater

Java DB 10.5.3.0

Java 6 Update 20

Java SE Development Kit 6 Update 18

Junk Mail filter update

Launch Manager

Lexmark 5600-6600 Series

Lexmark Printable Web

Lexmark Toolbar

Lexmark Tools for Office

Logitech Touch Mouse Server 1.0

Malwarebytes Anti-Malware version 1.75.0.1300

McAfee SecurityCenter

Microsoft .NET Framework 4 Client Profile

Microsoft Application Error Reporting

Microsoft Office 2003 Web Components

Microsoft Office 2007 Primary Interop Assemblies

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Professional 2007

Microsoft Office Professional 2007 Trial

Microsoft Office Professional Hybrid 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (English) 2010 (Beta)

Microsoft Office Proof (French) 2007

Microsoft Office Proof (French) 2010 (Beta)

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proof (Spanish) 2010 (Beta)

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing (English) 2010 (Beta)

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Send-a-Smile

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared MUI (English) 2010 (Beta)

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2010 (Beta)

Microsoft Office Small Business Connectivity Components

Microsoft Office Suite Activation Assistant

Microsoft Office Visio 2010 (Beta)

Microsoft Office Visio MUI (English) 2010 (Beta)

Microsoft Office Word MUI (English) 2007

Microsoft Silverlight

Microsoft SQL Server 2005

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)

Microsoft SQL Server 2008

Microsoft SQL Server 2008 Browser

Microsoft SQL Server 2008 Common Files

Microsoft SQL Server 2008 Database Engine Services

Microsoft SQL Server 2008 Database Engine Shared

Microsoft SQL Server 2008 Management Objects

Microsoft SQL Server 2008 Native Client

Microsoft SQL Server 2008 RsFx Driver

Microsoft SQL Server 2008 Setup Support Files (English)

Microsoft SQL Server Native Client

Microsoft SQL Server Setup Support Files (English)

Microsoft SQL Server VSS Writer

Microsoft Visio 2010

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2005 Redistributable - KB2467175

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Express Edition with SP1 - ENU

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft Web Platform Installer 2.0

Microsoft Windows SDK for Visual Studio 2008 Headers and Libraries

Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for .NET Framework - enu

Microsoft Windows SDK for Visual Studio 2008 SP1 Express Tools for Win32

Microsoft WSE 3.0 Runtime

Mobile Broadband Generic Drivers

Mozilla Firefox 13.0.1 (x86 en-US)

Mozilla Maintenance Service

MSVCRT

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MySQL Connector Net 5.2.5

NetBeans IDE 6.8

Nikon Message Center

Nikon Transfer

Norton Online Backup

NTI Backup Now 5

NTI Backup Now Standard

OGA Notifier 2.0.0048.0

OpenOffice.org 3.2

Origin

pdfFactory

PGP Desktop

PHP 5.2.13

Picture Control Utility

PuTTY version 0.60

QuickTime

RealNetworks - Microsoft Visual C++ 2008 Runtime

RealPlayer

Realtek USB 2.0 Card Reader

RealUpgrade 1.1

Search Toolbar

Security Update for 2007 Microsoft Office System (KB2288621)

Security Update for 2007 Microsoft Office System (KB2288931)

Security Update for 2007 Microsoft Office System (KB2345043)

Security Update for 2007 Microsoft Office System (KB2466156)

Security Update for 2007 Microsoft Office System (KB2509488)

Security Update for 2007 Microsoft Office System (KB969559)

Security Update for 2007 Microsoft Office System (KB976321)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft Office Access 2007 (KB979440)

Security Update for Microsoft Office Excel 2007 (KB2464583)

Security Update for Microsoft Office InfoPath 2007 (KB979441)

Security Update for Microsoft Office PowerPoint 2007 (KB2464594)

Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)

Security Update for Microsoft Office Publisher 2007 (KB2284697)

Security Update for Microsoft Office system 2007 (972581)

Security Update for Microsoft Office system 2007 (KB974234)

Security Update for Microsoft Office Visio Viewer 2007 (KB973709)

Security Update for Microsoft Office Word 2007 (KB2344993)

ShopAtHome SelectRebates

Skype Toolbars

Skype™ 4.2

Sony Pictures Download Manager

Sql Server Customer Experience Improvement Program

SQL Server System CLR Types

SSH Secure Shell

Sun GlassFish Enterprise Server v3

The Sims™ 3

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office Access 2007 Help (KB963663)

Update for Microsoft Office Excel 2007 Help (KB963678)

Update for Microsoft Office Outlook 2007 (KB2412171)

Update for Microsoft Office Outlook 2007 Help (KB963677)

Update for Microsoft Office Powerpoint 2007 Help (KB963669)

Update for Microsoft Office Publisher 2007 Help (KB963667)

Update for Microsoft Office Script Editor Help (KB963671)

Update for Microsoft Office Word 2007 Help (KB963665)

Update for Outlook 2007 Junk Email Filter (KB2522999)

Update Installer for WildTangent Games App

WampServer 2.0

Warner Bros. Digital Copy Manager

Web Deployment Tool

Welcome Center

WildTangent Games App (Acer Games)

Windows Live Communications Platform

Windows Live Essentials

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Mail

Windows Live Messenger

Windows Live MIME IFilter

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live Sync

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

Windows Media Player Firefox Plugin

WSOP-USA.com

Xvid 1.2.1 final uninstall

Yahoo! Messenger

Yahoo! Software Update

Yahoo! Toolbar

Yontoo Layers Runtime 1.10.01

.

==== Event Viewer Messages From Past Week ========

.

4/23/2013 9:58:19 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}

4/23/2013 9:43:35 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000008e (0xc0000005, 0x83653b40, 0xc397ff34, 0x00000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 042313-39780-01.

4/23/2013 10:35:22 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}

4/23/2013 10:35:22 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

4/23/2013 10:35:17 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

4/23/2013 10:35:05 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}

4/23/2013 10:35:04 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service TermService with arguments "" in order to run the server: {F9A874B6-F8A8-4D73-B5A8-AB610816828B}

4/23/2013 10:34:57 PM, Error: Microsoft-Windows-Eventlog [22] - The event logging service encountered an error while initializing publishing resources for channel DebugChannel. If channel type is Analytic or Debug, then this could mean there was an error initializing logging resources as well.

4/23/2013 10:34:44 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000007e (0xc0000005, 0x821033e1, 0x8f93fb4c, 0x8f93f730). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 042313-40965-01.

4/23/2013 10:29:24 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x000000be (0x00100060, 0x9129a025, 0x8cf1bb8c, 0x0000000a). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 042313-38875-01.

4/23/2013 10:19:40 PM, Error: Service Control Manager [7001] -

.

==== End Of File ===========================

gringo_pr · April 24, 2013

Hello MaestroX101

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
[*]Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
[*]Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
[*]Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.

-Security Check-

Download Security Check by screen317 from

here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-AdwCleaner-

Please download

AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

--RogueKiller--

Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit
- Quit all programs that you may have started.
- Please disconnect any USB or external drives from the computer before you run this scan!
- For Vista or Windows 7, right-click and select "Run as Administrator to start"
- For Windows XP, double-click to start.
- Wait until Prescan has finished ...
- Then Click on "Scan" button
- Wait until the Status box shows "Scan Finished"
- click on "delete"
- Wait until the Status box shows "Deleting Finished"
- Click on "Report" and copy/paste the content of the Notepad into your next reply.
- The log should be found in RKreport[1].txt on your Desktop
- Exit/Close RogueKiller+

Gringo

MaestroX101 · April 24, 2013

Results from checkup.txt:

Results of screen317's Security Check version 0.99.63

Windows 7 x86 (UAC is enabled)

Out of date service pack!!

Internet Explorer 8 Out of date!

``````````````Antivirus/Firewall Check:``````````````

Windows Security Center service is not running! This report may not be accurate!

McAfee VirusScan

WMI entry may not exist for antivirus; attempting automatic update.

AVG2012 successfully updated!

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.75.0.1300

Java DB 10.5.3.0

Java 6 Update 20

Java SE Development Kit 6 Update 18

Java version out of Date!

Adobe Flash Player 11.3.300.265

Adobe Reader 9 Adobe Reader out of Date!

Mozilla Firefox 13.0.1 Firefox out of Date!

Google Chrome 21.0.1180.83

Google Chrome 21.0.1180.89

````````Process Check: objlist.exe by Laurent````````

`````````````````System Health check`````````````````

Total Fragmentation on Drive C:

````````````````````End of Log``````````````````````

About to run adwcleaner and I will post the results after the system has rebooted.

MaestroX101 · April 24, 2013

Results from AdwCleaner:

# AdwCleaner v2.202 - Logfile created 04/24/2013 at 10:38:55

# Updated 23/04/2013 by Xplode

# Operating system : Windows 7 Professional (32 bits)

# User : Altex - LXEEA03007-PC

# Boot Mode : Safe mode with networking

# Running from : C:\Users\Altex\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

File Deleted : C:\Program Files\Mozilla FireFox\extensions\dealio@mybrowserbar.com

File Deleted : C:\Program Files\Mozilla Firefox\extensions\wtxpcom@mybrowserbar.com

File Deleted : C:\Program Files\Mozilla Firefox\plugins\npdnu.dll

File Deleted : C:\Program Files\Mozilla Firefox\plugins\npdnu.xpt

File Deleted : C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll

File Deleted : C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.xpt

File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml

File Deleted : C:\Users\Altex\AppData\Roaming\Mozilla\Firefox\Profiles\9r0jd02t.default\searchplugins\web-search.xml

Folder Deleted : C:\Program Files\Application Updater

Folder Deleted : C:\Program Files\Common Files\Software Update Utility

Folder Deleted : C:\Program Files\Common Files\spigot

Folder Deleted : C:\Program Files\Dealio Toolbar

Folder Deleted : C:\Program Files\Free Offers from Freeze.com

Folder Deleted : C:\Program Files\Search Toolbar

Folder Deleted : C:\Program Files\SelectRebates

Folder Deleted : C:\Program Files\Yontoo Layers Runtime

Folder Deleted : C:\ProgramData\AVG Secure Search

Folder Deleted : C:\ProgramData\Partner

Folder Deleted : C:\ProgramData\Tarma Installer

Folder Deleted : C:\Users\Altex\AppData\Local\PackageAware

Folder Deleted : C:\Users\Altex\AppData\LocalLow\Dealio

Folder Deleted : C:\Users\Altex\AppData\LocalLow\Search Settings

Folder Deleted : C:\Users\Altex\AppData\Roaming\Mozilla\Firefox\Profiles\9r0jd02t.default\extensions\plugin@yontoo.com

Folder Deleted : C:\Users\Altex\AppData\Roaming\Mozilla\Firefox\Profiles\9r0jd02t.default\FCTB

Folder Deleted : C:\Users\LX.EEA03.007\AppData\Local\Temp\boost_interprocess

Folder Deleted : C:\Users\LX.EEA03.007\AppData\LocalLow\Dealio

Folder Deleted : C:\Users\LX.EEA03.007\AppData\LocalLow\Search Settings

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Dealio

Key Deleted : HKCU\Software\AppDataLow\Software\Search Settings

Key Deleted : HKCU\Software\AVG Secure Search

Key Deleted : HKCU\Software\IGearSettings

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98279C38-DE4B-4BCF-93C9-8EC26069D6F4}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9D425283-D487-4337-BAB6-AB8354A81457}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E8DAAA30-6CAA-4B58-9603-8E54238219E2}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98279C38-DE4B-4BCF-93C9-8EC26069D6F4}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D425283-D487-4337-BAB6-AB8354A81457}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E312764E-7706-43F1-8DAB-FCDD2B1E416D}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E8DAAA30-6CAA-4B58-9603-8E54238219E2}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Deleted : HKCU\Software\Zugo

Key Deleted : HKLM\Software\Application Updater

Key Deleted : HKLM\Software\AVG Secure Search

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{28A88B70-D874-4F73-BBBA-9B2B222FB7D6}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\dnu.EXE

Key Deleted : HKLM\SOFTWARE\Classes\AppID\kt_bho_dll.dll

Key Deleted : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{98279C38-DE4B-4BCF-93C9-8EC26069D6F4}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{99066096-8989-4612-841F-621A01D54AD7}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9D425283-D487-4337-BAB6-AB8354A81457}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E8DAAA30-6CAA-4B58-9603-8E54238219E2}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}

Key Deleted : HKLM\SOFTWARE\Classes\dnUpdate

Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser

Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1

Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController

Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1

Key Deleted : HKLM\Software\Classes\Installer\Features\646404015C7770F449E7855EAF878AEB

Key Deleted : HKLM\Software\Classes\Installer\Products\646404015C7770F449E7855EAF878AEB

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E3ED53C5-7AD5-4DF5-9734-AFB6E7E5D9DB}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}

Key Deleted : HKLM\SOFTWARE\Classes\kt_bho.KettleBho

Key Deleted : HKLM\SOFTWARE\Classes\kt_bho.KettleBho.1

Key Deleted : HKLM\SOFTWARE\Classes\S

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{86676E13-D6D8-4652-9FCF-F2047F1FB000}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}

Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api

Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1

Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Layers

Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\Software\Dealio

Key Deleted : HKLM\Software\Freeze.com

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D425283-D487-4337-BAB6-AB8354A81457}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E8DAAA30-6CAA-4B58-9603-8E54238219E2}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\23A03A6765D10864EB278629A2DF32C3

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2C2D840AB81518B4E8007294C43143F9

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3A4FCCE032CA50340A6975C92410AE30

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6059D61EECDC80945A4F394A2796D98A

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6334ACC8923CC1241ACEAD4E9F158639

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6E00D9B24354FBA44AE2CA0FA86EF2E2

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7C13F41728A69EF41AA1A3372FB86FA6

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\81EC02DB04E46864B82B67EE402176C9

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B92A2929968AED344BD6B34AD60E6604

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D1DC57F55B9713541BF737FD481087A8

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ED1CAE30F47D14B41B5FC8FA53658044

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F2BDC886A30209F4EBE1141B470A8090

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\646404015C7770F449E7855EAF878AEB

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility

Key Deleted : HKLM\Software\Search Settings

Key Deleted : HKLM\Software\Tarma Installer

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{98279C38-DE4B-4BCF-93C9-8EC26069D6F4}]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{9D425283-D487-4337-BAB6-AB8354A81457}]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}]

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C}]

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{98279C38-DE4B-4BCF-93C9-8EC26069D6F4}]

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{9D425283-D487-4337-BAB6-AB8354A81457}]

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [searchSettings]

***** [internet Browsers] *****

-\\ Internet Explorer v8.0.7600.16766

[OK] Registry is clean.

-\\ Mozilla Firefox v13.0.1 (en-US)

File : C:\Users\Altex\AppData\Roaming\Mozilla\Firefox\Profiles\9r0jd02t.default\prefs.js

C:\Users\Altex\AppData\Roaming\Mozilla\Firefox\Profiles\9r0jd02t.default\user.js ... Deleted !

Deleted : user_pref("browser.search.defaultenginename", "AVG Secure Search");

Deleted : user_pref("browser.search.selectedEngine", "AVG Secure Search");

Deleted : user_pref("extentions.y2layers.installId", "cb0073f0-e7ad-4f4a-ad3f-1d53f332a5ad");

Deleted : user_pref("extentions.y2layers.lastDnsTest", 372018);

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.2799403.KeywordHistory", "xbox%2520360%7C");

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.AutoSearchEventData", "auto%20search");

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.ClearCacheDate", 10);

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.DNSCatch", false);

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.DisplayEULA", false);

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.DnsCatchEventData", "dns%20catch");

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.FirstLaunchShown", true);

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.LoadLayoutDate.60497", 10);

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.MailLastCheckTime", 1347312868);

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.NewTabSearchEventData", "tab%20search");

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.RemoveAllData", true);

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.ShowRecommendedOptions", false);

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.StateReportDate", "1347312868413");

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.TopRightSearchEventData", "top%20right%20search[...]

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.api.settings.fctoolbar51ef49d2624b41948b971c468[...]

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.customNewTab", false);

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.data", "970E0D327E91ACB7AE5FC2C7B268ABD9A70C71F[...]

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.helpUsImprove", true);

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.hideOthers", false);

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.processAddrBar", true);

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.remove_search", true);

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.restoreSearch", false);

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.revision", "82");

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.searchHistory", true);

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.session", "30E814015129C29135B4CB7905EE163C316D[...]

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.showFirstLaunchOptions", false);

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.stday", "14");

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.sthour", "19");

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.tb_lang", "en");

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.tool_id", "60497");

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.user_id", "36976591");

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.user_key", "aeacdbf72ee254d431bbb260f16d90a1b6b[...]

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.user_layouts", "60497");

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.user_lnames", "MyPoints%20Point%20Finder");

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.weather_location_IDcid2799617", "USTX0294");

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.weather_location_namecid2799617", "Corpus%20Chr[...]

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.xml_service_url", "64e3a27980eeceb34248bc3e680b[...]

Deleted : user_pref("freecause51ef49d2624b41948b971c468e9b0efe.yahooSearch", true);

-\\ Google Chrome v21.0.1180.89

File : C:\Users\Altex\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.36] : icon_url = "hxxps://isearch.avg.com/favicon.ico",

Deleted [l.39] : keyword = "isearch.avg.com",

Deleted [l.42] : search_url = "hxxps://isearch.avg.com/search?cid={28664C5B-08FB-4386-921B-FD22134A857C}&mid=&[...]

*************************

AdwCleaner[s1].txt - [365 octets] - [24/04/2013 10:35:50]

AdwCleaner[s2].txt - [17365 octets] - [24/04/2013 10:38:55]

########## EOF - C:\AdwCleaner[s2].txt - [17426 octets] ##########

About to run RogueKiller

MaestroX101 · April 24, 2013

Before I post the results of RogueKiller, I noticed that after the main scan, a popup appeared with something along the lines of "rootkit" in the address bar, and again after the deletion process. I am currently in safe mode because after the reboot before running adwcleaner, it blue screened when I tried opening Chrome. So since then, ran both adwcleaner and roguekiller in safe mode.

These are the results from RK:

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7600 ) 32 bits version

Started in : Safe mode with network support

User : Altex [Admin rights]

Mode : Remove -- Date : 04/24/2013 10:54:27

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FOLDER] ROOT : C:\Windows\Installer\{7a9a1355-2def-95e0-5fc8-d2d7a5580498}\U --> REMOVED

[ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC\Desktop.ini [-] --> REMOVED

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: TOSHIBA MK2555GSX +++++

--- User ---

[MBR] d2eba62231f349db9190d798ef88ae06

[bSP] 8d3aefc9ce1031ea5619d4b868890035 : Windows 7/8 MBR Code

Partition table:

0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 20480 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 41945088 | Size: 100 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 42149888 | Size: 121806 Mo

3 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 291608576 | Size: 96087 Mo

User != LL1 ... KO!

--- LL1 ---

[MBR] 9d9c44dccfe96004b139176af833454a

[bSP] 8d3aefc9ce1031ea5619d4b868890035 : Windows 7/8 MBR Code

Partition table:

1 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 20480 Mo

2 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 41945088 | Size: 100 Mo

3 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 42149888 | Size: 121806 Mo

User != LL2 ... KO!

--- LL2 ---

[MBR] 9d9c44dccfe96004b139176af833454a

[bSP] 8d3aefc9ce1031ea5619d4b868890035 : Windows 7/8 MBR Code

Partition table:

1 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 20480 Mo

2 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 41945088 | Size: 100 Mo

3 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 42149888 | Size: 121806 Mo

Finished : << RKreport[2]_D_04242013_02d1054.txt >>

RKreport[1]_S_04242013_02d1053.txt ; RKreport[2]_D_04242013_02d1054.txt

I really appreciate your help, Gringo!

gringo_pr · April 24, 2013

Hello MaestroX101

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

MaestroX101 · April 24, 2013

I did not notice any issues other than trying to disable McAfee. It would open and then close, so I was unable to check to see if it was disabled. Other than than, ComboFix did not initialize properly at first, but upon restarting, it initialized and went through the scan with no other problems. I'll do a test run outside of Safe Mode to see if there are any problems still, and will respond in about 10-20 minutes (or until I blue screen).

Results from ComboFix:

ComboFix 13-04-24.03 - Altex 04/24/2013 14:26:13.1.2 - x86 NETWORK

Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3001.2563 [GMT -5:00]

Running from: c:\users\Altex\Desktop\ComboFix.exe

AV: McAfee VirusScan *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}

FW: McAfee Personal Firewall *Disabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}

SP: McAfee VirusScan *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\iWin Games\iWINgameshookie.dll

c:\programdata\33021704

c:\programdata\Microsoft\Windows\DRM\5FB0.tmp

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\PGPtray.exe.lnk

c:\programdata\SPL45FB.tmp

c:\programdata\SPLA497.tmp

c:\users\Altex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Recovery

c:\users\Public\invokesi.exe

c:\windows\COUPon~1.ocx

c:\windows\PolicyDefinitions

c:\windows\PolicyDefinitions\ActiveXInstallService.admx

c:\windows\PolicyDefinitions\AddRemovePrograms.admx

c:\windows\PolicyDefinitions\AppCompat.admx

c:\windows\PolicyDefinitions\AttachmentManager.admx

c:\windows\PolicyDefinitions\AutoPlay.admx

c:\windows\PolicyDefinitions\Biometrics.admx

c:\windows\PolicyDefinitions\Bits.admx

c:\windows\PolicyDefinitions\CEIPEnable.admx

c:\windows\PolicyDefinitions\CipherSuiteOrder.admx

c:\windows\PolicyDefinitions\COM.admx

c:\windows\PolicyDefinitions\Conf.admx

c:\windows\PolicyDefinitions\ControlPanel.admx

c:\windows\PolicyDefinitions\ControlPanelDisplay.admx

c:\windows\PolicyDefinitions\Cpls.admx

c:\windows\PolicyDefinitions\CredentialProviders.admx

c:\windows\PolicyDefinitions\CredSsp.admx

c:\windows\PolicyDefinitions\CredUI.admx

c:\windows\PolicyDefinitions\CtrlAltDel.admx

c:\windows\PolicyDefinitions\DCOM.admx

c:\windows\PolicyDefinitions\Desktop.admx

c:\windows\PolicyDefinitions\DeviceInstallation.admx

c:\windows\PolicyDefinitions\DeviceRedirection.admx

c:\windows\PolicyDefinitions\DFS.admx

c:\windows\PolicyDefinitions\DigitalLocker.admx

c:\windows\PolicyDefinitions\DiskDiagnostic.admx

c:\windows\PolicyDefinitions\DiskNVCache.admx

c:\windows\PolicyDefinitions\DiskQuota.admx

c:\windows\PolicyDefinitions\DistributedLinkTracking.admx

c:\windows\PolicyDefinitions\DnsClient.admx

c:\windows\PolicyDefinitions\DWM.admx

c:\windows\PolicyDefinitions\en-US\ActiveXInstallService.adml

c:\windows\PolicyDefinitions\en-US\AddRemovePrograms.adml

c:\windows\PolicyDefinitions\en-US\AppCompat.adml

c:\windows\PolicyDefinitions\en-US\AttachmentManager.adml

c:\windows\PolicyDefinitions\en-US\AutoPlay.adml

c:\windows\PolicyDefinitions\en-US\Biometrics.adml

c:\windows\PolicyDefinitions\en-US\Bits.adml

c:\windows\PolicyDefinitions\en-US\CEIPEnable.adml

c:\windows\PolicyDefinitions\en-US\CipherSuiteOrder.adml

c:\windows\PolicyDefinitions\en-US\COM.adml

c:\windows\PolicyDefinitions\en-US\Conf.adml

c:\windows\PolicyDefinitions\en-US\ControlPanel.adml

c:\windows\PolicyDefinitions\en-US\ControlPanelDisplay.adml

c:\windows\PolicyDefinitions\en-US\Cpls.adml

c:\windows\PolicyDefinitions\en-US\CredentialProviders.adml

c:\windows\PolicyDefinitions\en-US\CredSsp.adml

c:\windows\PolicyDefinitions\en-US\CredUI.adml

c:\windows\PolicyDefinitions\en-US\CtrlAltDel.adml

c:\windows\PolicyDefinitions\en-US\DCOM.adml

c:\windows\PolicyDefinitions\en-US\Desktop.adml

c:\windows\PolicyDefinitions\en-US\DeviceInstallation.adml

c:\windows\PolicyDefinitions\en-US\DeviceRedirection.adml

c:\windows\PolicyDefinitions\en-US\DFS.adml

c:\windows\PolicyDefinitions\en-US\DigitalLocker.adml

c:\windows\PolicyDefinitions\en-US\DiskDiagnostic.adml

c:\windows\PolicyDefinitions\en-US\DiskNVCache.adml

c:\windows\PolicyDefinitions\en-US\DiskQuota.adml

c:\windows\PolicyDefinitions\en-US\DistributedLinkTracking.adml

c:\windows\PolicyDefinitions\en-US\DnsClient.adml

c:\windows\PolicyDefinitions\en-US\DWM.adml

c:\windows\PolicyDefinitions\en-US\EncryptFilesonMove.adml

c:\windows\PolicyDefinitions\en-US\EnhancedStorage.adml

c:\windows\PolicyDefinitions\en-US\ErrorReporting.adml

c:\windows\PolicyDefinitions\en-US\EventForwarding.adml

c:\windows\PolicyDefinitions\en-US\EventLog.adml

c:\windows\PolicyDefinitions\en-US\EventViewer.adml

c:\windows\PolicyDefinitions\en-US\Explorer.adml

c:\windows\PolicyDefinitions\en-US\FileRecovery.adml

c:\windows\PolicyDefinitions\en-US\FileSys.adml

c:\windows\PolicyDefinitions\en-US\FolderRedirection.adml

c:\windows\PolicyDefinitions\en-US\FramePanes.adml

c:\windows\PolicyDefinitions\en-US\fthsvc.adml

c:\windows\PolicyDefinitions\en-US\GameExplorer.adml

c:\windows\PolicyDefinitions\en-US\Globalization.adml

c:\windows\PolicyDefinitions\en-US\GroupPolicy.adml

c:\windows\PolicyDefinitions\en-US\Help.adml

c:\windows\PolicyDefinitions\en-US\HelpAndSupport.adml

c:\windows\PolicyDefinitions\en-US\HotStart.adml

c:\windows\PolicyDefinitions\en-US\ICM.adml

c:\windows\PolicyDefinitions\en-US\IIS.adml

c:\windows\PolicyDefinitions\en-US\InetRes.adml

c:\windows\PolicyDefinitions\en-US\InkWatson.adml

c:\windows\PolicyDefinitions\en-US\InputPersonalization.adml

c:\windows\PolicyDefinitions\en-US\iSCSI.adml

c:\windows\PolicyDefinitions\en-US\Kerberos.adml

c:\windows\PolicyDefinitions\en-US\LanmanServer.adml

c:\windows\PolicyDefinitions\en-US\LeakDiagnostic.adml

c:\windows\PolicyDefinitions\en-US\LinkLayerTopologyDiscovery.adml

c:\windows\PolicyDefinitions\en-US\Logon.adml

c:\windows\PolicyDefinitions\en-US\MediaCenter.adml

c:\windows\PolicyDefinitions\en-US\MMC.adml

c:\windows\PolicyDefinitions\en-US\MMCSnapins.adml

c:\windows\PolicyDefinitions\en-US\MobilePCMobilityCenter.adml

c:\windows\PolicyDefinitions\en-US\MobilePCPresentationSettings.adml

c:\windows\PolicyDefinitions\en-US\MSDT.adml

c:\windows\PolicyDefinitions\en-US\Msi-FileRecovery.adml

c:\windows\PolicyDefinitions\en-US\MSI.adml

c:\windows\PolicyDefinitions\en-US\NCSI.adml

c:\windows\PolicyDefinitions\en-US\Netlogon.adml

c:\windows\PolicyDefinitions\en-US\NetworkConnections.adml

c:\windows\PolicyDefinitions\en-US\NetworkProjection.adml

c:\windows\PolicyDefinitions\en-US\OfflineFiles.adml

c:\windows\PolicyDefinitions\en-US\P2P-pnrp.adml

c:\windows\PolicyDefinitions\en-US\ParentalControls.adml

c:\windows\PolicyDefinitions\en-US\pca.adml

c:\windows\PolicyDefinitions\en-US\PeerToPeerCaching.adml

c:\windows\PolicyDefinitions\en-US\PenTraining.adml

c:\windows\PolicyDefinitions\en-US\PerfCenterCPL.adml

c:\windows\PolicyDefinitions\en-US\PerformanceDiagnostics.adml

c:\windows\PolicyDefinitions\en-US\PerformancePerftrack.adml

c:\windows\PolicyDefinitions\en-US\Power.adml

c:\windows\PolicyDefinitions\en-US\PreviousVersions.adml

c:\windows\PolicyDefinitions\en-US\Printing.adml

c:\windows\PolicyDefinitions\en-US\Programs.adml

c:\windows\PolicyDefinitions\en-US\QOS.adml

c:\windows\PolicyDefinitions\en-US\RacWmiProv.adml

c:\windows\PolicyDefinitions\en-US\Radar.adml

c:\windows\PolicyDefinitions\en-US\ReAgent.adml

c:\windows\PolicyDefinitions\en-US\Reliability.adml

c:\windows\PolicyDefinitions\en-US\RemoteAssistance.adml

c:\windows\PolicyDefinitions\en-US\RemovableStorage.adml

c:\windows\PolicyDefinitions\en-US\RPC.adml

c:\windows\PolicyDefinitions\en-US\Scripts.adml

c:\windows\PolicyDefinitions\en-US\sdiageng.adml

c:\windows\PolicyDefinitions\en-US\sdiagschd.adml

c:\windows\PolicyDefinitions\en-US\Search.adml

c:\windows\PolicyDefinitions\en-US\Securitycenter.adml

c:\windows\PolicyDefinitions\en-US\Sensors.adml

c:\windows\PolicyDefinitions\en-US\Setup.adml

c:\windows\PolicyDefinitions\en-US\ShapeCollector.adml

c:\windows\PolicyDefinitions\en-US\SharedFolders.adml

c:\windows\PolicyDefinitions\en-US\Sharing.adml

c:\windows\PolicyDefinitions\en-US\Shell-CommandPrompt-RegEditTools.adml

c:\windows\PolicyDefinitions\en-US\ShellWelcomeCenter.adml

c:\windows\PolicyDefinitions\en-US\Sidebar.adml

c:\windows\PolicyDefinitions\en-US\Sideshow.adml

c:\windows\PolicyDefinitions\en-US\Smartcard.adml

c:\windows\PolicyDefinitions\en-US\Snmp.adml

c:\windows\PolicyDefinitions\en-US\SoundRec.adml

c:\windows\PolicyDefinitions\en-US\StartMenu.adml

c:\windows\PolicyDefinitions\en-US\SystemResourceManager.adml

c:\windows\PolicyDefinitions\en-US\SystemRestore.adml

c:\windows\PolicyDefinitions\en-US\TabletPCInputPanel.adml

c:\windows\PolicyDefinitions\en-US\TabletShell.adml

c:\windows\PolicyDefinitions\en-US\Taskbar.adml

c:\windows\PolicyDefinitions\en-US\TaskScheduler.adml

c:\windows\PolicyDefinitions\en-US\tcpip.adml

c:\windows\PolicyDefinitions\en-US\TerminalServer.adml

c:\windows\PolicyDefinitions\en-US\Thumbnails.adml

c:\windows\PolicyDefinitions\en-US\TouchInput.adml

c:\windows\PolicyDefinitions\en-US\TPM.adml

c:\windows\PolicyDefinitions\en-US\UserDataBackup.adml

c:\windows\PolicyDefinitions\en-US\UserProfiles.adml

c:\windows\PolicyDefinitions\en-US\VolumeEncryption.adml

c:\windows\PolicyDefinitions\en-US\W32Time.adml

c:\windows\PolicyDefinitions\en-US\WDI.adml

c:\windows\PolicyDefinitions\en-US\WinCal.adml

c:\windows\PolicyDefinitions\en-US\Windows.adml

c:\windows\PolicyDefinitions\en-US\WindowsAnytimeUpgrade.adml

c:\windows\PolicyDefinitions\en-US\WindowsBackup.adml

c:\windows\PolicyDefinitions\en-US\WindowsColorSystem.adml

c:\windows\PolicyDefinitions\en-US\WindowsConnectNow.adml

c:\windows\PolicyDefinitions\en-US\WindowsDefender.adml

c:\windows\PolicyDefinitions\en-US\WindowsExplorer.adml

c:\windows\PolicyDefinitions\en-US\WindowsFileProtection.adml

c:\windows\PolicyDefinitions\en-US\WindowsFirewall.adml

c:\windows\PolicyDefinitions\en-US\WindowsMail.adml

c:\windows\PolicyDefinitions\en-US\WindowsMediaDRM.adml

c:\windows\PolicyDefinitions\en-US\WindowsMediaPlayer.adml

c:\windows\PolicyDefinitions\en-US\WindowsMessenger.adml

c:\windows\PolicyDefinitions\en-US\WindowsProducts.adml

c:\windows\PolicyDefinitions\en-US\WindowsRemoteManagement.adml

c:\windows\PolicyDefinitions\en-US\WindowsRemoteShell.adml

c:\windows\PolicyDefinitions\en-US\WindowsUpdate.adml

c:\windows\PolicyDefinitions\en-US\WinInit.adml

c:\windows\PolicyDefinitions\en-US\WinLogon.adml

c:\windows\PolicyDefinitions\en-US\Winsrv.adml

c:\windows\PolicyDefinitions\en-US\WordWheel.adml

c:\windows\PolicyDefinitions\EncryptFilesonMove.admx

c:\windows\PolicyDefinitions\EnhancedStorage.admx

c:\windows\PolicyDefinitions\ErrorReporting.admx

c:\windows\PolicyDefinitions\EventForwarding.admx

c:\windows\PolicyDefinitions\EventLog.admx

c:\windows\PolicyDefinitions\EventViewer.admx

c:\windows\PolicyDefinitions\Explorer.admx

c:\windows\PolicyDefinitions\FileRecovery.admx

c:\windows\PolicyDefinitions\FileSys.admx

c:\windows\PolicyDefinitions\FolderRedirection.admx

c:\windows\PolicyDefinitions\FramePanes.admx

c:\windows\PolicyDefinitions\fthsvc.admx

c:\windows\PolicyDefinitions\GameExplorer.admx

c:\windows\PolicyDefinitions\Globalization.admx

c:\windows\PolicyDefinitions\GroupPolicy.admx

c:\windows\PolicyDefinitions\Help.admx

c:\windows\PolicyDefinitions\HelpAndSupport.admx

c:\windows\PolicyDefinitions\HotStart.admx

c:\windows\PolicyDefinitions\ICM.admx

c:\windows\PolicyDefinitions\IIS.admx

c:\windows\PolicyDefinitions\inetres.admx

c:\windows\PolicyDefinitions\InkWatson.admx

c:\windows\PolicyDefinitions\InputPersonalization.admx

c:\windows\PolicyDefinitions\iSCSI.admx

c:\windows\PolicyDefinitions\Kerberos.admx

c:\windows\PolicyDefinitions\LanmanServer.admx

c:\windows\PolicyDefinitions\LeakDiagnostic.admx

c:\windows\PolicyDefinitions\LinkLayerTopologyDiscovery.admx

c:\windows\PolicyDefinitions\Logon.admx

c:\windows\PolicyDefinitions\MediaCenter.admx

c:\windows\PolicyDefinitions\MMC.admx

c:\windows\PolicyDefinitions\MMCSnapins.admx

c:\windows\PolicyDefinitions\MobilePCMobilityCenter.admx

c:\windows\PolicyDefinitions\MobilePCPresentationSettings.admx

c:\windows\PolicyDefinitions\MSDT.admx

c:\windows\PolicyDefinitions\Msi-FileRecovery.admx

c:\windows\PolicyDefinitions\MSI.admx

c:\windows\PolicyDefinitions\NCSI.admx

c:\windows\PolicyDefinitions\Netlogon.admx

c:\windows\PolicyDefinitions\NetworkConnections.admx

c:\windows\PolicyDefinitions\NetworkProjection.admx

c:\windows\PolicyDefinitions\OfflineFiles.admx

c:\windows\PolicyDefinitions\P2P-pnrp.admx

c:\windows\PolicyDefinitions\ParentalControls.admx

c:\windows\PolicyDefinitions\pca.admx

c:\windows\PolicyDefinitions\PeerToPeerCaching.admx

c:\windows\PolicyDefinitions\PenTraining.admx

c:\windows\PolicyDefinitions\PerfCenterCPL.admx

c:\windows\PolicyDefinitions\PerformanceDiagnostics.admx

c:\windows\PolicyDefinitions\PerformancePerftrack.admx

c:\windows\PolicyDefinitions\Power.admx

c:\windows\PolicyDefinitions\PreviousVersions.admx

c:\windows\PolicyDefinitions\Printing.admx

c:\windows\PolicyDefinitions\Programs.admx

c:\windows\PolicyDefinitions\QOS.admx

c:\windows\PolicyDefinitions\RacWmiProv.admx

c:\windows\PolicyDefinitions\Radar.admx

c:\windows\PolicyDefinitions\ReAgent.admx

c:\windows\PolicyDefinitions\Reliability.admx

c:\windows\PolicyDefinitions\RemoteAssistance.admx

c:\windows\PolicyDefinitions\RemovableStorage.admx

c:\windows\PolicyDefinitions\RPC.admx

c:\windows\PolicyDefinitions\Scripts.admx

c:\windows\PolicyDefinitions\sdiageng.admx

c:\windows\PolicyDefinitions\sdiagschd.admx

c:\windows\PolicyDefinitions\Search.admx

c:\windows\PolicyDefinitions\Securitycenter.admx

c:\windows\PolicyDefinitions\Sensors.admx

c:\windows\PolicyDefinitions\Setup.admx

c:\windows\PolicyDefinitions\ShapeCollector.admx

c:\windows\PolicyDefinitions\SharedFolders.admx

c:\windows\PolicyDefinitions\Sharing.admx

c:\windows\PolicyDefinitions\Shell-CommandPrompt-RegEditTools.admx

c:\windows\PolicyDefinitions\ShellWelcomeCenter.admx

c:\windows\PolicyDefinitions\Sidebar.admx

c:\windows\PolicyDefinitions\Sideshow.admx

c:\windows\PolicyDefinitions\Smartcard.admx

c:\windows\PolicyDefinitions\Snmp.admx

c:\windows\PolicyDefinitions\SoundRec.admx

c:\windows\PolicyDefinitions\StartMenu.admx

c:\windows\PolicyDefinitions\SystemResourceManager.admx

c:\windows\PolicyDefinitions\SystemRestore.admx

c:\windows\PolicyDefinitions\TabletPCInputPanel.admx

c:\windows\PolicyDefinitions\TabletShell.admx

c:\windows\PolicyDefinitions\Taskbar.admx

c:\windows\PolicyDefinitions\TaskScheduler.admx

c:\windows\PolicyDefinitions\tcpip.admx

c:\windows\PolicyDefinitions\TerminalServer.admx

c:\windows\PolicyDefinitions\Thumbnails.admx

c:\windows\PolicyDefinitions\TouchInput.admx

c:\windows\PolicyDefinitions\TPM.admx

c:\windows\PolicyDefinitions\UserDataBackup.admx

c:\windows\PolicyDefinitions\UserProfiles.admx

c:\windows\PolicyDefinitions\VolumeEncryption.admx

c:\windows\PolicyDefinitions\W32Time.admx

c:\windows\PolicyDefinitions\WDI.admx

c:\windows\PolicyDefinitions\WinCal.admx

c:\windows\PolicyDefinitions\Windows.admx

c:\windows\PolicyDefinitions\WindowsAnytimeUpgrade.admx

c:\windows\PolicyDefinitions\WindowsBackup.admx

c:\windows\PolicyDefinitions\WindowsColorSystem.admx

c:\windows\PolicyDefinitions\WindowsConnectNow.admx

c:\windows\PolicyDefinitions\WindowsDefender.admx

c:\windows\PolicyDefinitions\WindowsExplorer.admx

c:\windows\PolicyDefinitions\WindowsFileProtection.admx

c:\windows\PolicyDefinitions\WindowsFirewall.admx

c:\windows\PolicyDefinitions\WindowsMail.admx

c:\windows\PolicyDefinitions\WindowsMediaDRM.admx

c:\windows\PolicyDefinitions\WindowsMediaPlayer.admx

c:\windows\PolicyDefinitions\WindowsMessenger.admx

c:\windows\PolicyDefinitions\WindowsProducts.admx

c:\windows\PolicyDefinitions\WindowsRemoteManagement.admx

c:\windows\PolicyDefinitions\WindowsRemoteShell.admx

c:\windows\PolicyDefinitions\WindowsUpdate.admx

c:\windows\PolicyDefinitions\WinInit.admx

c:\windows\PolicyDefinitions\WinLogon.admx

c:\windows\PolicyDefinitions\Winsrv.admx

c:\windows\PolicyDefinitions\WordWheel.admx

.

((((((((((((((((((((((((( Files Created from 2013-03-24 to 2013-04-24 )))))))))))))))))))))))))))))))

.

2013-04-24 19:50 . 2013-04-24 19:57 -------- d-----w- c:\users\Altex\AppData\Local\temp

2013-04-24 19:50 . 2013-04-24 19:50 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-04-24 19:50 . 2013-04-24 19:50 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp

2013-04-24 19:50 . 2013-04-24 19:50 -------- d-----w- c:\users\Mcx1-LXEEA03007-PC\AppData\Local\temp

2013-04-24 19:50 . 2013-04-24 19:50 -------- d-----w- c:\users\LX.EEA03.007\AppData\Local\temp

2013-04-24 16:01 . 2013-04-24 16:01 -------- d-----w- c:\program files\GUMF99.tmp

2013-04-24 15:43 . 2013-04-24 15:45 -------- d-----w- c:\program files\GUM561A.tmp

2013-04-24 15:43 . 2013-04-24 15:43 0 ----a-w- c:\program files\GUT561B.tmp

2013-04-24 03:26 . 2013-04-24 03:28 -------- d-----w- c:\program files\GUM49DB.tmp

2013-04-24 03:26 . 2013-04-24 03:26 0 ----a-w- c:\program files\GUT49DC.tmp

2013-04-24 03:23 . 2009-07-14 01:14 259072 ----a-w- c:\windows\system32\services.exe

2013-04-24 02:55 . 2013-04-24 03:39 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-04-04 19:50 . 2012-07-28 21:23 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-09-25 00:02 . 2012-09-25 00:02 4096000 ----a-w- c:\program files\GUT983A.tmp

2012-07-27 23:34 . 2011-08-15 00:44 85472 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[7] 2010-11-20 . 866A43013535DC8587C258E43579C764 . 317440 . . [6.1.7601.17514] . . c:\windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.1.7601.17514_none_d8530d0d1fcade21\spoolsv.exe

[7] 2010-08-21 . D1BB750EB51694DE183E08B9C33BE5B2 . 316928 . . [6.1.7600.16661] . . c:\windows\winsxs\x86_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.1.7600.16661_none_d6339da722cfb4be\spoolsv.exe

[7] 2010-08-20 . 2FB4CE429488156B19C0D8E5C4552043 . 316928 . . [6.1.7600.20785] . . c:\windows\winsxs\x86_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.1.7600.20785_none_d6ab9bc23bf9f1c6\spoolsv.exe

[7] 2009-07-14 . 49B6DD6AB3715B7A67965F17194E98A9 . 316416 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-printing-spooler-core_31bf3856ad364e35_6.1.7600.16385_none_d621f94522dc5a87\spoolsv.exe

.

c:\windows\System32\spoolsv.exe ... is missing !!

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn3\yt.dll" [2012-06-11 1524056]

.

[HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]

[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1]

[HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}]

[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-03-12 06:39 129272 ----a-w- c:\users\Altex\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-03-12 06:39 129272 ----a-w- c:\users\Altex\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-03-12 06:39 129272 ----a-w- c:\users\Altex\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOverlayHandlerAccessible]

@="{3DBF5F01-3287-46EB-82CF-45AA5C241162}"

[HKEY_CLASSES_ROOT\CLSID\{3DBF5F01-3287-46EB-82CF-45AA5C241162}]

2009-12-17 21:02 613496 ----a-w- c:\windows\System32\PGPfsshl.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2010-03-19 5248312]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

"Aim"="c:\program files\AIM\aim.exe" [2010-03-08 3972440]

"Facebook Update"="c:\users\Altex\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-11 138096]

"MobileDocuments"="c:\program files\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-28 39408]

"deskPDF Creator"="c:\program files\Docudesk\deskPDF Creator\deskPDFCreator.exe" [2012-07-05 2162688]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]

"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2009-09-27 83312]

"dcmsvc"="c:\program files\dcmsvc\dcmsvc.exe" [2009-04-07 30440]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

"Mobile Connectivity Suite"="c:\program files\HTC\HTC Sync\Application Launcher\Application Launcher.exe" [2009-11-19 598016]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-26 136216]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-26 171032]

"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 170520]

"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424]

"Nikon Transfer Monitor"="c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe" [2009-09-15 479232]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]

"TkBellExe"="c:\program files\real\realplayer\Update\realsched.exe" [2012-05-07 296056]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-04-19 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-06-08 421776]

"lxdumon.exe"="c:\program files\Lexmark 5600-6600 Series\lxdumon.exe" [2010-02-04 676520]

"lxduamon"="c:\program files\Lexmark 5600-6600 Series\lxduamon.exe" [2010-02-04 16040]

"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-04-05 2587008]

.

c:\users\Altex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\Altex\AppData\Roaming\Dropbox\bin\Dropbox.exe [2013-3-12 29106336]

OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]

Warner Bros.lnk - c:\program files\Warner Bros. Digital Copy Manager\Warner Bros. Digital Copy Manager.exe [2010-7-16 142336]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

OfficeSAS.lnk - c:\program files\Microsoft Office\Office14\OfficeSAS\officeSASscheduler.exe [2009-9-26 202648]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\System32\PGPmapih.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux3"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Notification Packages REG_MULTI_SZ scecli PGPpwflt

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]

@="Service"

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Acer VCM.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk

backup=c:\windows\pss\Acer VCM.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer Assist Launcher]

2007-11-19 22:17 1261568 ----a-w- c:\program files\Acer\Acer Assist\launcher.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer ePower Management]

2009-09-30 21:47 703008 ----a-w- c:\program files\Acer\Acer ePower Management\ePowerTray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2011-09-07 22:58 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cAudioFilterAgent]

2009-07-20 06:29 484920 ----a-w- c:\program files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Global Registration]

2009-08-28 09:40 2846240 ----a-w- c:\program files\Acer\Registration\GREG.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]

2009-06-05 02:03 186904 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]

2010-08-26 01:45 136216 ----a-w- c:\windows\System32\igfxtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]

2009-09-24 12:14 825864 ----a-w- c:\program files\Launch Manager\LManager.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcagent_exe]

2009-07-23 20:51 645328 ----a-w- c:\program files\McAfee.com\Agent\mcagent.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NortonOnlineBackupReminder]

2009-07-24 23:31 588648 ----a-w- c:\program files\Symantec\Norton Online Backup\Activation\NobuActivation.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PLFSetI]

2008-07-30 02:29 200704 ----a-w- c:\windows\PLFSetI.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

2009-10-28 22:32 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

.

R0 naquaw;naquaw;c:\windows\System32\drivers\uutgbpyy.sys [x]

R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x]

R2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\avgidsagent.exe [x]

R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [x]

R2 iPodDrv;iPodDrv;c:\windows\system32\drivers\iPodDrv.sys [x]

R2 iWinTrusted;iWinTrusted;c:\program files\iWin Games\iWinTrusted.exe [x]

R2 lxdu_device;lxdu_device;c:\windows\system32\lxducoms.exe [x]

R2 lxduCATSCustConnectService;lxduCATSCustConnectService;c:\windows\system32\spool\DRIVERS\W32X86\3\\lxduserv.exe [x]

R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]

R2 regi;regi;c:\windows\system32\drivers\regi.sys [x]

R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [x]

R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfilterx.sys [x]

R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [x]

R3 GamesAppService;GamesAppService;c:\program files\WildTangent Games\App\GamesAppService.exe [x]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]

R3 MsDepSvc;Web Deployment Agent Service;c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe [x]

R3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\DRIVERS\NwUsbCdFil.sys [x]

R3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\DRIVERS\nwusbser2.sys [x]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]

R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R4 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [x]

R4 Greg_Service;GRegService;c:\program files\Acer\Registration\GregHSRW.exe [x]

R4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [x]

R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [x]

R4 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [x]

R4 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [x]

R4 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [x]

R4 RsFx0102;RsFx0102 Driver;c:\windows\system32\DRIVERS\RsFx0102.sys [x]

R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [x]

R4 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]

S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [x]

S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x]

S0 pgpfs;PGP File Sharing;c:\windows\System32\Drivers\PGPfsfd.sys [x]

S0 Pgpwdefs;Pgpwdefs;c:\windows\system32\DRIVERS\Pgpwdefs.sys [x]

S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x]

S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [x]

S3 NETw5s32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [x]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

iissvcs REG_MULTI_SZ w3svc was

apphost REG_MULTI_SZ apphostsvc

.

Contents of the 'Scheduled Tasks' folder

.

2012-09-10 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4115776201-3469524103-2955975275-1004Core.job

- c:\users\Altex\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-14 23:23]

.

2012-09-10 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4115776201-3469524103-2955975275-1004UA.job

- c:\users\Altex\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-14 23:23]

.

2013-04-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 08:39]

.

2013-04-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 08:39]

.

2013-04-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4115776201-3469524103-2955975275-1004Core1ce4104f30df511.job

- c:\users\Altex\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-29 22:28]

.

2013-04-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4115776201-3469524103-2955975275-1004UA.job

- c:\users\Altex\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-29 22:28]

.

2012-07-16 c:\windows\Tasks\McDefragTask.job

- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-10-28 23:32]

.

2012-07-01 c:\windows\Tasks\McQcTask.job

- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-10-28 23:32]

.

2013-04-24 c:\windows\Tasks\ReclaimerResumeInstallLogin_Altex.job

- c:\users\Altex\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\rnupgagent.exe [2013-04-24 19:00]

.

2013-04-24 c:\windows\Tasks\ReclaimerResumeInstall_Altex.job

- c:\users\Altex\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\rnupgagent.exe [2013-04-24 19:00]

.

2012-08-13 c:\windows\Tasks\SidebarExecute.job

- c:\program files\Windows Sidebar\sidebar.exe [2009-07-13 01:14]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=extensa_5635&r=27050210g706l03c3z295i49j5v24n

mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=extensa_5635&r=27050210g706l03c3z295i49j5v24n

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000

LSP: c:\windows\system32\PGPlsp.dll

TCP: DhcpNameServer = 192.168.1.254

FF - ProfilePath - c:\users\Altex\AppData\Roaming\Mozilla\Firefox\Profiles\9r0jd02t.default\

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=374563&p=

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

HKCU-Run-DW6 - c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe

HKCU-Run-EA Core - c:\program files\Electronic Arts\EADM\Core.exe

HKLM-Run-SelectRebates - c:\program files\SelectRebates\SelectRebates.exe

MSConfigStartUp-SynTPEnh - c:\program files\Synaptics\SynTP\SynTPEnh.exe

AddRemove-Logitech Touch Mouse Server - c:\users\Altex\AppData\Local\Temp\Logitech Touch Mouse Server\uninst.exe

AddRemove-pdfFactory - c:\windows\system32\spool\DRIVERS\W32X86\3\fppinst4.exe

AddRemove-Search Toolbar - c:\program files\Search Toolbar\SearchToolbarUninstall.exe

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MsDepSvc]

"ImagePath"="\"c:\program files\IIS\Microsoft Web Deploy\MsDepSvc.exe\" -runService:MsDepSvc"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2013-04-24 15:04:21

ComboFix-quarantined-files.txt 2013-04-24 20:04

.

Pre-Run: 6,031,564,800 bytes free

Post-Run: 8,059,596,800 bytes free

.

- - End Of File - - 1F48CB4A7E50CB2E8A4B031950445669

MaestroX101 · April 24, 2013

Well the computer blue screened after about 10 minutes, after I opened iTunes. Before it would blue screen before it would open, so I think there's some kind of progress lol That's really the only issue I noticed. There's no more random pop-ups, Chrome isn't telling me that each website is malicious anymore. The blue screen is the only persistent problem, though I do not know if it's related to the malware. I figured it was since the blue screens started when the malware appeared.

gringo_pr · April 24, 2013

Hello MaestroX101

I would like you to try and run these next.

TDSSKiller

Please download the latest version of TDSSKiller from here and save it to your Desktop.

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
Put a checkmark beside loaded modules.
A reboot will be needed to apply the changes. Do it.
TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
Then click on Change parameters in TDSSKiller.
Check all boxes then click OK.
Click the Start Scan button.
The scan should take no longer than 2 minutes.
If a suspicious object is detected, the default action will be Skip, click on Continue.
If malicious objects are found, they will show in the Scan results
Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.
Note** this report can be very long - so if the website gives you an error saying it is to long you may attache it
If the forum still complains about it being to long send me everything that is at the end of the report after where it says
==================
Scan finished
==================

and I will see if I want to see the whole report

Malwarebytes Anti-Rootkit

1.Download Malwarebytes Anti-Rootkit

2.Unzip the contents to a folder in a convenient location.

3.Open the folder where the contents were unzipped and run mbar.exe

4.Follow the instructions in the wizard to update and allow the program to scan your computer for threats.

5.Click on the Cleanup button to remove any threats and reboot if prompted to do so.

6.Wait while the system shuts down and the cleanup process is performed.

7.Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.

8.If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

•Internet access
•Windows Update
•Windows Firewall

9.If there are additional problems with your system, such as any of those listed above or other system issues, then run the 'fixdamage' tool included with Malwarebytes Anti-Rootkit and reboot.

10.Verify that your system is now functioning normally.

If you have any problems running either one come back and let me know

please reply with the reports from TDSSKiller and MBAR

Gringo

MaestroX101 · April 24, 2013

17:15:50.0543 4112 Scan finished

17:15:50.0543 4112 ============================================================

17:15:50.0575 5728 Detected object count: 7

17:15:50.0576 5728 Actual detected object count: 7

17:17:03.0369 5728 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user

17:17:03.0370 5728 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip

17:17:03.0372 5728 int15.sys ( UnsignedFile.Multi.Generic ) - skipped by user

17:17:03.0372 5728 int15.sys ( UnsignedFile.Multi.Generic ) - User select action: Skip

17:17:03.0376 5728 iPodDrv ( UnsignedFile.Multi.Generic ) - skipped by user

17:17:03.0376 5728 iPodDrv ( UnsignedFile.Multi.Generic ) - User select action: Skip

17:17:03.0380 5728 RS_Service ( UnsignedFile.Multi.Generic ) - skipped by user

17:17:03.0380 5728 RS_Service ( UnsignedFile.Multi.Generic ) - User select action: Skip

17:17:03.0383 5728 wampapache ( UnsignedFile.Multi.Generic ) - skipped by user

17:17:03.0383 5728 wampapache ( UnsignedFile.Multi.Generic ) - User select action: Skip

17:17:04.0276 5728 \Device\Harddisk0\DR0\# - copied to quarantine

17:17:04.0283 5728 \Device\Harddisk0\DR0 - copied to quarantine

17:17:05.0045 5728 \Device\Harddisk0\DR0\TDLFS\ldrm - copied to quarantine

17:17:05.0096 5728 \Device\Harddisk0\DR0\TDLFS\config.ini - copied to quarantine

17:17:05.0109 5728 \Device\Harddisk0\DR0\TDLFS\cmd.dll - copied to quarantine

17:17:05.0130 5728 \Device\Harddisk0\DR0\TDLFS\cmd64.dll - copied to quarantine

17:17:05.0150 5728 \Device\Harddisk0\DR0\TDLFS\sub.dll - copied to quarantine

17:17:05.0202 5728 \Device\Harddisk0\DR0\TDLFS\subx.dll - copied to quarantine

17:17:05.0227 5728 \Device\Harddisk0\DR0\TDLFS\drv32 - copied to quarantine

17:17:05.0251 5728 \Device\Harddisk0\DR0\TDLFS\drv64 - copied to quarantine

17:17:05.0269 5728 \Device\Harddisk0\DR0\TDLFS\servers.dat - copied to quarantine

17:17:05.0273 5728 \Device\Harddisk0\DR0\TDLFS\ldr16 - copied to quarantine

17:17:05.0278 5728 \Device\Harddisk0\DR0\TDLFS\ldr32 - copied to quarantine

17:17:05.0295 5728 \Device\Harddisk0\DR0\TDLFS\ldr64 - copied to quarantine

17:17:05.0312 5728 \Device\Harddisk0\DR0\TDLFS\s - copied to quarantine

17:17:05.0317 5728 \Device\Harddisk0\DR0\TDLFS\u - copied to quarantine

17:17:05.0331 5728 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine

17:17:05.0433 5728 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - will be cured on reboot

17:17:05.0465 5728 \Device\Harddisk0\DR0 - ok

17:17:06.0076 5728 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.c ) - User select action: Cure

17:17:06.0077 5728 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user

17:17:06.0077 5728 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip

17:17:20.0323 5644 Deinitialize success

Will download Anti-Rootkit now

MaestroX101 · April 25, 2013

I have a question. When I opened MBAR, it gave me this message:

"Registry value "AppInit_Dlls" has been found, which may be caused by rootkit activity.

Note: Press "No" button if you're not sure. If the tool crashes or terminates unexpectedly during a system scan, restart the tool and press "Yes" should this message appear again.

Do you want to remove this value and restart the tool?"

I pressed no, and during the scan, not only did MBAR detect this infection, but at the same moment, AVG detected it, but it listed it three times. When the scan was completed, I pressed cleanup, and upon starting MBAR again, it's giving me that same message. Before I run MBAR again, I would like to know if it's just going to be a cycle of the same thing and if another solution is possible, or if I should run MBAR once again.

gringo_pr · April 25, 2013

Hello

I would like you to rerun TDSSKiller and this time when it gets to this part

\Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
\Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip

I want you to select Delete this time instead of skip.

Gringo

MaestroX101 · April 25, 2013

0:48:50.0807 4884 Scan finished

20:48:50.0807 4884 ============================================================

20:48:50.0893 4876 Detected object count: 6

20:48:50.0893 4876 Actual detected object count: 6

20:50:37.0696 4876 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user

20:50:37.0696 4876 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip

20:50:37.0697 4876 int15.sys ( UnsignedFile.Multi.Generic ) - skipped by user

20:50:37.0697 4876 int15.sys ( UnsignedFile.Multi.Generic ) - User select action: Skip

20:50:37.0700 4876 iPodDrv ( UnsignedFile.Multi.Generic ) - skipped by user

20:50:37.0700 4876 iPodDrv ( UnsignedFile.Multi.Generic ) - User select action: Skip

20:50:37.0703 4876 RS_Service ( UnsignedFile.Multi.Generic ) - skipped by user

20:50:37.0703 4876 RS_Service ( UnsignedFile.Multi.Generic ) - User select action: Skip

20:50:37.0706 4876 wampapache ( UnsignedFile.Multi.Generic ) - skipped by user

20:50:37.0706 4876 wampapache ( UnsignedFile.Multi.Generic ) - User select action: Skip

20:50:37.0781 4876 \Device\Harddisk0\DR0\TDLFS\ldrm - copied to quarantine

20:50:37.0790 4876 \Device\Harddisk0\DR0\TDLFS\config.ini - copied to quarantine

20:50:38.0101 4876 \Device\Harddisk0\DR0\TDLFS\cmd.dll - copied to quarantine

20:50:38.0147 4876 \Device\Harddisk0\DR0\TDLFS\cmd64.dll - copied to quarantine

20:50:38.0175 4876 \Device\Harddisk0\DR0\TDLFS\sub.dll - copied to quarantine

20:50:38.0211 4876 \Device\Harddisk0\DR0\TDLFS\subx.dll - copied to quarantine

20:50:38.0245 4876 \Device\Harddisk0\DR0\TDLFS\drv32 - copied to quarantine

20:50:38.0280 4876 \Device\Harddisk0\DR0\TDLFS\drv64 - copied to quarantine

20:50:38.0308 4876 \Device\Harddisk0\DR0\TDLFS\servers.dat - copied to quarantine

20:50:38.0315 4876 \Device\Harddisk0\DR0\TDLFS\ldr16 - copied to quarantine

20:50:38.0324 4876 \Device\Harddisk0\DR0\TDLFS\ldr32 - copied to quarantine

20:50:38.0352 4876 \Device\Harddisk0\DR0\TDLFS\ldr64 - copied to quarantine

20:50:38.0377 4876 \Device\Harddisk0\DR0\TDLFS\s - copied to quarantine

20:50:38.0387 4876 \Device\Harddisk0\DR0\TDLFS\u - copied to quarantine

20:50:38.0403 4876 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine

20:50:38.0432 4876 \Device\Harddisk0\DR0\TDLFS - deleted

20:50:38.0432 4876 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Delete

20:51:30.0321 3352 Deinitialize success

Restarting MBAR now.

gringo_pr · April 25, 2013

Hello MaestroX101

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Please start by opening Notepad and copy/paste the text in the box into the window:

ClearJavaCache::

Save it to your desktop as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.

Restart if you have to.

Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following

report from Combofix
let me know of any problems you may have had
How is the computer doing now after running the script?

Gringo

MaestroX101 · April 25, 2013

In the blue command line screen, it gives me the error that "Windows cannot find 'NIRKMD' when trying to create a system restore point.

gringo_pr · April 25, 2013

Hello MaestroX101

Ok Give it a few minutes and if nothing happens then lets try this, I want you to run the combofix script in safe mode but it is very important that when combofix reboots the computer for you to direct it back into safe mode so it can finish the scan.

Boot into Safe Mode

Reboot your computer in Safe Mode.

If the computer is running, shut down Windows, and then turn off the power.
Wait 30 seconds, and then turn the computer on.
Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
Ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.
Login on your usual account.

Now run the script just like we did before

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window:

ClearJavaCache::

Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.

Restart if you have to.

Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following

report from Combofix
let me know of any problems you may have had
How is the computer doing now after running the script?

Gringo

MaestroX101 · April 25, 2013

I went ahead and rebooted and entered Safe Mode to run ComboFix. These are the results:

ComboFix 13-04-24.03 - Altex 04/24/2013 22:46:27.3.2 - x86 MINIMAL

Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3001.2086 [GMT -5:00]

Running from: c:\users\Altex\Desktop\ComboFix.exe

Command switches used :: c:\users\Altex\Desktop\CFScript.txt

AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

AV: McAfee VirusScan *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}

FW: McAfee Personal Firewall *Disabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}

SP: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: McAfee VirusScan *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\jestertb.dll

c:\windows\wininit.ini

.

((((((((((((((((((((((((( Files Created from 2013-03-25 to 2013-04-25 )))))))))))))))))))))))))))))))

.

2013-04-25 03:56 . 2013-04-25 03:56 -------- d-----w- c:\users\Altex\AppData\Local\temp

2013-04-25 03:56 . 2013-04-25 03:56 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp

2013-04-25 03:56 . 2013-04-25 03:56 -------- d-----w- c:\users\Mcx1-LXEEA03007-PC\AppData\Local\temp

2013-04-25 03:56 . 2013-04-25 03:56 -------- d-----w- c:\users\LX.EEA03.007\AppData\Local\temp

2013-04-25 03:56 . 2013-04-25 03:56 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-04-24 22:17 . 2013-04-25 01:50 -------- d-----w- C:\TDSSKiller_Quarantine

2013-04-24 16:01 . 2013-04-24 16:01 -------- d-----w- c:\program files\GUMF99.tmp

2013-04-24 15:43 . 2013-04-24 15:45 -------- d-----w- c:\program files\GUM561A.tmp

2013-04-24 15:43 . 2013-04-24 15:43 0 ----a-w- c:\program files\GUT561B.tmp

2013-04-24 03:26 . 2013-04-24 03:28 -------- d-----w- c:\program files\GUM49DB.tmp

2013-04-24 03:26 . 2013-04-24 03:26 0 ----a-w- c:\program files\GUT49DC.tmp

2013-04-24 03:23 . 2009-07-14 01:14 259072 ----a-w- c:\windows\system32\services.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-04-25 03:53 . 2012-07-27 14:46 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0DBFA5E5-FAC2-4D92-8BAA-B998B4416A20}\offreg.dll