unsure of what I have -"Unusual traffic from your computer network" notification

ivorybow · May 7, 2013

I am getting this Google and Yahoo warning "Our systems have detected unusual traffic from your computer network." I just ran a complete deep scan which took nearly 2 hours using the lasted updated Malware Bytes and got 0 detections. I have run Hijackthis and I have a log file but I do not know what I am looking at. Where can I go to get help?I am using Windows 7 and I keep Microsoft Security Essentials running and updated all the time.

Thanks

ivorybow · May 7, 2013

Sorry, just now found the pinned instructions and I am going through them now...will post results.

ivorybow · May 7, 2013

dds file

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 10.0.9200.16537

Run by Carolyn at 16:00:11 on 2013-05-07

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.3037.950 [GMT 3:00]

.

AV: Lavasoft Ad-Aware *Disabled/Updated* {E0D97DD4-42BA-B3F2-A5A7-22E9ACE81FC7}

AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Lavasoft Ad-Aware *Disabled/Updated* {5BB89C30-6480-BC7C-9F17-199BD76F557A}

SP: Spybot - Search and Destroy *Enabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}

FW: Lavasoft Ad-Aware *Disabled* {D8E2FCF1-08D5-B2AA-8EF8-8BDC523B58BC}

.

============== Running Processes ================

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe

C:\Program Files\ATKGFNEX\GFNEXSrv.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Program Files\ASUS\Wireless Console 3\wcourier.exe

C:\Program Files\ASUS\ATK Hotkey\HControl.exe

C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe

C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe

C:\Program Files\ASUS\ATK Media\DMedia.exe

C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Elantech\ETDCtrl.exe

C:\Program Files\Online Games Manager\ogmservice.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\ASUS\ATK Hotkey\WDC.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Windows\system32\wuauclt.exe

C:\Windows\system32\NOTEPAD.EXE

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Windows\system32\AUDIODG.EXE

C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe

C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe

C:\Program Files\adawaretb\ffHelper.exe

C:\ProgramData\Search Protection\SearchProtection.exe

C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe

C:\PROGRA~1\AD-AWA~1\AdAware.exe

C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Program Files\bfgclient\bfggameservices.exe

C:\Program Files\Puzzle Quest 2\PuzzleQuest2.exe

C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe

C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe

C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe

C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe

C:\Program Files\Spybot - Search & Destroy 2\SDWelcome.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k hpdevmgmt

C:\Windows\System32\svchost.exe -k HPZ12

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\System32\svchost.exe -k swprv

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://securesearch.lavasoft.com/?source=f439e2c0&tbp=homepage&toolbarid=adawaretb&v=2_5&u=DDDE830199165A0AA7D5F35188E9C61E

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>

BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll

BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy 2\SDHelper.dll

BHO: Ad-Aware Security Add-on: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - c:\program files\adawaretb\adawareDx.dll

BHO: LastPass Vault: {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - c:\users\carolyn\appdata\roaming\lastpass\LPToolbar.dll

BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

TB: LastPass Toolbar: {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - c:\users\carolyn\appdata\roaming\lastpass\LPToolbar.dll

TB: Ad-Aware Security Add-on: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - c:\program files\adawaretb\adawareDx.dll

EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrun

uRun: [GoogleChromeAutoLaunch_DFA48FDAA3B0A81D660EA553F2BCCD68] "c:\program files\google\chrome\application\chrome.exe" --no-startup-window

uRunOnce: [adawarebp] reg.exe delete "HKCU\Software\AppDataLow\Software\adawarebp" /f

uRunOnce: [adawarebp_XP] reg.exe delete "HKCU\Software\adawarebp" /f

mRun: [HDAudDeck] c:\program files\via\viaudioi\vdeck\VDeck.exe -r

mRun: [HControlUser] c:\program files\asus\atk hotkey\HControlUser.exe

mRun: [ATKMEDIA] c:\program files\asus\atk media\DMedia.exe

mRun: [AmIcoSinglun] c:\program files\amicosinglun\AmIcoSinglun.exe

mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [ETDWare] c:\program files\elantech\ETDCtrl.exe

mRun: [Ad-Aware Browsing Protection] "c:\programdata\ad-aware browsing protection\adawarebp.exe"

mRun: [searchProtection] c:\programdata\search protection\_run.bat

mRun: [Ad-Aware Antivirus] "c:\program files\ad-aware antivirus\AdAwareLauncher" --windows-run

mRun: [sDTray] "c:\program files\spybot - search & destroy 2\SDTray.exe"

StartupFolder: c:\users\carolyn\appdata\roaming\micros~1\windows\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: LastPass - c:\users\carolyn\appdata\locallow\lastpass\context.html?cmd=lastpass

IE: LastPass Fill Forms - c:\users\carolyn\appdata\locallow\lastpass\context.html?cmd=fillforms

IE: {43699cd0-e34f-11de-8a39-0800200c9a66} - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - c:\users\carolyn\appdata\roaming\lastpass\LPToolbar.dll

IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy 2\SDHelper.dll

TCP: NameServer = 192.168.1.1 192.168.1.1

TCP: Interfaces\{45410C67-2807-4B87-8423-60F8CDBCDE31} : DHCPNameServer = 192.168.1.1 192.168.1.1

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll

Notify: igfxcui - igfxdev.dll

Notify: SDWinLogon - SDWinLogon.dll

SSODL: WebCheck - <orphaned>

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\26.0.1410.64\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\carolyn\appdata\roaming\mozilla\firefox\profiles\3o0m498s.default\

FF - prefs.js: browser.startup.homepage - hxxp://google.com/ncr

FF - prefs.js: browser.search.selectedEngine - SecureSearch

FF - prefs.js: browser.startup.homepage - hxxp://securesearch.lavasoft.com/?source=f439e2c0&tbp=homepage&toolbarid=adawaretb&v=2_5&u=DDDE830199165A0AA7D5F35188E9C61E

FF - plugin: c:\program files\foxit software\foxit reader\plugins\npFoxitReaderPlugin.dll

FF - plugin: c:\program files\google\update\1.3.21.145\npGoogleUpdate3.dll

FF - plugin: c:\program files\microsoft silverlight\5.1.20125.0\npctrlui.dll

FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_7_700_169.dll

FF - ExtSQL: 2013-04-19 22:31; support@lastpass.com; c:\users\carolyn\appdata\roaming\mozilla\firefox\profiles\3o0m498s.default\extensions\support@lastpass.com

FF - ExtSQL: 2013-04-23 14:03; smartwebprinting@hp.com; c:\program files\hp\digital imaging\smart web printing\MozillaAddOn3

FF - ExtSQL: 2013-05-02 22:52; {6d96bb5e-1175-4ebf-8ab5-5f56f1c79f65}; c:\users\carolyn\appdata\roaming\mozilla\firefox\profiles\3o0m498s.default\extensions\{6d96bb5e-1175-4ebf-8ab5-5f56f1c79f65}.xpi

FF - ExtSQL: !HIDDEN! 2013-04-23 14:03; smartwebprinting@hp.com; c:\program files\hp\digital imaging\smart web printing\MozillaAddOn3

.

---- FIREFOX POLICIES ----

FF - user.js: yahoo.ytff.general.dontshowhpoffer - true

============= SERVICES / DRIVERS ===============

.

R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2013-1-20 195296]

R1 MpKsl17911bd6;MpKsl17911bd6;c:\programdata\microsoft\microsoft antimalware\definition updates\{c7653b03-3e24-4ebc-b7b6-3f5c52a8113d}\MpKsl17911bd6.sys [2013-5-7 29904]

R2 Ad-Aware Service;Ad-Aware Service;c:\program files\ad-aware antivirus\AdAwareService.exe [2013-3-18 1236336]

R2 ogmservice;Online Games Manager;c:\program files\online games manager\ogmservice.exe [2013-3-12 559168]

R2 SBAMSvc;Ad-Aware;c:\program files\ad-aware antivirus\SBAMSvc.exe [2012-9-20 3677000]

R2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files\spybot - search & destroy 2\SDFSSvc.exe [2013-5-7 1103392]

R2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files\spybot - search & destroy 2\SDUpdSvc.exe [2013-5-7 1369624]

R2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files\spybot - search & destroy 2\SDWSCSvc.exe [2013-5-7 168384]

R3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\drivers\ETD.sys [2013-3-29 94208]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2013-5-7 40776]

R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2013-2-28 1066496]

S0 gfibto;gfibto;c:\windows\system32\drivers\gfibto.sys [2013-5-7 13560]

S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-2-28 161384]

S3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.sys [2009-8-21 27136]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]

S3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-21 62464]

S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2013-1-20 100328]

S3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\NisSrv.exe [2013-1-27 295232]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-21 15872]

S3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\Synth3dVsc.sys [2010-11-21 77184]

S3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [2010-11-21 25600]

S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2010-11-21 52224]

S3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 27264]

S3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [2010-11-21 112640]

.

=============== Created Last 30 ================

.

2013-05-07 12:56:48 29904 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{c7653b03-3e24-4ebc-b7b6-3f5c52a8113d}\MpKsl17911bd6.sys

2013-05-07 12:54:26 -------- d-----w- c:\programdata\Spybot - Search & Destroy

2013-05-07 12:54:11 15224 ----a-w- c:\windows\system32\sdnclean.exe

2013-05-07 12:53:59 -------- d-----w- c:\program files\Spybot - Search & Destroy 2

2013-05-07 11:51:34 -------- d-----w- c:\users\carolyn\appdata\roaming\LavasoftStatistics

2013-05-07 11:51:34 -------- d-----w- c:\programdata\Ad-Aware Antivirus

2013-05-07 11:49:04 -------- d-----w- c:\program files\Ad-Aware Antivirus

2013-05-07 11:48:33 -------- d-----w- c:\programdata\Downloaded Installations

2013-05-07 11:48:17 -------- d-----w- c:\programdata\Search Protection

2013-05-07 11:48:14 -------- d-----w- c:\programdata\blekko toolbars

2013-05-07 11:48:14 -------- d-----w- c:\programdata\adawaretb

2013-05-07 11:48:13 -------- d-----w- c:\users\carolyn\appdata\local\adawarebp

2013-05-07 11:48:10 -------- d-----w- c:\programdata\Ad-Aware Browsing Protection

2013-05-07 11:47:53 -------- d-----w- c:\program files\Toolbar Cleaner

2013-05-07 11:47:17 -------- d-----w- c:\program files\adawaretb

2013-05-07 11:44:16 44424 ----a-w- c:\windows\system32\sbbd.exe

2013-05-07 11:44:16 13560 ----a-w- c:\windows\system32\drivers\gfibto.sys

2013-05-07 11:44:13 -------- d-----w- c:\users\carolyn\appdata\roaming\Ad-Aware Antivirus

2013-05-07 11:06:55 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2013-05-06 09:54:22 6906960 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{c7653b03-3e24-4ebc-b7b6-3f5c52a8113d}\mpengine.dll

2013-05-04 23:58:01 6906960 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll

2013-05-02 22:20:48 -------- d-----w- c:\windows\Enigma Agency - The Case of Shadows Collectors Edition

2013-05-01 21:45:32 -------- d-----w- c:\program files\Resonance Demo

2013-05-01 21:00:17 -------- d-----w- c:\programdata\Meridian93

2013-05-01 20:34:15 -------- d-----w- c:\users\carolyn\appdata\roaming\Meridian93

2013-04-25 17:39:06 965120 ----a-w- c:\windows\system32\ac3filter.acm

2013-04-25 17:39:05 -------- d-----w- c:\program files\AC3Filter

2013-04-24 23:52:15 -------- d-----w- c:\windows\pss

2013-04-24 22:58:04 2706432 ----a-w- c:\windows\system32\mshtml.tlb

2013-04-24 22:58:03 217600 ----a-w- c:\program files\internet explorer\sqmapi.dll

2013-04-24 22:58:02 61440 ----a-w- c:\windows\system32\iesetup.dll

2013-04-24 22:58:02 2877440 ----a-w- c:\windows\system32\jscript9.dll

2013-04-24 22:58:01 257536 ----a-w- c:\program files\internet explorer\ieproxy.dll

2013-04-24 22:58:00 235520 ----a-w- c:\program files\internet explorer\IEShims.dll

2013-04-24 22:57:59 71680 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe

2013-04-24 22:57:59 109056 ----a-w- c:\windows\system32\iesysprep.dll

2013-04-24 22:57:57 817664 ----a-w- c:\program files\common files\microsoft shared\vgx\VGX.dll

2013-04-24 22:57:56 770608 ----a-w- c:\program files\internet explorer\iexplore.exe

2013-04-24 22:57:56 1766912 ----a-w- c:\windows\system32\wininet.dll

2013-04-24 22:55:25 -------- d-----w- c:\program files\MSXML 4.0

2013-04-24 22:54:51 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys

2013-04-24 22:54:50 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys

2013-04-24 22:54:46 3217408 ----a-w- c:\windows\system32\mstscax.dll

2013-04-24 22:54:45 36864 ----a-w- c:\windows\system32\tsgqec.dll

2013-04-24 22:54:45 131584 ----a-w- c:\windows\system32\aaclient.dll

2013-04-24 22:54:42 2347008 ----a-w- c:\windows\system32\win32k.sys

2013-04-24 22:54:35 196328 ----a-w- c:\windows\system32\drivers\fvevol.sys

2013-04-24 22:54:28 3968856 ----a-w- c:\windows\system32\ntkrnlpa.exe

2013-04-24 22:54:28 3913560 ----a-w- c:\windows\system32\ntoskrnl.exe

2013-04-24 22:54:27 69632 ----a-w- c:\windows\system32\smss.exe

2013-04-24 22:54:27 38912 ----a-w- c:\windows\system32\csrsrv.dll

2013-04-24 20:23:19 -------- d-----w- c:\users\carolyn\appdata\roaming\GhostElisaCameron

2013-04-24 20:21:57 -------- d-----w- c:\programdata\Trymedia

2013-04-24 20:21:54 -------- d-----w- c:\program files\Online Games Manager

2013-04-24 20:15:58 -------- d-----w- C:\GameHouse Games

2013-04-24 20:15:36 -------- d-----w- c:\program files\RealArcade

2013-04-24 09:48:50 706640 ------w- c:\programdata\microsoft\microsoft antimalware\definition updates\{fb2f4db6-2290-456f-92a3-0c78e15e4efb}\gapaengine.dll

2013-04-23 16:43:56 -------- d-----w- c:\program files\Ergo Romanian

2013-04-23 16:42:59 -------- d-----w- c:\program files\common files\Wise Installation Wizard

2013-04-23 11:06:28 -------- d-----w- c:\programdata\WEBREG

2013-04-23 11:05:22 280064 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\hpzppw71.dll

2013-04-23 11:01:42 -------- d-----w- c:\program files\common files\HP

2013-04-23 11:01:17 -------- d-----w- c:\program files\common files\Hewlett-Packard

2013-04-23 11:00:41 -------- d-----w- c:\program files\HP

2013-04-23 10:57:55 729088 ----a-w- c:\windows\system32\hpowiax7.dll

2013-04-23 10:57:55 452408 ----a-w- c:\windows\system32\hpzids01.dll

2013-04-23 10:57:55 372736 ----a-w- c:\windows\system32\hppldcoi.dll

2013-04-23 10:57:54 581632 ----a-w- c:\windows\system32\hpotscl6.dll

2013-04-23 10:57:54 303104 ----a-w- c:\windows\system32\hpovst15.dll

2013-04-19 19:30:48 -------- d-----w- c:\users\carolyn\appdata\roaming\LastPass

2013-04-17 21:40:49 -------- d-----w- c:\users\carolyn\appdata\roaming\Systweak

2013-04-17 21:00:17 -------- d-----w- C:\output

2013-04-17 16:02:35 -------- d-----w- c:\users\carolyn\appdata\roaming\DikobrazGames

2013-04-15 10:19:54 -------- d-----w- c:\users\carolyn\appdata\local\Apple Computer

2013-04-15 10:19:47 26840 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2013-04-15 10:19:08 -------- d-----w- c:\program files\iPod

2013-04-15 10:19:07 -------- d-----w- c:\programdata\188F1432-103A-4ffb-80F1-36B633C5C9E1

2013-04-15 10:19:07 -------- d-----w- c:\program files\iTunes

2013-04-15 10:18:04 -------- d-----w- c:\program files\Bonjour

2013-04-14 09:43:17 -------- d-----w- c:\users\carolyn\appdata\roaming\Foxit Software

2013-04-13 15:38:56 -------- d-----w- c:\users\carolyn\appdata\roaming\KompoZer

2013-04-12 17:35:40 -------- d-----w- c:\program files\Citrix

2013-04-11 12:48:24 -------- d-----w- c:\users\carolyn\appdata\roaming\ScummVM

2013-04-11 11:25:28 -------- d-----w- C:\GOG Games

2013-04-10 12:39:30 -------- d-----w- c:\program files\Yahoo!

2013-04-09 18:44:54 -------- d-----w- c:\windows\Carol Reed 9 - Cold Case Summer

2013-04-09 18:44:54 -------- d-----w- c:\program files\Carol Reed 9 - Cold Case Summer

2013-04-09 12:08:03 -------- d-----w- c:\windows\Dreamscapes - The Sandman Premium Edition

2013-04-08 15:31:00 -------- d-----w- c:\users\carolyn\appdata\roaming\ShamanGS

.

==================== Find3M ====================

.

2013-05-02 15:28:50 238872 ------w- c:\windows\system32\MpSigStub.exe

2013-04-12 07:23:49 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-04-12 07:23:49 691592 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-04-04 11:50:32 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-03-16 20:59:30 202149 ----a-w- c:\windows\XHeader Uninstaller.exe

2013-02-12 04:48:31 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll

2013-02-12 04:48:26 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll

.

============= FINISH: 16:00:25.58 ===============

Attach file

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Ultimate

Boot Device: \Device\HarddiskVolume1

Install Date: 2/28/2013 8:32:50 PM

System Uptime: 5/7/2013 11:13:54 AM (5 hours ago)

.

Motherboard: ASUSTeK Computer Inc. | | K50IJ

Processor: Celeron® Dual-Core CPU T3000 @ 1.80GHz | Socket 478 | 1795/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 49 GiB total, 13.515 GiB free.

D: is FIXED (NTFS) - 184 GiB total, 43.147 GiB free.

E: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP138: 5/6/2013 12:53:58 PM - Windows Update

.

==== Installed Programs ======================

.

32 Bit HP CIO Components Installer

AC3Filter 2.5b

Ad-Aware Antivirus

Ad-Aware Security Add-on

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Alcor Micro USB Card Reader

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ATK Generic Function Service

ATK Hotkey

ATK Media

Big Fish Games: Game Manager

BitTorrent

Bonjour

BufferChm

calibre

Carol Reed 9 - Cold Case Summer

Copy

Destinations

DeviceDiscovery

DJ_AIO_03_F4200_Software_Min

Elisa Cameron - Ghost

Ergo Romanian 2.1

ETDWare PS/2-x86 7.0.5.9_WHQL

F4200

FileZilla Client 3.6.0.2

Foxit Reader

GIMP 2.8.4

GOG.com Downloader version 3.4.8

GOM Player

Google Chrome

Google Update Helper

GoToMeeting 5.5.0.1132

GPBaseService2

Half-Life

Half-Life: Blue Shift

Half-Life: Opposing Force

Half-Life: Source

HMA! Pro VPN 2.7.1.7

HP Deskjet F4200 All-In-One Driver Software 13.0 Rel. 3

HP Imaging Device Functions 13.0

HP Smart Web Printing 4.51

HP Solution Center 13.0

HP Update

HPPhotoGadget

HPProductAssistant

Instant Eyedropper 1.75

Intel® Graphics Media Accelerator Driver

Intel® TV Wizard

IrfanView (remove only)

iTunes

KindlePreviewer

LastPass(uninstall only)

Lure of the Temptress

Malwarebytes Anti-Malware version 1.75.0.1300

Microsoft Security Client

Microsoft Security Essentials

Microsoft Silverlight

Microsoft Visual C++ 2005 Redistributable

Mozilla Firefox 20.0.1 (x86 en-US)

MSXML 4.0 SP2 (KB954430)

Octoshape add-in for Adobe Flash Player

Online Games Manager v1.20

OpenOffice.org 3.4.1

PhotoScape

Platform

Puzzle Quest 2

QuickTime

Resonance Demo version 1.0

Revo Uninstaller 1.94

Scan

Silent Scream II - the Bride

Skype™ 6.3

SmartWebPrinting

SolutionCenter

Spybot - Search & Destroy

Status

Steam

The Sims Complete Collection

Toolbox

TrayApp

UnloadSupport

USB 2.0 1.3M UVC WebCam

VIA Platform Device Manager

WebReg

WinRAR 4.20 (32-bit)

Wireless Console 3

Worlds of Ultima - Martian Dreams

XHeader

Yahoo! Messenger

.

==== Event Viewer Messages From Past Week ========

.

5/4/2013 12:16:22 PM, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.

5/3/2013 7:10:47 PM, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

.

==== End Of File ===========================

MrCharlie · May 7, 2013

Welcome to the forum.

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller 32 Bit to your desktop.

RogueKiller 64 Bit <---use this one for 64 bit systems

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes)

P2P Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

MrC

Note:

Please read all of my instructions completely including these.

Make sure you're subscribed to this topic:

Click on the

Follow This Topic Button

(at the top right of this page), make sure that the

Receive notification

box is checked and that it is set to

Instantly

Removing malware can be unpredictable

...things can go very wrong!

Backup

any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>Please stick with me until I give you the "all clear" and

Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

ivorybow · May 7, 2013

dds.txt

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 10.0.9200.16537

Run by Carolyn at 16:19:28 on 2013-05-07

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.3037.924 [GMT 3:00]