Another victim to FBI Moneypak...

[stevemartin83]

I woke up this morning to the famed FBI Moneypak virus/malware on my computer and am completely beat. I have spent the day exploring every option I could find and none work. All 3 safe modes are blocked and I also tried using HitmanPro Kickstart. It opened and scanned as advertised. It restarted my computer as advertised. And the virus was still going full force with no change, not as advertised. I really don't know what else to do, aside from a complete system wipe and restore, which I don't want to do. I'm running Windows 7 64-bit and really need some help, this virus/malware is kicking my butt!

[MrCharlie]

Welcome to the forum, here's how we deal with that malware:

1. Please download Farbar Recovery Scan Tool and save it to a flash drive.
   Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
   Plug the flash drive into the infected PC.
   
2. If you are using Windows 8 consult How to use the Windows 8 System Recovery Environment Command Prompt to enter System Recovery Command prompt.
   If you are using Vista or Windows 7 enter System Recovery Options.
   To enter System Recovery Options from the Advanced Boot Options:
   
   • Restart the computer.
     
   • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
     
   • Use the arrow keys to select the Repair your computer menu item.
     
   • Select US as the keyboard language settings, and then click Next.
     
   • Select the operating system you want to repair, and then click Next.
     
   • Select your user account an click Next.

Note: In case you can not enter System Recovery Options by using F8 method, you can use Windows installation disc, or make a repair disc. Any Windows installation disc or a repair disc made on another computer can be used.

To make a repair disk on Windows 7 consult: http://www.sevenforums.com/tutorials/2083-system-repair-disc-create.html

To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
  
• Restart your computer.
  
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  
• Click Repair your computer.
  
• Select US as the keyboard language settings, and then click Next.
  
• Select the operating system you want to repair, and then click Next.
  
• Select your user account and click Next.

[*]On the System Recovery Options menu you will get the following options:

• • 
    Startup Repair
    System Restore
    Windows Complete PC Restore
    Windows Memory Diagnostic Tool
    Command Prompt
    Select Command Prompt
    Once in the Command Prompt:

[*]In the command window type in notepad and press Enter.

[*]The notepad opens. Under File menu select Open.

[*]Select "Computer" and find your flash drive letter and close the notepad.

[*]In the command window type e:\frst (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.

[*]The tool will start to run.

[*]When the tool opens click Yes to disclaimer.

[*]Press Scan button.

[*]It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

MrC

[stevemartin83]

Sorry it took so long to get back, hard to find computer access without another computer. Anyway, I think this is what I'm supposed to provide.

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-05-2013

Ran by SYSTEM on 08-05-2013 20:28:42

Running from H:\

Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)

Internet Explorer Version 9

Boot Mode: Recovery

The current controlset is ControlSet001

ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\mssecex.exe" -hide -runkey [x]

HKLM\...\Run: [AtherosBtStack] "C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe" [1014432 2011-12-29] (Atheros Commnucations)

HKLM\...\Run: [AthBtTray] "C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe" [800416 2011-12-29] (Atheros Commnucations)

HKLM\...\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s [6457960 2011-12-23] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /MAXX4 [1156712 2011-11-15] (Realtek Semiconductor)

HKLM\...\Winlogon: [shell] regsvr32 /n /i /s "C:\Users\Owner\AppData\Local\ztfriln.fdp" [x ] ()

HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] ATTENTION! ====> ZeroAccess

HKLM-x32\...\Run: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)

HKLM-x32\...\Run: [uSB3MON] "C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [291608 2012-02-16] (Intel Corporation)

HKLM-x32\...\Run: [shwiconXP9106] C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe [237568 2010-03-10] (Alcor Micro Corp.)

HKLM-x32\...\Run: [Dell Registration] C:\Program Files (x86)\System Registration\prodreg.exe /boot [4165440 2011-08-04] (Dell, Inc.)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [38112 2012-12-18] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [946352 2012-12-02] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Lachesis] C:\Program Files (x86)\Razer\Lachesis\razerhid.exe [172032 2007-09-12] ()

HKLM-x32\...\Run: [Tarantula] C:\Program Files (x86)\Razer\Tarantula\razerhid.exe [176128 2006-09-30] ()

HKLM-x32\...\Run: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml [20992 2012-03-19] ()

HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-01-28] (Apple Inc.)

HKLM-x32\...\Run: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [642216 2012-08-06] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)

HKLM-x32\...\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)

HKLM-x32\...\Run: [] [x]

HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-02-18] (Apple Inc.)

HKLM-x32\...\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.)

HKU\Owner\...\Run: [HP Photosmart 6520 series (NET)] "C:\Program Files\HP\HP Photosmart 6520 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN291151TM05TZ:NW" -scfn "HP Photosmart 6520 series (NET)" -AutoStart 1 [2573416 2012-10-17] (Hewlett-Packard Co.)

Startup: C:\ProgramData\Start Menu\Programs\Startup\CodecPackTrayMenu.lnk

ShortcutTarget: CodecPackTrayMenu.lnk -> C:\Windows\SysWOW64\C2MP\TrayMenu.exe ()

Startup: C:\ProgramData\Start Menu\Programs\Startup\CodecPackUpdateChecker.lnk

ShortcutTarget: CodecPackUpdateChecker.lnk -> C:\Windows\SysWOW64\C2MP\UpdateChecker.exe ()

Startup: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()

Startup: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Photosmart 6520 series (Network).lnk

ShortcutTarget: Monitor Ink Alerts - HP Photosmart 6520 series (Network).lnk -> C:\Program Files\HP\HP Photosmart 6520 series\bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Services (Whitelisted) =================

S2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [109352 2013-05-07] (SurfRight B.V.)

S2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [128280 2012-01-21] ()

S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22056 2013-01-27] (Microsoft Corporation)

S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [379360 2013-01-27] (Microsoft Corporation)

S2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2012-12-04] ()

S2 ZAtheros Wlan Agent; C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe [76960 2011-12-26] (Atheros)

==================== Drivers (Whitelisted) ====================

S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [230320 2013-01-20] (Microsoft Corporation)

S2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [130008 2013-01-20] (Microsoft Corporation)

S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2013-01-12] ()

S3 VaneFltr; C:\Windows\System32\drivers\Lachesis.sys [30336 2007-08-17] (Razer (Asia-Pacific) Pte Ltd)

S3 motandroidusb; System32\Drivers\motoandroid.sys [x]

S3 PCDSRVC{1E208CE0-FB7451FF-06020200}_0; \??\c:\program files\dell support center\pcdsrvc_x64.pkms [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-05-07 12:52 - 2013-05-07 12:52 - 00000000 ____D C:\FRST

2013-05-07 12:12 - 2013-05-07 12:12 - 00012872 ____A (SurfRight B.V.) C:\Windows\System32\bootdelete.exe

2013-05-07 12:06 - 2013-05-07 12:20 - 00001823 ____A C:\Users\Public\Desktop\HitmanPro.lnk

2013-05-07 12:06 - 2013-05-07 12:20 - 00001823 ____A C:\ProgramData\Desktop\HitmanPro.lnk

2013-05-07 12:06 - 2013-05-07 12:12 - 00000000 ____D C:\ProgramData\HitmanPro

2013-05-07 12:06 - 2013-05-07 12:12 - 00000000 ____D C:\ProgramData\Application Data\HitmanPro

2013-05-07 12:06 - 2013-05-07 12:06 - 00000000 ____D C:\Program Files\HitmanPro

2013-05-07 07:04 - 2013-05-07 07:04 - 00055808 ____A C:\Users\Owner\Local Settings\ztfriln.fdp

2013-05-07 07:04 - 2013-05-07 07:04 - 00055808 ____A C:\Users\Owner\Local Settings\Application Data\ztfriln.fdp

2013-05-07 07:04 - 2013-05-07 07:04 - 00055808 ____A C:\Users\Owner\AppData\Local\ztfriln.fdp

2013-05-07 07:04 - 2013-05-07 07:04 - 00055808 ____A C:\ProgramData\pqmxqchx.fmf

2013-05-07 07:04 - 2013-05-07 07:04 - 00055808 ____A C:\ProgramData\Application Data\pqmxqchx.fmf

2013-05-05 16:31 - 2013-05-04 18:30 - 735027200 ____A C:\Users\Owner\Desktop\28 Days Later.avi

2013-04-24 13:51 - 2013-04-12 06:45 - 01656680 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys

2013-04-18 14:38 - 2013-04-18 14:38 - 00039904 ____A C:\Windows\SysWOW64\Media Player - Codec Pack Disc handler.exe

2013-04-18 14:38 - 2013-04-18 14:38 - 00039904 ____A C:\Windows\SysWOW64\dischandler.exe

2013-04-16 13:34 - 2013-04-16 13:34 - 00000000 ____D C:\Windows\SysWOW64\C2MP

2013-04-16 13:28 - 2013-04-16 13:28 - 00000000 ____D C:\ProgramData\Windows Genuine Advantage

2013-04-16 13:28 - 2013-04-16 13:28 - 00000000 ____D C:\ProgramData\Application Data\Windows Genuine Advantage

2013-04-16 02:40 - 2013-04-16 02:40 - 04012544 ____A C:\Windows\System32\ffmpeg.dll

2013-04-16 02:39 - 2013-04-16 02:39 - 04372992 ____A C:\Windows\System32\ffdshow.ax

2013-04-16 02:39 - 2013-04-16 02:39 - 00127488 ____A C:\Windows\System32\ff_vfw.dll

2013-04-16 02:38 - 2013-04-16 02:38 - 00474624 ____A C:\Windows\System32\ff_kernelDeint.dll

2013-04-16 02:37 - 2013-04-16 02:37 - 01532928 ____A C:\Windows\System32\ff_samplerate.dll

2013-04-16 02:37 - 2013-04-16 02:37 - 00631296 ____A C:\Windows\System32\TomsMoComp_ff.dll

2013-04-16 02:37 - 2013-04-16 02:37 - 00222720 ____A C:\Windows\System32\ff_libdts.dll

2013-04-16 02:37 - 2013-04-16 02:37 - 00190464 ____A C:\Windows\System32\libmpeg2_ff.dll

2013-04-16 02:37 - 2013-04-16 02:37 - 00183296 ____A C:\Windows\System32\ff_unrar.dll

2013-04-16 02:37 - 2013-04-16 02:37 - 00156672 ____A C:\Windows\System32\ff_libmad.dll

2013-04-16 02:37 - 2013-04-16 02:37 - 00116224 ____A C:\Windows\System32\ff_liba52.dll

2013-04-16 02:37 - 2013-04-16 02:37 - 00114688 ____A C:\Windows\System32\ff_wmv9.dll

2013-04-16 02:35 - 2013-04-16 02:35 - 03915776 ____A C:\Windows\SysWOW64\ffmpeg.dll

2013-04-16 02:33 - 2013-04-16 02:33 - 03501568 ____A C:\Windows\SysWOW64\ffdshow.ax

2013-04-16 02:33 - 2013-04-16 02:33 - 00112640 ____A C:\Windows\SysWOW64\ff_vfw.dll

2013-04-16 02:32 - 2013-04-16 02:32 - 01525760 ____A C:\Windows\SysWOW64\ff_samplerate.dll

2013-04-16 02:32 - 2013-04-16 02:32 - 00271360 ____A C:\Windows\SysWOW64\TomsMoComp_ff.dll

2013-04-16 02:32 - 2013-04-16 02:32 - 00211968 ____A C:\Windows\SysWOW64\ff_libdts.dll

2013-04-16 02:32 - 2013-04-16 02:32 - 00157184 ____A C:\Windows\SysWOW64\ff_unrar.dll

2013-04-16 02:32 - 2013-04-16 02:32 - 00147456 ____A C:\Windows\SysWOW64\ff_libmad.dll

2013-04-16 02:32 - 2013-04-16 02:32 - 00136704 ____A C:\Windows\SysWOW64\libmpeg2_ff.dll

2013-04-16 02:32 - 2013-04-16 02:32 - 00114688 ____A C:\Windows\SysWOW64\ff_liba52.dll

2013-04-16 02:32 - 2013-04-16 02:32 - 00099840 ____A C:\Windows\SysWOW64\ff_wmv9.dll

2013-04-13 04:24 - 2013-04-13 04:24 - 07977200 ____A C:\Windows\System32\avcodec-lav-55.dll

2013-04-13 04:24 - 2013-04-13 04:24 - 01515520 ____A (1f0.de - Hendrik Leppkes) C:\Windows\System32\LAVVideo.ax

2013-04-13 04:24 - 2013-04-13 04:24 - 01245920 ____A C:\Windows\System32\avformat-lav-55.dll

2013-04-13 04:24 - 2013-04-13 04:24 - 00509952 ____A (1f0.de - Hendrik Leppkes) C:\Windows\System32\LAVSplitter.ax

2013-04-13 04:24 - 2013-04-13 04:24 - 00421600 ____A C:\Windows\System32\swscale-lav-2.dll

2013-04-13 04:24 - 2013-04-13 04:24 - 00364720 ____A (Intel Corp.) C:\Windows\System32\IntelQuickSyncDecoder.dll

2013-04-13 04:24 - 2013-04-13 04:24 - 00289008 ____A C:\Windows\System32\avutil-lav-52.dll

2013-04-13 04:24 - 2013-04-13 04:24 - 00272384 ____A (1f0.de - Hendrik Leppkes) C:\Windows\System32\LAVAudio.ax

2013-04-13 04:24 - 2013-04-13 04:24 - 00202648 ____A C:\Windows\System32\avfilter-lav-3.dll

2013-04-13 04:24 - 2013-04-13 04:24 - 00194016 ____A C:\Windows\System32\avresample-lav-1.dll

2013-04-13 04:23 - 2013-04-13 04:23 - 07788672 ____A C:\Windows\SysWOW64\avcodec-lav-55.dll

2013-04-13 04:23 - 2013-04-13 04:23 - 01300152 ____A C:\Windows\SysWOW64\avformat-lav-55.dll

2013-04-13 04:23 - 2013-04-13 04:23 - 01185456 ____A (1f0.de - Hendrik Leppkes) C:\Windows\SysWOW64\LAVVideo.ax

2013-04-13 04:23 - 2013-04-13 04:23 - 00424624 ____A (1f0.de - Hendrik Leppkes) C:\Windows\SysWOW64\LAVSplitter.ax

2013-04-13 04:23 - 2013-04-13 04:23 - 00400592 ____A C:\Windows\SysWOW64\swscale-lav-2.dll

2013-04-13 04:23 - 2013-04-13 04:23 - 00284336 ____A (Intel Corp.) C:\Windows\SysWOW64\IntelQuickSyncDecoder.dll

2013-04-13 04:23 - 2013-04-13 04:23 - 00272192 ____A C:\Windows\SysWOW64\avutil-lav-52.dll

2013-04-13 04:23 - 2013-04-13 04:23 - 00244400 ____A (1f0.de - Hendrik Leppkes) C:\Windows\SysWOW64\LAVAudio.ax

2013-04-13 04:23 - 2013-04-13 04:23 - 00194632 ____A C:\Windows\SysWOW64\avfilter-lav-3.dll

2013-04-13 04:23 - 2013-04-13 04:23 - 00172728 ____A C:\Windows\SysWOW64\avresample-lav-1.dll

2013-04-10 23:01 - 2013-02-21 02:30 - 01766912 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-04-10 23:01 - 2013-02-21 02:30 - 01129984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-04-10 23:01 - 2013-02-21 02:29 - 14323200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-04-10 23:01 - 2013-02-21 02:29 - 13761024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-04-10 23:01 - 2013-02-21 02:29 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-04-10 23:01 - 2013-02-21 02:29 - 02046464 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-04-10 23:01 - 2013-02-21 02:29 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-04-10 23:01 - 2013-02-21 02:29 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-04-10 23:01 - 2013-02-21 02:29 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-04-10 23:01 - 2013-02-21 02:29 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-04-10 23:01 - 2013-02-21 02:29 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-04-10 23:01 - 2013-02-21 02:29 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-04-10 23:01 - 2013-02-21 02:29 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-04-10 23:01 - 2013-02-21 02:15 - 02240512 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll

2013-04-10 23:01 - 2013-02-21 02:15 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe

2013-04-10 23:01 - 2013-02-21 02:14 - 19230208 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2013-04-10 23:01 - 2013-02-21 02:14 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2013-04-10 23:01 - 2013-02-21 02:14 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2013-04-10 23:01 - 2013-02-21 02:14 - 02647040 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2013-04-10 23:01 - 2013-02-21 02:14 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2013-04-10 23:01 - 2013-02-21 02:14 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll

2013-04-10 23:01 - 2013-02-21 02:14 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll

2013-04-10 23:01 - 2013-02-21 02:14 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2013-04-10 23:01 - 2013-02-21 02:14 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll

2013-04-10 23:01 - 2013-02-21 02:14 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll

2013-04-10 23:01 - 2013-02-21 02:14 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2013-04-10 23:01 - 2013-02-21 02:14 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll

2013-04-10 23:01 - 2013-02-19 04:01 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-04-10 23:01 - 2013-02-19 03:42 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2013-04-10 23:01 - 2013-02-19 03:10 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-04-10 23:01 - 2013-02-19 02:51 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe

2013-04-10 11:03 - 2013-03-18 22:04 - 05550424 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe

2013-04-10 11:03 - 2013-03-18 21:46 - 00043520 ____A (Microsoft Corporation) C:\Windows\System32\csrsrv.dll

2013-04-10 11:03 - 2013-03-18 21:04 - 03968856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2013-04-10 11:03 - 2013-03-18 21:04 - 03913560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2013-04-10 11:03 - 2013-03-18 20:47 - 00006656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll

2013-04-10 11:03 - 2013-03-18 19:06 - 00112640 ____A (Microsoft Corporation) C:\Windows\System32\smss.exe

2013-04-10 11:03 - 2013-02-28 19:36 - 03153408 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys

2013-04-10 11:03 - 2013-01-23 22:01 - 00223752 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\fvevol.sys

==================== One Month Modified Files and Folders =======

2013-05-07 13:35 - 2012-04-24 08:54 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup

2013-05-07 13:35 - 2012-04-24 08:49 - 00000828 ____A C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job

2013-05-07 13:35 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2013-05-07 13:35 - 2009-07-13 20:51 - 00142845 ____A C:\Windows\setupact.log

2013-05-07 12:52 - 2013-05-07 12:52 - 00000000 ____D C:\FRST

2013-05-07 12:31 - 2012-04-24 08:34 - 01879788 ____A C:\Windows\WindowsUpdate.log

2013-05-07 12:27 - 2009-07-13 20:45 - 00021296 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-05-07 12:27 - 2009-07-13 20:45 - 00021296 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-05-07 12:26 - 2012-04-24 08:35 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-05-07 12:25 - 2009-07-13 21:13 - 00779788 ____A C:\Windows\System32\PerfStringBackup.INI

2013-05-07 12:20 - 2013-05-07 12:06 - 00001823 ____A C:\Users\Public\Desktop\HitmanPro.lnk

2013-05-07 12:20 - 2013-05-07 12:06 - 00001823 ____A C:\ProgramData\Desktop\HitmanPro.lnk

2013-05-07 12:20 - 2012-04-24 09:06 - 00000000 ____D C:\Users\Default\Local Settings\SoftThinks

2013-05-07 12:20 - 2012-04-24 09:06 - 00000000 ____D C:\Users\Default\Local Settings\Application Data\SoftThinks

2013-05-07 12:20 - 2012-04-24 09:06 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks

2013-05-07 12:20 - 2012-04-24 09:06 - 00000000 ____D C:\Users\Default User\Local Settings\SoftThinks

2013-05-07 12:20 - 2012-04-24 09:06 - 00000000 ____D C:\Users\Default User\Local Settings\Application Data\SoftThinks

2013-05-07 12:20 - 2012-04-24 09:06 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks

2013-05-07 12:12 - 2013-05-07 12:12 - 00012872 ____A (SurfRight B.V.) C:\Windows\System32\bootdelete.exe

2013-05-07 12:12 - 2013-05-07 12:06 - 00000000 ____D C:\ProgramData\HitmanPro

2013-05-07 12:12 - 2013-05-07 12:06 - 00000000 ____D C:\ProgramData\Application Data\HitmanPro

2013-05-07 12:06 - 2013-05-07 12:06 - 00000000 ____D C:\Program Files\HitmanPro

2013-05-07 08:10 - 2012-07-09 11:25 - 00000000 ____D C:\users\Owner

2013-05-07 07:04 - 2013-05-07 07:04 - 00055808 ____A C:\Users\Owner\Local Settings\ztfriln.fdp

2013-05-07 07:04 - 2013-05-07 07:04 - 00055808 ____A C:\Users\Owner\Local Settings\Application Data\ztfriln.fdp

2013-05-07 07:04 - 2013-05-07 07:04 - 00055808 ____A C:\Users\Owner\AppData\Local\ztfriln.fdp

2013-05-07 07:04 - 2013-05-07 07:04 - 00055808 ____A C:\ProgramData\pqmxqchx.fmf

2013-05-07 07:04 - 2013-05-07 07:04 - 00055808 ____A C:\ProgramData\Application Data\pqmxqchx.fmf

2013-05-07 06:54 - 2012-08-29 19:26 - 00000000 ____D C:\Users\Owner\Local Settings\Deployment

2013-05-07 06:54 - 2012-08-29 19:26 - 00000000 ____D C:\Users\Owner\Local Settings\Application Data\Deployment

2013-05-07 06:54 - 2012-08-29 19:26 - 00000000 ____D C:\Users\Owner\AppData\Local\Deployment

2013-05-06 11:55 - 2012-04-24 08:49 - 00000830 ____A C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job

2013-05-04 18:30 - 2013-05-05 16:31 - 735027200 ____A C:\Users\Owner\Desktop\28 Days Later.avi

2013-05-02 07:29 - 2010-11-20 19:27 - 00278800 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe

2013-04-30 06:28 - 2012-07-09 15:05 - 00000000 ____D C:\Program Files (x86)\Steam

2013-04-25 11:35 - 2012-04-24 09:03 - 00000000 ____D C:\ProgramData\Application Data\Adobe

2013-04-25 11:35 - 2012-04-24 09:03 - 00000000 ____D C:\ProgramData\Adobe

2013-04-25 11:35 - 2012-04-24 08:35 - 00691592 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-04-25 11:35 - 2012-04-24 08:35 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-04-24 23:17 - 2012-07-11 20:04 - 00000000 ____D C:\Users\Owner\Local Settings\CrashDumps

2013-04-24 23:17 - 2012-07-11 20:04 - 00000000 ____D C:\Users\Owner\Local Settings\Application Data\CrashDumps

2013-04-24 23:17 - 2012-07-11 20:04 - 00000000 ____D C:\Users\Owner\AppData\Local\CrashDumps

2013-04-18 14:38 - 2013-04-18 14:38 - 00039904 ____A C:\Windows\SysWOW64\Media Player - Codec Pack Disc handler.exe

2013-04-18 14:38 - 2013-04-18 14:38 - 00039904 ____A C:\Windows\SysWOW64\dischandler.exe

2013-04-16 13:34 - 2013-04-16 13:34 - 00000000 ____D C:\Windows\SysWOW64\C2MP

2013-04-16 13:28 - 2013-04-16 13:28 - 00000000 ____D C:\ProgramData\Windows Genuine Advantage

2013-04-16 13:28 - 2013-04-16 13:28 - 00000000 ____D C:\ProgramData\Application Data\Windows Genuine Advantage

2013-04-16 02:40 - 2013-04-16 02:40 - 04012544 ____A C:\Windows\System32\ffmpeg.dll

2013-04-16 02:39 - 2013-04-16 02:39 - 04372992 ____A C:\Windows\System32\ffdshow.ax

2013-04-16 02:39 - 2013-04-16 02:39 - 00127488 ____A C:\Windows\System32\ff_vfw.dll

2013-04-16 02:38 - 2013-04-16 02:38 - 00474624 ____A C:\Windows\System32\ff_kernelDeint.dll

2013-04-16 02:37 - 2013-04-16 02:37 - 01532928 ____A C:\Windows\System32\ff_samplerate.dll

2013-04-16 02:37 - 2013-04-16 02:37 - 00631296 ____A C:\Windows\System32\TomsMoComp_ff.dll

2013-04-16 02:37 - 2013-04-16 02:37 - 00222720 ____A C:\Windows\System32\ff_libdts.dll

2013-04-16 02:37 - 2013-04-16 02:37 - 00190464 ____A C:\Windows\System32\libmpeg2_ff.dll

2013-04-16 02:37 - 2013-04-16 02:37 - 00183296 ____A C:\Windows\System32\ff_unrar.dll

2013-04-16 02:37 - 2013-04-16 02:37 - 00156672 ____A C:\Windows\System32\ff_libmad.dll

2013-04-16 02:37 - 2013-04-16 02:37 - 00116224 ____A C:\Windows\System32\ff_liba52.dll

2013-04-16 02:37 - 2013-04-16 02:37 - 00114688 ____A C:\Windows\System32\ff_wmv9.dll

2013-04-16 02:35 - 2013-04-16 02:35 - 03915776 ____A C:\Windows\SysWOW64\ffmpeg.dll

2013-04-16 02:33 - 2013-04-16 02:33 - 03501568 ____A C:\Windows\SysWOW64\ffdshow.ax

2013-04-16 02:33 - 2013-04-16 02:33 - 00112640 ____A C:\Windows\SysWOW64\ff_vfw.dll

2013-04-16 02:32 - 2013-04-16 02:32 - 01525760 ____A C:\Windows\SysWOW64\ff_samplerate.dll

2013-04-16 02:32 - 2013-04-16 02:32 - 00271360 ____A C:\Windows\SysWOW64\TomsMoComp_ff.dll

2013-04-16 02:32 - 2013-04-16 02:32 - 00211968 ____A C:\Windows\SysWOW64\ff_libdts.dll

2013-04-16 02:32 - 2013-04-16 02:32 - 00157184 ____A C:\Windows\SysWOW64\ff_unrar.dll

2013-04-16 02:32 - 2013-04-16 02:32 - 00147456 ____A C:\Windows\SysWOW64\ff_libmad.dll

2013-04-16 02:32 - 2013-04-16 02:32 - 00136704 ____A C:\Windows\SysWOW64\libmpeg2_ff.dll

2013-04-16 02:32 - 2013-04-16 02:32 - 00114688 ____A C:\Windows\SysWOW64\ff_liba52.dll

2013-04-16 02:32 - 2013-04-16 02:32 - 00099840 ____A C:\Windows\SysWOW64\ff_wmv9.dll

2013-04-13 04:24 - 2013-04-13 04:24 - 07977200 ____A C:\Windows\System32\avcodec-lav-55.dll

2013-04-13 04:24 - 2013-04-13 04:24 - 01515520 ____A (1f0.de - Hendrik Leppkes) C:\Windows\System32\LAVVideo.ax

2013-04-13 04:24 - 2013-04-13 04:24 - 01245920 ____A C:\Windows\System32\avformat-lav-55.dll

2013-04-13 04:24 - 2013-04-13 04:24 - 00509952 ____A (1f0.de - Hendrik Leppkes) C:\Windows\System32\LAVSplitter.ax

2013-04-13 04:24 - 2013-04-13 04:24 - 00421600 ____A C:\Windows\System32\swscale-lav-2.dll

2013-04-13 04:24 - 2013-04-13 04:24 - 00364720 ____A (Intel Corp.) C:\Windows\System32\IntelQuickSyncDecoder.dll

2013-04-13 04:24 - 2013-04-13 04:24 - 00289008 ____A C:\Windows\System32\avutil-lav-52.dll

2013-04-13 04:24 - 2013-04-13 04:24 - 00272384 ____A (1f0.de - Hendrik Leppkes) C:\Windows\System32\LAVAudio.ax

2013-04-13 04:24 - 2013-04-13 04:24 - 00202648 ____A C:\Windows\System32\avfilter-lav-3.dll

2013-04-13 04:24 - 2013-04-13 04:24 - 00194016 ____A C:\Windows\System32\avresample-lav-1.dll

2013-04-13 04:23 - 2013-04-13 04:23 - 07788672 ____A C:\Windows\SysWOW64\avcodec-lav-55.dll

2013-04-13 04:23 - 2013-04-13 04:23 - 01300152 ____A C:\Windows\SysWOW64\avformat-lav-55.dll

2013-04-13 04:23 - 2013-04-13 04:23 - 01185456 ____A (1f0.de - Hendrik Leppkes) C:\Windows\SysWOW64\LAVVideo.ax

2013-04-13 04:23 - 2013-04-13 04:23 - 00424624 ____A (1f0.de - Hendrik Leppkes) C:\Windows\SysWOW64\LAVSplitter.ax

2013-04-13 04:23 - 2013-04-13 04:23 - 00400592 ____A C:\Windows\SysWOW64\swscale-lav-2.dll

2013-04-13 04:23 - 2013-04-13 04:23 - 00284336 ____A (Intel Corp.) C:\Windows\SysWOW64\IntelQuickSyncDecoder.dll

2013-04-13 04:23 - 2013-04-13 04:23 - 00272192 ____A C:\Windows\SysWOW64\avutil-lav-52.dll

2013-04-13 04:23 - 2013-04-13 04:23 - 00244400 ____A (1f0.de - Hendrik Leppkes) C:\Windows\SysWOW64\LAVAudio.ax

2013-04-13 04:23 - 2013-04-13 04:23 - 00194632 ____A C:\Windows\SysWOW64\avfilter-lav-3.dll

2013-04-13 04:23 - 2013-04-13 04:23 - 00172728 ____A C:\Windows\SysWOW64\avresample-lav-1.dll

2013-04-12 06:45 - 2013-04-24 13:51 - 01656680 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys

2013-04-10 23:25 - 2009-07-13 20:45 - 00275712 ____A C:\Windows\System32\FNTCACHE.DAT

2013-04-10 23:02 - 2012-07-12 05:06 - 72702784 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe

2013-04-09 15:00 - 2012-07-09 17:01 - 00000000 ____D C:\Program Files (x86)\World of Warcraft

==================== Known DLLs (Whitelisted) ================

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2013-04-21 07:57:01

Restore point made on: 2013-04-24 13:50:17

Restore point made on: 2013-04-24 23:00:24

Restore point made on: 2013-04-28 02:55:23

Restore point made on: 2013-05-01 04:23:49

Restore point made on: 2013-05-04 09:57:26

==================== Memory info ===========================

Percentage of memory in use: 9%

Total physical RAM: 8152.96 MB

Available physical RAM: 7356.33 MB

Total Pagefile: 8151.16 MB

Available Pagefile: 7345.66 MB

Total Virtual: 8192 MB

Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:919.22 GB) (Free:645.45 GB) NTFS (Disk=0 Partition=3)

Drive h: (USB20FD) (Removable) (Total:14.74 GB) (Free:14.74 GB) FAT32 (Disk=1 Partition=1)

Drive i: (RECOVERY) (Fixed) (Total:12.25 GB) (Free:5.06 GB) NTFS (Disk=0 Partition=2) ==>[system with boot components (obtained from reading drive)]

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows Vista) (Size: 932 GB) (Disk ID: 9A8CC90F)

Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)

Partition 2: (Active) - (Size=12 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=919 GB) - (Type=07 NTFS)

========================================================

Disk: 1 (Size: 15 GB) (Disk ID: 9E16F1CA)

Partition 1: (Not Active) - (Size=15 GB) - (Type=0B)

Last Boot: 2013-05-04 07:38

==================== End Of Log ============================

[MrCharlie]

OK, here you go......this should get you going:

Please download the attached fixlist.txt and copy it to your flashdrive.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options. (as you did before)

Run FRST64 or FRST (which ever one you're using) and press the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

See if the computer boots normally now.

MrC

[stevemartin83]

I ran it FRST64 again and clicked "Fix" with the fixlist.txt you gave me. Computer has booted up in normal mode now, but background is all black Windows Firewall is blocking something with my printer. I have literally not touched anything yet, awaiting next step.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 08-05-2013

Ran by SYSTEM at 2013-05-08 20:53:59 Run:1

Running from H:\

Boot Mode: Recovery

==============================================

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value was restored successfully.

HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default => Value was restored successfully.

C:\Users\Owner\AppData\Local\ztfriln.fdp => Moved successfully.

C:\Users\Owner\Local Settings\ztfriln.fdp => File/Directory not found.

C:\Users\Owner\Local Settings\Application Data\ztfriln.fdp => File/Directory not found.

C:\ProgramData\pqmxqchx.fmf => Moved successfully.

C:\ProgramData\Application Data\pqmxqchx.fmf => File/Directory not found.

==== End of Fixlog ====

[MrCharlie]

OK..see if you can run ComboFix:

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

[stevemartin83]

Ok, ran ComboFix, this is the log that came up.

ComboFix 13-05-08.02 - Owner 05/08/2013 21:27:26.1.4 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8153.6292 [GMT -4:00]

Running from: c:\users\Owner\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}

SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\PCDr\6032\AddOnDownloaded\1ea63693-456f-437c-857f-522df77e7357.dll

c:\programdata\PCDr\6032\AddOnDownloaded\32ac3173-77bd-4ec6-9638-94e174508c22.dll

c:\programdata\PCDr\6032\AddOnDownloaded\4d4f44db-c9f0-4cc8-a32f-e98ea4fff68d.dll

c:\programdata\PCDr\6032\AddOnDownloaded\7b6e388f-35d0-44f8-aa2c-20538273473f.dll

c:\programdata\PCDr\6032\AddOnDownloaded\7dd123b0-30e9-4f67-b7e2-20e7374cbb87.dll

c:\programdata\PCDr\6032\AddOnDownloaded\88bde4bf-b24d-4cb6-92ef-eb02d3276f09.dll

c:\programdata\PCDr\6032\AddOnDownloaded\96c23f75-9f21-4ef8-a3c8-1a554b815309.dll

c:\programdata\PCDr\6032\AddOnDownloaded\97cd9b9c-9747-469a-acfa-cfbf8aed528a.dll

c:\programdata\PCDr\6032\AddOnDownloaded\9cdc7b97-c1d2-495c-8b7f-12fd3c7e14b8.dll

c:\programdata\PCDr\6032\AddOnDownloaded\be661974-a339-4e9a-bea4-bda0af68ba7f.dll

c:\programdata\PCDr\6032\AddOnDownloaded\bea3f575-677a-4c92-89ca-7be8480c11a9.dll

c:\programdata\PCDr\6032\AddOnDownloaded\c0ff87a7-2f82-4d5e-8d0f-38cbd0c2f4d1.dll

c:\programdata\PCDr\6032\AddOnDownloaded\ca35a61e-780d-401f-891e-22b67162d061.dll

c:\programdata\PCDr\6032\AddOnDownloaded\ca39d363-7f7b-442f-9d1a-7cf8e06b7b08.dll

c:\programdata\PCDr\6032\AddOnDownloaded\caf72ad2-a222-415c-a303-8ca35e466713.dll

c:\programdata\PCDr\6032\AddOnDownloaded\d04640e7-f772-4909-8f8e-f8294ff0752f.dll

c:\programdata\PCDr\6032\AddOnDownloaded\d2597799-52b1-4a68-9280-897ad5c0c18e.dll

c:\programdata\PCDr\6032\AddOnDownloaded\fb803e34-29ed-4941-a7b3-4074ca51286c.dll

c:\windows\RPSETUP.EXE.LOG

.

.

((((((((((((((((((((((((( Files Created from 2013-04-09 to 2013-05-09 )))))))))))))))))))))))))))))))

.

.

2013-05-09 01:31 . 2013-05-09 01:31 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-05-09 01:05 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{14B9DF71-CE98-40DA-A027-2A529EC9E9B8}\mpengine.dll

2013-05-07 20:52 . 2013-05-07 20:52 -------- d-----w- C:\FRST

2013-05-07 20:12 . 2013-05-07 20:12 12872 ----a-w- c:\windows\system32\bootdelete.exe

2013-05-07 20:06 . 2013-05-07 20:12 -------- d-----w- c:\programdata\HitmanPro

2013-05-07 13:29 . 2013-04-10 03:46 9317456 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2013-04-24 21:51 . 2013-04-24 21:50 905296 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{97CE9639-3DB4-4E4C-80A0-0B46AD5AE10D}\gapaengine.dll

2013-04-24 21:51 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys

2013-04-22 01:23 . 2013-04-22 01:23 163504 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10144.bin

2013-04-18 22:38 . 2013-04-18 22:38 39904 ----a-w- c:\windows\SysWow64\Media Player - Codec Pack Disc handler.exe

2013-04-18 22:38 . 2013-04-18 22:38 39904 ----a-w- c:\windows\SysWow64\dischandler.exe

2013-04-16 21:34 . 2013-04-16 21:34 -------- d-----w- c:\windows\SysWow64\C2MP

2013-04-16 10:40 . 2013-04-16 10:40 4012544 ----a-w- c:\windows\system32\ffmpeg.dll

2013-04-16 10:39 . 2013-04-16 10:39 127488 ----a-w- c:\windows\system32\ff_vfw.dll

2013-04-16 10:39 . 2013-04-16 10:39 4372992 ----a-w- c:\windows\system32\ffdshow.ax

2013-04-16 10:38 . 2013-04-16 10:38 474624 ----a-w- c:\windows\system32\ff_kernelDeint.dll

2013-04-16 10:37 . 2013-04-16 10:37 631296 ----a-w- c:\windows\system32\TomsMoComp_ff.dll

2013-04-16 10:37 . 2013-04-16 10:37 114688 ----a-w- c:\windows\system32\ff_wmv9.dll

2013-04-16 10:37 . 2013-04-16 10:37 183296 ----a-w- c:\windows\system32\ff_unrar.dll

2013-04-16 10:37 . 2013-04-16 10:37 156672 ----a-w- c:\windows\system32\ff_libmad.dll

2013-04-16 10:37 . 2013-04-16 10:37 222720 ----a-w- c:\windows\system32\ff_libdts.dll

2013-04-16 10:37 . 2013-04-16 10:37 1532928 ----a-w- c:\windows\system32\ff_samplerate.dll

2013-04-16 10:37 . 2013-04-16 10:37 190464 ----a-w- c:\windows\system32\libmpeg2_ff.dll

2013-04-16 10:37 . 2013-04-16 10:37 116224 ----a-w- c:\windows\system32\ff_liba52.dll

2013-04-16 10:35 . 2013-04-16 10:35 3915776 ----a-w- c:\windows\SysWow64\ffmpeg.dll

2013-04-16 10:33 . 2013-04-16 10:33 112640 ----a-w- c:\windows\SysWow64\ff_vfw.dll

2013-04-16 10:33 . 2013-04-16 10:33 3501568 ----a-w- c:\windows\SysWow64\ffdshow.ax

2013-04-16 10:32 . 2013-04-16 10:32 157184 ----a-w- c:\windows\SysWow64\ff_unrar.dll

2013-04-16 10:32 . 2013-04-16 10:32 271360 ----a-w- c:\windows\SysWow64\TomsMoComp_ff.dll

2013-04-16 10:32 . 2013-04-16 10:32 99840 ----a-w- c:\windows\SysWow64\ff_wmv9.dll

2013-04-16 10:32 . 2013-04-16 10:32 211968 ----a-w- c:\windows\SysWow64\ff_libdts.dll

2013-04-16 10:32 . 2013-04-16 10:32 147456 ----a-w- c:\windows\SysWow64\ff_libmad.dll

2013-04-16 10:32 . 2013-04-16 10:32 1525760 ----a-w- c:\windows\SysWow64\ff_samplerate.dll

2013-04-16 10:32 . 2013-04-16 10:32 114688 ----a-w- c:\windows\SysWow64\ff_liba52.dll

2013-04-16 10:32 . 2013-04-16 10:32 136704 ----a-w- c:\windows\SysWow64\libmpeg2_ff.dll

2013-04-13 12:24 . 2013-04-13 12:24 1515520 ----a-w- c:\windows\system32\LAVVideo.ax

2013-04-13 12:24 . 2013-04-13 12:24 364720 ----a-w- c:\windows\system32\IntelQuickSyncDecoder.dll

2013-04-13 12:24 . 2013-04-13 12:24 509952 ----a-w- c:\windows\system32\LAVSplitter.ax

2013-04-13 12:24 . 2013-04-13 12:24 272384 ----a-w- c:\windows\system32\LAVAudio.ax

2013-04-13 12:24 . 2013-04-13 12:24 421600 ----a-w- c:\windows\system32\swscale-lav-2.dll

2013-04-13 12:24 . 2013-04-13 12:24 7977200 ----a-w- c:\windows\system32\avcodec-lav-55.dll

2013-04-13 12:24 . 2013-04-13 12:24 289008 ----a-w- c:\windows\system32\avutil-lav-52.dll

2013-04-13 12:24 . 2013-04-13 12:24 202648 ----a-w- c:\windows\system32\avfilter-lav-3.dll

2013-04-13 12:24 . 2013-04-13 12:24 194016 ----a-w- c:\windows\system32\avresample-lav-1.dll

2013-04-13 12:24 . 2013-04-13 12:24 1245920 ----a-w- c:\windows\system32\avformat-lav-55.dll

2013-04-13 12:23 . 2013-04-13 12:23 7788672 ----a-w- c:\windows\SysWow64\avcodec-lav-55.dll

2013-04-13 12:23 . 2013-04-13 12:23 424624 ----a-w- c:\windows\SysWow64\LAVSplitter.ax

2013-04-13 12:23 . 2013-04-13 12:23 400592 ----a-w- c:\windows\SysWow64\swscale-lav-2.dll

2013-04-13 12:23 . 2013-04-13 12:23 284336 ----a-w- c:\windows\SysWow64\IntelQuickSyncDecoder.dll

2013-04-13 12:23 . 2013-04-13 12:23 272192 ----a-w- c:\windows\SysWow64\avutil-lav-52.dll

2013-04-13 12:23 . 2013-04-13 12:23 244400 ----a-w- c:\windows\SysWow64\LAVAudio.ax

2013-04-13 12:23 . 2013-04-13 12:23 194632 ----a-w- c:\windows\SysWow64\avfilter-lav-3.dll

2013-04-13 12:23 . 2013-04-13 12:23 172728 ----a-w- c:\windows\SysWow64\avresample-lav-1.dll

2013-04-13 12:23 . 2013-04-13 12:23 1300152 ----a-w- c:\windows\SysWow64\avformat-lav-55.dll

2013-04-13 12:23 . 2013-04-13 12:23 1185456 ----a-w- c:\windows\SysWow64\LAVVideo.ax

2013-04-10 19:03 . 2013-03-01 03:36 3153408 ----a-w- c:\windows\system32\win32k.sys

2013-04-10 19:03 . 2013-01-24 06:01 223752 ----a-w- c:\windows\system32\drivers\fvevol.sys

2013-04-10 19:03 . 2013-03-19 06:04 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe

2013-04-10 19:03 . 2013-03-19 05:04 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

2013-04-10 19:03 . 2013-03-19 05:46 43520 ----a-w- c:\windows\system32\csrsrv.dll

2013-04-10 19:03 . 2013-03-19 05:04 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

2013-04-10 19:03 . 2013-03-19 04:47 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll

2013-04-10 19:03 . 2013-03-19 03:06 112640 ----a-w- c:\windows\system32\smss.exe

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-05-02 15:29 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe

2013-04-25 19:35 . 2012-04-24 16:35 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-04-25 19:35 . 2012-04-24 16:35 691592 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2013-04-11 07:02 . 2012-07-12 13:06 72702784 ----a-w- c:\windows\system32\MRT.exe

2013-03-16 04:32 . 2013-03-16 04:32 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe

2013-03-16 04:32 . 2013-03-16 04:32 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe

2013-03-16 04:32 . 2013-03-16 04:32 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll

2013-03-16 04:32 . 2013-03-16 04:32 61952 ----a-w- c:\windows\SysWow64\tdc.ocx

2013-03-16 04:32 . 2013-03-16 04:32 523264 ----a-w- c:\windows\SysWow64\vbscript.dll

2013-03-16 04:32 . 2013-03-16 04:32 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll

2013-03-16 04:32 . 2013-03-16 04:32 38400 ----a-w- c:\windows\SysWow64\imgutil.dll

2013-03-16 04:32 . 2013-03-16 04:32 361984 ----a-w- c:\windows\SysWow64\html.iec

2013-03-16 04:32 . 2013-03-16 04:32 226304 ----a-w- c:\windows\system32\elshyph.dll

2013-03-16 04:32 . 2013-03-16 04:32 185344 ----a-w- c:\windows\SysWow64\elshyph.dll

2013-03-16 04:32 . 2013-03-16 04:32 158720 ----a-w- c:\windows\SysWow64\msls31.dll

2013-03-16 04:32 . 2013-03-16 04:32 150528 ----a-w- c:\windows\SysWow64\iexpress.exe

2013-03-16 04:32 . 2013-03-16 04:32 138752 ----a-w- c:\windows\SysWow64\wextract.exe

2013-03-16 04:32 . 2013-03-16 04:32 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe

2013-03-16 04:32 . 2013-03-16 04:32 12800 ----a-w- c:\windows\SysWow64\mshta.exe

2013-03-16 04:32 . 2013-03-16 04:32 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll

2013-03-16 04:32 . 2013-03-16 04:32 97280 ----a-w- c:\windows\system32\mshtmled.dll

2013-03-16 04:32 . 2013-03-16 04:32 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll

2013-03-16 04:32 . 2013-03-16 04:32 81408 ----a-w- c:\windows\system32\icardie.dll

2013-03-16 04:32 . 2013-03-16 04:32 762368 ----a-w- c:\windows\system32\ieapfltr.dll

2013-03-16 04:32 . 2013-03-16 04:32 62976 ----a-w- c:\windows\system32\pngfilt.dll

2013-03-16 04:32 . 2013-03-16 04:32 599552 ----a-w- c:\windows\system32\vbscript.dll

2013-03-16 04:32 . 2013-03-16 04:32 52224 ----a-w- c:\windows\system32\msfeedsbs.dll

2013-03-16 04:32 . 2013-03-16 04:32 51200 ----a-w- c:\windows\system32\imgutil.dll

2013-03-16 04:32 . 2013-03-16 04:32 452096 ----a-w- c:\windows\system32\dxtmsft.dll

2013-03-16 04:32 . 2013-03-16 04:32 441856 ----a-w- c:\windows\system32\html.iec

2013-03-16 04:32 . 2013-03-16 04:32 281600 ----a-w- c:\windows\system32\dxtrans.dll

2013-03-16 04:32 . 2013-03-16 04:32 27648 ----a-w- c:\windows\system32\licmgr10.dll

2013-03-16 04:32 . 2013-03-16 04:32 270848 ----a-w- c:\windows\system32\iedkcs32.dll

2013-03-16 04:32 . 2013-03-16 04:32 247296 ----a-w- c:\windows\system32\webcheck.dll

2013-03-16 04:32 . 2013-03-16 04:32 235008 ----a-w- c:\windows\system32\url.dll

2013-03-16 04:32 . 2013-03-16 04:32 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll

2013-03-16 04:32 . 2013-03-16 04:32 216064 ----a-w- c:\windows\system32\msls31.dll

2013-03-16 04:32 . 2013-03-16 04:32 197120 ----a-w- c:\windows\system32\msrating.dll

2013-03-16 04:32 . 2013-03-16 04:32 173568 ----a-w- c:\windows\system32\ieUnatt.exe

2013-03-16 04:32 . 2013-03-16 04:32 167424 ----a-w- c:\windows\system32\iexpress.exe

2013-03-16 04:32 . 2013-03-16 04:32 1509376 ----a-w- c:\windows\system32\inetcpl.cpl

2013-03-16 04:32 . 2013-03-16 04:32 149504 ----a-w- c:\windows\system32\occache.dll

2013-03-16 04:32 . 2013-03-16 04:32 144896 ----a-w- c:\windows\system32\wextract.exe

2013-03-16 04:32 . 2013-03-16 04:32 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl

2013-03-16 04:32 . 2013-03-16 04:32 1400416 ----a-w- c:\windows\system32\ieapfltr.dat

2013-03-16 04:32 . 2013-03-16 04:32 13824 ----a-w- c:\windows\system32\mshta.exe

2013-03-16 04:32 . 2013-03-16 04:32 136192 ----a-w- c:\windows\system32\iepeers.dll

2013-03-16 04:32 . 2013-03-16 04:32 135680 ----a-w- c:\windows\system32\IEAdvpack.dll

2013-03-16 04:32 . 2013-03-16 04:32 12800 ----a-w- c:\windows\system32\msfeedssync.exe

2013-03-16 04:32 . 2013-03-16 04:32 102912 ----a-w- c:\windows\system32\inseng.dll

2013-03-16 04:32 . 2013-03-16 04:32 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2013-03-16 04:32 . 2013-03-16 04:32 77312 ----a-w- c:\windows\system32\tdc.ocx

2013-03-16 04:32 . 2013-03-16 04:32 48640 ----a-w- c:\windows\system32\mshtmler.dll

2013-03-08 17:39 . 2013-03-08 17:39 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

2013-03-08 17:39 . 2012-08-29 15:56 861088 ----a-w- c:\windows\SysWow64\npdeployJava1.dll

2013-03-08 17:39 . 2012-08-29 15:56 782240 ----a-w- c:\windows\SysWow64\deployJava1.dll

2013-02-12 05:45 . 2013-03-12 22:52 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2013-02-12 05:45 . 2013-03-12 22:52 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll

2013-02-12 05:45 . 2013-03-12 22:52 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll

2013-02-12 05:45 . 2013-03-12 22:52 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll

2013-02-12 04:48 . 2013-03-12 22:52 474112 ----a-w- c:\windows\apppatch\AcSpecfc.dll

2013-02-12 04:48 . 2013-03-12 22:52 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll

2013-02-12 04:12 . 2013-03-15 12:14 19968 ----a-w- c:\windows\system32\drivers\usb8023.sys

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HP Photosmart 6520 series (NET)"="c:\program files\HP\HP Photosmart 6520 series\Bin\ScanToPCActivationApp.exe" [2012-10-17 2573416]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]

"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2011-11-30 284440]

"USB3MON"="c:\program files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-02-17 291608]

"ShwiconXP9106"="c:\program files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe" [2010-03-10 237568]

"Dell Registration"="c:\program files (x86)\System Registration\prodreg.exe" [2011-08-04 4165440]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2012-12-18 38112]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]

"Lachesis"="c:\program files (x86)\Razer\Lachesis\razerhid.exe" [2007-09-12 172032]

"Tarantula"="c:\program files (x86)\Razer\Tarantula\razerhid.exe" [2006-09-30 176128]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-08-06 642216]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]

"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-18 152392]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

.

c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

CurseClientStartup.ccip [2012-8-29 0]

Monitor Ink Alerts - HP Photosmart 6520 series (Network).lnk - c:\windows\system32\RunDll32.exe [2009-7-13 45568]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

CodecPackTrayMenu.lnk - c:\windows\SysWOW64\C2MP\TrayMenu.exe [2013-3-19 704008]

CodecPackUpdateChecker.lnk - c:\windows\SysWOW64\C2MP\UpdateChecker.exe [2013-3-21 46848]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [x]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]

R3 pmxdrv;pmxdrv;c:\windows\system32\drivers\pmxdrv.sys [2013-01-12 31152]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-07-10 1255736]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]

S0 iusb3hcs;Intel® USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys [2012-01-27 16152]

S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-17 98208]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-07-28 239616]

S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe [2011-12-29 106144]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]

S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-11-30 13592]

S2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe [2012-01-11 627936]

S2 Intel® ME Service;Intel® ME Service;c:\program files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [2012-01-21 128280]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]

S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2012-02-16 1695040]

S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2012-01-21 363800]

S2 ZAtheros Wlan Agent;ZAtheros Wlan Agent;c:\program files (x86)\Dell Wireless\Ath_WlanAgent.exe [2011-12-27 76960]

S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys [2011-12-29 36000]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-05-14 96896]

S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys [2011-12-29 338592]

S3 btath_avdt;Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys [2011-12-29 110752]

S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys [2011-12-29 30368]

S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys [2011-12-29 167584]

S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys [2011-12-29 68256]

S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys [2011-12-29 280992]

S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys [2011-12-29 548000]

S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2011-12-06 331264]

S3 iusb3hub;Intel® USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys [2012-01-27 356120]

S3 iusb3xhc;Intel® USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys [2012-01-27 787736]

S3 PCDSRVC{1E208CE0-FB7451FF-06020200}_0;PCDSRVC{1E208CE0-FB7451FF-06020200}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc_x64.pkms [2012-11-26 25584]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-11-24 648808]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]

S3 VaneFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys [2007-08-17 30336]

.

.

Contents of the 'Scheduled Tasks' folder

.

2013-05-09 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-24 19:35]

.

2013-05-09 c:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job

- c:\program files (x86)\Intel\Intel® ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25 18:41]

.

2013-05-06 c:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job

- c:\program files (x86)\Intel\Intel® ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25 18:41]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AtherosBtStack"="c:\program files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe" [2011-12-29 1014432]

"AthBtTray"="c:\program files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe" [2011-12-29 800416]

"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-12-23 6457960]

"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-11-16 1156712]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService

FontCache

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.yahoo.com/

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local;192.168.*.*

IE: Download with &Shareaza - c:\program files\Shareaza\RazaWebHook64.dll/3000

TCP: DhcpNameServer = 10.0.0.1

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

Toolbar-Locked - (no file)

HKLM-Run-MSC - c:\program files\Microsoft Security Client\mssecex.exe

.

.

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCDSRVC{1E208CE0-FB7451FF-06020200}_0]

"ImagePath"="\??\c:\program files\dell support center\pcdsrvc_x64.pkms"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_169_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_169.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2013-05-08 21:34:12

ComboFix-quarantined-files.txt 2013-05-09 01:34

.

Pre-Run: 692,620,079,104 bytes free

Post-Run: 694,148,902,912 bytes free

.

- - End Of File - - 1F63FC02EA27A7EC5B9638DA342E6F3A

[MrCharlie]

How's the backround color??

Please download and run RogueKiller 32 Bit to your desktop.

RogueKiller 64 Bit <---use this one for 64 bit systems

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

[stevemartin83]

The screen is still not normal, background is all black and the windows bar at the bottom looks more like Windows 95 than Windows 7. Here's a screen shot.

[stevemartin83]

Here's the log from RogueKillerX64. I noticed it seemed to be very interested in curse client. Don't know if you play games, but its an add-on management for World of Warcraft. Basically Steam for warcraft add-ons, keeps them up to date with latest version.

RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Owner [Admin rights]

Mode : Scan -- Date : 05/09/2013 15:17:30

| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤

[sUSP PATH] CurseClient.exe -- C:\Users\Owner\AppData\Local\Apps\2.0\RNX0EZQE.KKO\MPGT8ZHD.PE4\curs..tion_9e9e83ddf3ed3ead_0005.0001_35ab96b41397406c\CurseClient.exe [-] -> KILLED [TermProc]

¤¤¤ Registry Entries : 8 ¤¤¤

[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> FOUND

[HJ] HKLM\[...]\Wow6432Node\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND

[HJ] HKLM\[...]\Wow6432Node\System : EnableLUA (0) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST31000524AS +++++

--- User ---

[MBR] 7d495c9e80d1d03943476c8f5fb0500b

[bSP] 25b6910abf9c3e45a9dfa4e897c311cb : Windows Vista MBR Code

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 12544 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 25772032 | Size: 941284 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_05092013_02d1517.txt >>

RKreport[1]_S_05092013_02d1517.txt

[MrCharlie]

http://www.sevenforums.com/tutorials/67200-remove-background-images-where-available.html

See if any of this works while I investigate a little more.

MrC

[stevemartin83]

I was just playing it safe and not touching anything until I got the all clear. Going into the control panel, seems like the virus turned off my theme. Now it looks just like normal, aside from 2 icon images not loading as if the .gif images for them have been deleted.

[MrCharlie]

So it's OK now??

If so lets check for any adware while you're here:

Please download AdwCleaner from here and save it on your Desktop.

AdwCleaner is a reliable removal tool for Adware, Foistware, toolbars and potentially unwanted programs.

AdwCleaner is a tool that deletes :

· Adwares (software ads)

· PUP/LPI (Potentially Undesirable Program)

· Toolbars

· Hijacker (Hijack of the browser's homepage)

It works with a Search and Deletion method. It can be easily uninstalled using the "Uninstall" mode.

1. Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.
   
2. Now click on the Search tab.
   
3. Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

Note:

Please look over what was found......especially any folders, we're going to permanently delete it all in the next step....if there's something you may want to keep...please let me know and I'll explain to why it shouldn't be on your system.

If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.

Please note that Antivir Webguard uses ASK Toolbar as part of its web security. If you remove ASK by using Adwcleaner, Antivir Webguard will no longer work properly. Therefore, if you use this program please use the instructions below to access the options screen where you should enable /DisableAskDetections before using AdwCleaner.

You can click on the question mark (?) in the upper left corner of the program and then click on Options. You will then be presented with a dialog where you can disable various detections. These options are described below:

/DisableAskDetection - This option disables Ask Toolbar detection.

MrC

[stevemartin83]

Here's the log from AdwCleaner. Looks like it's all crap, not seeing anything that could be mistaken for a "keeper".

# AdwCleaner v2.300 - Logfile created 05/09/2013 at 17:04:58

# Updated 28/04/2013 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Owner - OWNER-PC

# Boot Mode : Normal

# Running from : C:\Users\Owner\Desktop\adwcleaner.exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

File Found : C:\END

Folder Found : C:\Program Files (x86)\Conduit

Folder Found : C:\Users\Owner\AppData\Local\Conduit

Folder Found : C:\Users\Owner\AppData\LocalLow\Conduit

Folder Found : C:\Users\Owner\AppData\LocalLow\PriceGong

***** [Registry] *****

Key Found : HKCU\Software\AppDataLow\Software\Conduit

Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes

Key Found : HKCU\Software\AppDataLow\Software\PriceGong

Key Found : HKCU\Software\AppDataLow\Software\SmartBar

Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3244149

Key Found : HKLM\Software\Conduit

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

***** [internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16537

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [1166 octets] - [09/05/2013 17:04:58]

########## EOF - C:\AdwCleaner[R1].txt - [1226 octets] ##########

[MrCharlie]

Yes, it's all adware.....

Some adware found....lets clear it out.....

1. Please re-run AdwCleaner
   
2. Click on Delete button.
   
3. Confirm each time with OK if asked.
   
4. Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.
   

Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.

Then......

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt.
  
• Please Post the contents of that document.
  
• Do Not Attach It!!!
  

MrC

[stevemartin83]

# AdwCleaner v2.300 - Logfile created 05/09/2013 at 17:27:59

# Updated 28/04/2013 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Owner - OWNER-PC

# Boot Mode : Normal

# Running from : C:\Users\Owner\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

File Deleted : C:\END

Folder Deleted : C:\Program Files (x86)\Conduit

Folder Deleted : C:\Users\Owner\AppData\Local\Conduit

Folder Deleted : C:\Users\Owner\AppData\LocalLow\Conduit

Folder Deleted : C:\Users\Owner\AppData\LocalLow\PriceGong

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Conduit

Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes

Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong

Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3244149

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

***** [internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16537

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [1295 octets] - [09/05/2013 17:04:58]

AdwCleaner[R2].txt - [1355 octets] - [09/05/2013 17:27:45]

AdwCleaner[s1].txt - [1310 octets] - [09/05/2013 17:27:59]

########## EOF - C:\AdwCleaner[s1].txt - [1370 octets] ##########

[stevemartin83]

Results of screen317's Security Check version 0.99.63

Windows 7 Service Pack 1 x64 (UAC is disabled!)

Internet Explorer 9

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Enabled!

Microsoft Security Essentials

Antivirus up to date!

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.75.0.1300

JavaFX 2.0.3

Java 7 Update 17

Java version out of Date!

Adobe Reader 10.1.6 Adobe Reader out of Date!

````````Process Check: objlist.exe by Laurent````````

Microsoft Security Essentials MSMpEng.exe

Microsoft Security Essentials msseces.exe

Malwarebytes Anti-Malware mbamservice.exe

Malwarebytes Anti-Malware mbamgui.exe

Malwarebytes' Anti-Malware mbamscheduler.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 0%

````````````````````End of Log``````````````````````

[MrCharlie]

Out dated programs on the system are vulnerable to malware.

Please update or uninstall them:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

JavaFX 2.0.3 <---please uninstall from add/remove programs

Java 7 Update 17 <---please update, should be Update 21

Java version out of Date! <--------Go to control panel > Java > Update Tab > Update Now

Uncheck the box to install the Ask toolbar!!! and any other free "stuff".

If there's no update tab in Java, uninstall it and Download and install the latest version from Here

Uncheck the box to install the Ask toolbar!!! and any other free "stuff".

-------------------------------------

Adobe Reader 10.1.6 Adobe Reader out of Date! <---please check for an update if available or uninstall and download and install Foxit Reader which is less vulnerable to malware and much better than Adobe. Don't install any toolbars or other free "stuff" that may come with it (ASK Toolbar, etc).

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall)

---------------------------------

If you used DeFogger to disable your CD Emulation drivers, please re-enable them.

-------------------------------

Please download OTL from one of the links below: (you may already have OTL on the system)

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com

http://www.itxassoci...T-Tools/OTL.exe

Save it to your desktop.

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, MBAR, etc....AdwCleaner > just run the program and click uninstall.

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[stevemartin83]

Thank you so much for giving me back my computer!! I was pretty much ready to give up due to the persistence of this virus/malware. It was, by far, 100 times more difficult to remove than the System Tools virus/malware I got a couple years ago!!

[MrCharlie]

OK...Take Care MrC

[LDTate]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!