Every browser crashes...(Win7 64bit)

opacupa · May 15, 2013

Hey all!

Like I've said, every single browser randomly crashes on my desktop PC! I've tryed Chrome, Firefox (Nightly 64bit), Maxthon Cloud, IE 9... All browsers were the latest version, updated regulary! I've just completed Malwarebaytes full scan, but nothing was found, and my antivirus is MSE, also updated to latest version.

Does anyone have any idea what could be the cause of these crashes, and how to deal with them?

If any more scans are necessary, please tell me and I'll post back all the logs!

I've attached latest mbam full scan log, hope it helpes!

Cheers guys!

mbam-log-2013-05-15 (14-54-25).txt

Maniac · May 15, 2013

Hello opacupa! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.
Do not perform any kind of scanning and fixing without my instructions. If you want to proceed on your own, please let me know.

Please follow the instructions here and post your log files:

http://forums.malwarebytes.org/index.php?showtopic=9573

opacupa · May 15, 2013

Thanx mate!

Here are the logs:

DDS

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer:

Run by Gosa at 15:47:54 on 2013-05-15

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.8174.6339 [GMT 2:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Microsoft Security Essentials *Enabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\atieclxx.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

C:\Program Files (x86)\TuneUp Utilities\TuneUpUtilitiesService64.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\Dwm.exe

c:\Program Files\Microsoft Security Client\NisSrv.exe

C:\Program Files (x86)\TuneUp Utilities\TuneUpUtilitiesApp64.exe

C:\Windows\Explorer.EXE

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files (x86)\SVP\SVPMgr.exe

C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files\Nightly\firefox.exe

c:\Program Files\Microsoft Security Client\MpCmdRun.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

mWinlogon: Userinit = userinit.exe,

BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

uRun: [sVPMgr] "C:\Program Files (x86)\SVP\SVPMgr.exe"

mRun: [VirtualCloneDrive] "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:0

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableLUA = dword:0

mPolicies-System: EnableUIADesktopToggle = dword:0

mPolicies-System: PromptOnSecureDesktop = dword:0

mPolicies-Windows\System: UseOEMBackground = dword:1

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

TCP: NameServer = 89.216.1.40 89.216.1.50

TCP: Interfaces\{0DB4CB06-0D3B-4E40-B9B6-15A5F8D6A372} : DHCPNameServer = 89.216.1.40 89.216.1.50

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

SSODL: WebCheck - <orphaned>

SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

IFEO: excel.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

IFEO: groove.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

IFEO: infopath.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

IFEO: msaccess.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

IFEO: msoxmled.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

x64-Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - <orphaned>

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-SSODL: WebCheck - <orphaned>

x64-IFEO: excel.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

x64-IFEO: groove.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

x64-IFEO: infopath.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

x64-IFEO: msaccess.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

x64-IFEO: msoxmled.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

.

Note: multiple IFEO entries found. Please refer to Attach.txt

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Gosa\AppData\Roaming\Mozilla\Firefox\Profiles\dc5ftd9h.default\

FF - prefs.js: network.proxy.type - 4

FF - plugin: C:\Windows\System32\Macromed\Flash\NPSWF64_11_7_700_202.dll

FF - ExtSQL: 2013-05-14 20:27; support@lastpass.com; C:\Users\Gosa\AppData\Roaming\Mozilla\Firefox\Profiles\dc5ftd9h.default\extensions\support@lastpass.com

FF - ExtSQL: 2013-05-14 20:29; {fe272bd1-5f76-4ea4-8501-a05d35d823fc}; C:\Users\Gosa\AppData\Roaming\Mozilla\Firefox\Profiles\dc5ftd9h.default\extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi

FF - ExtSQL: 2013-05-14 20:37; mytube@ashishmishra.in; C:\Users\Gosa\AppData\Roaming\Mozilla\Firefox\Profiles\dc5ftd9h.default\extensions\mytube@ashishmishra.in.xpi

FF - ExtSQL: 2013-05-15 15:02; firegestures@xuldev.org; C:\Users\Gosa\AppData\Roaming\Mozilla\Firefox\Profiles\dc5ftd9h.default\extensions\firegestures@xuldev.org.xpi

.

============= SERVICES / DRIVERS ===============

.

R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2013-1-20 230320]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2012-12-19 240640]

R2 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2013-1-20 130008]

R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;C:\Program Files (x86)\TuneUp Utilities\TuneUpUtilitiesService64.exe [2012-9-17 2365792]

R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2012-11-6 96256]

R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2013-1-27 379360]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2013-2-16 769168]

R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;C:\Program Files (x86)\TuneUp Utilities\TuneUpUtilitiesDriver64.sys [2012-8-29 11880]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2012-7-9 104912]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2012-7-9 123856]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-2-28 161384]

S3 dmvsc;dmvsc;C:\Windows\System32\drivers\dmvsc.sys [2011-4-12 71168]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-2-16 19456]

S3 Synth3dVsc;Microsoft Virtual 3D Video Transport Driver;C:\Windows\System32\drivers\Synth3dVsc.sys [2011-4-12 88960]

S3 terminpt;Microsoft Remote Desktop Input Driver;C:\Windows\System32\drivers\terminpt.sys [2013-2-16 29696]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-2-16 57856]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2013-2-16 30208]

S3 tsusbhub;Remote Deskotop USB Hub;C:\Windows\System32\drivers\tsusbhub.sys [2011-4-12 117248]

S3 UsbFltr;WayTech USB Filter Driver;C:\Windows\System32\drivers\UsbFltr.sys [2007-4-9 12288]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2013-2-16 1255736]

.

=============== Created Last 30 ================

.

2013-05-15 13:23:46 -------- d-----w- C:\Program Files\Nightly

2013-05-14 19:28:13 76232 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{56C9C6C3-405D-4EBF-AF0A-215E58348365}\offreg.dll

2013-05-14 19:27:40 9460464 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{56C9C6C3-405D-4EBF-AF0A-215E58348365}\mpengine.dll

2013-05-14 18:26:23 -------- d-----w- C:\Users\Gosa\AppData\Local\Mozilla

2013-05-14 13:56:21 9317456 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2013-05-13 17:04:20 -------- d-----w- C:\Users\Gosa\AppData\Roaming\SVP 3.1

2013-05-13 17:04:16 406016 ----a-w- C:\Windows\SysWow64\avisynth.dll

2013-05-13 17:04:14 -------- d-----w- C:\Program Files (x86)\SVP

2013-05-11 14:56:51 -------- d-----w- C:\Users\Gosa\AppData\Local\Facebook

2013-05-11 08:27:24 -------- d-----w- C:\ProgramData\Voksi

2013-05-05 22:26:58 -------- d-----w- C:\Users\Gosa\AppData\Local\AdFender

2013-04-27 17:15:06 -------- d-----w- C:\Users\Gosa\AppData\Local\Apple Computer

2013-04-27 17:14:30 -------- d-----w- C:\Users\Gosa\AppData\Local\Apple

2013-04-26 18:41:16 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2013-04-26 18:41:16 692104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2013-04-26 18:39:45 -------- d-----w- C:\Users\Gosa\AppData\Local\Opera

2013-04-25 15:49:26 -------- d-----w- C:\Program Files (x86)\TuneUp Utilities

2013-04-23 19:34:24 -------- d-----w- C:\Windows\SysWow64\searchplugins

2013-04-23 19:34:24 -------- d-----w- C:\Windows\SysWow64\Extensions

2013-04-23 19:33:47 -------- d-----w- C:\Users\Gosa\AppData\Roaming\Babylon

2013-04-23 19:33:47 -------- d-----w- C:\ProgramData\Babylon

2013-04-23 19:33:32 -------- d-----w- C:\ProgramData\Tarma Installer

2013-04-23 19:33:28 -------- d-----w- C:\Program Files (x86)\FirstRowSportApp.com

2013-04-23 18:46:15 972264 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

2013-04-23 18:46:15 905296 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{02CC83E1-5AC3-4B83-B077-4BF8B1281223}\gapaengine.dll

2013-04-23 18:46:12 1656680 ----a-w- C:\Windows\System32\drivers\ntfs.sys

2013-04-17 18:29:27 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

2013-04-17 18:29:27 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-04-17 18:23:22 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client

2013-04-17 18:23:13 -------- d-----w- C:\Program Files\Microsoft Security Client

2013-04-17 18:09:26 -------- d-----w- C:\Users\Gosa\AppData\Local\Secunia PSI

2013-04-17 18:09:18 -------- d-----w- C:\Program Files (x86)\Secunia

2013-04-16 14:11:12 34656 ----a-w- C:\Windows\System32\TURegOpt.exe

2013-04-16 14:11:12 25952 ----a-w- C:\Windows\System32\authuitu.dll

2013-04-16 14:11:11 21344 ----a-w- C:\Windows\SysWow64\authuitu.dll

2013-04-16 14:10:40 -------- d-----w- C:\Users\Gosa\AppData\Roaming\TuneUp Software

2013-04-16 14:10:25 -------- d-----w- C:\Program Files (x86)\TuneUp Utilities 2013

2013-04-16 14:09:20 -------- d-----w- C:\ProgramData\TuneUp Software

2013-04-16 14:09:02 -------- d-sh--w- C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}

2013-04-16 14:09:02 -------- d--h--w- C:\ProgramData\Common Files

2013-04-16 13:35:08 -------- d-----w- C:\Windows\System32\drivers\NISx64\1403010.016

.

==================== Find3M ====================

.

2013-05-02 15:29:56 278800 ------w- C:\Windows\System32\MpSigStub.exe

2013-03-20 17:39:39 4608 ----a-w- C:\Windows\SysWow64\w95inf32.dll

2013-03-20 17:39:39 2272 ----a-w- C:\Windows\SysWow64\w95inf16.dll

2013-03-19 06:04:06 5550424 ----a-w- C:\Windows\System32\ntoskrnl.exe

2013-03-19 05:46:56 43520 ----a-w- C:\Windows\System32\csrsrv.dll

2013-03-19 05:04:13 3968856 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

2013-03-19 05:04:10 3913560 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

2013-03-19 04:47:50 6656 ----a-w- C:\Windows\SysWow64\apisetschema.dll

2013-03-19 03:06:33 112640 ----a-w- C:\Windows\System32\smss.exe

2013-03-03 13:19:19 0 ----a-w- C:\Windows\ativpsrm.bin

2013-03-01 03:36:04 3153408 ----a-w- C:\Windows\System32\win32k.sys

2013-02-22 06:27:49 2312704 ----a-w- C:\Windows\System32\jscript9.dll

2013-02-22 06:20:51 1392128 ----a-w- C:\Windows\System32\wininet.dll

2013-02-22 06:19:37 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl

2013-02-22 06:15:48 173056 ----a-w- C:\Windows\System32\ieUnatt.exe

2013-02-22 06:15:23 599040 ----a-w- C:\Windows\System32\vbscript.dll

2013-02-22 06:12:41 2382848 ----a-w- C:\Windows\System32\mshtml.tlb

2013-02-22 03:46:00 1800704 ----a-w- C:\Windows\SysWow64\jscript9.dll

2013-02-22 03:38:00 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll

2013-02-22 03:37:50 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

2013-02-22 03:34:17 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe

2013-02-22 03:34:03 420864 ----a-w- C:\Windows\SysWow64\vbscript.dll

2013-02-22 03:31:46 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb

.

============= FINISH: 15:48:11.45 ===============

.

ATTACH

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Ultimate

Boot Device: \Device\HarddiskVolume1

Install Date: 3/3/2013 1:57:27 PM

System Uptime: 5/15/2013 2:53:02 PM (1 hours ago)

.

Motherboard: MSI | | H61M-P22 (MS-7680)

Processor: Intel® Core i3-2100 CPU @ 3.10GHz | SOCKET 0 | 3100/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 466 GiB total, 193.601 GiB free.

D: is CDROM ()

F: is FIXED (NTFS) - 0 GiB total, 0.062 GiB free.

G: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID:

Description: SM Bus Controller

Device ID: PCI\VEN_8086&DEV_1C22&SUBSYS_76801462&REV_05\3&11583659&0&FB

Manufacturer:

Name: SM Bus Controller

PNP Device ID: PCI\VEN_8086&DEV_1C22&SUBSYS_76801462&REV_05\3&11583659&0&FB

Service:

.

==== System Restore Points ===================

.

RP73: 5/12/2013 4:00:51 PM - Installed Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

RP74: 5/14/2013 3:56:01 PM - Windows Update

RP76: 5/14/2013 8:42:45 PM - Removed Facebook Messenger 2.1.4814.0

RP77: 5/15/2013 11:42:26 AM - Windows Update

.

==== Image File Execution Options =============

.

IFEO: excel.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

IFEO: groove.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

IFEO: infopath.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

IFEO: msaccess.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

IFEO: msoxmled.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

IFEO: mspub.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

IFEO: mstore.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

IFEO: offdiag.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

IFEO: ois.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

IFEO: onenote.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

IFEO: outlook.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

IFEO: powerpnt.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

IFEO: vscontentinstaller.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

IFEO: vslauncher.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

IFEO: winword.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

x64-IFEO: excel.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

x64-IFEO: groove.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

x64-IFEO: infopath.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

x64-IFEO: msaccess.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

x64-IFEO: msoxmled.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

x64-IFEO: mspub.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

x64-IFEO: mstore.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

x64-IFEO: offdiag.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

x64-IFEO: ois.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

x64-IFEO: onenote.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

x64-IFEO: outlook.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

x64-IFEO: powerpnt.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

x64-IFEO: vscontentinstaller.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

x64-IFEO: vslauncher.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

x64-IFEO: winword.exe - "C:\Program Files (x86)\TuneUp Utilities\TUAutoReactivator64.exe"

.

==== Installed Programs ======================

.

µTorrent

7-Zip 9.20 (x64 edition)

Adobe Flash Player 11 Plugin

AMD Accelerated Video Transcoding

AMD APP SDK Runtime

AMD Catalyst Install Manager

AMD Drag and Drop Transcoding

AMD Media Foundation Decoders

AviSynth 2.5

Bejeweled 3

Black Mirror 3

Catalyst Control Center

Catalyst Control Center - Branding

Catalyst Control Center Graphics Previews Common

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

ccc-utility64

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

Daum PotPlayer 1.5.35491

ffdshow v1.3.4500 [2013-01-06]

Fieldrunners 2

Foxit Phantom

Haali Media Splitter

Malwarebytes Anti-Malware version 1.75.0.1300

Mars War Logs version 1.00

Microsoft .NET Framework 4.5

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office File Validation Add-In

Microsoft Office Groove MUI (English) 2007

Microsoft Office Groove Setup Metadata MUI (English) 2007

Microsoft Office InfoPath MUI (English) 2007

Microsoft Office Office 64-bit Components 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared 64-bit MUI (English) 2007

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Security Client

Microsoft Security Essentials

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Nightly 24.0a1 (x64 en-US)

Resident. Evil 6

Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition

Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition

Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition

Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition

Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition

Skype™ 6.3

SmoothVideo Project version 3.1.4

Syberia 1 1.00

TuneUp Utilities 2013

TuneUp Utilities Language Pack (en-US)

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition

Update for Microsoft Office Access 2007 Help (KB963663)

Update for Microsoft Office Excel 2007 Help (KB963678)

Update for Microsoft Office Infopath 2007 Help (KB963662)

Update for Microsoft Office OneNote 2007 Help (KB963670)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition

Update for Microsoft Office Outlook 2007 Help (KB963677)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2768021) 32-Bit Edition

Update for Microsoft Office Powerpoint 2007 Help (KB963669)

Update for Microsoft Office Publisher 2007 Help (KB963667)

Update for Microsoft Office Script Editor Help (KB963671)

Update for Microsoft Office Word 2007 Help (KB963665)

Uplay

VirtualCloneDrive

.

==== Event Viewer Messages From Past Week ========

.

5/9/2013 5:17:01 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000004e (0x0000000000000099, 0x00000000001b524c, 0x0000000000000002, 0x000000000022388b). A dump was saved in: C:\Windows\Minidump\050913-23571-01.dmp. Report Id: 050913-23571-01.

5/15/2013 2:58:41 PM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.

5/15/2013 11:43:58 AM, Error: Service Control Manager [7031] - The Windows Modules Installer service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.

5/13/2013 9:46:44 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x00000050 (0xfffff8a0121fb4e0, 0x0000000000000000, 0xfffff80002aea500, 0x0000000000000002). A dump was saved in: C:\Windows\Minidump\051313-20623-01.dmp. Report Id: 051313-20623-01.

5/13/2013 9:44:31 PM, Error: Service Control Manager [7031] - The Superfetch service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

5/13/2013 9:23:58 PM, Error: Service Control Manager [7031] - The Superfetch service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

5/13/2013 6:45:23 PM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x00000019 (0x0000000000000020, 0xfffff8a00b7a6000, 0xfffff8a00b7a6250, 0x0000000005250000). A dump was saved in: C:\Windows\Minidump\051313-27534-01.dmp. Report Id: 051313-27534-01.

5/13/2013 4:57:45 PM, Error: Service Control Manager [7031] - The Microsoft Antimalware Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 15000 milliseconds: Restart the service.

5/13/2013 4:57:39 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x80070006 Error description: The handle is invalid. Reason: The filter driver has successfully restarted.

5/13/2013 4:57:37 PM, Error: Microsoft Antimalware [5008] - Microsoft Antimalware engine has been terminated due to an unexpected error. Failure Type: Crash Exception code: 0xc0000005 Resource: process:pid:4704

5/13/2013 4:57:37 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: On Access Error Code: 0x80070006 Error description: The handle is invalid. Reason: The filter driver was unloaded unexpectedly.

5/13/2013 4:57:37 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x80070006 Error description: The handle is invalid. Reason: The filter driver was unloaded unexpectedly.

5/13/2013 4:57:37 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80070006 Error description: The handle is invalid. Reason: The filter driver was unloaded unexpectedly.

5/13/2013 4:49:21 PM, Error: Service Control Manager [7031] - The Microsoft Antimalware Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 15000 milliseconds: Restart the service.

5/13/2013 4:49:09 PM, Error: Microsoft Antimalware [5008] - Microsoft Antimalware engine has been terminated due to an unexpected error. Failure Type: Crash Exception code: 0xc0000005 Resource: file:C:\Program Files (x86)\PotPlayer\Uninstall.exe

5/11/2013 11:11:51 AM, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

5/10/2013 6:54:41 PM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Microsoft Antimalware Service service, but this action failed with the following error: An instance of the service is already running.

5/10/2013 6:54:21 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x80070006 Error description: The handle is invalid. Reason: The filter driver has successfully restarted.

5/10/2013 6:54:19 PM, Error: Microsoft Antimalware [5008] - Microsoft Antimalware engine has been terminated due to an unexpected error. Failure Type: Crash Exception code: 0xc0000005 Resource: process:pid:2980

5/10/2013 6:54:19 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: On Access Error Code: 0x80070006 Error description: The handle is invalid. Reason: The filter driver was unloaded unexpectedly.

5/10/2013 6:54:19 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x80070006 Error description: The handle is invalid. Reason: The filter driver was unloaded unexpectedly.

5/10/2013 6:54:19 PM, Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring Error Code: 0x80070006 Error description: The handle is invalid. Reason: The filter driver was unloaded unexpectedly.

.

==== End Of File ===========================

opacupa · May 15, 2013

Oh and I have uTorrent installed, but I will not be using it during your help!

Maniac · May 15, 2013

Step 1

Please uninstall the following applications:

µTorrent

TuneUp Utilities 2013

TuneUp Utilities Language Pack (en-US)

Step 2

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Step 3

Please download AdwCleaner from here and save it on your Desktop.

Right-click on adwcleaner.exe and select Run As Administrator to launch the application.
Now click on the Search tab.
Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

In your next reply, post the following log files:

Junkware Removal Tool log
AdwCleaner log
a new fresh DDS log

opacupa · May 15, 2013

Ok, I've uninstalled uTorrent and TuneUp utilities, and ran the tests. Here are all the logs:

JRT

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 4.9.4 (05.06.2013:1)

OS: Windows 7 Ultimate x64

Ran by Gosa on Wed 05/15/2013 at 16:14:17.00

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\1clickdownload

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\babylon

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\babylontoolbar

Failed to delete: [Registry Key] HKEY_CURRENT_USER\Software\datamngr

Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\datamngr

Failed to delete: [Registry Key] HKEY_CURRENT_USER\Software\datamngr_toolbar

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\prod.cap

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\mybabylontb_rasapi32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\mybabylontb_rasmancs

Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\datamngr

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}

~~~ Files

Successfully deleted: [File] C:\eula.1028.txt

Successfully deleted: [File] C:\eula.1031.txt

Successfully deleted: [File] C:\eula.1033.txt

Successfully deleted: [File] C:\eula.1036.txt

Successfully deleted: [File] C:\eula.1040.txt

Successfully deleted: [File] C:\eula.1041.txt

Successfully deleted: [File] C:\eula.1042.txt

Successfully deleted: [File] C:\eula.2052.txt

Successfully deleted: [File] C:\install.res.1028.dll

Successfully deleted: [File] C:\install.res.1031.dll

Successfully deleted: [File] C:\install.res.1033.dll

Successfully deleted: [File] C:\install.res.1036.dll

Successfully deleted: [File] C:\install.res.1040.dll

Successfully deleted: [File] C:\install.res.1041.dll

Successfully deleted: [File] C:\install.res.1042.dll

Successfully deleted: [File] C:\install.res.2052.dll

Successfully deleted: [File] C:\install.res.3082.dll

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\babylon"

Successfully deleted: [Folder] "C:\ProgramData\tarma installer"

Successfully deleted: [Folder] "C:\ProgramData\trymedia"

Successfully deleted: [Folder] "C:\Users\Gosa\AppData\Roaming\babylon"

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Wed 05/15/2013 at 16:16:09.39

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

ADWCLEANER

# AdwCleaner v2.300 - Logfile created 05/15/2013 at 16:17:23

# Updated 28/04/2013 by Xplode

# Operating system : Windows 7 Ultimate Service Pack 1 (64 bits)

# User : Gosa - GOSA-PC

# Boot Mode : Normal

# Running from : C:\Users\Gosa\Downloads\adwcleaner.exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

***** [Registry] *****

Key Found : HKCU\Software\DataMngr

Key Found : HKCU\Software\DataMngr_Toolbar

Key Found : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}

Key Found : HKLM\Software\DataMngr

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}

Key Found : HKLM\SOFTWARE\Tarma Installer

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

-\\ Mozilla Firefox v [unable to get version]

File : C:\Users\Gosa\AppData\Roaming\Mozilla\Firefox\Profiles\dc5ftd9h.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v [unable to get version]

File : C:\Users\Gosa\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [1350 octets] - [15/05/2013 16:17:23]

########## EOF - C:\AdwCleaner[R1].txt - [1410 octets] ##########

DDS - NEW

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer:

Run by Gosa at 16:18:17 on 2013-05-15

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.8174.6199 [GMT 2:00]

.

AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\atieclxx.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\taskhost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\Dwm.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files (x86)\SVP\SVPMgr.exe

C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\system32\msiexec.exe

C:\Windows\System32\svchost.exe -k swprv

C:\Windows\explorer.exe

C:\Windows\SysWOW64\notepad.exe

C:\Program Files\Nightly\firefox.exe

C:\Windows\system32\NOTEPAD.EXE