Jump to content

Computer Infected with Numerous Viruses


Recommended Posts

Hello Brandon! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

  • If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.
  • I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
  • Make sure you read all of the instructions and fixes thoroughly before continuing with them.
  • Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
  • Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.
  • Do not perform any kind of scanning and fixing without my instructions. If you want to proceed on your own, please let me know.

Please follow the instructions here and post your log files:

http://forums.malwarebytes.org/index.php?showtopic=9573

Link to post
Share on other sites

Thanks for the help!

Here is DDS Attach:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume2

Install Date: 1/17/2012 2:14:02 AM

System Uptime: 5/15/2013 2:03:45 PM (3 hours ago)

.

Motherboard: ASUSTeK Computer Inc. | | K54C

Processor: Intel® Core i3-2350M CPU @ 2.30GHz | CPU 1 | 782/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 119 GiB total, 75.749 GiB free.

D: is FIXED (NTFS) - 154 GiB total, 153.759 GiB free.

E: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

.

==== Installed Programs ======================

.

??????? Windows Live Mesh ActiveX ??(????)

??????? Windows Live Mesh ActiveX ???

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader XI (11.0.02)

Alcor Micro USB Card Reader

Ask Toolbar

Ask Toolbar Updater

Asmedia ASM104x USB 3.0 Host Controller Driver

ASUS AI Recovery

ASUS FaceLogon

ASUS FancyStart

ASUS LifeFrame3

ASUS Live Update

ASUS Power4Gear Hybrid

ASUS Virtual Camera

ASUS WebStorage

ASUS_Screensaver

AsusVibe2.0

ATK Package

Bejeweled 2 Deluxe

Bing Bar

Contrôle ActiveX Windows Live Mesh pour connexions à distance

Control ActiveX de Windows Live Mesh para conexiones remotas

Controlo ActiveX do Windows Live Mesh para Ligações Remotas

CyberLink LabelPrint

CyberLink Media Suite

CyberLink Power2Go

D3DX10

DomaIQ

Driver Pro v3.0

Facebook Video Calling 1.2.0.287

Fast Boot

Galeria de Fotografias do Windows Live

Galerie de photos Windows Live

Galería fotográfica de Windows Live

Google Chrome

Google Update Helper

HiJackThis

InstantOn for NB

Intel® Control Center

Intel® Management Engine Components

Intel® Processor Graphics

InternetHelper3 Firefox Toolbar

Java 7 Update 17

Java Auto Updater

JavaFX 2.1.1

Junk Mail filter update

Malwarebytes Anti-Malware version 1.75.0.1300

Mesh Runtime

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Application Error Reporting

Microsoft Office 2010

Microsoft Office Click-to-Run 2010

Microsoft Office Starter 2010 - English

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2005 Redistributable (x64)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Mozilla Firefox 20.0.1 (x86 en-US)

Mozilla Maintenance Service

MSVCRT

MSVCRT_amd64

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Norton AntiVirus

Norton Identity Safe

Nuance PDF Reader

Optimizer Pro v3.0

PC Health Kit v3.2

Qualcomm Atheros WiFi Driver Installation

Realtek High Definition Audio Driver

Recipe Hub toolbar

Search Protect by conduit

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

Security Update for Microsoft .NET Framework 4 Extended (KB2656351)

Security Update for Microsoft .NET Framework 4 Extended (KB2736428)

Security Update for Microsoft .NET Framework 4 Extended (KB2742595)

Software Version Updater

Sonic Focus

Strongvault Online Backup

Supreme Savings

Synaptics Pointing Device Driver

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft .NET Framework 4 Extended (KB2468871)

Update for Microsoft .NET Framework 4 Extended (KB2533523)

Update for Microsoft .NET Framework 4 Extended (KB2600217)

Updater By SweetPacks 2.0.0.566

VAFPlayer

Windows Live

Windows Live ???

Windows Live ????

Windows Live Communications Platform

Windows Live Essentials

Windows Live Family Safety

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Language Selector

Windows Live Mail

Windows Live Mesh

Windows Live Mesh ActiveX Control for Remote Connections

Windows Live Messenger

Windows Live MIME IFilter

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live Remote Client

Windows Live Remote Client Resources

Windows Live Remote Service

Windows Live Remote Service Resources

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

WinFlash

Wireless Console 3

Yahoo! Software Update

Yahoo! Toolbar

Yontoo 2.051

.

==== End Of File ===========================

Here is the other log:

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 10.0.9200.16537 BrowserJavaVersion: 10.17.2

Run by peg at 17:22:03 on 2013-05-15

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4000.1059 [GMT -4:00]

.

AV: Norton AntiVirus *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton AntiVirus *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\FBAgent.exe

C:\Windows\system32\WLANExt.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe

C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe

C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\ccSvcHst.exe

C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\PROGRA~2\RECIPE~2\bar\1.bin\2jbarsvc.exe

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe

C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe

C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\ASUS\P4G\BatteryLife.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe

C:\Program Files (x86)\ASUS\FaceLogon\sensorsrv.exe

C:\Windows\system32\Dwm.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe

C:\Windows\Explorer.EXE

C:\Windows\AsScrPro.exe

C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files (x86)\Strongvault Online Backup\BackupAgent.exe

C:\Windows\System32\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe

C:\PROGRA~3\rundll32.exe

C:\PROGRA~3\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe

C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe

C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

C:\Windows\system32\ctfmon.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\wuauclt.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\ccSvcHst.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.yahoo.com/?fr=fp-yie10

uWindow Title = Windows Internet Explorer provided by Yahoo!

uDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie10

mStart Page = hxxp://www.google.com

uProxyOverride = <local>

uURLSearchHooks: <No Name>: {cc8ae5b8-005b-4b1a-a27d-307eddffe5c8} -

uURLSearchHooks: YTNavAssistPlugin Class: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll

mWinlogon: Userinit = C:\Windows\System32\userinit.exe

BHO: Toolbar BHO: {06e3475c-5521-4de8-bb12-50720f21631c} -

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\IPS\IPSBHO.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Norton Identity Protection: {AB4C7833-A6EC-433f-B9FE-6B14B1A2F836} - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\CoIEPlg.dll

BHO: Search Assistant BHO: {b7acdf9c-c4f9-4d5d-998e-b147866b4d4c} -

BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

TB: Norton Identity Safe Toolbar: {A13C2648-91D4-4BF3-BC6D-0079707C4389} - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\CoIEPlg.dll

TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} -

TB: Recipe Hub: {cf51de5b-eb36-4114-bb69-84df63fbadb4} -

TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll

TB: Norton Identity Safe Toolbar: {A13C2648-91D4-4bf3-BC6D-0079707C4389} - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\CoIEPlg.dll

uRun: [Facebook Update] "C:\Users\peg\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

uRun: [backupAgent] C:\Program Files (x86)\Strongvault Online Backup\BackupAgent.exe

uRun: [Driver Pro] C:\Program Files (x86)\Driver Pro\DPLauncher.exe

uRun: [ctfmon.exe] C:\PROGRA~3\rundll32.exe C:\PROGRA~3\43d3.dat,FG00

mRun: [Nuance PDF Reader-reminder] "C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\PDF Reader\Ereg\Ereg.ini"

mRun: [ASUSPRP] "C:\Program Files (x86)\ASUS\APRP\APRP.EXE"

mRun: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe /S

mRun: [sonicMasterTray] C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe

mRun: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe

mRun: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

mRun: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe

mRun: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [EKIJ5000StatusMonitor] C:\Windows\System32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe

mRunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

StartupFolder: C:\Users\peg\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\msconfig.lnk - C:\Windows\System32\rundll32.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\ASUSVI~1.LNK - C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\FANCYS~1.LNK - C:\Windows\Installer\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}\_77B5857C27147149171BE7.exe

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

TCP: NameServer = 192.168.0.1

TCP: Interfaces\{E4EE1EFE-5953-489B-9C59-8FD50AAFCDA2} : DHCPNameServer = 192.168.0.1

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

SSODL: WebCheck - <orphaned>

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - C:\Windows\System32\rundll32.exe C:\Windows\System32\advpack.dll,LaunchINFSectionEx C:\Program Files (x86)\Internet Explorer\clrtour.inf,DefaultInstall.ResetTour,,12

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-BHO: Updater By SweetPacks: {C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD} - C:\Program Files\Updater By SweetPacks\Extension64.dll

x64-Run: [synTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe

x64-Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

x64-Run: [synAsusAcpi] C:\Program Files (x86)\Synaptics\SynTP\SynAsusAcpi.exe

x64-Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /SF3

x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

x64-Run: [EKIJ5000StatusMonitor] C:\Windows\System32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe

x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

x64-Notify: igfxcui - igfxdev.dll

x64-SSODL: WebCheck - <orphaned>

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\

FF - prefs.js: browser.search.selectedEngine - Norton Safe Search

FF - prefs.js: network.proxy.type - 0

FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Users\peg\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll

FF - plugin: C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\extensions\{b920380d-fbe7-45c7-96ab-37e9870a566c}\plugins\np-mswmp.dll

FF - plugin: C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\extensions\{b920380d-fbe7-45c7-96ab-37e9870a566c}\plugins\npConduitFirefoxPlugin.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll

FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll

FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

FF - ExtSQL: 2013-04-21 18:47; {b920380d-fbe7-45c7-96ab-37e9870a566c}; C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\extensions\{b920380d-fbe7-45c7-96ab-37e9870a566c}

FF - ExtSQL: 2013-05-06 21:20; {BBDA0591-3099-440a-AA10-41764D9DB4DB}; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.3.1.22\IPSFFPlgn

FF - ExtSQL: 2013-05-06 21:54; {F04D2D30-776C-4d02-8627-8E4385ECA58D}; C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2013.3.3.19\coFFPlgn

.

============= SERVICES / DRIVERS ===============

.

R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\NAVx64\1403010.016\SymDS64.sys [2013-5-6 493656]

R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\NAVx64\1403010.016\SymEFA64.sys [2013-5-6 1139800]

R1 ATKWMIACPIIO_;ATKWMIACPI Driver_;C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2011-9-7 17536]

R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.3.1.22\Definitions\BASHDefs\20130502.001\BHDrvx64.sys [2013-5-7 1390680]

R1 ccSet_NAV;Norton AntiVirus Settings Manager;C:\Windows\System32\drivers\NAVx64\1403010.016\ccSetx64.sys [2013-5-6 168096]

R1 ccSet_NST;Norton Identity Safe Settings Manager;C:\Windows\System32\drivers\NSTx64\7DD03030.013\ccSetx64.sys [2013-5-6 168096]

R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.3.1.22\Definitions\IPSDefs\20130514.001\IDSviA64.sys [2013-5-15 513184]

R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\NAVx64\1403010.016\Ironx64.sys [2013-5-6 224416]

R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\NAVx64\1403010.016\symnets.sys [2013-5-6 432800]

R2 AFBAgent;AFBAgent;C:\Windows\System32\FBAgent.exe [2011-12-10 379520]

R2 ASMMAP64;ASMMAP64;C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-7-2 15416]

R2 ASUS InstantOn;ASUS InstantOn Service;C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe [2012-2-16 277120]

R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-5-15 418376]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-5-15 701512]

R2 NAV;Norton AntiVirus;C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\ccSvcHst.exe [2013-5-6 144520]

R2 NCO;Norton Identity Safe;C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe [2013-5-6 144520]

R2 RecipeHub_2jService;Recipe HubService;C:\PROGRA~2\RECIPE~2\bar\1.bin\2jbarsvc.exe [2013-3-16 42504]

R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776]

R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-12-10 2656280]

R3 asmthub3;ASMedia USB3 Hub Service;C:\Windows\System32\drivers\asmthub3.sys [2011-11-22 130024]

R3 asmtxhci;ASMEDIA XHCI Service;C:\Windows\System32\drivers\asmtxhci.sys [2011-11-22 395752]

R3 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.EXE [2012-6-11 240208]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-5-7 138912]

R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2011-11-3 317440]

R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2011-10-17 76912]

R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-5-15 25928]

R3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2011-10-1 764264]

R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2011-10-1 268648]

R3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2011-10-1 25960]

R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2011-10-1 22376]

R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496]

S2 BBSvc;BingBar Service;C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.EXE [2012-6-11 193616]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2011-10-18 48488]

S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2011-5-13 1492840]

S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\System32\drivers\SiSG664.sys [2009-6-10 56832]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-2-18 59392]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2011-2-18 31232]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-1-20 1255736]

S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

.

=============== Created Last 30 ================

.

2013-05-15 21:17:44 -------- d-----w- C:\Users\peg\AppData\Roaming\Malwarebytes

2013-05-15 21:17:32 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

2013-05-15 21:17:32 -------- d-----w- C:\ProgramData\Malwarebytes

2013-05-15 21:17:31 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-05-12 21:17:30 -------- d-----w- C:\Users\peg\AppData\Local\ Online Backup

2013-05-12 20:30:28 -------- d-----w- C:\Windows\ERUNT

2013-05-12 20:30:22 -------- d-----w- C:\JRT

2013-05-12 20:29:22 388096 ----a-r- C:\Users\peg\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2013-05-12 20:29:22 -------- d-----w- C:\Program Files (x86)\Trend Micro

2013-05-07 21:01:19 -------- d-----w- C:\Users\peg\AppData\Local\NPE

2013-05-07 01:54:11 168096 ----a-r- C:\Windows\System32\drivers\NSTx64\7DD03030.013\ccSetx64.sys

2013-05-07 01:54:03 -------- d-----w- C:\Windows\System32\drivers\NSTx64\7DD03030.013

2013-05-07 01:54:03 -------- d-----w- C:\Windows\System32\drivers\NSTx64

2013-05-07 01:54:02 -------- d-----w- C:\Program Files (x86)\Norton Identity Safe

2013-05-07 01:53:55 177312 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS

2013-05-07 01:53:54 -------- d-----w- C:\Program Files\Symantec

2013-05-07 01:53:54 -------- d-----w- C:\Program Files\Common Files\Symantec Shared

2013-05-07 01:52:57 432800 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\symnets.sys

2013-05-07 01:52:57 23448 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\SymELAM.sys

2013-05-07 01:52:57 1139800 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\SymEFA64.sys

2013-05-07 01:52:56 796248 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\srtsp64.sys

2013-05-07 01:52:56 493656 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\SymDS64.sys

2013-05-07 01:52:56 36952 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\srtspx64.sys

2013-05-07 01:52:56 224416 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\Ironx64.sys

2013-05-07 01:52:56 168096 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\ccSetx64.sys

2013-05-07 01:52:23 -------- d-----w- C:\Windows\System32\drivers\NAVx64\1403010.016

2013-05-07 01:52:23 -------- d-----w- C:\Windows\System32\drivers\NAVx64

2013-05-07 01:52:22 -------- d-----w- C:\Program Files (x86)\Norton AntiVirus

2013-05-07 01:46:35 -------- d-----w- C:\ProgramData\PCSettings

2013-05-07 01:22:26 -------- d-----w- C:\Program Files (x86)\Common Files\Symantec Shared

2013-05-07 01:15:55 -------- d-----w- C:\ProgramData\NortonInstaller

2013-05-07 01:15:55 -------- d-----w- C:\Program Files (x86)\NortonInstaller

2013-05-07 00:32:41 -------- d-----w- C:\ProgramData\Norton

2013-05-01 00:58:15 140800 ----a-w- C:\ProgramData\39ri.dat

2013-05-01 00:58:12 44544 ----a-w- C:\ProgramData\rundll32.exe

2013-05-01 00:58:12 140800 ----a-w- C:\ProgramData\43d3.dat

2013-04-23 23:23:34 1656680 ----a-w- C:\Windows\System32\drivers\ntfs.sys

2013-04-22 23:12:40 -------- d-----w- C:\Windows\pss

2013-04-21 22:49:21 -------- d-----w- C:\Users\peg\AppData\Roaming\PC Health Kit

2013-04-21 22:49:17 -------- d-----w- C:\Program Files (x86)\PC Health Kit

2013-04-15 22:38:16 -------- d-----w- C:\Program Files (x86)\MSXML 4.0

.

==================== Find3M ====================

.

2013-04-21 22:51:30 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2013-04-21 22:51:30 691592 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2013-04-11 14:22:56 770384 ----a-w- C:\Windows\SysWow64\msvcr100.dll

2013-04-11 14:22:56 421200 ----a-w- C:\Windows\SysWow64\msvcp100.dll

2013-03-29 22:57:50 9728 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-03-19 06:04:06 5550424 ----a-w- C:\Windows\System32\ntoskrnl.exe

2013-03-19 05:46:56 43520 ----a-w- C:\Windows\System32\csrsrv.dll

2013-03-19 05:04:13 3968856 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

2013-03-19 05:04:10 3913560 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

2013-03-19 04:47:50 6656 ----a-w- C:\Windows\SysWow64\apisetschema.dll

2013-03-19 03:06:33 112640 ----a-w- C:\Windows\System32\smss.exe

2013-03-17 17:42:31 95648 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll

2013-03-17 17:42:31 861088 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll

2013-03-17 17:42:31 782240 ----a-w- C:\Windows\SysWow64\deployJava1.dll

2013-03-01 03:36:04 3153408 ----a-w- C:\Windows\System32\win32k.sys

2013-02-21 10:30:16 1766912 ----a-w- C:\Windows\SysWow64\wininet.dll

2013-02-21 10:29:39 2877440 ----a-w- C:\Windows\SysWow64\jscript9.dll

2013-02-21 10:29:37 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll

2013-02-21 10:29:37 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll

2013-02-21 10:15:07 2240512 ----a-w- C:\Windows\System32\wininet.dll

2013-02-21 10:14:09 3958784 ----a-w- C:\Windows\System32\jscript9.dll

2013-02-21 10:14:05 67072 ----a-w- C:\Windows\System32\iesetup.dll

2013-02-21 10:14:05 136704 ----a-w- C:\Windows\System32\iesysprep.dll

2013-02-19 12:01:03 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2013-02-19 11:42:14 2706432 ----a-w- C:\Windows\System32\mshtml.tlb

2013-02-19 11:10:53 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe

2013-02-19 10:51:18 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe

2013-02-15 06:08:40 44032 ----a-w- C:\Windows\System32\tsgqec.dll

2013-02-15 06:06:11 3717632 ----a-w- C:\Windows\System32\mstscax.dll

2013-02-15 06:02:26 158720 ----a-w- C:\Windows\System32\aaclient.dll

2013-02-15 04:37:10 3217408 ----a-w- C:\Windows\SysWow64\mstscax.dll

2013-02-15 04:34:10 131584 ----a-w- C:\Windows\SysWow64\aaclient.dll

2013-02-15 03:25:51 36864 ----a-w- C:\Windows\SysWow64\tsgqec.dll

.

============= FINISH: 17:29:51.33 ===============

Also here is MBam's log on quick scan:

Malwarebytes Anti-Malware (Trial) 1.75.0.1300

www.malwarebytes.org

Database version: v2013.05.15.11

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 10.0.9200.16540

peg :: PEG-PC [administrator]

Protection: Enabled

5/15/2013 5:20:20 PM

MBAM-log-2013-05-15 (17-37-01).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 222007

Time elapsed: 16 minute(s), 20 second(s)

Memory Processes Detected: 2

C:\ProgramData\rundll32.exe (Trojan.Agent.Gen) -> 2804 -> No action taken.

C:\ProgramData\rundll32.exe (Trojan.Agent.Gen) -> 3620 -> No action taken.

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 4

HKCR\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9} (PUP.Software.Updater) -> No action taken.

HKCR\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476} (PUP.Software.Updater) -> No action taken.

HKCR\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67} (PUP.Software.Updater) -> No action taken.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} (PUP.Software.Updater) -> No action taken.

Registry Values Detected: 1

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|ctfmon.exe (Trojan.Agent.Gen) -> Data: C:\PROGRA~3\rundll32.exe C:\PROGRA~3\43d3.dat,FG00 -> No action taken.

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 6

C:\ProgramData\43d3.dat (Trojan.FakeMS) -> No action taken.

C:\ProgramData\39ri.dat (Trojan.FakeMS) -> No action taken.

C:\Users\peg\AppData\Local\Temp\ofi3jZF.exe (Trojan.FakeMS) -> No action taken.

C:\Users\peg\AppData\Local\Temp\DIQ\FlashPlayer_151\software\SupremeSavings.exe (Heuristics.Shuriken) -> No action taken.

C:\Windows\Tasks\AmiUpdXp.job (PUP.Software.Updater) -> No action taken.

C:\ProgramData\rundll32.exe (Trojan.Agent.Gen) -> No action taken.

(end)

Link to post
Share on other sites

Step 1

Please uninstall the following applications:

Ask Toolbar

Ask Toolbar Updater

InternetHelper3 Firefox Toolbar

Recipe Hub toolbar

Search Protect by conduit

Supreme Savings

Updater By SweetPacks 2.0.0.566

Yontoo 2.051

Step 2

Please download Junkware Removal Tool to your desktop.

  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.

Step 3

  • Launch Malwarebytes' Anti-Malware
  • Go to Update tab and select Check for Updates. If an update is found, it will download and install the latest version.
  • Go to Scanner tab and select Perform Quick Scan, then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer,please do so immediately.

Step 4

Please download AdwCleaner from here and save it on your Desktop.

  1. Right-click on adwcleaner.exe and select Run As Administrator to launch the application.
  2. Now click on the Search tab.
  3. Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

Step 5

  • Download on the desktop RogueKiller
  • Quit all programs
  • Start RogueKiller.exe
  • Wait until Prescan has finished ...
  • Click on Scan. Click on Report and copy/paste the content of the notepad in your next reply.

In your next reply, post the following log files:

  • Junkware Removal Tool log
  • Malwarebytes' Anti-Malware log
  • AdwCleaner log
  • RogueKiller log
  • a new fresh DDS log

Link to post
Share on other sites

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 4.9.4 (05.06.2013:1)

OS: Windows 7 Home Premium x64

Ran by peg on Thu 05/16/2013 at 13:55:56.98

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\conduit

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\Software\smartbar

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\Users\peg\appdata\local\strongvault online backup"

Failed to delete: [Folder] "C:\Program Files (x86)\recipehub_2j"

Failed to delete: [Folder] "C:\Program Files (x86)\strongvault online backup"

~~~ FireFox

Successfully deleted: [Folder] C:\Users\peg\AppData\Roaming\mozilla\firefox\profiles\w8013kzv.default\smartbar

Successfully deleted: [Folder] C:\Users\peg\AppData\Roaming\mozilla\firefox\profiles\w8013kzv.default\extensions\staged

Successfully deleted the following from C:\Users\peg\AppData\Roaming\mozilla\firefox\profiles\w8013kzv.default\prefs.js

user_pref("CT3277370.1000234.weatherData", "{\"icon\":\"34.png\",\"temperature\":\"75°F\",\"temperatureClear\":\"75°F\",\"highTemperature\":\"80°F\",\"lowTemperature\":\"51

user_pref("CT3277370.embeddedsData", "[{\"appId\":\"130021582164426878\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"get

user_pref("CT3277370.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit.com/?ctid=CT3277370&octid=CT3277370&SearchSource=15&CUI=UN2743726527155421

user_pref("CT3277370.search.searchAppId", "130021582164426878");

user_pref("CT3277370.search.searchCount", "0");

user_pref("CT3277370.smartbar.CTID", "CT3277370");

user_pref("CT3277370.smartbar.Uninstall", "0");

user_pref("CT3277370.smartbar.toolbarName", "InternetHelper3 ");

user_pref("CT3289847.embeddedsData", "[{\"appId\":\"130068661007799818\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"get

user_pref("CT3289847.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit.com/?ctid=CT3289847&octid=CT3289847&SearchSource=15&CUI=UN2447261197201281

user_pref("CT3289847.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fforums.malwarebytes.org%2Findex.php%3Fshowtopic%3D125897\",\"EB_MAIN_FRAME_TITLE\":\"I%20th

user_pref("CT3289847.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://WhiteSmokeNew.OurToolbar.com//xpi\"}");

user_pref("CT3289847.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"WhiteSmoke New\"}");

user_pref("extensions.crossriderapp19962.19962.backgroundjs", "\n\n//\n");

user_pref("extensions.crossriderapp19962.19962.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var _GPL_=function(){_GPL_PLUGIN.started||_GPL_PLUGIN.prepare({pid:1340,baseCDN:

user_pref("extensions.crossriderapp19962.19962.plugins.plugin_14.code", "if(typeof(appAPI)===\"undefined\"){appAPI={};}var CR__bIsIEWindow=false;if(typeof window!==\"undefined

user_pref("extensions.crossriderapp19962.19962.plugins.plugin_16.code", "if((typeof isBackground===\"undefined\"||isBackground!==true)&&(typeof _firefoxVersion!==\"undefined\"

user_pref("extensions.crossriderapp19962.19962.plugins.plugin_17.code", "if(typeof window!==\"undefined\"){\n/*!\n * jQuery JavaScript Library v1.4.2\n * hxxp://jquery.com/\n

user_pref("extensions.crossriderapp19962.19962.plugins.plugin_22.code", "(function(a){appAPI.queueManager={queue:[],register:function(b){this.queue.push(b);}};appAPI.ready=fun

user_pref("extensions.crossriderapp19962.19962.plugins.plugin_4.code", "var jQuery = $jquery_171 = $jquery = null;\n\nif (document && typeof document.getElementById !== \"unde

user_pref("extensions.crossriderapp19962.19962.plugins.plugin_64.code", "(function(){var h=\"__CR_EMPTY_CHANNEL__\";var d=function(j){return(typeof j===\"object\"&&j!==null);}

user_pref("extensions.crossriderapp19962.19962.plugins.plugin_78.code", "if(typeof jQuery!==\"undefined\"&&(jQuery)&&typeof navigator!==\"undefined\"&&typeof navigator.userAge

user_pref("extensions.crossriderapp19962.19962.plugins.plugin_98.code", "(function(){var b=\"cr_\"+appAPI.appID+\"internalMessage\";var a=function(){var d=function(g){if(g===t

user_pref("smartbar.machineId", "UHZACU7OVIWN/S30C/HX5TS0QUERFH6SHSTWCQHOZVZ4Q4JMDZ0QXR3GODXE7PIUYJQYDVWQ46Q9F2STYBDXZW");

user_pref("sweetim.toolbar.scripts.0.domain-whitelist", "hxxp://(www.|apps.)?facebook\\.com.*");

user_pref("sweetim.toolbar.scripts.1.domain-whitelist", "hxxps://(www.|apps.)?facebook\\.com.*");

user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engine=\"hxxp://*google.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://sear

user_pref("{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}.ScriptData_WSG_whiteList", "{\"search.babylon.com\":\"q\",\"search.imesh.net\":\"q\",\"www.search-results.com\":\"q\",\"home.

Emptied folder: C:\Users\peg\AppData\Roaming\mozilla\firefox\profiles\w8013kzv.default\minidumps [4 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Thu 05/16/2013 at 14:01:21.19

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Malwarebytes Anti-Malware (Trial) 1.75.0.1300

www.malwarebytes.org

Database version: v2013.05.15.11

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 10.0.9200.16540

peg :: PEG-PC [administrator]

Protection: Enabled

5/15/2013 5:20:20 PM

MBAM-log-2013-05-15 (17-37-01).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 222007

Time elapsed: 16 minute(s), 20 second(s)

Memory Processes Detected: 2

C:\ProgramData\rundll32.exe (Trojan.Agent.Gen) -> 2804 -> No action taken.

C:\ProgramData\rundll32.exe (Trojan.Agent.Gen) -> 3620 -> No action taken.

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 4

HKCR\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9} (PUP.Software.Updater) -> No action taken.

HKCR\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476} (PUP.Software.Updater) -> No action taken.

HKCR\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67} (PUP.Software.Updater) -> No action taken.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} (PUP.Software.Updater) -> No action taken.

Registry Values Detected: 1

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|ctfmon.exe (Trojan.Agent.Gen) -> Data: C:\PROGRA~3\rundll32.exe C:\PROGRA~3\43d3.dat,FG00 -> No action taken.

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 6

C:\ProgramData\43d3.dat (Trojan.FakeMS) -> No action taken.

C:\ProgramData\39ri.dat (Trojan.FakeMS) -> No action taken.

C:\Users\peg\AppData\Local\Temp\ofi3jZF.exe (Trojan.FakeMS) -> No action taken.

C:\Users\peg\AppData\Local\Temp\DIQ\FlashPlayer_151\software\SupremeSavings.exe (Heuristics.Shuriken) -> No action taken.

C:\Windows\Tasks\AmiUpdXp.job (PUP.Software.Updater) -> No action taken.

C:\ProgramData\rundll32.exe (Trojan.Agent.Gen) -> No action taken.

(end)

# AdwCleaner v2.300 - Logfile created 05/16/2013 at 14:54:05

# Updated 28/04/2013 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : peg - PEG-PC

# Boot Mode : Normal

# Running from : C:\Users\peg\Desktop\adwcleaner.exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

Folder Found : C:\Program Files\DomaIQ Uninstaller

Folder Found : C:\Users\peg\AppData\Local\APN

Folder Found : C:\Users\peg\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihkeoookbpemkdccdccdmacnidhooohk

Folder Found : C:\Users\peg\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj

Folder Found : C:\Users\peg\AppData\Local\Temp\CT3277370

Folder Found : C:\Users\peg\AppData\Local\Updater19962

Folder Found : C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\CT3277370

Folder Found : C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\extensions\{b920380d-fbe7-45c7-96ab-37e9870a566c}

Folder Found : C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\Smartbar

Folder Found : C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\SweetPacksToolbarData

***** [Registry] *****

Key Found : HKCU\Software\AppDataLow\Software\SmartBar

Key Found : HKCU\Software\AppDataLow\Software\Supreme Savings

Key Found : HKCU\Software\Conduit

Key Found : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}

Key Found : HKCU\Software\SearchProtect

Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

Key Found : HKLM\Software\Classes\Installer\Features\90C64EA18BA25EE488BF80DCF07F2FFD

Key Found : HKLM\Software\Classes\Installer\Products\90C64EA18BA25EE488BF80DCF07F2FFD

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{03119103-0854-469D-807A-171568457991}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}

Key Found : HKLM\Software\GamesBarSetup

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Found : HKLM\Software\SearchProtect

Key Found : HKLM\Software\Supreme Savings

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{13119113-0854-469D-807A-171568457991}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{33119133-0854-469D-807A-171568457991}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{23119123-0854-469D-807A-171568457991}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DomaIQ Uninstaller

Key Found : HKLM\SOFTWARE\Classes\Interface\{23119123-0854-469D-807A-171568457991}

Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

Key Found : HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}

Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF

Key Found : HKLM\SOFTWARE\Tarma Installer

Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EEE6C35B-6118-11DC-9C72-001320C79847}]

Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

***** [internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16576

[OK] Registry is clean.

-\\ Mozilla Firefox v20.0.1 (en-US)

File : C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\prefs.js

Found : user_pref("CT3277370.1000082.isPlayDisplay", "true");

Found : user_pref("CT3277370.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description[...]

Found : user_pref("CT3277370.1000234.TWC_TMP_city", "ALLENTOWN");

Found : user_pref("CT3277370.1000234.TWC_TMP_country", "US");

Found : user_pref("CT3277370.1000234.TWC_country", "UNITED STATES");

Found : user_pref("CT3277370.1000234.TWC_locId", "USPA0025");

Found : user_pref("CT3277370.1000234.TWC_location", "Allentown, PA");

Found : user_pref("CT3277370.1000234.TWC_region", "US");

Found : user_pref("CT3277370.1000234.TWC_temp_dis", "f");

Found : user_pref("CT3277370.1000234.TWC_wind_dis", "mph");

Found : user_pref("CT3277370.1000234.weatherData", "{\"icon\":\"34.png\",\"temperature\":\"79°F\",\"temperat[...]

Found : user_pref("CT3277370.CT3277370ads1.enc", "JTdCJTIyYWRzJTIyJTNBJTVCJTdCJTIyYWlkJTIyJTNBJTIyNDQ5NzAlMj[...]

Found : user_pref("CT3277370.CT3277370current_term.enc", "");

Found : user_pref("CT3277370.CT3277370sdate.enc", "MTY=");

Found : user_pref("CT3277370.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");

Found : user_pref("CT3277370.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]

Found : user_pref("CT3277370.FF19Solved", "true");

Found : user_pref("CT3277370.FirstTime", "true");

Found : user_pref("CT3277370.FirstTimeFF3", "true");

Found : user_pref("CT3277370.UserID", "UN27437265271554213");

Found : user_pref("CT3277370.addressBarTakeOverEnabledInHidden", "true");

Found : user_pref("CT3277370.autoDisableScopes", -1);

Found : user_pref("CT3277370.browser.search.defaultthis.engineName", "true");

Found : user_pref("CT3277370.defaultSearch", "true");

Found : user_pref("CT3277370.embeddedsData", "[{\"appId\":\"130021582164426878\",\"apiPermissions\":{\"cross[...]

Found : user_pref("CT3277370.enableAlerts", "true");

Found : user_pref("CT3277370.enableFix404ByUser", "FALSE");

Found : user_pref("CT3277370.enableSearchFromAddressBar", "true");

Found : user_pref("CT3277370.firstTimeDialogOpened", "true");

Found : user_pref("CT3277370.fixPageNotFoundError", "true");

Found : user_pref("CT3277370.fixPageNotFoundErrorByUser", "true");

Found : user_pref("CT3277370.fixPageNotFoundErrorInHidden", "true");

Found : user_pref("CT3277370.fixUrls", true);

Found : user_pref("CT3277370.hxxp___pinterest_aot_im.isEnabled.enc", "WQ==");

Found : user_pref("CT3277370.installDate", "21/4/2013 18:47:25");

Found : user_pref("CT3277370.installId", "stub.exe");

Found : user_pref("CT3277370.installSessionId", "{2860EC0F-FF88-4E1B-893F-82C19D399F3A}");

Found : user_pref("CT3277370.installSp", "TRUE");

Found : user_pref("CT3277370.installUsage", "2013-04-22T02:10:33.3749993+03:00");

Found : user_pref("CT3277370.installUsageEarly", "2013-04-22T02:10:30.2237589+03:00");

Found : user_pref("CT3277370.installerVersion", "1.4.1.3");

Found : user_pref("CT3277370.isCheckedStartAsHidden", true);

Found : user_pref("CT3277370.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");

Found : user_pref("CT3277370.isFirstTimeToolbarLoading", "false");

Found : user_pref("CT3277370.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");

Found : user_pref("CT3277370.keyword", "true");

Found : user_pref("CT3277370.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit[...]

Found : user_pref("CT3277370.lastVersion", "10.16.1.521");

Found : user_pref("CT3277370.mam_gk_installer_preapproved.enc", "ZmFsc2U=");

Found : user_pref("CT3277370.migrateAppsAndComponents", true);

Found : user_pref("CT3277370.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"\",\"[...]

Found : user_pref("CT3277370.openThankYouPage", "false");

Found : user_pref("CT3277370.openUninstallPage", "true");

Found : user_pref("CT3277370.revertSettingsEnabled", "false");

Found : user_pref("CT3277370.search.searchAppId", "130021582164426878");

Found : user_pref("CT3277370.search.searchCount", "0");

Found : user_pref("CT3277370.searchFromAddressBarEnabledByUser", "true");

Found : user_pref("CT3277370.searchInNewTabEnabledByUser", "true");

Found : user_pref("CT3277370.searchInNewTabEnabledInHidden", "true");

Found : user_pref("CT3277370.searchRevert", "false");

Found : user_pref("CT3277370.searchUserMode", "2");

Found : user_pref("CT3277370.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");

Found : user_pref("CT3277370.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]

Found : user_pref("CT3277370.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]

Found : user_pref("CT3277370.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]

Found : user_pref("CT3277370.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]

Found : user_pref("CT3277370.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]

Found : user_pref("CT3277370.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]

Found : user_pref("CT3277370.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1368652166791");

Found : user_pref("CT3277370.serviceLayer_services_appsMetadata_lastUpdate", "1368729106334");

Found : user_pref("CT3277370.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1367897403133");

Found : user_pref("CT3277370.serviceLayer_services_installUsage_ToolbarInstallEarly_lastUpdate", "1366585829[...]

Found : user_pref("CT3277370.serviceLayer_services_installUsage_ToolbarInstall_lastUpdate", "1366585833392")[...]

Found : user_pref("CT3277370.serviceLayer_services_location_lastUpdate", "1368652166571");

Found : user_pref("CT3277370.serviceLayer_services_login_10.15.2.23_lastUpdate", "1366838100366");

Found : user_pref("CT3277370.serviceLayer_services_login_10.15.2.523_lastUpdate", "1368233827490");

Found : user_pref("CT3277370.serviceLayer_services_login_10.16.1.521_lastUpdate", "1368729223368");

Found : user_pref("CT3277370.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1367897387442");

Found : user_pref("CT3277370.serviceLayer_services_searchAPI_lastUpdate", "1368652166605");

Found : user_pref("CT3277370.serviceLayer_services_serviceMap_lastUpdate", "1368652166391");

Found : user_pref("CT3277370.serviceLayer_services_toolbarContextMenu_lastUpdate", "1367897392177");

Found : user_pref("CT3277370.serviceLayer_services_toolbarSettings_lastUpdate", "1368729106171");

Found : user_pref("CT3277370.serviceLayer_services_translation_lastUpdate", "1368652166783");

Found : user_pref("CT3277370.settingsINI", true);

Found : user_pref("CT3277370.shouldFirstTimeDialog", "false");

Found : user_pref("CT3277370.showToolbarPermission", "false");

Found : user_pref("CT3277370.smartbar.CTID", "CT3277370");

Found : user_pref("CT3277370.smartbar.Uninstall", "0");

Found : user_pref("CT3277370.smartbar.toolbarName", "InternetHelper3 ");

Found : user_pref("CT3277370.startPage", "true");

Found : user_pref("CT3277370.toolbarBornServerTime", "22-4-2013");

Found : user_pref("CT3277370.toolbarCurrentServerTime", "16-5-2013");

Found : user_pref("CT3277370.toolbarLoginClientTime", "Sun Apr 21 2013 19:10:34 GMT-0400 (Eastern Daylight T[...]

Found : user_pref("CT3277370.versionFromInstaller", "10.15.2.23");

Found : user_pref("CT3277370_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]

Found : user_pref("CT3289847.1000082.isPlayDisplay", "true");

Found : user_pref("CT3289847.1000082.state", "{\"state\":\"stopped\",\"text\":\"1.FM (Cou...\",\"description[...]

Found : user_pref("CT3289847.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");

Found : user_pref("CT3289847.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]

Found : user_pref("CT3289847.FF19Solved", "true");

Found : user_pref("CT3289847.FirstTime", "true");

Found : user_pref("CT3289847.FirstTimeFF3", "true");

Found : user_pref("CT3289847.PG_ENABLE", "dHJ1ZQ==");

Found : user_pref("CT3289847.PG_ENABLE.enc", "dHJ1ZQ==");

Found : user_pref("CT3289847.SF_JUST_INSTALLED.enc", "RkFMU0U=");

Found : user_pref("CT3289847.SF_STATUS.enc", "RU5BQkxFRA==");

Found : user_pref("CT3289847.SF_USER_ID.enc", "Y2lkXzI4NDIwMTMxMDE2NzUwODU0ODQ=");

Found : user_pref("CT3289847.UserID", "UN24472611972012819");

Found : user_pref("CT3289847.addressBarTakeOverEnabledInHidden", "true");

Found : user_pref("CT3289847.browser.search.defaultthis.engineName", "true");

Found : user_pref("CT3289847.cb_experience_000.enc", "NA==");

Found : user_pref("CT3289847.cb_firstuse0100.enc", "MQ==");

Found : user_pref("CT3289847.cb_user_id_000.enc", "Q0I2Mjc0OTIwNTY4ODVfMTM2ODM5MDQwMTA1M19GaXJlZm94");

Found : user_pref("CT3289847.cbfirsttime.enc", "U3VuIE1heSAxMiAyMDEzIDE2OjI2OjQxIEdNVC0wNDAwIChFYXN0ZXJuIERh[...]

Found : user_pref("CT3289847.defaultSearch", "true");

Found : user_pref("CT3289847.embeddedsData", "[{\"appId\":\"130068661007799818\",\"apiPermissions\":{\"cross[...]

Found : user_pref("CT3289847.enableAlerts", "true");

Found : user_pref("CT3289847.enableFix404ByUser", "TRUE");

Found : user_pref("CT3289847.enableSearchFromAddressBar", "true");

Found : user_pref("CT3289847.firstTimeDialogOpened", "true");

Found : user_pref("CT3289847.first_time_search.enc", "MQ==");

Found : user_pref("CT3289847.fixPageNotFoundError", "true");

Found : user_pref("CT3289847.fixPageNotFoundErrorByUser", "true");

Found : user_pref("CT3289847.fixPageNotFoundErrorInHidden", "true");

Found : user_pref("CT3289847.fixUrls", true);

Found : user_pref("CT3289847.hxxp___api16_similarsites_com.pid2.enc", "OTllYjk1OWRkZTk5YmFjOQ==");

Found : user_pref("CT3289847.hxxp___api18_similarsites_com.pid2.enc", "OTllYjk1OWRkZTk5YmFjOQ==");

Found : user_pref("CT3289847.hxxp___api28_starwebnet_com.pid2.enc", "NzZlOTUzYTMtN2Q5Zi1jY2YzLTcxZTktZDI1ZDV[...]

Found : user_pref("CT3289847.hxxp___api29_starwebnet_com.pid2.enc", "YmI3MGRlODYtM2Q5Yy1mNDJkLWRjYjYtMWMxYTc[...]

Found : user_pref("CT3289847.hxxp___api30_starwebnet_com.pid2.enc", "NGYxNTJlNTAtN2M4My1kM2I5LWJlZGMtNWU4YTl[...]

Found : user_pref("CT3289847.hxxp___api31_starwebnet_com.pid2.enc", "ODMxNzM1MTEtYzNlNS1lODY0LTBjMjQtMmQ1NDg[...]

Found : user_pref("CT3289847.hxxp___api32_starwebnet_com.pid2.enc", "MWU0NjIyYjgtYWFkOS05MTA5LTU0OTUtOGZiMDJ[...]

Found : user_pref("CT3289847.hxxp___toolbar_jollywallet_com_tlb_2.Affiliate_defaultGui.enc", "eyJndWkiOltdLC[...]

Found : user_pref("CT3289847.hxxp___toolbar_jollywallet_com_tlb_2.Affiliate_settings.enc", "eyJpbml0VXJsIjoi[...]

Found : user_pref("CT3289847.hxxp___toolbar_jollywallet_com_tlb_2.jw_token.enc", "ZTc3MDExY2UtYmI1MS1lNDA0LT[...]

Found : user_pref("CT3289847.hxxp___toolbar_jollywallet_com_tlb_2.key_list_id.enc", "MjAxMjA4MDItMDAw");

Found : user_pref("CT3289847.installDate", "14/4/2013 0:31:48");

Found : user_pref("CT3289847.installId", "9818");

Found : user_pref("CT3289847.installerVersion", "1.3.7.3");

Found : user_pref("CT3289847.isCheckedStartAsHidden", true);

Found : user_pref("CT3289847.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");

Found : user_pref("CT3289847.isFirstTimeToolbarLoading", "false");

Found : user_pref("CT3289847.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");

Found : user_pref("CT3289847.keyword", "true");

Found : user_pref("CT3289847.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit[...]

Found : user_pref("CT3289847.lastVersion", "10.15.0.562");

Found : user_pref("CT3289847.mam_gk_appStateReportTime.enc", "MTM2ODM5MDM0NjMzMA==");

Found : user_pref("CT3289847.mam_gk_appState_CouponBuddy.enc", "b24=");

Found : user_pref("CT3289847.mam_gk_appState_PriceGong.enc", "b24=");

Found : user_pref("CT3289847.mam_gk_appsDefaultEnabled.enc", "bnVsbA==");

Found : user_pref("CT3289847.mam_gk_configuration.enc", "eyJjb25maWd1cmF0aW9uIjpbeyJpZCI6IkNvdXBvbkJ1ZGR5Iiw[...]

Found : user_pref("CT3289847.mam_gk_currentVersion.enc", "MS40LjQuNg==");

Found : user_pref("CT3289847.mam_gk_eventsCache.enc", "eyJjMDVhNTk2NS1iM2JkLTQyOTYtOTFjZC01NjNkYzczMDc3YjIiO[...]

Found : user_pref("CT3289847.mam_gk_first_time.enc", "MQ==");

Found : user_pref("CT3289847.mam_gk_gadgetOpen.enc", "d2VsY29tZQ==");

Found : user_pref("CT3289847.mam_gk_installer_preapproved.enc", "ZmFsc2U=");

Found : user_pref("CT3289847.mam_gk_lastLoginTime.enc", "MTM2ODM5MDM0MjMyMw==");

Found : user_pref("CT3289847.mam_gk_localization.enc", "eyJnYWRnZXRDb250ZW50UG9saWN5Ijp7IlRleHQiOiJDb250ZW50[...]

Found : user_pref("CT3289847.mam_gk_pgUnloadedOnce.enc", "dHJ1ZQ==");

Found : user_pref("CT3289847.mam_gk_settings1.4.4.6.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVyd[...]

Found : user_pref("CT3289847.mam_gk_showCloseButton.enc", "dHJ1ZQ==");

Found : user_pref("CT3289847.mam_gk_showWelcomeGadget.enc", "ZmFsc2U=");

Found : user_pref("CT3289847.mam_gk_userId.enc", "YTkxNWMzN2QtNzNhNy00MmNhLTg0NzYtMmNhMWIxMzQxMWZh");

Found : user_pref("CT3289847.migrateAppsAndComponents", true);

Found : user_pref("CT3289847.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fforums.malwareby[...]

Found : user_pref("CT3289847.newSettings", "{\"dataType\":\"boolean\",\"data\":\"true\"}");

Found : user_pref("CT3289847.openThankYouPage", "false");

Found : user_pref("CT3289847.openUninstallPage", "true");

Found : user_pref("CT3289847.price-gong.isManagedApp", "true");

Found : user_pref("CT3289847.revertSettingsEnabled", "true");

Found : user_pref("CT3289847.searchFromAddressBarEnabledByUser", "true");

Found : user_pref("CT3289847.searchInNewTabEnabledByUser", "true");

Found : user_pref("CT3289847.searchInNewTabEnabledInHidden", "true");

Found : user_pref("CT3289847.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");

Found : user_pref("CT3289847.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]

Found : user_pref("CT3289847.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]

Found : user_pref("CT3289847.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]

Found : user_pref("CT3289847.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]

Found : user_pref("CT3289847.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]

Found : user_pref("CT3289847.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]

Found : user_pref("CT3289847.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1367779252531");

Found : user_pref("CT3289847.serviceLayer_services_appsMetadata_lastUpdate", "1368372970736");

Found : user_pref("CT3289847.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1368372970418");

Found : user_pref("CT3289847.serviceLayer_services_location_lastUpdate", "1368372983417");

Found : user_pref("CT3289847.serviceLayer_services_login_10.14.380.14_lastUpdate", "1366065463117");

Found : user_pref("CT3289847.serviceLayer_services_login_10.15.0.562_lastUpdate", "1368390457264");

Found : user_pref("CT3289847.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1368372970744");

Found : user_pref("CT3289847.serviceLayer_services_searchAPI_lastUpdate", "1368372983453");

Found : user_pref("CT3289847.serviceLayer_services_serviceMap_lastUpdate", "1368372970725");

Found : user_pref("CT3289847.serviceLayer_services_setupAPI_lastUpdate", "1365939823647");

Found : user_pref("CT3289847.serviceLayer_services_toolbarContextMenu_lastUpdate", "1368372970199");

Found : user_pref("CT3289847.serviceLayer_services_toolbarSettings_lastUpdate", "1368390456864");

Found : user_pref("CT3289847.serviceLayer_services_translation_lastUpdate", "1368372970948");

Found : user_pref("CT3289847.settingsINI", true);

Found : user_pref("CT3289847.shouldFirstTimeDialog", "false");

Found : user_pref("CT3289847.showToolbarPermission", "false");

Found : user_pref("CT3289847.startPage", "true");

Found : user_pref("CT3289847.toolbarBornServerTime", "14-4-2013");

Found : user_pref("CT3289847.toolbarCurrentServerTime", "12-5-2013");

Found : user_pref("CT3289847.toolbarLoginClientTime", "Mon Apr 15 2013 18:39:13 GMT-0400 (Eastern Daylight T[...]

Found : user_pref("CT3289847.url_history0001.enc", "aHR0cDovL2NsYXNzaWZpZWRzLnBlbm5zd29vZHMubmV0L2NsYXNzaWZp[...]

Found : user_pref("CT3289847_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]

Found : user_pref("extensions.asktb.ff-original-keyword-url", "");

Found : user_pref("extensions.crossriderapp19962.19962.backgroundjs", "\n\n//\n");

Found : user_pref("extensions.crossriderapp19962.19962.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var _[...]

Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_14.code", "if(typeof(appAPI)===\"undef[...]

Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_16.code", "if((typeof isBackground===\[...]

Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_17.code", "if(typeof window!==\"undefi[...]

Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_22.code", "(function(a){appAPI.queueMa[...]

Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_4.code", "var jQuery = $jquery_171 = $[...]

Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_64.code", "(function(){var h=\"__CR_EM[...]

Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_78.code", "if(typeof jQuery!==\"undefi[...]

Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_98.code", "(function(){var b=\"cr_\"+a[...]

Found : user_pref("smartbar.machineId", "UHZACU7OVIWN/S30C/HX5TS0QUERFH6SHSTWCQHOZVZ4Q4JMDZ0QXR3GODXE7PIUYJQ[...]

Found : user_pref("sweetim.toolbar.scripts.0.domain-whitelist", "hxxp://(www.|apps.)?facebook\\.com.*");

Found : user_pref("sweetim.toolbar.scripts.1.domain-whitelist", "hxxps://(www.|apps.)?facebook\\.com.*");

Found : user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engin[...]

Found : user_pref("{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...]

-\\ Google Chrome v26.0.1410.64

File : C:\Users\peg\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [25279 octets] - [12/05/2013 17:26:52]

AdwCleaner[R2].txt - [24260 octets] - [16/05/2013 14:34:47]

AdwCleaner[R3].txt - [24321 octets] - [16/05/2013 14:53:36]

AdwCleaner[R4].txt - [24265 octets] - [16/05/2013 14:54:05]

########## EOF - C:\AdwCleaner[R4].txt - [24326 octets] ##########

RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : peg [Admin rights]

Mode : Scan -- Date : 05/16/2013 14:44:43

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 5 ¤¤¤

[TASK][sUSP PATH] Updater19962.exe : C:\Users\peg\AppData\Local\Updater19962\Updater19962.exe /extensionid=19962 /extensionname="Supreme Savings" /chromeid=ihkeoookbpemkdccdccdmacnidhooohk [7] -> FOUND

[HJPOL] HKCU\[...]\System : DisableTaskMgr (0) -> FOUND

[HJPOL] HKCU\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-18\$3c42eb883e76c42fe757e3ec8d556822\@ [-] --> FOUND

[ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-21-1531084523-3685658873-1988755905-1000\$3c42eb883e76c42fe757e3ec8d556822\@ [-] --> FOUND

[ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-18\$3c42eb883e76c42fe757e3ec8d556822\U --> FOUND

[ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-21-1531084523-3685658873-1988755905-1000\$3c42eb883e76c42fe757e3ec8d556822\U --> FOUND

[ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-18\$3c42eb883e76c42fe757e3ec8d556822\L --> FOUND

[ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-21-1531084523-3685658873-1988755905-1000\$3c42eb883e76c42fe757e3ec8d556822\L --> FOUND

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD3200BPVT-80JJ5T0 +++++

--- User ---

[MBR] 2d7d94ba8776bd501073fc5c5b67dc55

[bSP] 6038da5abdb86a32e945c2c6aa172f56 : Windows 7/8 MBR Code

Partition table:

0 - [XXXXXX] FAT32-LBA (0x1c) [HIDDEN!] Offset (sectors): 2048 | Size: 25600 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 52430848 | Size: 122098 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 302487552 | Size: 157545 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_05162013_02d1444.txt >>

RKreport[1]_S_05162013_02d1444.txt

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume2

Install Date: 1/17/2012 2:14:02 AM

System Uptime: 5/16/2013 2:26:51 PM (0 hours ago)

.

Motherboard: ASUSTeK Computer Inc. | | K54C

Processor: Intel® Core i3-2350M CPU @ 2.30GHz | CPU 1 | 2300/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 119 GiB total, 76.408 GiB free.

D: is FIXED (NTFS) - 154 GiB total, 153.759 GiB free.

E: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP110: 5/10/2013 5:30:02 PM - Removed Internet Explorer Toolbar 4.7 by SweetPacks

RP111: 5/10/2013 5:31:13 PM - Removed Internet Explorer Toolbar 4.7 by SweetPacks

RP112: 5/12/2013 4:27:52 PM - Installed HiJackThis

RP113: 5/16/2013 10:26:57 AM - Windows Update

.

==== Installed Programs ======================

.

??????? Windows Live Mesh ActiveX ??(????)

??????? Windows Live Mesh ActiveX ???

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader XI (11.0.03)

Alcor Micro USB Card Reader

Ask Toolbar

Ask Toolbar Updater

Asmedia ASM104x USB 3.0 Host Controller Driver

ASUS AI Recovery

ASUS FaceLogon

ASUS FancyStart

ASUS LifeFrame3

ASUS Live Update

ASUS Power4Gear Hybrid

ASUS Virtual Camera

ASUS WebStorage

ASUS_Screensaver

AsusVibe2.0

ATK Package

Bejeweled 2 Deluxe

Bing Bar

Contrôle ActiveX Windows Live Mesh pour connexions à distance

Control ActiveX de Windows Live Mesh para conexiones remotas

Controlo ActiveX do Windows Live Mesh para Ligações Remotas

CyberLink LabelPrint

CyberLink Media Suite

CyberLink Power2Go

D3DX10

DomaIQ

Driver Pro v3.0

Facebook Video Calling 1.2.0.287

Fast Boot

Galeria de Fotografias do Windows Live

Galerie de photos Windows Live

Galería fotográfica de Windows Live

Google Chrome

Google Update Helper

HiJackThis

InstantOn for NB

Intel® Control Center

Intel® Management Engine Components

Intel® Processor Graphics

Java 7 Update 17

Java Auto Updater

JavaFX 2.1.1

Junk Mail filter update

Malwarebytes Anti-Malware version 1.75.0.1300

Mesh Runtime

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Application Error Reporting

Microsoft Office 2010

Microsoft Office Click-to-Run 2010

Microsoft Office Starter 2010 - English

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2005 Redistributable (x64)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Mozilla Firefox 20.0.1 (x86 en-US)

Mozilla Maintenance Service

MSVCRT

MSVCRT_amd64

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Norton AntiVirus

Norton Identity Safe

Nuance PDF Reader

Optimizer Pro v3.0

PC Health Kit v3.2

Qualcomm Atheros WiFi Driver Installation

Realtek High Definition Audio Driver

Recipe Hub toolbar

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

Security Update for Microsoft .NET Framework 4 Extended (KB2656351)

Security Update for Microsoft .NET Framework 4 Extended (KB2736428)

Security Update for Microsoft .NET Framework 4 Extended (KB2742595)

Sonic Focus

Strongvault Online Backup

Synaptics Pointing Device Driver

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft .NET Framework 4 Extended (KB2468871)

Update for Microsoft .NET Framework 4 Extended (KB2533523)

Update for Microsoft .NET Framework 4 Extended (KB2600217)

VAFPlayer

Windows Live

Windows Live ???

Windows Live ????

Windows Live Communications Platform

Windows Live Essentials

Windows Live Family Safety

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Language Selector

Windows Live Mail

Windows Live Mesh

Windows Live Mesh ActiveX Control for Remote Connections

Windows Live Messenger

Windows Live MIME IFilter

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live Remote Client

Windows Live Remote Client Resources

Windows Live Remote Service

Windows Live Remote Service Resources

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

WinFlash

Wireless Console 3

Yahoo! Software Update

Yahoo! Toolbar

.

==== Event Viewer Messages From Past Week ========

.

5/16/2013 2:29:55 PM, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143.

5/16/2013 2:28:27 PM, Error: Service Control Manager [7024] - The Windows Firewall service terminated with service-specific error Access is denied..

.

==== End Of File ===========================

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 10.0.9200.16576 BrowserJavaVersion: 10.17.2

Run by peg at 14:56:02 on 2013-05-16

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4000.2030 [GMT -4:00]

.

AV: Norton AntiVirus *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton AntiVirus *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\FBAgent.exe

C:\Windows\system32\WLANExt.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe

C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\ccSvcHst.exe

C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\PROGRA~2\RECIPE~2\bar\1.bin\2jbarsvc.exe

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\system32\Dwm.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe

C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe

C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe

C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\ccSvcHst.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\ASUS\P4G\BatteryLife.exe

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe

C:\Program Files (x86)\ASUS\FaceLogon\sensorsrv.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files (x86)\Strongvault Online Backup\BackupAgent.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe

C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Windows\AsScrPro.exe

C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Windows\system32\consent.exe

C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe

C:\Users\peg\Desktop\RogueKillerX64.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.yahoo.com/?fr=fp-yie10

uWindow Title = Windows Internet Explorer provided by Yahoo!

uDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie10

mStart Page = hxxp://www.google.com

uProxyOverride = <local>

uURLSearchHooks: <No Name>: {cc8ae5b8-005b-4b1a-a27d-307eddffe5c8} -

uURLSearchHooks: YTNavAssistPlugin Class: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll

BHO: Toolbar BHO: {06e3475c-5521-4de8-bb12-50720f21631c} -

BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\IPS\IPSBHO.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Norton Identity Protection: {AB4C7833-A6EC-433f-B9FE-6B14B1A2F836} - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\CoIEPlg.dll

BHO: Search Assistant BHO: {b7acdf9c-c4f9-4d5d-998e-b147866b4d4c} -

BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

TB: Norton Identity Safe Toolbar: {A13C2648-91D4-4BF3-BC6D-0079707C4389} - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\CoIEPlg.dll

TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} -

TB: Recipe Hub: {cf51de5b-eb36-4114-bb69-84df63fbadb4} -

TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll

TB: Norton Identity Safe Toolbar: {A13C2648-91D4-4bf3-BC6D-0079707C4389} - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\CoIEPlg.dll

uRun: [Facebook Update] "C:\Users\peg\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

uRun: [backupAgent] C:\Program Files (x86)\Strongvault Online Backup\BackupAgent.exe

uRun: [Driver Pro] C:\Program Files (x86)\Driver Pro\DPLauncher.exe

mRun: [Nuance PDF Reader-reminder] "C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\PDF Reader\Ereg\Ereg.ini"

mRun: [ASUSPRP] "C:\Program Files (x86)\ASUS\APRP\APRP.EXE"

mRun: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe /S

mRun: [sonicMasterTray] C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe

mRun: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe

mRun: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

mRun: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe

mRun: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [EKIJ5000StatusMonitor] C:\Windows\System32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\ASUSVI~1.LNK - C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\FANCYS~1.LNK - C:\Windows\Installer\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}\_77B5857C27147149171BE7.exe

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

TCP: NameServer = 192.168.0.1

TCP: Interfaces\{E4EE1EFE-5953-489B-9C59-8FD50AAFCDA2} : DHCPNameServer = 192.168.0.1

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

SSODL: WebCheck - <orphaned>

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - C:\Windows\System32\rundll32.exe C:\Windows\System32\advpack.dll,LaunchINFSectionEx C:\Program Files (x86)\Internet Explorer\clrtour.inf,DefaultInstall.ResetTour,,12

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-Run: [synTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe

x64-Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

x64-Run: [synAsusAcpi] C:\Program Files (x86)\Synaptics\SynTP\SynAsusAcpi.exe

x64-Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /SF3

x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

x64-Run: [EKIJ5000StatusMonitor] C:\Windows\System32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe

x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

x64-Notify: igfxcui - igfxdev.dll

x64-SSODL: WebCheck - <orphaned>

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\

FF - prefs.js: browser.search.selectedEngine - Norton Safe Search

FF - prefs.js: network.proxy.type - 0

FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Users\peg\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll

FF - plugin: C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\extensions\{b920380d-fbe7-45c7-96ab-37e9870a566c}\plugins\np-mswmp.dll

FF - plugin: C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\extensions\{b920380d-fbe7-45c7-96ab-37e9870a566c}\plugins\npConduitFirefoxPlugin.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll

FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll

FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

FF - ExtSQL: 2013-04-21 18:47; {b920380d-fbe7-45c7-96ab-37e9870a566c}; C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\extensions\{b920380d-fbe7-45c7-96ab-37e9870a566c}

FF - ExtSQL: 2013-05-06 21:20; {BBDA0591-3099-440a-AA10-41764D9DB4DB}; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.3.1.22\IPSFFPlgn

FF - ExtSQL: 2013-05-06 21:54; {F04D2D30-776C-4d02-8627-8E4385ECA58D}; C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2013.3.3.19\coFFPlgn

.

============= SERVICES / DRIVERS ===============

.

R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\NAVx64\1403010.016\SymDS64.sys [2013-5-6 493656]

R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\NAVx64\1403010.016\SymEFA64.sys [2013-5-6 1139800]

R1 ATKWMIACPIIO_;ATKWMIACPI Driver_;C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2011-9-7 17536]

R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.3.1.22\Definitions\BASHDefs\20130502.001\BHDrvx64.sys [2013-5-7 1390680]

R1 ccSet_NAV;Norton AntiVirus Settings Manager;C:\Windows\System32\drivers\NAVx64\1403010.016\ccSetx64.sys [2013-5-6 168096]

R1 ccSet_NST;Norton Identity Safe Settings Manager;C:\Windows\System32\drivers\NSTx64\7DD03030.013\ccSetx64.sys [2013-5-6 168096]

R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.3.1.22\Definitions\IPSDefs\20130515.001\IDSviA64.sys [2013-5-15 513184]

R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\NAVx64\1403010.016\Ironx64.sys [2013-5-6 224416]

R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\NAVx64\1403010.016\symnets.sys [2013-5-6 432800]

R2 AFBAgent;AFBAgent;C:\Windows\System32\FBAgent.exe [2011-12-10 379520]

R2 ASMMAP64;ASMMAP64;C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-7-2 15416]

R2 ASUS InstantOn;ASUS InstantOn Service;C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe [2012-2-16 277120]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-5-15 418376]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-5-15 701512]

R2 NAV;Norton AntiVirus;C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\ccSvcHst.exe [2013-5-6 144520]

R2 NCO;Norton Identity Safe;C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe [2013-5-6 144520]

R2 RecipeHub_2jService;Recipe HubService;C:\PROGRA~2\RECIPE~2\bar\1.bin\2jbarsvc.exe [2013-3-16 42504]

R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776]

R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-12-10 2656280]

R3 asmthub3;ASMedia USB3 Hub Service;C:\Windows\System32\drivers\asmthub3.sys [2011-11-22 130024]

R3 asmtxhci;ASMEDIA XHCI Service;C:\Windows\System32\drivers\asmtxhci.sys [2011-11-22 395752]

R3 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.EXE [2012-6-11 240208]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-5-7 138912]

R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2011-11-3 317440]

R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2011-10-17 76912]

R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-5-15 25928]

R3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2011-10-1 764264]

R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2011-10-1 268648]

R3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2011-10-1 25960]

R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2011-10-1 22376]

R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496]

S2 BBSvc;BingBar Service;C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.EXE [2012-6-11 193616]

S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2011-10-18 48488]

S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2011-5-13 1492840]

S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\System32\drivers\SiSG664.sys [2009-6-10 56832]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-2-18 59392]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2011-2-18 31232]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-1-20 1255736]

S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

.

=============== Created Last 30 ================

.

2013-05-15 21:17:44 -------- d-----w- C:\Users\peg\AppData\Roaming\Malwarebytes

2013-05-15 21:17:32 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

2013-05-15 21:17:32 -------- d-----w- C:\ProgramData\Malwarebytes

2013-05-15 21:17:31 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-05-12 21:17:30 -------- d-----w- C:\Users\peg\AppData\Local\ Online Backup

2013-05-12 20:30:28 -------- d-----w- C:\Windows\ERUNT

2013-05-12 20:30:22 -------- d-----w- C:\JRT

2013-05-12 20:29:22 388096 ----a-r- C:\Users\peg\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2013-05-12 20:29:22 -------- d-----w- C:\Program Files (x86)\Trend Micro

2013-05-07 21:01:19 -------- d-----w- C:\Users\peg\AppData\Local\NPE

2013-05-07 01:54:11 168096 ----a-r- C:\Windows\System32\drivers\NSTx64\7DD03030.013\ccSetx64.sys

2013-05-07 01:54:03 -------- d-----w- C:\Windows\System32\drivers\NSTx64\7DD03030.013

2013-05-07 01:54:03 -------- d-----w- C:\Windows\System32\drivers\NSTx64

2013-05-07 01:54:02 -------- d-----w- C:\Program Files (x86)\Norton Identity Safe

2013-05-07 01:53:55 177312 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS

2013-05-07 01:53:54 -------- d-----w- C:\Program Files\Symantec

2013-05-07 01:53:54 -------- d-----w- C:\Program Files\Common Files\Symantec Shared

2013-05-07 01:52:57 432800 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\symnets.sys

2013-05-07 01:52:57 23448 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\SymELAM.sys

2013-05-07 01:52:57 1139800 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\SymEFA64.sys

2013-05-07 01:52:56 796248 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\srtsp64.sys

2013-05-07 01:52:56 493656 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\SymDS64.sys

2013-05-07 01:52:56 36952 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\srtspx64.sys

2013-05-07 01:52:56 224416 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\Ironx64.sys

2013-05-07 01:52:56 168096 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\ccSetx64.sys

2013-05-07 01:52:23 -------- d-----w- C:\Windows\System32\drivers\NAVx64\1403010.016

2013-05-07 01:52:23 -------- d-----w- C:\Windows\System32\drivers\NAVx64

2013-05-07 01:52:22 -------- d-----w- C:\Program Files (x86)\Norton AntiVirus

2013-05-07 01:46:35 -------- d-----w- C:\ProgramData\PCSettings

2013-05-07 01:22:26 -------- d-----w- C:\Program Files (x86)\Common Files\Symantec Shared

2013-05-07 01:15:55 -------- d-----w- C:\ProgramData\NortonInstaller

2013-05-07 01:15:55 -------- d-----w- C:\Program Files (x86)\NortonInstaller

2013-05-07 00:32:41 -------- d-----w- C:\ProgramData\Norton

2013-04-23 23:23:34 1656680 ----a-w- C:\Windows\System32\drivers\ntfs.sys

2013-04-22 23:12:40 -------- d-----w- C:\Windows\pss

2013-04-21 22:49:21 -------- d-----w- C:\Users\peg\AppData\Roaming\PC Health Kit

2013-04-21 22:49:17 -------- d-----w- C:\Program Files (x86)\PC Health Kit

.

==================== Find3M ====================

.

2013-05-15 23:31:12 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2013-05-15 23:31:12 692104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2013-04-13 05:49:23 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll

2013-04-13 05:49:19 350208 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll

2013-04-13 05:49:19 308736 ----a-w- C:\Windows\apppatch\AppPatch64\AcGenral.dll

2013-04-13 05:49:19 111104 ----a-w- C:\Windows\apppatch\AppPatch64\acspecfc.dll

2013-04-13 04:45:16 474624 ----a-w- C:\Windows\apppatch\AcSpecfc.dll

2013-04-13 04:45:15 2176512 ----a-w- C:\Windows\apppatch\AcGenral.dll

2013-04-11 14:22:56 770384 ----a-w- C:\Windows\SysWow64\msvcr100.dll

2013-04-11 14:22:56 421200 ----a-w- C:\Windows\SysWow64\msvcp100.dll

2013-04-10 06:01:54 265064 ----a-w- C:\Windows\System32\drivers\dxgmms1.sys

2013-04-10 06:01:53 983400 ----a-w- C:\Windows\System32\drivers\dxgkrnl.sys

2013-04-10 03:30:50 3153920 ----a-w- C:\Windows\System32\win32k.sys

2013-04-05 06:52:14 2242048 ----a-w- C:\Windows\System32\wininet.dll

2013-04-05 06:50:36 3958784 ----a-w- C:\Windows\System32\jscript9.dll

2013-04-05 06:50:31 67072 ----a-w- C:\Windows\System32\iesetup.dll

2013-04-05 06:50:31 136704 ----a-w- C:\Windows\System32\iesysprep.dll

2013-04-05 05:28:24 1767424 ----a-w- C:\Windows\SysWow64\wininet.dll

2013-04-05 05:26:26 2877440 ----a-w- C:\Windows\SysWow64\jscript9.dll

2013-04-05 05:26:21 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll

2013-04-05 05:26:21 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll

2013-04-05 04:43:00 2706432 ----a-w- C:\Windows\System32\mshtml.tlb

2013-04-05 04:29:45 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2013-04-05 03:51:11 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe

2013-04-05 03:38:25 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe

2013-03-29 22:57:50 9728 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-03-19 06:04:06 5550424 ----a-w- C:\Windows\System32\ntoskrnl.exe

2013-03-19 05:53:58 48640 ----a-w- C:\Windows\System32\wwanprotdim.dll

2013-03-19 05:53:58 230400 ----a-w- C:\Windows\System32\wwansvc.dll

2013-03-19 05:46:56 43520 ----a-w- C:\Windows\System32\csrsrv.dll

2013-03-19 05:04:13 3968856 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

2013-03-19 05:04:10 3913560 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

2013-03-19 04:47:50 6656 ----a-w- C:\Windows\SysWow64\apisetschema.dll

2013-03-19 03:06:33 112640 ----a-w- C:\Windows\System32\smss.exe

2013-03-17 17:42:31 95648 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll

2013-03-17 17:42:31 861088 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll

2013-03-17 17:42:31 782240 ----a-w- C:\Windows\SysWow64\deployJava1.dll

2013-02-27 06:02:44 111448 ----a-w- C:\Windows\System32\consent.exe

2013-02-27 05:48:00 1930752 ----a-w- C:\Windows\System32\authui.dll

2013-02-27 05:47:10 70144 ----a-w- C:\Windows\System32\appinfo.dll

2013-02-27 04:49:24 1796096 ----a-w- C:\Windows\SysWow64\authui.dll

.

============= FINISH: 14:58:05.67 ===============

Link to post
Share on other sites

I'm afraid I have bad news.

One or more of the identified infections is a rootkit. Rootkits are very dangerous because they use advanced techniques (backdoors) as a means of accessing a computer system that bypasses security mechanisms and steal sensitive information which they send back to the hacker. Many rootkits can hook into the Windows 32-bit kernel, and patch several APIs to hide new registry keys and files they install. Remote attackers use backdoor Trojans and rootkits as part of an exploit to gain unauthorized access to a computer and take control of it without your knowledge.

I suggest you disconnect this computer from the Internet immediately you finish reading this post.

If you do any banking or other financial transactions on the computer, or if it contains any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the trojan has been identified and can be killed, your computer is very likely compromised and there is no way to be sure your computer can ever again be trusted.

Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the Operating System.

Visit the following sites for more information on Internet theft and when to reformat!

Help: I Got Hacked. Now What Do I Do?

Help: I Got Hacked. Now What Do I Do? Part II

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall

Should you decide not to follow that advice, we will of course do our best to clean the computer of any infections that we can see but, as I already stated, we can in no way guarantee it to be trustworthy.

If you have any questions before making a final decision, please feel free to ask.

Instructions how to format and reinstall Windows can be found here

Link to post
Share on other sites

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.