bipster10 Posted May 17, 2013 ID:680830 Share Posted May 17, 2013 I got the Hijack Virus "Computer Crime & Intellectual Property". Here is my log after scanning. Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-05-2013Ran by SYSTEM on 17-05-2013 10:44:13Running from G:\Windows 7 Home Premium (X64) OS Language: English(US)Internet Explorer Version 9Boot Mode: RecoveryThe current controlset is ControlSet001ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.==================== Registry (Whitelisted) ==================HKLM\...\Run: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1808168 2009-06-18] (Synaptics Incorporated)HKLM\...\Run: [cAudioFilterAgent] C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [495104 2009-07-14] (Conexant Systems, Inc.)HKLM\...\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" [171520 2009-08-17] (Sun Microsystems, Inc.)HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] C:\$Recycle.Bin\S-1-5-18\$708e671f3545291506c06082039c15b2\n. ATTENTION! ====> ZeroAccessHKLM-x32\...\Run: [QPService] "C:\Program Files (x86)\HP\QuickPlay\QPService.exe" [468264 2009-06-23] (CyberLink Corp.)HKLM-x32\...\Run: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start [323640 2009-11-24] ( Hewlett-Packard Development Company, L.P.)HKLM-x32\...\Run: [updatePRCShortCut] "C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Hewlett-Packard\Recovery" UpdateWithCreateOnce "Software\CyberLink\PowerRecover" [222504 2009-05-19] (CyberLink Corp.)HKLM-x32\...\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [54576 2008-12-08] (Hewlett-Packard)HKLM-x32\...\Run: [] [x]HKLM-x32\...\Run: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [498744 2009-07-23] (Hewlett-Packard)HKLM-x32\...\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation)HKLM-x32\...\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [248552 2010-05-14] (Sun Microsystems, Inc.)HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2010-11-29] (Apple Inc.)HKLM-x32\...\Run: [bncsaui.exe] %ProgramFiles%\Bradford Networks\Persistent Agent\bncsaui.exe [2625304 2010-09-29] (Bradford Networks)HKLM-x32\...\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe [2345592 2012-08-01] (AVG Technologies CZ, s.r.o.)HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-05-30] (Apple Inc.)HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421776 2012-06-07] (Apple Inc.)HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)HKU\Default\...\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1668664 2009-07-15] (Hewlett-Packard)HKU\Default\...\Policies\system: [WallpaperStyle] 2HKU\Default User\...\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1668664 2009-07-15] (Hewlett-Packard)HKU\Default User\...\Policies\system: [WallpaperStyle] 2HKU\Owner\...\Run: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [1668664 2009-07-15] (Hewlett-Packard)HKU\Owner\...\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden [2363392 2010-01-22] (Hewlett-Packard Company)HKU\Owner\...\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [5629312 2013-01-07] (SUPERAntiSpyware.com)HKU\Owner\...\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent [3325952 2009-03-28] (Electronic Arts)HKU\Owner\...\Run: [ROC_ROC_APR2013_AV] C:\Users\Owner\AppData\Roaming\AVG April 2013 Campaign\AVG-Secure-Search-Update.exe /PROMPT --mid 81a617cf71db2c1ec1ee89d706ce56e8-4cd87842c5a390c2d205201fdc60c1ae43e8325e --CMPID ROC_APR2013_AV [x]HKU\Owner\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] C:\Users\Owner\Documents\29ca7cd9.exe [24064 2013-05-17] ()HKU\Owner\...\Policies\system: [WallpaperStyle] 2HKU\Owner\...\Winlogon: [shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation) <==== ATTENTION Startup: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnkShortcutTarget: MagicDisc.lnk -> C:\Program Files (x86)\MagicDisc\MagicDisc.exe (MagicISO, Inc.)Startup: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnkShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)BootExecute: autocheck autochk * C:\PROGRA~2\AVG\AVG10\avgchsva.exe /syncC:\PROGRA~2\AVG\AVG10\avgrsa.exe /sync /restart==================== Services (Whitelisted) =================S2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [140672 2013-01-07] (SUPERAntiSpyware.com)S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [7391072 2012-01-31] (AVG Technologies CZ, s.r.o.)S2 avgwd; C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe [269520 2011-02-08] (AVG Technologies CZ, s.r.o.)S2 BNPagent; C:\Program Files (x86)\Bradford Networks\Persistent Agent\bndaemon.exe [3067672 2010-09-29] (Bradford Networks)S2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [66872 2011-07-07] ()S2 PnkBstrB; C:\Windows\SysWow64\PnkBstrB.exe [107832 2011-07-07] ()S2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-01-21] ()==================== Drivers (Whitelisted) ====================S3 AVGIDSDriver; C:\Windows\System32\DRIVERS\AVGIDSDriver.Sys [118864 2011-05-27] (AVG Technologies CZ, s.r.o. )S0 AVGIDSEH; C:\Windows\System32\DRIVERS\AVGIDSEH.Sys [26704 2011-02-22] (AVG Technologies CZ, s.r.o. )S3 AVGIDSFilter; C:\Windows\System32\DRIVERS\AVGIDSFilter.Sys [29264 2011-02-10] (AVG Technologies CZ, s.r.o. )S1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [312160 2012-11-12] (AVG Technologies CZ, s.r.o.)S1 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [41552 2011-03-01] (AVG Technologies CZ, s.r.o.)S0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [37456 2011-03-16] (AVG Technologies CZ, s.r.o.)S1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [377936 2011-04-04] (AVG Technologies CZ, s.r.o.)S1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)S1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)S4 eabfiltr; S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [x]S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [x]==================== NetSvcs (Whitelisted) ======================================= One Month Created Files and Folders ========2013-05-17 10:44 - 2013-05-17 10:44 - 00000000 ____D C:\FRST2013-05-17 06:14 - 2013-05-17 06:14 - 00001400 ____A C:\Windows\PFRO.log2013-05-17 06:12 - 2013-05-17 06:12 - 00174351 ____A C:\ProgramData\2433f4332013-05-17 06:12 - 2013-05-17 06:12 - 00174332 ____A C:\Users\Owner\AppData\Local\2433f4332013-05-17 06:12 - 2013-05-17 06:12 - 00174328 ____A C:\Users\Owner\AppData\Roaming\2433f4332013-05-17 06:12 - 2013-05-17 06:12 - 00024064 ____A C:\Users\Owner\Documents\29ca7cd9.exe2013-05-16 17:54 - 2013-05-17 06:27 - 00000336 ____A C:\Windows\setupact.log2013-05-16 17:54 - 2013-05-16 17:54 - 00000000 ____A C:\Windows\setuperr.log2013-05-15 14:07 - 2013-04-04 22:52 - 02242048 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll2013-05-15 14:07 - 2013-04-04 22:52 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll2013-05-15 14:07 - 2013-04-04 22:52 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe2013-05-15 14:07 - 2013-04-04 22:50 - 19231232 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll2013-05-15 14:07 - 2013-04-04 22:50 - 15404032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll2013-05-15 14:07 - 2013-04-04 22:50 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll2013-05-15 14:07 - 2013-04-04 22:50 - 02647552 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll2013-05-15 14:07 - 2013-04-04 22:50 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll2013-05-15 14:07 - 2013-04-04 22:50 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll2013-05-15 14:07 - 2013-04-04 22:50 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll2013-05-15 14:07 - 2013-04-04 22:50 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll2013-05-15 14:07 - 2013-04-04 22:50 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll2013-05-15 14:07 - 2013-04-04 22:50 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll2013-05-15 14:07 - 2013-04-04 22:50 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll2013-05-15 14:07 - 2013-04-04 21:28 - 01767424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2013-05-15 14:07 - 2013-04-04 21:28 - 01130496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2013-05-15 14:07 - 2013-04-04 21:26 - 14323712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2013-05-15 14:07 - 2013-04-04 21:26 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2013-05-15 14:07 - 2013-04-04 21:26 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2013-05-15 14:07 - 2013-04-04 21:26 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2013-05-15 14:07 - 2013-04-04 21:26 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll2013-05-15 14:07 - 2013-04-04 21:26 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll2013-05-15 14:07 - 2013-04-04 21:26 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2013-05-15 14:07 - 2013-04-04 21:26 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll2013-05-15 14:07 - 2013-04-04 21:26 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll2013-05-15 14:07 - 2013-04-04 21:26 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2013-05-15 14:07 - 2013-04-04 21:26 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll2013-05-15 14:07 - 2013-04-04 20:43 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb2013-05-15 14:07 - 2013-04-04 20:29 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2013-05-15 14:07 - 2013-04-04 19:51 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe2013-05-15 14:07 - 2013-04-04 19:38 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe2013-05-15 01:29 - 2013-04-09 22:01 - 00983400 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys2013-05-15 01:29 - 2013-04-09 22:01 - 00265064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys2013-05-15 01:29 - 2013-04-09 19:30 - 03153920 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys2013-05-15 01:29 - 2013-03-18 21:53 - 00230400 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll2013-05-15 01:29 - 2013-03-18 21:53 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll2013-05-15 01:29 - 2013-02-26 22:02 - 00111448 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe2013-05-15 01:29 - 2013-02-26 21:52 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll2013-05-15 01:29 - 2013-02-26 21:52 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll2013-05-15 01:29 - 2013-02-26 21:48 - 01930752 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll2013-05-15 01:29 - 2013-02-26 21:47 - 00070144 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll2013-05-15 01:29 - 2013-02-26 20:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll2013-05-15 01:29 - 2013-02-26 20:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll2013-05-15 01:29 - 2013-02-26 20:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll2013-05-15 01:29 - 2011-02-03 03:25 - 00144384 ____A (Microsoft Corporation) C:\Windows\System32\cdd.dll2013-05-14 13:09 - 2013-05-14 13:09 - 17613192 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe2013-05-02 16:07 - 2013-05-02 16:07 - 00171109 ____A C:\Users\Owner\Desktop\tesr.wma2013-04-27 21:53 - 2013-04-27 21:54 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Stella2013-04-27 21:18 - 2013-04-28 17:22 - 00000072 ____A C:\Users\Owner\Desktop\layout.jsf2013-04-27 20:58 - 2013-04-27 21:00 - 00000000 ____D C:\Program Files (x86)\Project64 1.62013-04-27 17:19 - 2013-04-27 20:51 - 00000000 ____D C:\Users\Owner\Desktop\Games2013-04-27 16:50 - 2013-04-27 17:10 - 569063376 ____A C:\Users\Owner\Downloads\mcg-torrent.rar2013-04-23 18:39 - 2013-04-12 06:45 - 01656680 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys2013-04-21 10:52 - 2013-04-21 10:52 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe2013-04-21 10:52 - 2013-04-21 10:52 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll2013-04-21 10:52 - 2013-04-21 10:52 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll2013-04-21 10:52 - 2013-04-21 10:52 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll2013-04-21 10:52 - 2013-04-21 10:52 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll2013-04-21 10:52 - 2013-04-21 10:52 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll2013-04-21 10:51 - 2013-04-21 10:51 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl2013-04-21 10:51 - 2013-04-21 10:51 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2013-04-21 10:51 - 2013-04-21 10:51 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat2013-04-21 10:51 - 2013-04-21 10:51 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat2013-04-21 10:51 - 2013-04-21 10:51 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec2013-04-21 10:51 - 2013-04-21 10:51 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec2013-04-21 10:51 - 2013-04-21 10:51 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe2013-04-21 10:51 - 2013-04-21 10:51 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe2013-04-21 10:51 - 2013-04-21 10:51 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe2013-04-21 10:51 - 2013-04-21 10:51 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe2013-04-21 10:51 - 2013-04-21 10:51 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe2013-04-21 10:51 - 2013-04-21 10:51 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2013-04-21 10:51 - 2013-04-21 10:51 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe2013-04-21 10:51 - 2013-04-21 10:51 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx2013-04-21 10:51 - 2013-04-21 10:51 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe2013-04-21 10:51 - 2013-04-21 10:51 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx2013-04-21 10:51 - 2013-04-21 10:51 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe2013-04-21 10:51 - 2013-04-21 10:51 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe2013-04-21 10:51 - 2013-04-21 10:51 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe2013-04-21 10:51 - 2013-04-21 10:51 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe==================== One Month Modified Files and Folders =======2013-05-17 10:44 - 2013-05-17 10:44 - 00000000 ____D C:\FRST2013-05-17 06:31 - 2009-10-23 08:45 - 01202107 ____A C:\Windows\WindowsUpdate.log2013-05-17 06:28 - 2011-02-17 12:57 - 00000892 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job2013-05-17 06:27 - 2013-05-16 17:54 - 00000336 ____A C:\Windows\setupact.log2013-05-17 06:27 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT2013-05-17 06:14 - 2013-05-17 06:14 - 00001400 ____A C:\Windows\PFRO.log2013-05-17 06:12 - 2013-05-17 06:12 - 00174351 ____A C:\ProgramData\2433f4332013-05-17 06:12 - 2013-05-17 06:12 - 00174332 ____A C:\Users\Owner\AppData\Local\2433f4332013-05-17 06:12 - 2013-05-17 06:12 - 00174328 ____A C:\Users\Owner\AppData\Roaming\2433f4332013-05-17 06:12 - 2013-05-17 06:12 - 00024064 ____A C:\Users\Owner\Documents\29ca7cd9.exe2013-05-17 06:09 - 2012-07-06 16:45 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job2013-05-17 06:04 - 2011-02-17 12:57 - 00000896 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job2013-05-17 06:00 - 2011-05-12 06:14 - 00000000 ____D C:\Windows\System32\Drivers\AVG2013-05-16 17:54 - 2013-05-16 17:54 - 00000000 ____A C:\Windows\setuperr.log2013-05-16 12:58 - 2009-07-13 20:45 - 00023248 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02013-05-16 12:58 - 2009-07-13 20:45 - 00023248 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02013-05-15 18:30 - 2010-11-01 19:40 - 00000000 ____A C:\Users\Owner\AppData\Local\prvlcl.dat2013-05-15 17:54 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache2013-05-15 14:28 - 2012-08-06 09:48 - 00000000 ____D C:\Program Files\SUPERAntiSpyware2013-05-15 14:28 - 2009-10-23 08:59 - 00000290 ____A C:\ProgramData\hpqp.ini2013-05-15 14:26 - 2009-07-13 20:45 - 00433824 ____A C:\Windows\System32\FNTCACHE.DAT2013-05-15 14:20 - 2009-12-17 16:46 - 00000000 ____D C:\ProgramData\Microsoft Help2013-05-15 14:15 - 2009-11-29 13:39 - 75016696 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe2013-05-15 14:11 - 2009-07-13 21:13 - 00740814 ____A C:\Windows\System32\PerfStringBackup.INI2013-05-14 13:09 - 2013-05-14 13:09 - 17613192 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe2013-05-14 13:09 - 2012-07-06 16:45 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2013-05-14 13:09 - 2012-07-06 16:45 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2013-05-13 11:43 - 2012-06-04 10:21 - 00000000 ____A C:\Windows\System32\HP_ActiveX_Patch_NOT_DETECTED.txt2013-05-13 11:43 - 2009-11-30 20:48 - 00000052 ____A C:\Windows\SysWOW64\DOErrors.log2013-05-13 11:32 - 2012-09-15 21:28 - 00000332 ____A C:\Windows\Tasks\HPCeeScheduleForOwner.job2013-05-02 16:07 - 2013-05-02 16:07 - 00171109 ____A C:\Users\Owner\Desktop\tesr.wma2013-04-29 18:18 - 2011-04-30 22:12 - 00000000 ____D C:\Users\Owner\AppData\Roaming\BitTorrent2013-04-28 17:22 - 2013-04-27 21:18 - 00000072 ____A C:\Users\Owner\Desktop\layout.jsf2013-04-27 21:54 - 2013-04-27 21:53 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Stella2013-04-27 21:00 - 2013-04-27 20:58 - 00000000 ____D C:\Program Files (x86)\Project64 1.62013-04-27 20:51 - 2013-04-27 17:19 - 00000000 ____D C:\Users\Owner\Desktop\Games2013-04-27 17:10 - 2013-04-27 16:50 - 569063376 ____A C:\Users\Owner\Downloads\mcg-torrent.rar2013-04-27 08:36 - 2010-01-23 18:40 - 00000021 ____A C:\ProgramData\hpqp.txt2013-04-24 03:10 - 2012-05-02 19:24 - 00000000 ____D C:\Users\Owner\AppData\Local\TSVNCache2013-04-21 10:56 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\PolicyDefinitions2013-04-21 10:52 - 2013-04-21 10:52 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe2013-04-21 10:52 - 2013-04-21 10:52 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll2013-04-21 10:52 - 2013-04-21 10:52 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll2013-04-21 10:52 - 2013-04-21 10:52 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll2013-04-21 10:52 - 2013-04-21 10:52 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll2013-04-21 10:52 - 2013-04-21 10:52 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll2013-04-21 10:51 - 2013-04-21 10:51 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl2013-04-21 10:51 - 2013-04-21 10:51 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2013-04-21 10:51 - 2013-04-21 10:51 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat2013-04-21 10:51 - 2013-04-21 10:51 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat2013-04-21 10:51 - 2013-04-21 10:51 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec2013-04-21 10:51 - 2013-04-21 10:51 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec2013-04-21 10:51 - 2013-04-21 10:51 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe2013-04-21 10:51 - 2013-04-21 10:51 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe2013-04-21 10:51 - 2013-04-21 10:51 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe2013-04-21 10:51 - 2013-04-21 10:51 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe2013-04-21 10:51 - 2013-04-21 10:51 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe2013-04-21 10:51 - 2013-04-21 10:51 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2013-04-21 10:51 - 2013-04-21 10:51 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe2013-04-21 10:51 - 2013-04-21 10:51 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx2013-04-21 10:51 - 2013-04-21 10:51 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe2013-04-21 10:51 - 2013-04-21 10:51 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx2013-04-21 10:51 - 2013-04-21 10:51 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll2013-04-21 10:51 - 2013-04-21 10:51 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe2013-04-21 10:51 - 2013-04-21 10:51 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe2013-04-21 10:51 - 2013-04-21 10:51 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe2013-04-21 10:51 - 2013-04-21 10:51 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exeZeroAccess:C:\$Recycle.Bin\S-1-5-21-2861860325-1608682575-3244310698-1000\$708e671f3545291506c06082039c15b2ZeroAccess:C:\$Recycle.Bin\S-1-5-18\$708e671f3545291506c06082039c15b2==================== Known DLLs (Whitelisted) ==================================== Bamital & volsnap Check =================C:\Windows\System32\winlogon.exe => MD5 is legitC:\Windows\System32\wininit.exe => MD5 is legitC:\Windows\SysWOW64\wininit.exe => MD5 is legitC:\Windows\explorer.exe => MD5 is legitC:\Windows\SysWOW64\explorer.exe => MD5 is legitC:\Windows\System32\svchost.exe => MD5 is legitC:\Windows\SysWOW64\svchost.exe => MD5 is legitC:\Windows\System32\services.exe => MD5 is legitC:\Windows\System32\User32.dll => MD5 is legitC:\Windows\SysWOW64\User32.dll => MD5 is legitC:\Windows\System32\userinit.exe => MD5 is legitC:\Windows\SysWOW64\userinit.exe => MD5 is legitC:\Windows\System32\Drivers\volsnap.sys => MD5 is legit==================== EXE ASSOCIATION =====================HKLM\...\.exe: exefile => OKHKLM\...\exefile\DefaultIcon: %1 => OKHKLM\...\exefile\open\command: "%1" %* => OK==================== Restore Points =========================Restore point made on: 2013-05-05 15:00:39Restore point made on: 2013-05-13 11:33:33Restore point made on: 2013-05-15 14:06:20==================== Memory info =========================== Percentage of memory in use: 31%Total physical RAM: 1979.2 MBAvailable physical RAM: 1364.7 MBTotal Pagefile: 1979.2 MBAvailable Pagefile: 1358 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.88 MB==================== Drives ================================Drive c: () (Fixed) (Total:136.98 GB) (Free:49.03 GB) NTFS (Disk=0 Partition=2) ==>[system with boot components (obtained from reading drive)]Drive e: (RECOVERY) (Fixed) (Total:11.87 GB) (Free:2 GB) NTFS (Disk=0 Partition=3) ==>[system with boot components (obtained from reading drive)]Drive f: (Sims3) (CDROM) (Total:5.54 GB) (Free:0 GB) UDFDrive g: (STORE N GO) (Removable) (Total:7.45 GB) (Free:3.59 GB) FAT32 (Disk=1 Partition=1)Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFSDrive y: (SYSTEM) (Fixed) (Total:0.19 GB) (Free:0.16 GB) NTFS (Disk=0 Partition=1) ==>[system with boot components (obtained from reading drive)]==================== MBR & Partition Table ==========================================================================Disk: 0 (Size: 149 GB) (Disk ID: 135C058F)Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)Partition 2: (Not Active) - (Size=137 GB) - (Type=07 NTFS)Partition 3: (Not Active) - (Size=12 GB) - (Type=07 NTFS)========================================================Disk: 1 (Size: 7 GB) (Disk ID: 00000000)Partition 1: (Not Active) - (Size=7 GB) - (Type=0B)Last Boot: 2013-05-13 20:59==================== End Of Log ============================ Link to post Share on other sites More sharing options...
MrCharlie Posted May 17, 2013 ID:680838 Share Posted May 17, 2013 There's signs of a backdoor trojan on the system so I have to give you this alert:You're infected with Rootkit.ZeroAccess, a BackDoor Trojan also.BACKDOOR WARNING------------------------------One or more of the identified infections is known to use a backdoor.This allows hackers to remotely control your computer, steal critical system information and download and execute files.I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.Though the infection has been identified and because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?http://www.dslreports.com/faq/10451When Should I Format, How Should I Reinstallhttp://www.dslreports.com/faq/10063I will try my best to clean this machine but I can't guarantee that it will be 100% secure afterwards.Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.-----------------------------------------OK, here you go......this should get you going:Please download the attached fixlist.txt and copy it to your flashdrive.NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating systemOn Vista or Windows 7: Now please enter System Recovery Options. (as you did before)Run FRST64 or FRST (which ever one you're using) and press the Fix button just once and wait.The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.See if the computer boots normally now and if so..........Download Malwarebytes Anti-Rootkit from HEREUnzip the contents to a folder in a convenient location.Open the folder where the contents were unzipped and run mbar.exeFollow the instructions in the wizard to update and allow the program to scan your computer for threats.Click on the Cleanup button to remove any threats and reboot if prompted to do so.Wait while the system shuts down and the cleanup process is performed.Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txtTo attach a log if needed:Bottom right corner of this page.New window that comes up.~~~~~~~~~~~~~~~~~~~~~~~Note:If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:Internet accessWindows UpdateWindows FirewallIf there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot. It's located in the Plugins folder which is in the MBAR folder.Just run fixdamage.exe.Verify that your system is now functioning normally.MrC Link to post Share on other sites More sharing options...
bipster10 Posted May 17, 2013 Author ID:680844 Share Posted May 17, 2013 Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-05-2013Ran by SYSTEM at 2013-05-17 11:30:58 Run:1Running from G:\Boot Mode: Recovery==============================================HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default => Value was restored successfully.HKEY_USERS\Owner\Software\Microsoft\Windows\CurrentVersion\Run\\qcgce2mrvjq91kk1e7pnbb19m52fx => Value deleted successfully.HKEY_USERS\Owner\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.C:\ProgramData\2433f433 => Moved successfully.C:\Users\Owner\AppData\Local\2433f433 => Moved successfully.C:\Users\Owner\AppData\Roaming\2433f433 => Moved successfully.C:\Users\Owner\Documents\29ca7cd9.exe => Moved successfully.C:\$Recycle.Bin\S-1-5-21-2861860325-1608682575-3244310698-1000\$708e671f3545291506c06082039c15b2 => Moved successfully.C:\$Recycle.Bin\S-1-5-18\$708e671f3545291506c06082039c15b2 => Moved successfully.C:\$Recycle.Bin\S-1-5-18\$708e671f3545291506c06082039c15b2\n. => File/Directory not found.==== End of Fixlog ==== Link to post Share on other sites More sharing options...
MrCharlie Posted May 17, 2013 ID:680846 Share Posted May 17, 2013 Does it boot normally???? MrC Link to post Share on other sites More sharing options...
bipster10 Posted May 17, 2013 Author ID:680848 Share Posted May 17, 2013 ohh sorry, yes it does. I am currenlty doing my second scan with malwarebytes. I will post the logs once it is finished. Link to post Share on other sites More sharing options...
MrCharlie Posted May 17, 2013 ID:680849 Share Posted May 17, 2013 OK.......MrC Link to post Share on other sites More sharing options...
bipster10 Posted May 17, 2013 Author ID:680857 Share Posted May 17, 2013 First LogMalwarebytes Anti-Rootkit BETA 1.05.0.1001www.malwarebytes.orgDatabase version: v2013.05.17.05Windows 7 Service Pack 1 x64 NTFSInternet Explorer 10.0.9200.16576Owner :: SHREDFEST [administrator]5/17/2013 11:51:34 AMmbar-log-2013-05-17 (11-51-34).txtScan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2PScan options disabled: Objects scanned: 31473Time elapsed: 12 minute(s), 8 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 7HKLM\SOFTWARE\CLASSES\APPID\{F85FA3F2-D2C8-4D4D-BB1C-3181E691AF2B} (PUP.FaceThemes) -> Delete on reboot.HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{F85FA3F2-D2C8-4D4D-BB1C-3181E691AF2B} (PUP.FaceThemes) -> Delete on reboot.HKLM\SOFTWARE\CLASSES\TYPELIB\{A3F56272-CDB4-4310-9BB1-9A0D0757A3B3} (PUP.FaceThemes) -> Delete on reboot.HKLM\SOFTWARE\CLASSES\INTERFACE\{D6975F9E-15B2-4FE7-9D16-FC2E85CB201B} (PUP.FaceThemes) -> Delete on reboot.HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{D6975F9E-15B2-4FE7-9D16-FC2E85CB201B} (PUP.FaceThemes) -> Delete on reboot.HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{A3F56272-CDB4-4310-9BB1-9A0D0757A3B3} (PUP.FaceThemes) -> Delete on reboot.HKCU\SOFTWARE\CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} (Hijack.Trojan.Siredef.C) -> Delete on reboot.Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 1HKCU\SOFTWARE\CLASSES\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\INPROCSERVER32| (Trojan.0Access) -> Bad: (C:\$Recycle.Bin\S-1-5-21-2861860325-1608682575-3244310698-1000\$708e671f3545291506c06082039c15b2\n.) Good: (shell32.dll) -> Delete on reboot.Folders Detected: 0(No malicious items detected)Files Detected: 0(No malicious items detected)(end)After RebootMalwarebytes Anti-Rootkit BETA 1.05.0.1001www.malwarebytes.orgDatabase version: v2013.05.17.05Windows 7 Service Pack 1 x64 NTFSInternet Explorer 10.0.9200.16576Owner :: SHREDFEST [administrator]5/17/2013 12:30:01 PMmbar-log-2013-05-17 (12-30-01).txtScan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2PScan options disabled: Objects scanned: 31455Time elapsed: 12 minute(s), 18 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 0(No malicious items detected)Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 0(No malicious items detected)(end)System Log---------------------------------------Malwarebytes Anti-Rootkit BETA 1.05.0.1001© Malwarebytes Corporation 2011-2012OS version: 6.1.7601 Windows 7 Service Pack 1 x64Account is AdministrativeInternet Explorer version: 10.0.9200.16576Java version: 1.6.0_21File system is: NTFSDisk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXEDCPU speed: 2.194000 GHzMemory total: 2075336704, free: 895168512------------ Kernel report ------------ 05/17/2013 11:38:15------------ Loaded modules -----------\SystemRoot\system32\ntoskrnl.exe\SystemRoot\system32\hal.dll\SystemRoot\system32\kdcom.dll\SystemRoot\system32\mcupdate_GenuineIntel.dll\SystemRoot\system32\PSHED.dll\SystemRoot\system32\CLFS.SYS\SystemRoot\system32\CI.dll\SystemRoot\system32\drivers\Wdf01000.sys\SystemRoot\system32\drivers\WDFLDR.SYS\SystemRoot\system32\drivers\ACPI.sys\SystemRoot\system32\drivers\WMILIB.SYS\SystemRoot\system32\drivers\msisadrv.sys\SystemRoot\system32\drivers\pci.sys\SystemRoot\system32\drivers\vdrvroot.sys\SystemRoot\system32\drivers\isapnp.sys\SystemRoot\system32\drivers\mpio.sys\SystemRoot\System32\drivers\partmgr.sys\SystemRoot\system32\DRIVERS\compbatt.sys\SystemRoot\system32\DRIVERS\BATTC.SYS\SystemRoot\system32\drivers\volmgr.sys\SystemRoot\System32\drivers\volmgrx.sys\SystemRoot\system32\drivers\intelide.sys\SystemRoot\system32\drivers\PCIIDEX.SYS\SystemRoot\system32\drivers\aliide.sys\SystemRoot\system32\drivers\amdide.sys\SystemRoot\system32\drivers\cmdide.sys\SystemRoot\System32\drivers\mountmgr.sys\SystemRoot\system32\drivers\msdsm.sys\SystemRoot\system32\drivers\nvraid.sys\SystemRoot\system32\drivers\CLASSPNP.SYS\SystemRoot\system32\drivers\pciide.sys\SystemRoot\system32\drivers\viaide.sys\SystemRoot\system32\drivers\iaStorV.sys\SystemRoot\system32\drivers\atapi.sys\SystemRoot\system32\drivers\ataport.SYS\SystemRoot\system32\DRIVERS\lsi_sas.sys\SystemRoot\system32\DRIVERS\storport.sys\SystemRoot\system32\drivers\msahci.sys\SystemRoot\system32\drivers\HpSAMD.sys\SystemRoot\system32\DRIVERS\adp94xx.sys\SystemRoot\system32\DRIVERS\adpahci.sys\SystemRoot\system32\DRIVERS\adpu320.sys\SystemRoot\system32\drivers\amdsata.sys\SystemRoot\system32\DRIVERS\amdsbs.sys\SystemRoot\system32\drivers\amdxata.sys\SystemRoot\system32\DRIVERS\arc.sys\SystemRoot\system32\DRIVERS\arcsas.sys\SystemRoot\system32\DRIVERS\elxstor.sys\SystemRoot\system32\DRIVERS\iirsp.sys\SystemRoot\system32\DRIVERS\lsi_fc.sys\SystemRoot\system32\DRIVERS\lsi_sas2.sys\SystemRoot\system32\DRIVERS\lsi_scsi.sys\SystemRoot\system32\DRIVERS\megasas.sys\SystemRoot\system32\DRIVERS\MegaSR.sys\SystemRoot\system32\DRIVERS\nfrd960.sys\SystemRoot\system32\drivers\nvstor.sys\SystemRoot\system32\DRIVERS\ql2300.sys\SystemRoot\system32\DRIVERS\ql40xx.sys\SystemRoot\system32\DRIVERS\SiSRaid2.sys\SystemRoot\system32\DRIVERS\sisraid4.sys\SystemRoot\system32\DRIVERS\stexstor.sys\SystemRoot\system32\DRIVERS\vsmraid.sys\SystemRoot\system32\drivers\fltmgr.sys\SystemRoot\system32\drivers\fileinfo.sys\SystemRoot\System32\Drivers\Ntfs.sys\SystemRoot\System32\Drivers\msrpc.sys\SystemRoot\System32\Drivers\ksecdd.sys\SystemRoot\System32\Drivers\cng.sys\SystemRoot\System32\drivers\pcw.sys\SystemRoot\System32\Drivers\Fs_Rec.sys\SystemRoot\system32\drivers\ndis.sys\SystemRoot\system32\drivers\NETIO.SYS\SystemRoot\System32\Drivers\ksecpkg.sys\SystemRoot\System32\drivers\tcpip.sys\SystemRoot\System32\drivers\fwpkclnt.sys\SystemRoot\system32\DRIVERS\wd.sys\SystemRoot\system32\drivers\volsnap.sys\SystemRoot\System32\Drivers\spldr.sys\SystemRoot\system32\drivers\sbp2port.sys\SystemRoot\System32\drivers\rdyboost.sys\SystemRoot\System32\Drivers\mup.sys\SystemRoot\System32\drivers\hwpolicy.sys\SystemRoot\System32\DRIVERS\fvevol.sys\SystemRoot\system32\DRIVERS\disk.sys\SystemRoot\system32\DRIVERS\avgrkx64.sys\SystemRoot\system32\DRIVERS\AVGIDSEH.Sys\SystemRoot\system32\DRIVERS\cdrom.sys\SystemRoot\system32\DRIVERS\avgmfx64.sys\SystemRoot\System32\Drivers\Null.SYS\SystemRoot\System32\Drivers\Beep.SYS\SystemRoot\System32\drivers\vga.sys\SystemRoot\System32\drivers\VIDEOPRT.SYS\SystemRoot\System32\drivers\watchdog.sys\SystemRoot\System32\DRIVERS\RDPCDD.sys\SystemRoot\system32\drivers\rdpencdd.sys\SystemRoot\system32\drivers\rdprefmp.sys\SystemRoot\System32\Drivers\Msfs.SYS\SystemRoot\System32\Drivers\Npfs.SYS\SystemRoot\system32\DRIVERS\tdx.sys\SystemRoot\system32\DRIVERS\TDI.SYS\SystemRoot\system32\DRIVERS\avgtdia.sys\SystemRoot\System32\DRIVERS\netbt.sys\SystemRoot\system32\drivers\afd.sys\SystemRoot\system32\DRIVERS\wfplwf.sys\SystemRoot\system32\DRIVERS\pacer.sys\SystemRoot\system32\DRIVERS\vwififlt.sys\SystemRoot\system32\DRIVERS\netbios.sys\SystemRoot\system32\DRIVERS\wanarp.sys\SystemRoot\system32\drivers\termdd.sys\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS\??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS\SystemRoot\system32\DRIVERS\rdbss.sys\SystemRoot\system32\drivers\nsiproxy.sys\SystemRoot\system32\drivers\mssmbios.sys\SystemRoot\System32\drivers\discache.sys\SystemRoot\System32\Drivers\dfsc.sys\SystemRoot\system32\DRIVERS\blbdrive.sys\SystemRoot\system32\DRIVERS\avgldx64.sys\SystemRoot\system32\DRIVERS\tunnel.sys\SystemRoot\system32\DRIVERS\intelppm.sys\SystemRoot\system32\drivers\wmiacpi.sys\SystemRoot\system32\DRIVERS\igdkmd64.sys\SystemRoot\System32\drivers\dxgkrnl.sys\SystemRoot\System32\drivers\dxgmms1.sys\SystemRoot\system32\drivers\usbuhci.sys\SystemRoot\system32\drivers\USBPORT.SYS\SystemRoot\system32\drivers\usbehci.sys\SystemRoot\system32\drivers\HDAudBus.sys\SystemRoot\system32\DRIVERS\Rt64win7.sys\SystemRoot\system32\DRIVERS\athrx.sys\SystemRoot\system32\DRIVERS\vwifibus.sys\SystemRoot\system32\drivers\i8042prt.sys\SystemRoot\system32\DRIVERS\HpqKbFiltr.sys\SystemRoot\system32\drivers\kbdclass.sys\SystemRoot\system32\DRIVERS\SynTP.sys\SystemRoot\system32\DRIVERS\USBD.SYS\SystemRoot\system32\DRIVERS\mouclass.sys\SystemRoot\system32\DRIVERS\CmBatt.sys\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys\SystemRoot\system32\drivers\CompositeBus.sys\SystemRoot\system32\DRIVERS\AgileVpn.sys\SystemRoot\system32\DRIVERS\rasl2tp.sys\SystemRoot\system32\DRIVERS\ndistapi.sys\SystemRoot\system32\DRIVERS\ndiswan.sys\SystemRoot\system32\DRIVERS\raspppoe.sys\SystemRoot\system32\DRIVERS\raspptp.sys\SystemRoot\system32\DRIVERS\rassstp.sys\SystemRoot\system32\DRIVERS\mcdbus.sys\SystemRoot\system32\DRIVERS\SCSIPORT.SYS\SystemRoot\system32\drivers\swenum.sys\SystemRoot\system32\drivers\ks.sys\SystemRoot\system32\drivers\umbus.sys\SystemRoot\system32\DRIVERS\usbhub.sys\SystemRoot\System32\Drivers\NDProxy.SYS\SystemRoot\system32\drivers\CHDRT64.sys\SystemRoot\system32\drivers\portcls.sys\SystemRoot\system32\drivers\drmk.sys\SystemRoot\system32\drivers\ksthunk.sys\SystemRoot\system32\DRIVERS\CAXHWAZL.sys\SystemRoot\system32\DRIVERS\CAX_DPV.sys\SystemRoot\system32\DRIVERS\CAX_CNXT.sys\SystemRoot\system32\drivers\modem.sys\SystemRoot\system32\drivers\IntcHdmi.sys\SystemRoot\system32\DRIVERS\udfs.sys\SystemRoot\system32\DRIVERS\cdfs.sys\SystemRoot\System32\Drivers\crashdmp.sys\SystemRoot\System32\Drivers\dump_dumpata.sys\SystemRoot\System32\Drivers\dump_msahci.sys\SystemRoot\System32\Drivers\dump_dumpfve.sys\SystemRoot\System32\win32k.sys\SystemRoot\System32\drivers\Dxapi.sys\SystemRoot\system32\DRIVERS\monitor.sys\SystemRoot\System32\TSDDD.dll\SystemRoot\System32\cdd.dll\SystemRoot\system32\drivers\luafv.sys\SystemRoot\system32\DRIVERS\lltdio.sys\SystemRoot\system32\DRIVERS\nwifi.sys\SystemRoot\system32\DRIVERS\ndisuio.sys\SystemRoot\system32\DRIVERS\rspndr.sys\SystemRoot\system32\drivers\HTTP.sys\SystemRoot\System32\DRIVERS\srvnet.sys\SystemRoot\system32\DRIVERS\bowser.sys\SystemRoot\system32\DRIVERS\mrxsmb.sys\SystemRoot\system32\DRIVERS\mrxsmb10.sys\SystemRoot\system32\DRIVERS\mrxsmb20.sys\SystemRoot\System32\DRIVERS\srv2.sys\SystemRoot\System32\DRIVERS\srv.sys\SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys\SystemRoot\system32\DRIVERS\mdmxsdk.sys\SystemRoot\system32\drivers\peauth.sys\SystemRoot\System32\Drivers\secdrv.SYS\SystemRoot\System32\drivers\tcpipreg.sys\SystemRoot\system32\DRIVERS\XAudio64.sys\SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys\SystemRoot\system32\DRIVERS\USBSTOR.SYS\SystemRoot\system32\drivers\spsys.sys\SystemRoot\System32\Drivers\fastfat.SYS\SystemRoot\system32\drivers\WudfPf.sys\SystemRoot\system32\DRIVERS\WUDFRd.sys\??\C:\Windows\system32\drivers\mbamchameleon.sys\??\C:\Windows\system32\drivers\mbamswissarmy.sys\Windows\System32\ntdll.dll\Windows\System32\smss.exe\Windows\System32\apisetschema.dll----------- End -----------<<<1>>>Upper Device Name: \Device\Harddisk1\DR1Upper Device Object: 0xfffffa8002593790Upper Device Driver Name: \Driver\Disk\Lower Device Name: \Device\000000a1\Lower Device Object: 0xfffffa8003f0c060Lower Device Driver Name: \Driver\USBSTOR\Driver name found: USBSTORInitialization returned 0x0Load Function returned 0x0<<<1>>>Upper Device Name: \Device\Harddisk0\DR0Upper Device Object: 0xfffffa8002423060Upper Device Driver Name: \Driver\Disk\Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\Lower Device Object: 0xfffffa8002211680Lower Device Driver Name: \Driver\atapi\Driver name found: atapiInitialization returned 0x0Port sub-driver loaded: \??\C:\Windows\System32\drivers\ataport.sys (0x0)Load Function returned 0x0Downloaded database version: v2013.05.17.05Downloaded database version: v2013.05.14.03Initializing...Done!<<<2>>>Device number: 0, partition: 2Physical Sector Size: 512Drive: 0, DevicePointer: 0xfffffa8002423060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\--------- Disk Stack ------DevicePointer: 0xfffffa8002423b90, DeviceName: Unknown, DriverName: \Driver\partmgr\DevicePointer: 0xfffffa8002423060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\DevicePointer: 0xfffffa8002211680, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\------------ End ----------Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\Upper DeviceData: 0xfffff8a0008227b0, 0xfffffa8002423060, 0xfffffa8001ce0090Lower DeviceData: 0xfffff8a0036853a0, 0xfffffa8002211680, 0xfffffa8003ef5e40<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesScanning directory: C:\Windows\system32\drivers...<<<2>>>Device number: 0, partition: 2<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesDone!Drive 0Scanning MBR on drive 0...Inspecting partition table:MBR Signature: 55AADisk Signature: 135C058FPartition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 2048 Numsec = 407552 Partition file system is NTFS Partition is bootable Partition 1 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 409600 Numsec = 287277056 Partition 2 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 287686656 Numsec = 24891392 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0Disk Size: 160041885696 bytesSector size: 512 bytesScanning physical sectors of unpartitioned space on drive 0 (1-2047-312561808-312581808)...Physical Sector Size: 512Drive: 1, DevicePointer: 0xfffffa8002593790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\--------- Disk Stack ------DevicePointer: 0xfffffa8003f4a040, DeviceName: Unknown, DriverName: \Driver\partmgr\DevicePointer: 0xfffffa8002593790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\DevicePointer: 0xfffffa8003f0c060, DeviceName: \Device\000000a1\, DriverName: \Driver\USBSTOR\------------ End ----------Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\Upper DeviceData: 0xfffff8a0008227e0, 0xfffffa8002593790, 0xfffffa8001c4b790Lower DeviceData: 0xfffff8a01140a5f0, 0xfffffa8003f0c060, 0xfffffa8003c1d750Drive 1Scanning MBR on drive 1...Inspecting partition table:MBR Signature: 55AADisk Signature: 0Partition information: Partition 0 type is Other (0xb) Partition is NOT ACTIVE. Partition starts at LBA: 32 Numsec = 15656928 Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0Disk Size: 8016363520 bytesSector size: 512 bytesDone!Performing system, memory and registry scan...Infected: HKLM\SOFTWARE\CLASSES\APPID\{F85FA3F2-D2C8-4D4D-BB1C-3181E691AF2B} --> [PUP.FaceThemes]Infected: HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{F85FA3F2-D2C8-4D4D-BB1C-3181E691AF2B} --> [PUP.FaceThemes]Infected: HKLM\SOFTWARE\CLASSES\TYPELIB\{A3F56272-CDB4-4310-9BB1-9A0D0757A3B3} --> [PUP.FaceThemes]Infected: HKLM\SOFTWARE\CLASSES\INTERFACE\{D6975F9E-15B2-4FE7-9D16-FC2E85CB201B} --> [PUP.FaceThemes]Infected: HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{D6975F9E-15B2-4FE7-9D16-FC2E85CB201B} --> [PUP.FaceThemes]Infected: HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{A3F56272-CDB4-4310-9BB1-9A0D0757A3B3} --> [PUP.FaceThemes]Infected: HKCU\SOFTWARE\CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} --> [Hijack.Trojan.Siredef.C]Infected: HKCU\SOFTWARE\CLASSES\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\INPROCSERVER32| --> [Trojan.0Access]Done!Scan finishedCreating System Restore point...Scheduling clean up...<<<2>>>Device number: 0, partition: 2<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesExecuting an action fixdamage.exe...Success!Removal successful. No system shutdown is required.=======================================---------------------------------------Malwarebytes Anti-Rootkit BETA 1.05.0.1001© Malwarebytes Corporation 2011-2012OS version: 6.1.7601 Windows 7 Service Pack 1 x64Account is AdministrativeInternet Explorer version: 10.0.9200.16576Java version: 1.6.0_21File system is: NTFSDisk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXEDCPU speed: 2.194000 GHzMemory total: 2075336704, free: 998584320------------ Kernel report ------------ 05/17/2013 11:55:39------------ Loaded modules -----------\SystemRoot\system32\ntoskrnl.exe\SystemRoot\system32\hal.dll\SystemRoot\system32\kdcom.dll\SystemRoot\system32\mcupdate_GenuineIntel.dll\SystemRoot\system32\PSHED.dll\SystemRoot\system32\CLFS.SYS\SystemRoot\system32\CI.dll\SystemRoot\system32\drivers\Wdf01000.sys\SystemRoot\system32\drivers\WDFLDR.SYS\SystemRoot\system32\drivers\ACPI.sys\SystemRoot\system32\drivers\WMILIB.SYS\SystemRoot\system32\drivers\msisadrv.sys\SystemRoot\system32\drivers\pci.sys\SystemRoot\system32\drivers\vdrvroot.sys\SystemRoot\system32\drivers\isapnp.sys\SystemRoot\system32\drivers\mpio.sys\SystemRoot\System32\drivers\partmgr.sys\SystemRoot\system32\DRIVERS\compbatt.sys\SystemRoot\system32\DRIVERS\BATTC.SYS\SystemRoot\system32\drivers\volmgr.sys\SystemRoot\System32\drivers\volmgrx.sys\SystemRoot\system32\drivers\intelide.sys\SystemRoot\system32\drivers\PCIIDEX.SYS\SystemRoot\system32\drivers\aliide.sys\SystemRoot\system32\drivers\amdide.sys\SystemRoot\system32\drivers\cmdide.sys\SystemRoot\System32\drivers\mountmgr.sys\SystemRoot\system32\drivers\msdsm.sys\SystemRoot\system32\drivers\nvraid.sys\SystemRoot\system32\drivers\CLASSPNP.SYS\SystemRoot\system32\drivers\pciide.sys\SystemRoot\system32\drivers\viaide.sys\SystemRoot\system32\drivers\iaStorV.sys\SystemRoot\system32\drivers\atapi.sys\SystemRoot\system32\drivers\ataport.SYS\SystemRoot\system32\DRIVERS\lsi_sas.sys\SystemRoot\system32\DRIVERS\storport.sys\SystemRoot\system32\drivers\msahci.sys\SystemRoot\system32\drivers\HpSAMD.sys\SystemRoot\system32\DRIVERS\adp94xx.sys\SystemRoot\system32\DRIVERS\adpahci.sys\SystemRoot\system32\DRIVERS\adpu320.sys\SystemRoot\system32\drivers\amdsata.sys\SystemRoot\system32\DRIVERS\amdsbs.sys\SystemRoot\system32\drivers\amdxata.sys\SystemRoot\system32\DRIVERS\arc.sys\SystemRoot\system32\DRIVERS\arcsas.sys\SystemRoot\system32\DRIVERS\elxstor.sys\SystemRoot\system32\DRIVERS\iirsp.sys\SystemRoot\system32\DRIVERS\lsi_fc.sys\SystemRoot\system32\DRIVERS\lsi_sas2.sys\SystemRoot\system32\DRIVERS\lsi_scsi.sys\SystemRoot\system32\DRIVERS\megasas.sys\SystemRoot\system32\DRIVERS\MegaSR.sys\SystemRoot\system32\DRIVERS\nfrd960.sys\SystemRoot\system32\drivers\nvstor.sys\SystemRoot\system32\DRIVERS\ql2300.sys\SystemRoot\system32\DRIVERS\ql40xx.sys\SystemRoot\system32\DRIVERS\SiSRaid2.sys\SystemRoot\system32\DRIVERS\sisraid4.sys\SystemRoot\system32\DRIVERS\stexstor.sys\SystemRoot\system32\DRIVERS\vsmraid.sys\SystemRoot\system32\drivers\fltmgr.sys\SystemRoot\system32\drivers\fileinfo.sys\SystemRoot\System32\Drivers\Ntfs.sys\SystemRoot\System32\Drivers\msrpc.sys\SystemRoot\System32\Drivers\ksecdd.sys\SystemRoot\System32\Drivers\cng.sys\SystemRoot\System32\drivers\pcw.sys\SystemRoot\System32\Drivers\Fs_Rec.sys\SystemRoot\system32\drivers\ndis.sys\SystemRoot\system32\drivers\NETIO.SYS\SystemRoot\System32\Drivers\ksecpkg.sys\SystemRoot\System32\drivers\tcpip.sys\SystemRoot\System32\drivers\fwpkclnt.sys\SystemRoot\system32\DRIVERS\wd.sys\SystemRoot\system32\drivers\volsnap.sys\SystemRoot\System32\Drivers\spldr.sys\SystemRoot\system32\drivers\sbp2port.sys\SystemRoot\System32\drivers\rdyboost.sys\SystemRoot\System32\Drivers\mup.sys\SystemRoot\System32\drivers\hwpolicy.sys\SystemRoot\System32\DRIVERS\fvevol.sys\SystemRoot\system32\DRIVERS\disk.sys\SystemRoot\system32\DRIVERS\avgrkx64.sys\SystemRoot\system32\DRIVERS\AVGIDSEH.Sys\SystemRoot\system32\DRIVERS\cdrom.sys\SystemRoot\system32\DRIVERS\avgmfx64.sys\SystemRoot\System32\Drivers\Null.SYS\SystemRoot\System32\Drivers\Beep.SYS\SystemRoot\System32\drivers\vga.sys\SystemRoot\System32\drivers\VIDEOPRT.SYS\SystemRoot\System32\drivers\watchdog.sys\SystemRoot\System32\DRIVERS\RDPCDD.sys\SystemRoot\system32\drivers\rdpencdd.sys\SystemRoot\system32\drivers\rdprefmp.sys\SystemRoot\System32\Drivers\Msfs.SYS\SystemRoot\System32\Drivers\Npfs.SYS\SystemRoot\system32\DRIVERS\tdx.sys\SystemRoot\system32\DRIVERS\TDI.SYS\SystemRoot\system32\DRIVERS\avgtdia.sys\SystemRoot\System32\DRIVERS\netbt.sys\SystemRoot\system32\drivers\afd.sys\SystemRoot\system32\DRIVERS\wfplwf.sys\SystemRoot\system32\DRIVERS\pacer.sys\SystemRoot\system32\DRIVERS\vwififlt.sys\SystemRoot\system32\DRIVERS\netbios.sys\SystemRoot\system32\DRIVERS\wanarp.sys\SystemRoot\system32\drivers\termdd.sys\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS\??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS\SystemRoot\system32\DRIVERS\rdbss.sys\SystemRoot\system32\drivers\nsiproxy.sys\SystemRoot\system32\drivers\mssmbios.sys\SystemRoot\System32\drivers\discache.sys\SystemRoot\System32\Drivers\dfsc.sys\SystemRoot\system32\DRIVERS\blbdrive.sys\SystemRoot\system32\DRIVERS\avgldx64.sys\SystemRoot\system32\DRIVERS\tunnel.sys\SystemRoot\system32\DRIVERS\intelppm.sys\SystemRoot\system32\drivers\wmiacpi.sys\SystemRoot\system32\DRIVERS\igdkmd64.sys\SystemRoot\System32\drivers\dxgkrnl.sys\SystemRoot\System32\drivers\dxgmms1.sys\SystemRoot\system32\drivers\usbuhci.sys\SystemRoot\system32\drivers\USBPORT.SYS\SystemRoot\system32\drivers\usbehci.sys\SystemRoot\system32\drivers\HDAudBus.sys\SystemRoot\system32\DRIVERS\Rt64win7.sys\SystemRoot\system32\DRIVERS\athrx.sys\SystemRoot\system32\DRIVERS\vwifibus.sys\SystemRoot\system32\drivers\i8042prt.sys\SystemRoot\system32\DRIVERS\HpqKbFiltr.sys\SystemRoot\system32\drivers\kbdclass.sys\SystemRoot\system32\DRIVERS\SynTP.sys\SystemRoot\system32\DRIVERS\USBD.SYS\SystemRoot\system32\DRIVERS\mouclass.sys\SystemRoot\system32\DRIVERS\CmBatt.sys\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys\SystemRoot\system32\drivers\CompositeBus.sys\SystemRoot\system32\DRIVERS\AgileVpn.sys\SystemRoot\system32\DRIVERS\rasl2tp.sys\SystemRoot\system32\DRIVERS\ndistapi.sys\SystemRoot\system32\DRIVERS\ndiswan.sys\SystemRoot\system32\DRIVERS\raspppoe.sys\SystemRoot\system32\DRIVERS\raspptp.sys\SystemRoot\system32\DRIVERS\rassstp.sys\SystemRoot\system32\DRIVERS\mcdbus.sys\SystemRoot\system32\DRIVERS\SCSIPORT.SYS\SystemRoot\system32\drivers\swenum.sys\SystemRoot\system32\drivers\ks.sys\SystemRoot\system32\drivers\umbus.sys\SystemRoot\system32\DRIVERS\usbhub.sys\SystemRoot\System32\Drivers\NDProxy.SYS\SystemRoot\system32\drivers\CHDRT64.sys\SystemRoot\system32\drivers\portcls.sys\SystemRoot\system32\drivers\drmk.sys\SystemRoot\system32\drivers\ksthunk.sys\SystemRoot\system32\DRIVERS\CAXHWAZL.sys\SystemRoot\system32\DRIVERS\CAX_DPV.sys\SystemRoot\system32\DRIVERS\CAX_CNXT.sys\SystemRoot\system32\drivers\modem.sys\SystemRoot\system32\drivers\IntcHdmi.sys\SystemRoot\system32\DRIVERS\udfs.sys\SystemRoot\system32\DRIVERS\cdfs.sys\SystemRoot\System32\Drivers\crashdmp.sys\SystemRoot\System32\Drivers\dump_dumpata.sys\SystemRoot\System32\Drivers\dump_msahci.sys\SystemRoot\System32\Drivers\dump_dumpfve.sys\SystemRoot\System32\win32k.sys\SystemRoot\System32\drivers\Dxapi.sys\SystemRoot\system32\DRIVERS\monitor.sys\SystemRoot\System32\TSDDD.dll\SystemRoot\System32\cdd.dll\SystemRoot\system32\drivers\luafv.sys\SystemRoot\system32\DRIVERS\lltdio.sys\SystemRoot\system32\DRIVERS\nwifi.sys\SystemRoot\system32\DRIVERS\ndisuio.sys\SystemRoot\system32\DRIVERS\rspndr.sys\SystemRoot\system32\drivers\HTTP.sys\SystemRoot\System32\DRIVERS\srvnet.sys\SystemRoot\system32\DRIVERS\bowser.sys\SystemRoot\system32\DRIVERS\mrxsmb.sys\SystemRoot\system32\DRIVERS\mrxsmb10.sys\SystemRoot\system32\DRIVERS\mrxsmb20.sys\SystemRoot\System32\DRIVERS\srv2.sys\SystemRoot\System32\DRIVERS\srv.sys\SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys\SystemRoot\system32\DRIVERS\mdmxsdk.sys\SystemRoot\system32\drivers\peauth.sys\SystemRoot\System32\Drivers\secdrv.SYS\SystemRoot\System32\drivers\tcpipreg.sys\SystemRoot\system32\DRIVERS\XAudio64.sys\SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys\SystemRoot\system32\DRIVERS\USBSTOR.SYS\SystemRoot\System32\Drivers\fastfat.SYS\SystemRoot\system32\drivers\WudfPf.sys\SystemRoot\system32\DRIVERS\WUDFRd.sys\SystemRoot\System32\drivers\mpsdrv.sys\??\C:\Windows\system32\drivers\mbamchameleon.sys\??\C:\Windows\system32\drivers\mbamswissarmy.sys\Windows\System32\ntdll.dll\Windows\System32\smss.exe\Windows\System32\apisetschema.dll----------- End -----------<<<1>>>Upper Device Name: \Device\Harddisk1\DR1Upper Device Object: 0xfffffa8002593790Upper Device Driver Name: \Driver\Disk\Lower Device Name: \Device\000000a1\Lower Device Object: 0xfffffa8003f0c060Lower Device Driver Name: \Driver\USBSTOR\Device already Exists: 0xfffffa8003c1d750<<<1>>>Upper Device Name: \Device\Harddisk0\DR0Upper Device Object: 0xfffffa8002423060Upper Device Driver Name: \Driver\Disk\Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\Lower Device Object: 0xfffffa8002211680Lower Device Driver Name: \Driver\atapi\Device already Exists: 0xfffffa8003ef5e40Initializing...Done!<<<2>>>Device number: 0, partition: 2Physical Sector Size: 512Drive: 0, DevicePointer: 0xfffffa8002423060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\--------- Disk Stack ------DevicePointer: 0xfffffa8002423b90, DeviceName: Unknown, DriverName: \Driver\partmgr\DevicePointer: 0xfffffa8002423060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\DevicePointer: 0xfffffa8002211680, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\------------ End ----------Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\Upper DeviceData: 0xfffff8a00449f580, 0xfffffa8002423060, 0xfffffa8001ce0090Lower DeviceData: 0xfffff8a011a99230, 0xfffffa8002211680, 0xfffffa8003ef5e40<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesScanning directory: C:\Windows\system32\drivers...<<<2>>>Device number: 0, partition: 2<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesDone!Drive 0Scanning MBR on drive 0...Inspecting partition table:MBR Signature: 55AADisk Signature: 135C058FPartition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 2048 Numsec = 407552 Partition file system is NTFS Partition is bootable Partition 1 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 409600 Numsec = 287277056 Partition 2 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 287686656 Numsec = 24891392 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0Disk Size: 160041885696 bytesSector size: 512 bytesScanning physical sectors of unpartitioned space on drive 0 (1-2047-312561808-312581808)...Physical Sector Size: 512Drive: 1, DevicePointer: 0xfffffa8002593790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\--------- Disk Stack ------DevicePointer: 0xfffffa8003f4a040, DeviceName: Unknown, DriverName: \Driver\partmgr\DevicePointer: 0xfffffa8002593790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\DevicePointer: 0xfffffa8003f0c060, DeviceName: \Device\000000a1\, DriverName: \Driver\USBSTOR\------------ End ----------Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\Upper DeviceData: 0xfffff8a011a12230, 0xfffffa8002593790, 0xfffffa8001c4b790Lower DeviceData: 0xfffff8a010427940, 0xfffffa8003f0c060, 0xfffffa8003c1d750Drive 1Scanning MBR on drive 1...Inspecting partition table:MBR Signature: 55AADisk Signature: 0Partition information: Partition 0 type is Other (0xb) Partition is NOT ACTIVE. Partition starts at LBA: 32 Numsec = 15656928 Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0Disk Size: 8016363520 bytesSector size: 512 bytesDone!Performing system, memory and registry scan...Infected: HKCU\SOFTWARE\CLASSES\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9} --> [Hijack.Trojan.Siredef.C]Done!Scan finishedCreating System Restore point...Scheduling clean up...<<<2>>>Device number: 0, partition: 2<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesExecuting an action fixdamage.exe...Success!Removal successful. No system shutdown is required.=======================================---------------------------------------Malwarebytes Anti-Rootkit BETA 1.05.0.1001© Malwarebytes Corporation 2011-2012OS version: 6.1.7601 Windows 7 Service Pack 1 x64Account is AdministrativeInternet Explorer version: 10.0.9200.16576Java version: 1.6.0_21File system is: NTFSDisk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXEDCPU speed: 2.194000 GHzMemory total: 2075336704, free: 1079119872Removal queue found; removal startedRemoval finished=======================================---------------------------------------Malwarebytes Anti-Rootkit BETA 1.05.0.1001© Malwarebytes Corporation 2011-2012OS version: 6.1.7601 Windows 7 Service Pack 1 x64Account is AdministrativeInternet Explorer version: 10.0.9200.16576Java version: 1.6.0_21File system is: NTFSDisk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXEDCPU speed: 2.194000 GHzMemory total: 2075336704, free: 917045248------------ Kernel report ------------ 05/17/2013 12:17:38------------ Loaded modules -----------\SystemRoot\system32\ntoskrnl.exe\SystemRoot\system32\hal.dll\SystemRoot\system32\kdcom.dll\SystemRoot\system32\mcupdate_GenuineIntel.dll\SystemRoot\system32\PSHED.dll\SystemRoot\system32\CLFS.SYS\SystemRoot\system32\CI.dll\SystemRoot\system32\drivers\Wdf01000.sys\SystemRoot\system32\drivers\WDFLDR.SYS\SystemRoot\system32\drivers\ACPI.sys\SystemRoot\system32\drivers\WMILIB.SYS\SystemRoot\system32\drivers\msisadrv.sys\SystemRoot\system32\drivers\pci.sys\SystemRoot\system32\drivers\vdrvroot.sys\SystemRoot\system32\drivers\isapnp.sys\SystemRoot\system32\drivers\mpio.sys\SystemRoot\System32\drivers\partmgr.sys\SystemRoot\system32\DRIVERS\compbatt.sys\SystemRoot\system32\DRIVERS\BATTC.SYS\SystemRoot\system32\drivers\volmgr.sys\SystemRoot\System32\drivers\volmgrx.sys\SystemRoot\system32\drivers\intelide.sys\SystemRoot\system32\drivers\PCIIDEX.SYS\SystemRoot\system32\drivers\aliide.sys\SystemRoot\system32\drivers\amdide.sys\SystemRoot\system32\drivers\cmdide.sys\SystemRoot\System32\drivers\mountmgr.sys\SystemRoot\system32\drivers\msdsm.sys\SystemRoot\system32\drivers\nvraid.sys\SystemRoot\system32\drivers\CLASSPNP.SYS\SystemRoot\system32\drivers\pciide.sys\SystemRoot\system32\drivers\viaide.sys\SystemRoot\system32\drivers\iaStorV.sys\SystemRoot\system32\drivers\atapi.sys\SystemRoot\system32\drivers\ataport.SYS\SystemRoot\system32\DRIVERS\lsi_sas.sys\SystemRoot\system32\DRIVERS\storport.sys\SystemRoot\system32\drivers\msahci.sys\SystemRoot\system32\drivers\HpSAMD.sys\SystemRoot\system32\DRIVERS\adp94xx.sys\SystemRoot\system32\DRIVERS\adpahci.sys\SystemRoot\system32\DRIVERS\adpu320.sys\SystemRoot\system32\drivers\amdsata.sys\SystemRoot\system32\DRIVERS\amdsbs.sys\SystemRoot\system32\drivers\amdxata.sys\SystemRoot\system32\DRIVERS\arc.sys\SystemRoot\system32\DRIVERS\arcsas.sys\SystemRoot\system32\DRIVERS\elxstor.sys\SystemRoot\system32\DRIVERS\iirsp.sys\SystemRoot\system32\DRIVERS\lsi_fc.sys\SystemRoot\system32\DRIVERS\lsi_sas2.sys\SystemRoot\system32\DRIVERS\lsi_scsi.sys\SystemRoot\system32\DRIVERS\megasas.sys\SystemRoot\system32\DRIVERS\MegaSR.sys\SystemRoot\system32\DRIVERS\nfrd960.sys\SystemRoot\system32\drivers\nvstor.sys\SystemRoot\system32\DRIVERS\ql2300.sys\SystemRoot\system32\DRIVERS\ql40xx.sys\SystemRoot\system32\DRIVERS\SiSRaid2.sys\SystemRoot\system32\DRIVERS\sisraid4.sys\SystemRoot\system32\DRIVERS\stexstor.sys\SystemRoot\system32\DRIVERS\vsmraid.sys\SystemRoot\system32\drivers\fltmgr.sys\SystemRoot\system32\drivers\fileinfo.sys\SystemRoot\System32\Drivers\Ntfs.sys\SystemRoot\System32\Drivers\msrpc.sys\SystemRoot\System32\Drivers\ksecdd.sys\SystemRoot\System32\Drivers\cng.sys\SystemRoot\System32\drivers\pcw.sys\SystemRoot\System32\Drivers\Fs_Rec.sys\SystemRoot\system32\drivers\ndis.sys\SystemRoot\system32\drivers\NETIO.SYS\SystemRoot\System32\Drivers\ksecpkg.sys\SystemRoot\System32\drivers\tcpip.sys\SystemRoot\System32\drivers\fwpkclnt.sys\SystemRoot\system32\DRIVERS\wd.sys\SystemRoot\system32\drivers\volsnap.sys\SystemRoot\System32\Drivers\spldr.sys\SystemRoot\system32\drivers\sbp2port.sys\SystemRoot\System32\drivers\rdyboost.sys\SystemRoot\System32\Drivers\mup.sys\SystemRoot\System32\drivers\hwpolicy.sys\SystemRoot\System32\DRIVERS\fvevol.sys\SystemRoot\system32\DRIVERS\disk.sys\SystemRoot\system32\DRIVERS\avgrkx64.sys\SystemRoot\system32\DRIVERS\AVGIDSEH.Sys\SystemRoot\system32\DRIVERS\cdrom.sys\SystemRoot\system32\DRIVERS\avgmfx64.sys\SystemRoot\System32\Drivers\Null.SYS\SystemRoot\System32\Drivers\Beep.SYS\SystemRoot\System32\drivers\vga.sys\SystemRoot\System32\drivers\VIDEOPRT.SYS\SystemRoot\System32\drivers\watchdog.sys\SystemRoot\System32\DRIVERS\RDPCDD.sys\SystemRoot\system32\drivers\rdpencdd.sys\SystemRoot\system32\drivers\rdprefmp.sys\SystemRoot\System32\Drivers\Msfs.SYS\SystemRoot\System32\Drivers\Npfs.SYS\SystemRoot\system32\DRIVERS\tdx.sys\SystemRoot\system32\DRIVERS\TDI.SYS\SystemRoot\system32\DRIVERS\avgtdia.sys\SystemRoot\System32\DRIVERS\netbt.sys\SystemRoot\system32\drivers\afd.sys\SystemRoot\system32\DRIVERS\wfplwf.sys\SystemRoot\system32\DRIVERS\pacer.sys\SystemRoot\system32\DRIVERS\vwififlt.sys\SystemRoot\system32\DRIVERS\netbios.sys\SystemRoot\system32\DRIVERS\wanarp.sys\SystemRoot\system32\drivers\termdd.sys\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS\??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS\SystemRoot\system32\DRIVERS\rdbss.sys\SystemRoot\system32\drivers\nsiproxy.sys\SystemRoot\system32\drivers\mssmbios.sys\SystemRoot\System32\drivers\discache.sys\SystemRoot\System32\Drivers\dfsc.sys\SystemRoot\system32\DRIVERS\blbdrive.sys\SystemRoot\system32\DRIVERS\avgldx64.sys\SystemRoot\system32\DRIVERS\tunnel.sys\SystemRoot\system32\DRIVERS\intelppm.sys\SystemRoot\system32\drivers\wmiacpi.sys\SystemRoot\system32\DRIVERS\igdkmd64.sys\SystemRoot\System32\drivers\dxgkrnl.sys\SystemRoot\System32\drivers\dxgmms1.sys\SystemRoot\system32\drivers\usbuhci.sys\SystemRoot\system32\drivers\USBPORT.SYS\SystemRoot\system32\drivers\usbehci.sys\SystemRoot\system32\drivers\HDAudBus.sys\SystemRoot\system32\DRIVERS\Rt64win7.sys\SystemRoot\system32\DRIVERS\athrx.sys\SystemRoot\system32\DRIVERS\vwifibus.sys\SystemRoot\system32\drivers\i8042prt.sys\SystemRoot\system32\DRIVERS\HpqKbFiltr.sys\SystemRoot\system32\drivers\kbdclass.sys\SystemRoot\system32\DRIVERS\SynTP.sys\SystemRoot\system32\DRIVERS\USBD.SYS\SystemRoot\system32\DRIVERS\mouclass.sys\SystemRoot\system32\DRIVERS\CmBatt.sys\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys\SystemRoot\system32\drivers\CompositeBus.sys\SystemRoot\system32\DRIVERS\AgileVpn.sys\SystemRoot\system32\DRIVERS\rasl2tp.sys\SystemRoot\system32\DRIVERS\ndistapi.sys\SystemRoot\system32\DRIVERS\ndiswan.sys\SystemRoot\system32\DRIVERS\raspppoe.sys\SystemRoot\system32\DRIVERS\raspptp.sys\SystemRoot\system32\DRIVERS\rassstp.sys\SystemRoot\system32\DRIVERS\mcdbus.sys\SystemRoot\system32\DRIVERS\SCSIPORT.SYS\SystemRoot\system32\drivers\swenum.sys\SystemRoot\system32\drivers\ks.sys\SystemRoot\system32\drivers\umbus.sys\SystemRoot\system32\DRIVERS\usbhub.sys\SystemRoot\System32\Drivers\NDProxy.SYS\SystemRoot\system32\drivers\CHDRT64.sys\SystemRoot\system32\drivers\portcls.sys\SystemRoot\system32\drivers\drmk.sys\SystemRoot\system32\drivers\ksthunk.sys\SystemRoot\system32\DRIVERS\CAXHWAZL.sys\SystemRoot\system32\DRIVERS\CAX_DPV.sys\SystemRoot\system32\DRIVERS\CAX_CNXT.sys\SystemRoot\system32\drivers\modem.sys\SystemRoot\system32\drivers\IntcHdmi.sys\SystemRoot\system32\DRIVERS\udfs.sys\SystemRoot\system32\DRIVERS\cdfs.sys\SystemRoot\System32\Drivers\crashdmp.sys\SystemRoot\System32\Drivers\dump_dumpata.sys\SystemRoot\System32\Drivers\dump_msahci.sys\SystemRoot\System32\Drivers\dump_dumpfve.sys\SystemRoot\System32\win32k.sys\SystemRoot\System32\drivers\Dxapi.sys\SystemRoot\system32\DRIVERS\monitor.sys\SystemRoot\System32\TSDDD.dll\SystemRoot\System32\cdd.dll\SystemRoot\system32\drivers\luafv.sys\SystemRoot\system32\DRIVERS\lltdio.sys\SystemRoot\system32\DRIVERS\nwifi.sys\SystemRoot\system32\DRIVERS\ndisuio.sys\SystemRoot\system32\DRIVERS\rspndr.sys\SystemRoot\system32\drivers\HTTP.sys\SystemRoot\System32\DRIVERS\srvnet.sys\SystemRoot\system32\DRIVERS\bowser.sys\SystemRoot\System32\drivers\mpsdrv.sys\SystemRoot\system32\DRIVERS\mrxsmb.sys\SystemRoot\system32\DRIVERS\mrxsmb10.sys\SystemRoot\system32\DRIVERS\mrxsmb20.sys\SystemRoot\System32\DRIVERS\srv2.sys\SystemRoot\System32\DRIVERS\srv.sys\SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys\SystemRoot\system32\DRIVERS\mdmxsdk.sys\SystemRoot\system32\drivers\peauth.sys\SystemRoot\System32\Drivers\secdrv.SYS\SystemRoot\System32\drivers\tcpipreg.sys\SystemRoot\system32\DRIVERS\XAudio64.sys\SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys\SystemRoot\system32\DRIVERS\USBSTOR.SYS\SystemRoot\System32\Drivers\fastfat.SYS\SystemRoot\system32\drivers\WudfPf.sys\SystemRoot\system32\DRIVERS\WUDFRd.sys\SystemRoot\system32\drivers\spsys.sys\??\C:\Windows\system32\drivers\mbamchameleon.sys\??\C:\Windows\system32\drivers\mbamswissarmy.sys\Windows\System32\ntdll.dll\Windows\System32\smss.exe\Windows\System32\apisetschema.dll----------- End -----------<<<1>>>Upper Device Name: \Device\Harddisk1\DR1Upper Device Object: 0xfffffa8001caa790Upper Device Driver Name: \Driver\Disk\Lower Device Name: \Device\000000a1\Lower Device Object: 0xfffffa8001cc5060Lower Device Driver Name: \Driver\USBSTOR\Driver name found: USBSTORInitialization returned 0x0Load Function returned 0x0<<<1>>>Upper Device Name: \Device\Harddisk0\DR0Upper Device Object: 0xfffffa800273f660Upper Device Driver Name: \Driver\Disk\Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\Lower Device Object: 0xfffffa8002282680Lower Device Driver Name: \Driver\atapi\Driver name found: atapiInitialization returned 0x0Port sub-driver loaded: \??\C:\Windows\System32\drivers\ataport.sys (0x0)Load Function returned 0x0Initializing...Done!<<<2>>>Device number: 0, partition: 2Physical Sector Size: 512Drive: 0, DevicePointer: 0xfffffa800273f660, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\--------- Disk Stack ------DevicePointer: 0xfffffa8002740040, DeviceName: Unknown, DriverName: \Driver\partmgr\DevicePointer: 0xfffffa800273f660, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\DevicePointer: 0xfffffa8002282680, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\------------ End ----------Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\Upper DeviceData: 0xfffff8a00586e0d0, 0xfffffa800273f660, 0xfffffa8001ff8090Lower DeviceData: 0xfffff8a0054564e0, 0xfffffa8002282680, 0xfffffa80020fd7d0<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesScanning directory: C:\Windows\system32\drivers...<<<2>>>Device number: 0, partition: 2<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesDone!Drive 0Scanning MBR on drive 0...Inspecting partition table:MBR Signature: 55AADisk Signature: 135C058FPartition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 2048 Numsec = 407552 Partition file system is NTFS Partition is bootable Partition 1 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 409600 Numsec = 287277056 Partition 2 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 287686656 Numsec = 24891392 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0Disk Size: 160041885696 bytesSector size: 512 bytesScanning physical sectors of unpartitioned space on drive 0 (1-2047-312561808-312581808)...Physical Sector Size: 512Drive: 1, DevicePointer: 0xfffffa8001caa790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\--------- Disk Stack ------DevicePointer: 0xfffffa8001c63040, DeviceName: Unknown, DriverName: \Driver\partmgr\DevicePointer: 0xfffffa8001caa790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\DevicePointer: 0xfffffa8001cc5060, DeviceName: \Device\000000a1\, DriverName: \Driver\USBSTOR\------------ End ----------Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\Upper DeviceData: 0xfffff8a00586e130, 0xfffffa8001caa790, 0xfffffa80020c5090Lower DeviceData: 0xfffff8a0053fe9b0, 0xfffffa8001cc5060, 0xfffffa8002020130Drive 1Scanning MBR on drive 1...Inspecting partition table:MBR Signature: 55AADisk Signature: 0Partition information: Partition 0 type is Other (0xb) Partition is NOT ACTIVE. Partition starts at LBA: 32 Numsec = 15656928 Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0Disk Size: 8016363520 bytesSector size: 512 bytesDone!Performing system, memory and registry scan...Done!Scan finished======================================= Link to post Share on other sites More sharing options...
MrCharlie Posted May 17, 2013 ID:680858 Share Posted May 17, 2013 Well Done, lets run ComboFix to clear up any leftovers.Please download and run ComboFix.The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.Please visit this webpage for download links, and instructions for running ComboFixhttp://www.bleepingcomputer.com/combofix/how-to-use-combofixEnsure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Information on disabling your malware programs can be found Here.Make sure you run ComboFix from your desktop. Give it at least 30-45 minutes to finish if needed.Please include the C:\ComboFix.txt in your next reply for further review.---------->NOTE<----------If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.MrC Link to post Share on other sites More sharing options...
bipster10 Posted May 17, 2013 Author ID:680873 Share Posted May 17, 2013 ComboFix logComboFix 13-05-16.02 - Owner 05/17/2013 12:52:24.1.1 - x64Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.1979.986 [GMT -4:00]Running from: c:\users\Owner\Desktop\ComboFix.exeAV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}SP: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..c:\users\Owner\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbkc:\users\Owner\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\rasphone.pbkc:\users\Owner\xobglu32.dll..((((((((((((((((((((((((( Files Created from 2013-04-17 to 2013-05-17 )))))))))))))))))))))))))))))))..2013-05-17 18:44 . 2013-05-17 18:44 -------- d-----w- C:\FRST2013-05-17 17:04 . 2013-05-17 17:04 -------- d-----w- c:\users\Default\AppData\Local\temp2013-05-15 09:29 . 2013-04-10 06:01 265064 ----a-w- c:\windows\system32\drivers\dxgmms1.sys2013-05-14 21:09 . 2013-05-14 21:09 17613192 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe2013-04-28 05:53 . 2013-04-28 05:54 -------- d-----w- c:\users\Owner\AppData\Roaming\Stella2013-04-28 04:58 . 2013-04-28 04:58 40960 ----a-r- c:\users\Owner\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\NewShortcut1_9559F7CA5E344237A2D9D856464AD727.exe2013-04-28 04:58 . 2013-04-28 04:58 40960 ----a-r- c:\users\Owner\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\ARPPRODUCTICON.exe2013-04-28 04:58 . 2013-04-28 05:00 -------- d-----w- c:\program files (x86)\Project64 1.62013-04-24 02:39 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys2013-04-21 18:52 . 2013-04-21 18:52 226304 ----a-w- c:\windows\system32\elshyph.dll2013-04-21 18:52 . 2013-04-21 18:52 185344 ----a-w- c:\windows\SysWow64\elshyph.dll2013-04-21 18:52 . 2013-04-21 18:52 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe2013-04-21 18:52 . 2013-04-21 18:52 158720 ----a-w- c:\windows\SysWow64\msls31.dll...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2013-05-17 14:16 . 2010-06-24 15:33 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll2013-05-15 22:15 . 2009-11-29 21:39 75016696 ----a-w- c:\windows\system32\MRT.exe2013-05-14 21:09 . 2012-07-07 00:45 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl2013-05-14 21:09 . 2012-07-07 00:45 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe2013-04-13 05:49 . 2013-05-15 09:29 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll2013-04-13 05:49 . 2013-05-15 09:29 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll2013-04-13 05:49 . 2013-05-15 09:29 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll2013-04-13 05:49 . 2013-05-15 09:29 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll2013-04-13 04:45 . 2013-05-15 09:29 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll2013-04-13 04:45 . 2013-05-15 09:29 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll2013-03-19 06:04 . 2013-04-10 13:10 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe2013-03-19 05:46 . 2013-04-10 13:10 43520 ----a-w- c:\windows\system32\csrsrv.dll2013-03-19 05:04 . 2013-04-10 13:10 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe2013-03-19 05:04 . 2013-04-10 13:10 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe2013-03-19 04:47 . 2013-04-10 13:10 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll2013-03-19 03:06 . 2013-04-10 13:10 112640 ----a-w- c:\windows\system32\smss.exe..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]@="{C5994560-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]2011-06-13 14:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]@="{C5994561-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]2011-06-13 14:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]@="{C5994562-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]2011-06-13 14:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]@="{C5994563-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]2011-06-13 14:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]@="{C5994564-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]2011-06-13 14:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]@="{C5994565-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]2011-06-13 14:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]@="{C5994566-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]2011-06-13 14:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]@="{C5994567-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]2011-06-13 14:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]@="{C5994568-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]2011-06-13 14:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"HPADVISOR"="c:\program files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2009-07-16 1668664]"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-01-22 2363392]"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2013-01-08 5629312]"EA Core"="c:\program files (x86)\Electronic Arts\EADM\Core.exe" [2009-03-28 3325952].[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]"QPService"="c:\program files (x86)\HP\QuickPlay\QPService.exe" [2009-06-24 468264]"QlbCtrl.exe"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-11-24 323640]"UpdatePRCShortCut"="c:\program files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]"WirelessAssistant"="c:\program files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-07-23 498744]"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]"bncsaui.exe"="c:\program files (x86)\Bradford Networks\Persistent Agent\bncsaui.exe" [2010-09-29 2625304]"AVG_TRAY"="c:\program files (x86)\AVG\AVG10\avgtray.exe" [2012-08-01 2345592]"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-06-07 421776]"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576].[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]"Z1"="c:\users\Owner\Desktop\Protection\mbar\mbar.exe" [2013-03-23 1398856].c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk - c:\program files (x86)\MagicDisc\MagicDisc.exe [2011-5-1 576000]OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"= 5 (0x5)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableUIADesktopToggle"= 0 (0x0)"PromptOnSecureDesktop"= 0 (0x0).[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]"WallpaperStyle"= 2.[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~2\AVG\AVG10\avgchsva.exe /sync\0c:\progra~2\AVG\AVG10\avgrsa.exe /sync /restart.[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]@="".[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]@="Driver".R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [2012-01-31 7391072]R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [2009-06-10 5434368]R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-06-05 216064]R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-04-25 52736]R3 UsbFltr;WayTech USB Filter Driver;c:\windows\system32\Drivers\UsbFltr.sys [2007-04-09 12288]R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-03-01 1255736]R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120]R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [2011-02-22 26704]S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2011-03-16 37456]S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2012-11-12 312160]S1 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2011-03-01 41552]S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2011-04-05 377936]S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2013-01-08 140672]S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG10\avgwdsvc.exe [2011-02-08 269520]S2 BNPagent;Bradford Persistent Agent Service;c:\program files (x86)\Bradford Networks\Persistent Agent\bndaemon.exe [2010-09-29 3067672]S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2012-09-27 86528]S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe [2009-07-14 27136]S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\AVGIDSDriver.Sys [2011-05-27 118864]S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\AVGIDSFilter.Sys [2011-02-10 29264]S3 CAXHWAZL;CAXHWAZL;c:\windows\system32\DRIVERS\CAXHWAZL.sys [2009-06-24 292864]S3 Com4QLBEx;Com4QLBEx;c:\program files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2010-01-12 227896]S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-05-26 138752]S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-05-23 215040]..[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]2010-01-22 15:06 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe.Contents of the 'Scheduled Tasks' folder.2013-05-17 c:\windows\Tasks\Adobe Flash Player Updater.job- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-07 21:09].2013-05-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-17 20:57].2013-05-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-17 20:57].2013-05-13 c:\windows\Tasks\HPCeeScheduleForOwner.job- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 02:15]..--------- X64 Entries -----------..[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]@="{C5994560-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]2011-06-13 14:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]@="{C5994561-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]2011-06-13 14:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]@="{C5994562-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]2011-06-13 14:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]@="{C5994563-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]2011-06-13 14:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]@="{C5994564-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]2011-06-13 14:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]@="{C5994565-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]2011-06-13 14:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]@="{C5994566-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]2011-06-13 14:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]@="{C5994567-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]2011-06-13 14:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]@="{C5994568-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]2011-06-13 14:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2009-07-14 495104]"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-17 171520]"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-26 161304]"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-26 386584]"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-26 415256].HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalServiceFontCache.------- Supplementary Scan -------.uStart Page = hxxp://www.google.com/uLocal Page = c:\windows\system32\blank.htmmLocal Page = c:\windows\system32\blank.htmuInternet Settings,ProxyOverride = <local>;*.localIE: Free YouTube to MP3 Converter - c:\users\Owner\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htmTrusted Zone: juniata.edu\firepassTCP: DhcpNameServer = 192.168.2.1DPF: {195538FD-1C39-44B1-A7C3-5D7137A8A8F1} - hxxps://firepass.juniata.edu/vdesk/terminal/f5opswati.cab#Version=7001,2011,223,1226DPF: {30CF9713-6614-4556-B5F5-66F8C7F9DEF1} - hxxps://firepass.juniata.edu/vdesk/terminal/f5opswati.cab#Version=7001,2011,223,1226DPF: {49EC7987-E331-44E3-B170-748B58A268B9} - hxxps://firepass.juniata.edu/vdesk/terminal/f5opswati.cab#Version=7001,2011,223,1226DPF: {EBDC91CB-F23F-477D-B152-3F7243760D04} - hxxps://firepass.juniata.edu/vdesk/terminal/f5opswati.cab#Version=7001,2011,223,1226FF - ProfilePath - c:\users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\ukzgnjr5.default\FF - prefs.js: browser.search.selectedEngine - XFINITYFF - prefs.js: browser.startup.homepage - www.google.comFF - prefs.js: keyword.URL - hxxp://serp.freecause.com/?ourmark=3&sid=100815&q=FF - user.js: extensions.autoDisableScopes - 14user_pref('extensions.autoDisableScopes', 0);user_pref('security.csp.enable', false);user_pref('security.OCSP.enabled', 0);.- - - - ORPHANS REMOVED - - - -.BHO-{300BEC06-B743-4D19-86B9-11DC711D7FFB} - (no file)Toolbar-Locked - (no file)Wow6432Node-HKCU-Run-ROC_ROC_APR2013_AV - c:\users\Owner\AppData\Roaming\AVG April 2013 Campaign\AVG-Secure-Search-Update.exeWow6432Node-HKLM-Run-<NO NAME> - (no file)HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exeAddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exeAddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exeAddRemove-{EA2DB6E0-72C5-4ef9-A3A0-E6705F4A6A9E} - c:\programdata\NexonUS\NGM\NGM.exeAddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe...--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe".[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="IFlashBroker5".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Shockwave Flash Object".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]@="0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]@="ShockwaveFlash.ShockwaveFlash.11".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="ShockwaveFlash.ShockwaveFlash".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Macromedia Flash Factory Object".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]@="FlashFactory.FlashFactory.1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="FlashFactory.FlashFactory".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="IFlashBroker5".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]@="?????????????????? v1".[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}".[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]@="?????????????????? v2".[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}".[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]@Denied: (Full) (Everyone).Completion time: 2013-05-17 13:30:01ComboFix-quarantined-files.txt 2013-05-17 17:29.Pre-Run: 52,248,780,800 bytes freePost-Run: 51,739,504,640 bytes free.- - End Of File - - 1AE09299A3276E93ECF8F37EED6E6ED4 Link to post Share on other sites More sharing options...
MrCharlie Posted May 17, 2013 ID:680877 Share Posted May 17, 2013 Looks Good...............Lets check for any adware while you're here:Please download AdwCleaner from here and save it on your Desktop. AdwCleaner is a reliable removal tool for Adware, Foistware, toolbars and potentially unwanted programs.AdwCleaner is a tool that deletes :· Adwares (software ads)· PUP/LPI (Potentially Undesirable Program)· Toolbars· Hijacker (Hijack of the browser's homepage)It works with a Search and Deletion method. It can be easily uninstalled using the "Uninstall" mode.Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.Now click on the Search tab.Please post the contents of the log-file created in your next post.Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.Note:Please look over what was found......especially any folders, we're going to permanently delete it all in the next step....if there's something you may want to keep...please let me know and I'll explain to why it shouldn't be on your system.If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.Please note that Antivir Webguard uses ASK Toolbar as part of its web security. If you remove ASK by using Adwcleaner, Antivir Webguard will no longer work properly. Therefore, if you use this program please use the instructions below to access the options screen where you should enable /DisableAskDetections before using AdwCleaner.You can click on the question mark (?) in the upper left corner of the program and then click on Options. You will then be presented with a dialog where you can disable various detections. These options are described below:/DisableAskDetection - This option disables Ask Toolbar detection.MrC Link to post Share on other sites More sharing options...
bipster10 Posted May 17, 2013 Author ID:680879 Share Posted May 17, 2013 That was quick. # AdwCleaner v2.301 - Logfile created 05/17/2013 at 13:52:39# Updated 16/05/2013 by Xplode# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)# User : Owner - SHREDFEST# Boot Mode : Normal# Running from : C:\Users\Owner\Desktop\adwcleaner.exe# Option [search]***** [services] ********** [Files / Folders] *****File Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnkFolder Found : C:\Program Files (x86)\Common Files\DVDVideoSoft\TBFolder Found : C:\Program Files (x86)\Free Offers from Freeze.comFolder Found : C:\Program Files (x86)\OAppsFolder Found : C:\ProgramData\AVG Security ToolbarFolder Found : C:\ProgramData\Tarma InstallerFolder Found : C:\ProgramData\WeCareReminderFolder Found : C:\Users\Owner\AppData\Local\WajamFolder Found : C:\Users\Owner\AppData\Local\Zoom_DownloaderFolder Found : C:\Users\Owner\AppData\Roaming\dvdvideosoftiehelpersFolder Found : C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\ukzgnjr5.default\FCTB***** [Registry] *****Key Found : HKCU\Software\AppDataLow\Software\CrossriderKey Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}Key Found : HKCU\Software\wecarereminderKey Found : HKCU\Software\YahooPartnerToolbarKey Found : HKLM\Software\AVG Secure SearchKey Found : HKLM\Software\AVG Security ToolbarKey Found : HKLM\SOFTWARE\Classes\AppID\{4FBBF769-ECEB-420A-B536-133B1D505C36}Key Found : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}Key Found : HKLM\SOFTWARE\Classes\AppID\IEHelperv2.5.0.DLLKey Found : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLLKey Found : HKLM\SOFTWARE\Classes\IEHelperv250.WeCareReminderKey Found : HKLM\SOFTWARE\Classes\IEHelperv250.WeCareReminder.1Key Found : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}Key Found : HKLM\SOFTWARE\Classes\TypeLib\{B12920CF-BE13-4C09-890D-1B6EFFFE2FBE}Key Found : HKLM\Software\ConduitKey Found : HKLM\Software\Freeze.comKey Found : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASAPI32Key Found : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASAPI32Key Found : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASMANCSKey Found : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASMANCSKey Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{5EB0259D-AB79-4AE6-A6E6-24FFE21C3DA4}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{97D69524-BB57-4185-9C7F-5F05593B771A}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F773BB94-6C19-4643-A570-0E429103D1C3}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F773BB94-6C19-4643-A570-0E429103D1C3}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahlaKey Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjpKey Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AC5B6CDA-8F90-4740-9A8C-28AC5D3C73FE}Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}Key Found : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}Key Found : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}Key Found : HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}Key Found : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}Key Found : HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}Key Found : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}Key Found : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}Key Found : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}Key Found : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}Key Found : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}Key Found : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}***** [internet Browsers] *****-\\ Internet Explorer v10.0.9200.16576[OK] Registry is clean.-\\ Mozilla Firefox v20.0.1 (en-US)File : C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\ukzgnjr5.default\prefs.jsFound : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.AutoSearchEventData", "auto%20search");Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.ClearCacheDate", 7);Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.DNSCatch", true);Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.DisplayEULA", true);Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.DnsCatchEventData", "dns%20catch");Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.EBOMode", true);Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.FirstLaunchShown", true);Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.InstallDomain", "freecause.com");Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.InstallType", "standard");Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.LoadLayoutDate.100815", 7);Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.NewTabSearchEventData", "tab%20search");Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.ShowRecommendedOptions", true);Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.StateReportDate", "1341669311954");Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.TopRightSearchEventData", "top%20right%20search[...]Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.beforeInstallSaved", true);Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.beforeinstall.homepage", "hxxp%3A//www.google.c[...]Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.beforeinstall.search", "Jixey");Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.customNewTab", true);Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.helpUsImprove", true);Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.hideOthers", true);Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.partnerauth", false);Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.processAddrBar", true);Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.restoreSearch", false);Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.runcmd.", "bb_acct_status_1341699594");Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.searchHistory", true);Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.session", "84D6EFFA1187D2C13E07912CF8CD59E2D559[...]Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.showFirstLaunchOptions", false);Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.tb_lang", "en");Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.tool_id", "100815");Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.user_id", "110813648");Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.user_key", "4e76e438f817385ab402ab19cdfcc26aa53[...]Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.user_layouts", "100815");Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.user_lnames", "fcreward.100815.b");Found : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.yahooSearch", true);Found : user_pref("keyword.URL", "hxxp://serp.freecause.com/?ourmark=3&sid=100815&q=");Found : user_pref("vshare.install.date", "1286668800000");Found : user_pref("vshare.install.finished", "1.0.0");Found : user_pref("vshare.install.guid", "{6e14033f-b6e9-4298-9ed2-36f045163a02}");Found : user_pref("vshare.install.laststatreq", "1341619200000");Found : user_pref("vshare.install.newtab", false);*************************AdwCleaner[R1].txt - [10417 octets] - [17/05/2013 13:49:02]AdwCleaner[R2].txt - [10373 octets] - [17/05/2013 13:52:39]########## EOF - C:\AdwCleaner[R2].txt - [10434 octets] ########## Link to post Share on other sites More sharing options...
MrCharlie Posted May 17, 2013 ID:680886 Share Posted May 17, 2013 Lots of adware found....lets clear it out.....Please re-run AdwCleanerClick on Delete button.Confirm each time with OK if asked.Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.Then......Lets check your computers security before you go and we have a little cleanup to do also:Download Security Check by screen317 from HERE or HERE.Save it to your Desktop.Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.A Notepad document should open automatically called checkup.txt.Please Post the contents of that document.Do Not Attach It!!!MrC Link to post Share on other sites More sharing options...
bipster10 Posted May 17, 2013 Author ID:680894 Share Posted May 17, 2013 # AdwCleaner v2.301 - Logfile created 05/17/2013 at 14:13:50# Updated 16/05/2013 by Xplode# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)# User : Owner - SHREDFEST# Boot Mode : Normal# Running from : C:\Users\Owner\Desktop\adwcleaner.exe# Option [Delete]***** [services] ********** [Files / Folders] *****File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnkFolder Deleted : C:\Program Files (x86)\Common Files\DVDVideoSoft\TBFolder Deleted : C:\Program Files (x86)\Free Offers from Freeze.comFolder Deleted : C:\Program Files (x86)\OAppsFolder Deleted : C:\ProgramData\AVG Security ToolbarFolder Deleted : C:\ProgramData\Tarma InstallerFolder Deleted : C:\ProgramData\WeCareReminderFolder Deleted : C:\Users\Owner\AppData\Local\WajamFolder Deleted : C:\Users\Owner\AppData\Local\Zoom_DownloaderFolder Deleted : C:\Users\Owner\AppData\Roaming\dvdvideosoftiehelpersFolder Deleted : C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\ukzgnjr5.default\FCTB***** [Registry] *****Key Deleted : HKCU\Software\AppDataLow\Software\CrossriderKey Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}Key Deleted : HKCU\Software\wecarereminderKey Deleted : HKCU\Software\YahooPartnerToolbarKey Deleted : HKLM\Software\AVG Secure SearchKey Deleted : HKLM\Software\AVG Security ToolbarKey Deleted : HKLM\SOFTWARE\Classes\AppID\{4FBBF769-ECEB-420A-B536-133B1D505C36}Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}Key Deleted : HKLM\SOFTWARE\Classes\AppID\IEHelperv2.5.0.DLLKey Deleted : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLLKey Deleted : HKLM\SOFTWARE\Classes\IEHelperv250.WeCareReminderKey Deleted : HKLM\SOFTWARE\Classes\IEHelperv250.WeCareReminder.1Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{B12920CF-BE13-4C09-890D-1B6EFFFE2FBE}Key Deleted : HKLM\Software\ConduitKey Deleted : HKLM\Software\Freeze.comKey Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASAPI32Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\WajamUpdater_RASMANCSKey Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{5EB0259D-AB79-4AE6-A6E6-24FFE21C3DA4}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{97D69524-BB57-4185-9C7F-5F05593B771A}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F773BB94-6C19-4643-A570-0E429103D1C3}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F773BB94-6C19-4643-A570-0E429103D1C3}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahlaKey Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjpKey Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AC5B6CDA-8F90-4740-9A8C-28AC5D3C73FE}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}***** [internet Browsers] *****-\\ Internet Explorer v10.0.9200.16576[OK] Registry is clean.-\\ Mozilla Firefox v20.0.1 (en-US)File : C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\ukzgnjr5.default\prefs.jsC:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\ukzgnjr5.default\user.js ... Deleted !Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.AutoSearchEventData", "auto%20search");Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.ClearCacheDate", 7);Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.DNSCatch", true);Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.DisplayEULA", true);Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.DnsCatchEventData", "dns%20catch");Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.EBOMode", true);Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.FirstLaunchShown", true);Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.InstallDomain", "freecause.com");Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.InstallType", "standard");Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.LoadLayoutDate.100815", 7);Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.NewTabSearchEventData", "tab%20search");Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.ShowRecommendedOptions", true);Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.StateReportDate", "1341669311954");Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.TopRightSearchEventData", "top%20right%20search[...]Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.beforeInstallSaved", true);Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.beforeinstall.homepage", "hxxp%3A//www.google.c[...]Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.beforeinstall.search", "Jixey");Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.customNewTab", true);Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.helpUsImprove", true);Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.hideOthers", true);Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.partnerauth", false);Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.processAddrBar", true);Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.restoreSearch", false);Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.runcmd.", "bb_acct_status_1341699594");Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.searchHistory", true);Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.session", "84D6EFFA1187D2C13E07912CF8CD59E2D559[...]Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.showFirstLaunchOptions", false);Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.tb_lang", "en");Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.tool_id", "100815");Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.user_id", "110813648");Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.user_key", "4e76e438f817385ab402ab19cdfcc26aa53[...]Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.user_layouts", "100815");Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.user_lnames", "fcreward.100815.b");Deleted : user_pref("freecause758d6aeb75e49f24fd4951b640add07f.yahooSearch", true);Deleted : user_pref("keyword.URL", "hxxp://serp.freecause.com/?ourmark=3&sid=100815&q=");Deleted : user_pref("vshare.install.date", "1286668800000");Deleted : user_pref("vshare.install.finished", "1.0.0");Deleted : user_pref("vshare.install.guid", "{6e14033f-b6e9-4298-9ed2-36f045163a02}");Deleted : user_pref("vshare.install.laststatreq", "1341619200000");Deleted : user_pref("vshare.install.newtab", false);*************************AdwCleaner[R1].txt - [10417 octets] - [17/05/2013 13:49:02]AdwCleaner[R2].txt - [10478 octets] - [17/05/2013 13:52:39]AdwCleaner[R3].txt - [10539 octets] - [17/05/2013 13:54:58]AdwCleaner[s1].txt - [10683 octets] - [17/05/2013 14:13:50]########## EOF - C:\AdwCleaner[s1].txt - [10744 octets] ########## Results of screen317's Security Check version 0.99.63 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` Windows Security Center service is not running! This report may not be accurate! Windows Firewall Enabled! AVG Anti-Virus Free Edition 2011 Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware version 1.70.0.1100 CCleaner Java 6 Update 21 Java version out of Date! Adobe Flash Player 11.7.700.202 Adobe Reader XI Mozilla Firefox (20.0.1) ````````Process Check: objlist.exe by Laurent```````` AVG avgwdsvc.exe AVG avgtray.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 0% ````````````````````End of Log`````````````````````` Link to post Share on other sites More sharing options...
MrCharlie Posted May 17, 2013 ID:680897 Share Posted May 17, 2013 Out dated programs on the system are vulnerable to malware.Please update or uninstall them:~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Malwarebytes Anti-Malware version 1.70.0.1100 <---out dated, should be 1.75.0.1300Check for updates and then open up Malwarebytes and it should prompt you to install the latest version----------------------------------Java™ 6 Update 21 <------------uninstall from add/remove programsJava version out of Date! <-------Download and install the latest version from HereUncheck the box to install the Ask toolbar!!! and any other free "stuff".~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~A little clean up to do....Please Uninstall ComboFix: (if you used it)Press the Windows logo key + R to bring up the "run box"Copy and paste next command in the field:ComboFix /uninstallMake sure there's a space between Combofix and /Then hit enter.This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall)---------------------------------If you used DeFogger to disable your CD Emulation drivers, please re-enable them.-------------------------------Please download OTC to your desktop.http://oldtimer.geekstogo.com/OTC.exeDouble-click OTC to run it. (Vista and up users, please right click on OTC and select "Run as an Administrator")Click on the CleanUp! button and follow the prompts.(If you get a warning from your firewall or other security programs regarding OTC attempting to contact the Internet, please allow the connection.)You will be asked to reboot the machine to finish the Cleanup process, choose Yes.After the reboot all the tools we used should be gone.Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.Any other programs or logs you can manually delete.IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, MBAR, etc....AdwCleaner > just run the program and click uninstall.-------------------------------Any questions...please post back.If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.Take a look at My Preventive Maintenance to avoid being infected again.Good Luck and Thanks for using the forum, MrC Link to post Share on other sites More sharing options...
Maurice Naggar Posted May 19, 2013 ID:681435 Share Posted May 19, 2013 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts