C:\Users\All Users\YTD Video Downloader\ytd_installer.exe a variant of Win32/Bundled.Toolbar.Ask.C application

ardrm98 · June 1, 2013

THESE are my log files. DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 10.0.9200.16576

Run by alan at 14:58:57 on 2013-06-01

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.2045.1137 [GMT -4:00]

.

AV: AVG Internet Security 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

SP: AVG Internet Security 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: AVG Internet Security 2012 *Enabled* {621CC794-9486-F902-D092-0484E8EA828B}

.

============== Running Processes ================

.

C:\PROGRA~1\AVG\AVG2012\avgrsx.exe

C:\Program Files\AVG\AVG2012\avgcsrvx.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\nvvsvc.exe

C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\AVG\AVG2012\avgfws.exe

C:\Program Files\AVG\AVG2012\avgwdsvc.exe

C:\Windows\system32\CTsvcCDA.exe

C:\Windows\system32\crypserv.exe

C:\Program Files\GNU\GnuPG\dirmngr.exe

C:\Windows\system32\dlcicoms.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Windows\system32\vmnat.exe

C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.0.1\ToolbarUpdater.exe

C:\Program Files\VMware\VMware Player\vmware-authd.exe

C:\Windows\system32\vmnetdhcp.exe

C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe

C:\Program Files\AVG\AVG2012\avgidsagent.exe

C:\Windows\system32\taskhost.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\AVG\AVG2012\avgnsx.exe

C:\Program Files\AVG\AVG2012\avgemcx.exe

C:\Windows\System32\CtHelper.exe

C:\Program Files\AVG\AVG2012\avgtray.exe

C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files\NETGEAR Genie\bin\NETGEARGenie.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Program Files\AVG\AVG2012\avgcsrvx.exe

C:\Program Files\NETGEAR Genie\bin\genie2_tray.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\Macromed\Flash\FlashUtil32_11_7_700_202_ActiveX.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\system32\svchost.exe -k SDRSVC

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://yahoo.com

dURLSearchHooks: {A3BC75A2-1F87-4686-AA43-5347D756017C} - <orphaned>

BHO: AVG Do Not Track: {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - c:\program files\avg\avg2012\avgdtiex.dll

BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files\avg\avg2012\avgssie.dll

uRun: [sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun

uRun: [NETGEARGenie] "c:\program files\netgear genie\bin\NETGEARGenie.exe" -mini -redirect

mRun: [VolPanel] "c:\program files\creative\sound blaster x-fi\volume panel\VolPanlu.exe" /r

mRun: [CTHelper] "CTHELPER.EXE"

mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe"

mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot

uPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDriveTypeAutoRun = dword:255

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

mPolicies-System: PromptOnSecureDesktop = dword:0

IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: NameServer = 10.0.0.1

TCP: Interfaces\{2CDDEE82-149B-4285-80DA-2CAE32F50C8E} : DHCPNameServer = 192.168.42.129

TCP: Interfaces\{DB145FF6-3125-41B0-A760-14D015225CAF} : DHCPNameServer = 10.0.0.1

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dll

SSODL: WebCheck - <orphaned>

SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

mASetup: {A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2} - c:\program files\pixiepack codec pack\InstallerHelper.exe

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\alan\appdata\roaming\mozilla\firefox\profiles\2wd2aob9.default\

FF - prefs.js: keyword.URL -

FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\microsoft silverlight\5.1.20125.0\npctrlui.dll

FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dv.dll

FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dvstreaming.dll

FF - ExtSQL: 2013-04-09 15:40; {635abd67-4fe9-1b23-4f01-e679fa7484c1}; c:\users\alan\appdata\roaming\mozilla\firefox\profiles\2wd2aob9.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

FF - ExtSQL: 2013-05-06 17:48; torntv2@torntv.com; c:\users\alan\appdata\roaming\mozilla\firefox\profiles\2wd2aob9.default\extensions\torntv2@torntv.com.xpi

.

============= SERVICES / DRIVERS ===============

.

R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [2012-4-19 24896]

R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2012-1-31 31952]

R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-1-5 385536]

R0 vsock;vSockets Driver;c:\windows\system32\drivers\vsock.sys [2013-5-8 61464]

R1 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwd6x.sys [2011-5-23 47968]

R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2012-11-8 250080]

R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-12-23 41040]

R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2013-4-11 302368]

R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [2012-11-9 31576]

R1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\elrawdsk.sys [2010-8-23 20560]

R2 avgfws;AVG Firewall;c:\program files\avg\avg2012\avgfws.exe [2012-12-5 2321560]

R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2012\avgidsagent.exe [2012-11-2 5174392]

R2 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2012-2-14 193288]

R2 DirMngr;DirMngr;c:\program files\gnu\gnupg\dirmngr.exe [2011-3-2 224256]

R2 dlci_device;dlci_device;c:\windows\system32\dlcicoms.exe -service --> c:\windows\system32\dlcicoms.exe -service [?]

R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2012-9-28 418376]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-9-28 701512]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2013-1-18 383264]

R2 VMUSBArbService;VMware USB Arbitration Service;c:\program files\common files\vmware\usb\vmware-usbarbitrator.exe [2012-10-11 721048]

R2 vToolbarUpdater14.0.1;vToolbarUpdater14.0.1;c:\program files\common files\avg secure search\vtoolbarupdater\14.0.1\ToolbarUpdater.exe [2013-1-21 945328]

R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [2012-12-10 142176]

R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\avgidsfilterx.sys [2011-12-23 24144]

R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [2011-12-23 17232]

R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-7-27 22856]

R3 RRNetCapMP;RRNetCapMP;c:\windows\system32\drivers\rrnetcap.sys [2012-8-6 31848]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 NETGEARGenieDaemon;NETGEARGenieDaemon;c:\program files\netgear genie\bin\NETGEARGenieDaemon.exe [2012-9-25 195400]

S2 usbdevice;usbdevice;c:\windows\system32\launch.exe --> c:\windows\system32\launch.exe [?]

S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\drivers\ssudbus.sys [2012-5-11 80824]

S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\ANDROIDUSB.sys [2012-7-3 24576]

S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2010-3-11 34248]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2011-3-30 15872]

S3 RRNetCap;RRNetCap Service;c:\windows\system32\drivers\rrnetcap.sys [2012-8-6 31848]

S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\drivers\ssudmdm.sys [2012-5-11 181432]

S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-3-30 52224]

.

=============== File Associations ===============

.

FileExt: .txt: textfile="c:\program files\windows nt\accessories\WORDPAD.EXE" "%1" [userChoice]

.

=============== Created Last 30 ================

.

2013-06-01 00:30:03 7016152 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{cdab7604-bac6-42ee-8a3b-e49960be02b5}\mpengine.dll

2013-05-31 22:08:44 -------- d-----w- c:\program files\ESET

2013-05-31 21:01:07 -------- d-sh--w- C:\$RECYCLE.BIN

2013-05-31 20:11:07 -------- d-----w- c:\users\alan\appdata\local\temp

2013-05-16 09:28:30 40960 ----a-w- c:\windows\system32\wwanprotdim.dll

2013-05-16 09:28:30 186368 ----a-w- c:\windows\system32\wwansvc.dll

2013-05-16 09:28:29 2347520 ----a-w- c:\windows\system32\win32k.sys

2013-05-16 09:28:19 47104 ----a-w- c:\windows\system32\appinfo.dll

2013-05-16 09:28:19 1796096 ----a-w- c:\windows\system32\authui.dll

2013-05-16 09:28:19 101720 ----a-w- c:\windows\system32\consent.exe

2013-05-16 09:27:41 728424 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys

2013-05-16 09:27:40 218984 ----a-w- c:\windows\system32\drivers\dxgmms1.sys

2013-05-10 07:57:26 187456 ----a-w- c:\program files\internet explorer\plugins\nppdf32.dll

2013-05-08 09:48:33 -------- d-----w- c:\users\alan\appdata\local\VMware

2013-05-08 09:48:06 63128 ----a-w- c:\windows\system32\vsocklib.dll

2013-05-08 09:48:06 61464 ----a-w- c:\windows\system32\drivers\vsock.sys

2013-05-08 09:47:46 26064 ----a-w- c:\windows\system32\drivers\VMkbd.sys

2013-05-08 09:47:20 357456 ----a-w- c:\windows\system32\vmnetdhcp.exe

2013-05-08 09:47:18 436304 ----a-w- c:\windows\system32\vmnat.exe

2013-05-08 09:47:16 26192 ----a-w- c:\windows\system32\drivers\vmnetuserif.sys

2013-05-08 09:47:11 780368 ----a-w- c:\windows\system32\vnetlib.dll

2013-05-08 09:47:06 41496 ----a-w- c:\windows\system32\drivers\hcmon.sys

2013-05-08 09:46:37 -------- d-----w- c:\program files\VMware

2013-05-08 09:46:37 -------- d-----w- c:\program files\common files\VMware

2013-05-07 21:18:21 55448 ----a-w- c:\windows\system32\vmnetbridge.dll

2013-05-07 21:16:44 94319248 ----a-w- c:\users\alan\VMware-player-3.0.0-203739.exe

2013-05-07 20:41:16 -------- d-----w- C:\GM 98-04

.

==================== Find3M ====================

.

2013-05-31 19:31:23 460 ----a-w- c:\windows\DeleteOnReboot.bat

2013-05-15 13:22:39 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-05-15 13:22:39 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-05-02 06:06:08 238872 ------w- c:\windows\system32\MpSigStub.exe

2013-04-13 04:45:16 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll

2013-04-13 04:45:15 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll

2013-04-12 13:45:29 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys

2013-04-11 07:18:40 302368 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2013-04-07 21:25:14 35088 ----a-w- c:\windows\system32\drivers\npf.sys

2013-04-05 05:28:24 1767424 ----a-w- c:\windows\system32\wininet.dll

2013-04-05 05:26:26 2877440 ----a-w- c:\windows\system32\jscript9.dll

2013-04-05 05:26:21 61440 ----a-w- c:\windows\system32\iesetup.dll

2013-04-05 05:26:21 109056 ----a-w- c:\windows\system32\iesysprep.dll

2013-04-05 04:29:45 2706432 ----a-w- c:\windows\system32\mshtml.tlb

2013-04-05 03:38:25 71680 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe

2013-04-04 18:50:32 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-03-22 21:13:59 27849315 ----a-w- c:\users\alan\tor-browser-2.3.25-5_en-US.exe

2013-03-19 05:04:13 3968856 ----a-w- c:\windows\system32\ntkrnlpa.exe

2013-03-19 05:04:10 3913560 ----a-w- c:\windows\system32\ntoskrnl.exe

2013-03-19 04:48:45 38912 ----a-w- c:\windows\system32\csrsrv.dll

2013-03-19 02:49:16 69632 ----a-w- c:\windows\system32\smss.exe

2013-03-14 10:27:01 745472 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe

2013-03-14 10:27:01 185344 ----a-w- c:\windows\system32\elshyph.dll

2013-03-14 10:27:00 158720 ----a-w- c:\windows\system32\msls31.dll

.

============= FINISH: 14:59:40.02 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Ultimate

Boot Device: \Device\HarddiskVolume3

Install Date: 3/10/2010 6:49:40 PM

System Uptime: 6/1/2013 2:51:19 PM (1 hours ago)

.

Motherboard: Dell Inc. | | 0UY253

Processor: Intel® Core2 CPU 6320 @ 1.86GHz | Microprocessor | 1862/1066mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 921 GiB total, 800.34 GiB free.

D: is FIXED (NTFS) - 10 GiB total, 5.014 GiB free.

E: is CDROM ()

F: is CDROM ()

H: is FIXED (NTFS) - 149 GiB total, 77.966 GiB free.

.

==== Disabled Device Manager Items =============

.

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

Description: NETGEAR WG311v3 54Mbps Wireless PCI Adapter

Device ID: PCI\VEN_11AB&DEV_1FAA&SUBSYS_6B001385&REV_03\4&25DB9FF8&0&1078

Manufacturer: Marvell

Name: NETGEAR WG311v3 54Mbps Wireless PCI Adapter

PNP Device ID: PCI\VEN_11AB&DEV_1FAA&SUBSYS_6B001385&REV_03\4&25DB9FF8&0&1078

Service: MRV6X32P

.

==== System Restore Points ===================

.

RP676: 5/5/2013 7:00:15 PM - Windows Backup

RP677: 5/10/2013 8:09:01 AM - Removed YTD Toolbar v7.0.

RP678: 5/12/2013 7:00:10 PM - Windows Backup

RP679: 5/16/2013 5:30:48 AM - Windows Update

RP680: 5/19/2013 7:00:17 PM - Windows Backup

RP681: 5/26/2013 7:00:17 PM - Windows Backup

RP682: 5/31/2013 4:01:18 PM - ComboFix created restore point

RP684: 5/31/2013 5:45:42 PM - Revo Uninstaller's restore point - Adobe Flash Player 10 Plugin

RP685: 5/31/2013 8:29:37 PM - Windows Update

.

==== Installed Programs ======================

.

Update for Microsoft Office 2007 (KB2508958)

7-Zip 9.20

Acrobat.com

Adobe AIR

Adobe Flash Player 11 ActiveX

Adobe Reader X (10.1.7)

Audials

AVG 2012

BitTorrent

CCleaner

Claws Mail (3.9.0git149-pkg37)

Creative MediaSource 5

Dell AIO Printer 946

ESET Online Scanner v3

FairPoint DSL Security Improvement Upgrade

GM 98-04

Gpg4win (2.1.0)

i-Kam Media Player

iPod for Windows 2006-06-28

Malwarebytes Anti-Malware version 1.75.0.1300

Media Player Codec Pack 3.9.6

Microsoft .NET Framework 1.1

Microsoft .NET Framework 4 Client Profile

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office File Validation Add-In

Microsoft Office Groove MUI (English) 2007

Microsoft Office Groove Setup Metadata MUI (English) 2007

Microsoft Office InfoPath MUI (English) 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Silverlight

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Mozilla Firefox 20.0.1 (x86 en-US)

Mozilla Maintenance Service

MP3 Download Manager

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 4.0 SP2 and SOAP Toolkit 3.0

MSXML 4.0 SP3 Parser

MSXML 4.0 SP3 Parser (KB2721691)

MSXML 4.0 SP3 Parser (KB2758694)

MTP Porting Kit

neroxml

NETGEAR Genie

NVIDIA 3D Vision Driver 311.06

NVIDIA Control Panel 311.06

NVIDIA Graphics Driver 311.06

NVIDIA Install Application

NVIDIA Stereoscopic 3D Driver

NVIDIA Update 1.11.3

NVIDIA Update Components

PixiePack Codec Pack

PlayItAll media player 1.0.5

PVSonyDll

Revo Uninstaller 1.94

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)

Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition

Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition

Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition

Security Update for Microsoft Office Publisher 2007 (KB2597971) 32-Bit Edition

Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition

Sonic Activation Module

Sound Blaster X-Fi

tools-windows

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition

Update for Microsoft Office Access 2007 Help (KB963663)

Update for Microsoft Office Excel 2007 Help (KB963678)

Update for Microsoft Office Infopath 2007 Help (KB963662)

Update for Microsoft Office OneNote 2007 Help (KB963670)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition

Update for Microsoft Office Outlook 2007 Help (KB963677)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817359) 32-Bit Edition

Update for Microsoft Office Powerpoint 2007 Help (KB963669)

Update for Microsoft Office Publisher 2007 Help (KB963667)

Update for Microsoft Office Script Editor Help (KB963671)

Update for Microsoft Office Word 2007 Help (KB963665)

verizon wireless Download Manager 2.2.8-SNAPSHOT-r11521

VMware Player

WinRAR archiver

WModem Driver Installer

YTD Video Downloader 4.0

.

==== Event Viewer Messages From Past Week ========

.

6/1/2013 2:54:21 PM, Error: Service Control Manager [7038] - The nvUpdatusService service was unable to log on as .\UpdatusUser with the currently configured password due to the following error: Logon failure: the specified account password has expired. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

6/1/2013 2:54:21 PM, Error: Service Control Manager [7000] - The NVIDIA Update Service Daemon service failed to start due to the following error: The service did not start due to a logon failure.

6/1/2013 2:52:05 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the NETGEARGenieDaemon service to connect.

6/1/2013 2:52:05 PM, Error: Service Control Manager [7000] - The NETGEARGenieDaemon service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

5/31/2013 8:24:38 PM, Error: Service Control Manager [7034] - The Crypkey License service terminated unexpectedly. It has done this 1 time(s).

5/31/2013 8:24:38 PM, Error: Service Control Manager [7034] - The Creative Service for CDROM Access service terminated unexpectedly. It has done this 1 time(s).

5/31/2013 5:00:04 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

5/31/2013 4:52:53 PM, Error: Service Control Manager [7034] - The DirMngr service terminated unexpectedly. It has done this 1 time(s).

5/28/2013 5:21:06 AM, Error: bowser [8003] - The master browser has received a server announcement from the computer ROBYN-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{DB145FF6-3125-41B0-A760-14D015225. The master browser is stopping or an election is being forced.

.

==== End Of File ===========================

gringo_pr · June 1, 2013

Hello ardrm98

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
[*]Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
[*]Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
[*]Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

These are the programs I would like you to run next, if you have any problems with one of these just skip it and move on to the next one.

-AdwCleaner-

Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

-Junkware-Removal-Tool-

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

When they are complete let me have the two reports and let me know how things are running.

Gringo

ardrm98 · June 2, 2013

hi gringo this computer runs fine with one exception.it will freeze when playing music videos in win media player.when that happens,i have to push the power button off, because the ctrl alt del wont work either.so about three days ago I ran a eset online scan to see whats up and I kicked back 4 threats about Win32/Bundled.Toolbar.Ask.C application.i coudnt get rid of it so that brought me to you.here are the logs.

# AdwCleaner v2.301 - Logfile created 06/02/2013 at 06:58:42

# Updated 16/05/2013 by Xplode

# Operating system : Windows 7 Ultimate Service Pack 1 (32 bits)

# User : alan - ALAN-PC

# Boot Mode : Normal

# Running from : C:\Users\alan\Desktop\malware removers\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

Deleted on reboot : C:\Program Files\Common Files\AVG Secure Search

Folder Deleted : C:\Users\alan\AppData\Roaming\Mozilla\Firefox\Profiles\2wd2aob9.default\jetpack

***** [Registry] *****

***** [internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16576

[OK] Registry is clean.

-\\ Mozilla Firefox v20.0.1 (en-US)

File : C:\Users\alan\AppData\Roaming\Mozilla\Firefox\Profiles\2wd2aob9.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v [unable to get version]

File : C:\Users\alan\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [25749 octets] - [27/02/2013 06:24:33]

AdwCleaner[R2].txt - [1304 octets] - [17/03/2013 07:47:25]

AdwCleaner[R3].txt - [1247 octets] - [05/04/2013 16:23:53]

AdwCleaner[R4].txt - [3978 octets] - [31/05/2013 15:29:47]

AdwCleaner[R5].txt - [1601 octets] - [02/06/2013 06:58:24]

AdwCleaner[s1].txt - [9374 octets] - [27/02/2013 06:25:41]

AdwCleaner[s2].txt - [1375 octets] - [17/03/2013 07:47:56]

AdwCleaner[s3].txt - [1313 octets] - [05/04/2013 16:39:58]

AdwCleaner[s4].txt - [4066 octets] - [31/05/2013 15:31:05]

AdwCleaner[s5].txt - [1539 octets] - [02/06/2013 06:58:42]

########## EOF - C:\AdwCleaner[s5].txt - [1599 octets] ##########

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 4.9.4 (05.06.2013:1)

OS: Windows 7 Ultimate x86

Ran by alan on Sun 06/02/2013 at 7:10:10.34

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\systweak

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\Software\bittorrentbar

~~~ Files

Successfully deleted: [File] "C:\Windows\system32\roboot.exe"

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\ytd video downloader"

Successfully deleted: [Folder] "C:\Users\alan\AppData\Roaming\systweak"

Successfully deleted: [Folder] "C:\Users\alan\appdata\locallow\bittorrentbar"

Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ytd video downloader"

Successfully deleted: [Folder] "C:\Windows\system32\ai_recyclebin"

~~~ FireFox

Successfully deleted: [File] C:\Users\alan\AppData\Roaming\mozilla\firefox\profiles\2wd2aob9.default\invalidprefs.js

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Sun 06/02/2013 at 7:12:13.19

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

gringo_pr · June 2, 2013

Hello ardrm98

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

ardrm98 · June 2, 2013

hi gringo here is the combo fix log.also the computer is running good but I havnt tried a music video.also the freezing was sporadic. also there were no problems running combofix. ComboFix 13-06-02.02 - alan 06/02/2013 13:59:25.6.2 - x86

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.2045.1054 [GMT -4:00]

Running from: c:\users\alan\Desktop\ComboFix.exe

AV: AVG Internet Security 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

FW: AVG Internet Security 2012 *Enabled* {621CC794-9486-F902-D092-0484E8EA828B}

SP: AVG Internet Security 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((( Files Created from 2013-05-02 to 2013-06-02 )))))))))))))))))))))))))))))))

.

2013-06-02 18:06 . 2013-06-02 18:06 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2013-06-02 18:06 . 2013-06-02 18:06 -------- d-----w- c:\users\Public\AppData\Local\temp

2013-06-02 18:06 . 2013-06-02 18:06 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-06-02 11:10 . 2013-06-02 11:10 -------- d-----w- c:\windows\ERUNT

2013-06-02 11:09 . 2013-06-02 11:09 -------- d-----w- C:\JRT

2013-06-01 00:30 . 2013-05-14 05:49 7016152 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{CDAB7604-BAC6-42EE-8A3B-E49960BE02B5}\mpengine.dll

2013-05-31 22:08 . 2013-05-31 22:08 -------- d-----w- c:\program files\ESET

2013-05-31 20:11 . 2013-06-02 18:06 -------- d-----w- c:\users\alan\AppData\Local\temp

2013-05-16 09:28 . 2013-03-19 04:53 186368 ----a-w- c:\windows\system32\wwansvc.dll

2013-05-16 09:28 . 2013-03-19 03:33 40960 ----a-w- c:\windows\system32\wwanprotdim.dll

2013-05-16 09:28 . 2013-04-10 03:14 2347520 ----a-w- c:\windows\system32\win32k.sys

2013-05-16 09:28 . 2013-02-27 05:05 101720 ----a-w- c:\windows\system32\consent.exe

2013-05-16 09:28 . 2013-02-27 04:49 1796096 ----a-w- c:\windows\system32\authui.dll

2013-05-16 09:28 . 2013-02-27 04:49 47104 ----a-w- c:\windows\system32\appinfo.dll

2013-05-16 09:27 . 2013-04-10 05:18 728424 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys

2013-05-16 09:27 . 2013-04-10 05:18 218984 ----a-w- c:\windows\system32\drivers\dxgmms1.sys

2013-05-10 07:57 . 2013-05-10 07:57 187456 ----a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll

2013-05-08 09:48 . 2013-05-08 10:24 -------- d-----w- c:\users\alan\AppData\Local\VMware

2013-05-08 09:48 . 2012-10-24 18:17 63128 ----a-w- c:\windows\system32\vsocklib.dll

2013-05-08 09:48 . 2012-10-24 18:16 61464 ----a-w- c:\windows\system32\drivers\vsock.sys

2013-05-08 09:47 . 2013-02-26 06:27 26064 ----a-w- c:\windows\system32\drivers\VMkbd.sys

2013-05-08 09:47 . 2013-02-26 06:28 357456 ----a-w- c:\windows\system32\vmnetdhcp.exe

2013-05-08 09:47 . 2013-02-26 06:28 436304 ----a-w- c:\windows\system32\vmnat.exe

2013-05-08 09:47 . 2013-02-26 06:28 26192 ----a-w- c:\windows\system32\drivers\vmnetuserif.sys

2013-05-08 09:47 . 2013-02-26 06:28 780368 ----a-w- c:\windows\system32\vnetlib.dll

2013-05-08 09:47 . 2012-10-11 20:15 41496 ----a-w- c:\windows\system32\drivers\hcmon.sys

2013-05-08 09:46 . 2013-05-08 09:46 -------- d-----w- c:\program files\Common Files\VMware

2013-05-08 09:46 . 2013-05-08 09:46 -------- d-----w- c:\program files\VMware

2013-05-07 21:26 . 2013-05-08 10:08 -------- d-----w- c:\users\alan\AppData\Roaming\VMware

2013-05-07 21:18 . 2013-02-26 06:27 55448 ----a-w- c:\windows\system32\vmnetbridge.dll

2013-05-07 21:17 . 2013-06-02 17:54 -------- d-----w- c:\programdata\VMware

2013-05-07 21:16 . 2009-11-03 11:54 94319248 ----a-w- c:\users\alan\VMware-player-3.0.0-203739.exe

2013-05-07 20:41 . 2013-05-08 10:24 -------- d-----w- C:\GM 98-04

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-06-02 10:58 . 2013-02-27 10:25 575 ----a-w- c:\windows\DeleteOnReboot.bat

2013-05-15 13:22 . 2012-04-01 12:16 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-05-15 13:22 . 2011-06-27 20:51 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-05-02 06:06 . 2010-03-11 00:15 238872 ------w- c:\windows\system32\MpSigStub.exe

2013-04-13 04:45 . 2013-05-16 09:28 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll

2013-04-13 04:45 . 2013-05-16 09:28 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll

2013-04-12 13:45 . 2013-04-24 21:28 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys

2013-04-11 07:18 . 2013-04-11 07:18 302368 ----a-w- c:\windows\system32\drivers\avgtdix.sys

2013-04-07 21:25 . 2013-04-07 21:25 35088 ----a-w- c:\windows\system32\drivers\npf.sys

2013-04-04 18:50 . 2011-07-27 23:53 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-03-22 21:13 . 2013-03-22 20:59 27849315 ----a-w- c:\users\alan\tor-browser-2.3.25-5_en-US.exe

2013-03-19 05:04 . 2013-04-10 19:46 3968856 ----a-w- c:\windows\system32\ntkrnlpa.exe

2013-03-19 05:04 . 2013-04-10 19:46 3913560 ----a-w- c:\windows\system32\ntoskrnl.exe

2013-03-19 04:48 . 2013-04-10 19:46 38912 ----a-w- c:\windows\system32\csrsrv.dll

2013-03-19 02:49 . 2013-04-10 19:46 69632 ----a-w- c:\windows\system32\smss.exe

2013-03-14 10:27 . 2013-03-14 10:27 745472 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe

2013-03-14 10:27 . 2013-03-14 10:27 185344 ----a-w- c:\windows\system32\elshyph.dll

2013-03-14 10:27 . 2013-03-14 10:27 158720 ----a-w- c:\windows\system32\msls31.dll

2013-03-14 10:26 . 2013-03-14 10:26 523264 ----a-w- c:\windows\system32\vbscript.dll

2013-03-14 10:26 . 2013-03-14 10:26 150528 ----a-w- c:\windows\system32\iexpress.exe

2013-03-14 10:26 . 2013-03-14 10:26 138752 ----a-w- c:\windows\system32\wextract.exe

2013-03-14 10:26 . 2013-03-14 10:26 137216 ----a-w- c:\windows\system32\ieUnatt.exe

2013-03-14 10:26 . 2013-03-14 10:26 38400 ----a-w- c:\windows\system32\imgutil.dll

2013-03-14 10:26 . 2013-03-14 10:26 12800 ----a-w- c:\windows\system32\mshta.exe

2013-03-14 10:26 . 2013-03-14 10:26 73728 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2013-03-14 10:26 . 2013-03-14 10:26 110592 ----a-w- c:\windows\system32\IEAdvpack.dll

2013-03-14 10:26 . 2013-03-14 10:26 61952 ----a-w- c:\windows\system32\tdc.ocx

2013-03-14 10:26 . 2013-03-14 10:26 48640 ----a-w- c:\windows\system32\mshtmler.dll

2013-03-14 10:26 . 2013-03-14 10:26 361984 ----a-w- c:\windows\system32\html.iec

2013-03-14 10:26 . 2013-03-14 10:26 719360 ----a-w- c:\windows\system32\mshtmlmedia.dll

2013-03-14 10:26 . 2013-03-14 10:26 23040 ----a-w- c:\windows\system32\licmgr10.dll

2013-03-14 10:26 . 2013-03-14 10:26 1441280 ----a-w- c:\windows\system32\inetcpl.cpl

2013-05-10 12:17 . 2013-05-10 12:17 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]

"NETGEARGenie"="c:\program files\NETGEAR Genie\bin\NETGEARGenie.exe" [2012-10-16 1041736]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-09-28 155648]

"CTHelper"="CTHELPER.EXE" [2006-11-02 19456]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2013-04-04 887432]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]

"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-11-19 2598520]

"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2013-02-12 413928]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"mixer1"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"Evidence Eliminator"=c:\program files\Evidence Eliminator\EEStartupLauncher.exe

"Window Washer"=c:\program files\Webroot\Washer\wwDisp.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"UpdReg"="c:\windows\UpdReg.EXE"

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start

"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup

"AsioReg"="REGSVR32" /S CTASIO.DLL

"CTXFIREG"="CTxfiReg.exe"

"CTxfiHlp"="CTXFIHLP.EXE"

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"

"Mobile Connectivity Suite"="c:\program files\HTC\HTC Sync\Application Launcher\Application Launcher.exe" /startoptions

"vProt"="c:\program files\AVG Secure Search\vprot.exe"

.

R2 DirMngr;DirMngr;c:\program files\GNU\GnuPG\dirmngr.exe [x]

R2 NETGEARGenieDaemon;NETGEARGenieDaemon;c:\program files\NETGEAR Genie\bin\NETGEARGenieDaemon.exe [x]

R2 usbdevice;usbdevice;c:\windows\system32\launch.exe [x]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [x]

R3 HTCAND32;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [x]

R3 PTUMWBus;PANTECH USB Modem V2 Composite Device Driver;c:\windows\system32\DRIVERS\PTUMWBus.sys [x]

R3 PTUMWCDF;PANTECH USB Modem V2 Installation CD;c:\windows\system32\DRIVERS\PTUMWCDF.sys [x]

R3 PTUMWFLT;PTUMWNET Filter Driver;c:\windows\system32\DRIVERS\PTUMWFLT.sys [x]

R3 PTUMWMdm;PANTECH USB Modem V2 Modem Driver;c:\windows\system32\DRIVERS\PTUMWMdm.sys [x]

R3 PTUMWNET;PANTECH USB Modem V2 WWAN Driver;c:\windows\system32\DRIVERS\PTUMWNET.sys [x]

R3 PTUMWVsp;PANTECH USB Modem V2 Diagnostic Port;c:\windows\system32\DRIVERS\PTUMWVsp.sys [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]

R3 RRNetCap;RRNetCap Service;c:\windows\system32\DRIVERS\rrnetcap.sys [x]

R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [x]

R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]

R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]

S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [x]

S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [x]

S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys [x]

S0 vsock;vSockets Driver;c:\windows\system32\drivers\vsock.sys [x]

S1 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwd6x.sys [x]

S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [x]

S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [x]

S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [x]

S1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\elrawdsk.sys [x]

S2 avgfws;AVG Firewall;c:\program files\AVG\AVG2012\avgfws.exe [x]

S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2012\avgidsagent.exe [x]

S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2012\avgwdsvc.exe [x]

S2 dlci_device;dlci_device;c:\windows\system32\dlcicoms.exe [x]

S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]

S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files\Common Files\VMware\USB\vmware-usbarbitrator.exe [x]

S2 vToolbarUpdater14.0.1;vToolbarUpdater14.0.1;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\14.0.1\ToolbarUpdater.exe [x]

S3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [x]

S3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfilterx.sys [x]

S3 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 RRNetCapMP;RRNetCapMP;c:\windows\system32\DRIVERS\rrnetcap.sys [x]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS fdrespub AppIDSvc QWAVE wcncsvc Mcx2Svc SensrSvc

getPlusHelper REG_MULTI_SZ getPlusHelper

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalService

FontCache

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}]

2010-02-17 00:02 114688 ----a-w- c:\program files\PixiePack Codec Pack\InstallerHelper.exe

.

Contents of the 'Scheduled Tasks' folder

.

2013-06-02 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 13:22]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://yahoo.com

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 10.0.0.1

FF - ProfilePath - c:\users\alan\AppData\Roaming\Mozilla\Firefox\Profiles\2wd2aob9.default\

FF - prefs.js: keyword.URL -

FF - ExtSQL: 2013-04-09 15:40; {635abd67-4fe9-1b23-4f01-e679fa7484c1}; c:\users\alan\AppData\Roaming\Mozilla\Firefox\Profiles\2wd2aob9.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

FF - ExtSQL: 2013-05-06 17:48; torntv2@torntv.com; c:\users\alan\AppData\Roaming\Mozilla\Firefox\Profiles\2wd2aob9.default\extensions\torntv2@torntv.com.xpi

.

- - - - ORPHANS REMOVED - - - -

.

AddRemove-ESET Online Scanner - c:\program files\ESET\ESET Online Scanner\OnlineScannerUninstaller.exe

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]

@Denied: (2) (LocalSystem)

"{95B7759C-8C7F-4BF1-B163-73684A933233}"=hex:51,66,7a,6c,4c,1d,38,12,f2,76,a4,

91,4d,c2,9f,0e,ce,75,30,28,4f,cd,76,27

"{F3FEE66E-E034-436A-86E4-9690573BEE8A}"=hex:51,66,7a,6c,4c,1d,38,12,00,e5,ed,

f7,06,ae,04,06,f9,f2,d5,d0,52,65,aa,9e

"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,

1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7

"{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}"=hex:51,66,7a,6c,4c,1d,38,12,7c,f0,b1,

38,5c,21,3d,0e,d9,78,0d,25,e1,c9,8c,d4

"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,

76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a

"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47,

2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85

"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,

fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17

"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,

b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

@Denied: (2) (LocalSystem)

"Timestamp"=hex:84,29,5a,58,46,26,cd,01

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'Explorer.exe'(6064)

c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL

.

Completion time: 2013-06-02 14:08:25

ComboFix-quarantined-files.txt 2013-06-02 18:08

.

Pre-Run: 858,255,024,128 bytes free

Post-Run: 858,200,674,304 bytes free

.

- - End Of File - - DB6875B034CB114DF8D6408B08C47F7E

gringo_pr · June 2, 2013

Hello ardrm98

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

ardrm98 · June 2, 2013

hi gringo no problems and it seems to be running fine. heres the log.....

ComboFix 13-06-02.02 - alan 06/02/2013 17:12:48.7.2 - x86

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.2045.1107 [GMT -4:00]

Running from: c:\users\alan\Desktop\ComboFix.exe

AV: AVG Internet Security 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

FW: AVG Internet Security 2012 *Enabled* {621CC794-9486-F902-D092-0484E8EA828B}

SP: AVG Internet Security 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((( Files Created from 2013-05-02 to 2013-06-02 )))))))))))))))))))))))))))))))

.

2013-06-02 21:19 . 2013-06-02 21:19 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp

2013-06-02 21:19 . 2013-06-02 21:19 -------- d-----w- c:\users\Public\AppData\Local\temp

2013-06-02 21:19 . 2013-06-02 21:19 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-06-02 11:10 . 2013-06-02 11:10 -------- d-----w- c:\windows\ERUNT

2013-06-02 11:09 . 2013-06-02 11:09 -------- d-----w- C:\JRT

2013-06-01 00:30 . 2013-05-14 05:49 7016152 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{CDAB7604-BAC6-42EE-8A3B-E49960BE02B5}\mpengine.dll

2013-05-31 22:08 . 2013-05-31 22:08 -------- d-----w- c:\program files\ESET

2013-05-31 20:11 . 2013-06-02 21:19 -------- d-----w- c:\users\alan\AppData\Local\temp