Successfully blocked access to a potentially malicious website

[link67]

Hi,

 

I installed malwarebytes tonight and keep getting three pop-up alerts saying that it has "Successfully blocked access to a potentially malicious website". They're for the addresses:

 

46.19.138.211

193.105.134.142

193.106.172.46

 

I've run the DDS app and my logs are as follows:

 

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16537
Run by David at 21:59:53 on 2013-06-28
Microsoft Windows 8 Pro  6.2.9200.0.1252.44.2057.18.16331.12618 [GMT 1:00]
.
AV: GFI Software VIPRE *Enabled/Updated* {E0D97DD4-42BA-B3F2-A5A7-22E9ACE81FC7}
AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: GFI Software VIPRE *Enabled/Updated* {5BB89C30-6480-BC7C-9F17-199BD76F557A}
FW: GFI Software VIPRE *Enabled* {D8E2FCF1-08D5-B2AA-8EF8-8BDC523B58BC}
.
============== Running Processes ===============
.
C:\Windows\system32\svchost.exe -k DcomLaunch
I:\Program Files\AuthenTec TrueSuite\TrueSuiteService.exe
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\dwm.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
I:\Program Files\Protector Suite\upeksvr.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Realtek\Audio\HDA\DTSU2PAuSrv64.exe
C:\Windows\system32\dashost.exe
C:\Program Files (x86)\GFI Software\VIPRE\LanGuard 10 Agent\lnssatt.exe
C:\Program Files\Intel\iCLS Client\HeciServer.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
i:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
i:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\Trend Micro\RUBotted\RUBotSrv.exe
C:\Program Files (x86)\GFI Software\VIPRE\SBPIMSvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\System32\WUDFHost.exe
C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
C:\Windows\system32\taskhostex.exe
C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
i:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Windows\Explorer.EXE
I:\Program Files\AuthenTec TrueSuite\TouchControl.exe
I:\Program Files\AuthenTec TrueSuite\BioMonitor.exe
C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\System32\RuntimeBroker.exe
C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe
C:\Program Files\Tablet\Wacom\WacomHost.exe
C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe
C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe
I:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
I:\Program Files\Protector Suite\psqltray.exe
C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files (x86)\GFI Software\VIPRE\SBAMSvc.exe
C:\Program Files (x86)\GFI Software\VIPRE\LanGuard 10 Agent\Mantle.exe
C:\Program Files (x86)\GFI Software\VIPRE\SBAMTray.exe
I:\Adobe CS6 install\Acrobat 10.0\Acrobat\acrotray.exe
I:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Trend Micro\RUBotted\RUBottedGUI.exe
C:\Program Files\iPod\bin\iPodService.exe
I:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
I:\Program Files (x86)\iTunes\iTunes.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
I:\Program Files (x86)\Identity Cloaker\IDC2.exe
I:\Program Files (x86)\Identity Cloaker\icproxy.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
I:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
I:\Users\David\Documents\mbar-1.06.0.1004\mbar\mbar.exe
I:\super antispyware\SASCORE64.EXE
I:\super antispyware\SUPERAntiSpyware.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\System32\ThumbnailExtractionHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank

uProxyServer = 127.0.0.1:8080
mWinlogon: Userinit = userinit.exe
BHO: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
BHO: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
uRun: [AdobeBridge] <no file>
mRun: [bCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
mRun: [sBAMTray] "C:\Program Files (x86)\GFI Software\VIPRE\SBAMTray.exe"
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
mRun: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [Adobe Acrobat Speed Launcher] "I:\Adobe CS6 install\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
mRun: [Acrobat Assistant 8.0] "I:\Adobe CS6 install\Acrobat 10.0\Acrobat\Acrotray.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "I:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [Trend Micro RUBotted V2.0 Beta] C:\Program Files (x86)\Trend Micro\RUBotted\RUBottedGUI.exe
StartupFolder: C:\Users\David\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\David\AppData\Roaming\Dropbox\bin\Dropbox.exe
mPolicies-System: PromptOnSecureDesktop = dword:0
mPolicies-System: DisableCAD = dword:1
IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
LSP: C:\Windows\System32\ICProxy.dll
TCP: Interfaces\{427FA8B2-48B2-4E7D-96D9-7C78025A99A2} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{C155E2E8-B2BA-4E5F-A4F5-0A6141BB49BC} : NameServer = 8.8.8.8,8.8.4.4
TCP: Interfaces\{C155E2E8-B2BA-4E5F-A4F5-0A6141BB49BC} : DHCPNameServer = 192.168.1.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
AppInit_DLLs= C:\PROGRA~2\NVIDIA~1\3DVISI~1\nvStInit.dll
SSODL: WebCheck - <orphaned>
LSA: Notification Packages =  scecli I:\Program Files\Protector Suite\psqlpwd.dll
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.63\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
mASetup: {A6EADE66-0000-0000-484E-7E8A45000000} - "C:\Windows\SysWOW64\Rundll32.exe" "C:\Program Files (x86)\Adobe\Reader 11.0\Esl\AiodLite.dll",CreateReaderUserSettings
IFEO: sidebar.exe - C:\Program Files (x86)\Windows Sidebar\8GadgetPack.exe -run
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s
x64-Run: [RtHDVBg_DTS] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /DTSU2P
x64-Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
x64-Run: [PSQLLauncher] "I:\Program Files\Protector Suite\launcher.exe" /startup
x64-mPolicies-System: PromptOnSecureDesktop = dword:0
x64-mPolicies-System: DisableCAD = dword:1
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
x64-Notify: psfus - I:\Program Files\Protector Suite\psqlpwd.dll
x64-SSODL: WebCheck - <orphaned>
x64-IFEO: sidebar.exe - C:\Program Files (x86)\Windows Sidebar\8GadgetPack.exe -run
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\fxypytfr.default\
FF - plugin: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll
FF - plugin: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll
FF - plugin: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll
FF - plugin: C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll
FF - plugin: C:\Users\David\AppData\Local\Citrix\Plugins\104\npappdetector.dll
FF - plugin: C:\Users\David\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll
FF - plugin: C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\fxypytfr.default\extensions\passwordbank@authentec.com\plugins\5.9.6.0000\nppbff.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll
FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
FF - plugin: I:\Adobe CS6 install\Acrobat 10.0\Acrobat\Air\nppdf32.dll
FF - plugin: I:\Adobe CS6 install\Adobe Extension Manager CS6\npAdobeExManDetectX64.dll
FF - plugin: I:\Adobe CS6 install\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll
FF - plugin: I:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
FF - plugin: i:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
.
============= SERVICES / DRIVERS ===============
.
R1 SASKUTIL;SASKUTIL;I:\super antispyware\saskutil64.sys [2011-7-12 12368]
R1 SbFw;SbFw;C:\Windows\System32\Drivers\SbFw.sys [2012-12-20 258848]
R2 !SASCORE;SAS Core Service;I:\super antispyware\SASCore64.exe [2013-5-23 143120]
R2 DTSAudioSvc;DTSAudioSvc;C:\Program Files\Realtek\Audio\HDA\DTSU2PAuSrv64.exe [2012-12-18 233328]
R2 FPLService;TrueSuiteService;I:\Program Files\AuthenTec TrueSuite\TrueSuiteService.exe [2012-8-30 296808]
R2 gfi_lanss10_attservice;GFI LanGuard 10 Attendant Service;C:\Program Files (x86)\GFI Software\VIPRE\LanGuard 10 Agent\lnssatt.exe [2012-10-24 115568]
R2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-4-20 635104]
R2 jhi_service;Intel® Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe [2012-12-18 166720]
R2 MBAMScheduler;MBAMScheduler;I:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-6-28 418376]
R2 MBAMService;MBAMService;I:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-6-28 701512]
R2 RUBotSrv;Trend Micro RUBotted Service;C:\Program Files (x86)\Trend Micro\RUBotted\RUBotSrv.exe [2013-6-28 439632]
R2 SBAMSvc;VIPRE Internet Security;C:\Program Files (x86)\GFI Software\VIPRE\SBAMSvc.exe [2012-10-29 3677000]
R2 sbapifs;sbapifs;C:\Windows\System32\Drivers\sbapifs.sys [2012-10-24 82872]
R2 SBPIMSvc;SB Recovery Service;C:\Program Files (x86)\GFI Software\VIPRE\SBPIMSvc.exe [2012-10-29 175496]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-1-18 383264]
R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2012-12-18 365376]
R2 WTabletServicePro;Wacom Professional Service;C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [2013-1-6 613760]
R3 hidkmdf;KMDF Driver;C:\Windows\System32\Drivers\hidkmdf.sys [2013-1-6 13728]
R3 ICProxy;ICProxy;I:\Program Files (x86)\Identity Cloaker\ICProxy.exe [2013-4-19 3603536]
R3 mbamchameleon;mbamchameleon;C:\Windows\System32\Drivers\mbamchameleon.sys [2013-6-28 36680]
R3 MBAMProtector;MBAMProtector;C:\Windows\System32\Drivers\mbam.sys [2013-6-28 25928]
R3 mbamswissarmy;mbamswissarmy;C:\Windows\System32\Drivers\mbamswissarmy.sys [2013-6-28 162008]
R3 SBFWIMCLMP;GFI Software Firewall NDIS IM Filter Miniport;C:\Windows\System32\Drivers\SbFwIm.sys [2012-12-20 120608]
R3 sbwtis;sbwtis;C:\Windows\System32\Drivers\sbwtis.sys [2012-10-24 86816]
R3 WacHidRouter;Wacom Hid Router;C:\Windows\System32\Drivers\wachidrouter.sys [2013-1-6 81312]
R3 wacomrouterfilter;Wacom Router Filter Driver;C:\Windows\System32\Drivers\wacomrouterfilter.sys [2013-1-6 15776]
R3 WUDFWpdMtp;WUDFWpdMtp;C:\Windows\System32\Drivers\WUDFRd.sys [2012-7-26 198656]
S1 SASDIFSV;SASDIFSV;I:\super antispyware\sasdifsv64.sys [2011-7-22 14928]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);C:\Windows\System32\Drivers\ssudbus.sys [2013-2-6 102936]
S3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe [2012-10-25 136896]
S3 gfiark;gfiark;C:\Windows\System32\Drivers\gfiark.sys [2012-12-20 39504]
S3 SBFWIMCL;GFI Software Firewall NDIS IM Filter Service;C:\Windows\System32\Drivers\SbFwIm.sys [2012-12-20 120608]
S3 sbhips;sbhips;C:\Windows\System32\Drivers\sbhips.sys [2012-12-20 61216]
S3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);C:\Windows\System32\Drivers\ssudmdm.sys [2013-2-6 203544]
S3 SwitchBoard;SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\Drivers\usbaapl64.sys [2012-12-13 54784]
S3 vmbusr;Virtual Machine Bus Provider;C:\Windows\System32\Drivers\vmbusr.sys [2012-7-26 117248]
.
=============== File Associations ===============
.
ShellExec: dreamweaver.exe: Open="I:\Adobe CS6 install\Adobe Dreamweaver CS6\dreamweaver.exe", "%1"
.
=============== Created Last 30 ================
.
2013-06-28 20:53:01    --------    d-----w-    C:\Users\David\AppData\Roaming\SUPERAntiSpyware.com
2013-06-28 20:52:26    --------    d-----w-    C:\ProgramData\SUPERAntiSpyware.com
2013-06-28 20:44:05    162008    ----a-w-    C:\Windows\System32\drivers\mbamswissarmy.sys
2013-06-28 20:44:05    --------    d-----w-    C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-06-28 20:43:39    36680    ----a-w-    C:\Windows\System32\drivers\mbamchameleon.sys
2013-06-28 20:30:32    --------    d-----w-    C:\ProgramData\Trend Micro
2013-06-28 20:23:50    540240    ----a-w-    C:\Windows\System32\ICProxy64.dll
2013-06-28 20:23:48    379984    ----a-w-    C:\Windows\SysWow64\ICProxy.dll
2013-06-28 20:02:55    --------    d-----w-    C:\Program Files (x86)\WinPcap
2013-06-28 20:02:36    --------    d-----w-    C:\Program Files (x86)\Trend Micro
2013-06-28 19:59:31    --------    d-----w-    C:\Users\David\AppData\Roaming\Malwarebytes
2013-06-28 19:59:23    --------    d-----w-    C:\ProgramData\Malwarebytes
2013-06-28 19:59:22    25928    ----a-w-    C:\Windows\System32\drivers\mbam.sys
2013-06-28 19:59:07    --------    d-----w-    C:\Users\David\AppData\Local\Programs
2013-06-27 07:52:51    243888    ----a-w-    C:\ProgramData\Microsoft\Windows\Sqm\Manifest\Sqm10208.bin
2013-06-26 10:27:54    --------    d-----w-    C:\Program Files\Microsoft Mouse and Keyboard Center
2013-06-23 11:53:58    888320    ----a-w-    C:\Windows\System32\autochk.exe
2013-06-23 11:53:57    793088    ----a-w-    C:\Windows\SysWow64\autochk.exe
2013-06-23 11:53:57    542208    ----a-w-    C:\Windows\System32\untfs.dll
2013-06-23 11:53:57    482816    ----a-w-    C:\Windows\SysWow64\untfs.dll
2013-06-23 11:53:52    1300992    ----a-w-    C:\Windows\System32\gdi32.dll
2013-06-23 11:53:52    1022464    ----a-w-    C:\Windows\SysWow64\gdi32.dll
2013-06-22 15:07:45    17271808    ----a-w-    C:\Program Files\Common Files\Microsoft Shared\Microsoft Camera Codec Pack\MicrosoftRawCodec.dll
2013-06-18 09:24:54    --------    d-----w-    C:\Users\David\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2013-06-14 17:04:51    --------    d-----w-    C:\Users\David\AppData\Local\Diagnostics
2013-06-13 14:27:57    --------    d-----w-    C:\Users\David\AppData\Roaming\Identity Cloaker
2013-06-13 14:26:59    --------    d-sh--w-    C:\Windows\SysWow64\AI_RecycleBin
2013-06-13 14:26:47    --------    d-----w-    C:\ProgramData\Identity Cloaker 2
2013-06-13 14:26:11    --------    d-----w-    C:\Users\David\AppData\Roaming\Tomas France
2013-06-07 10:55:02    --------    d-----w-    C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-07 10:55:02    --------    d-----w-    C:\Program Files\iTunes
2013-06-07 10:55:02    --------    d-----w-    C:\Program Files\iPod
.
==================== Find3M  ====================
.
2013-06-04 22:09:22    78200    ----a-w-    C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-04 22:09:22    693112    ----a-w-    C:\Windows\SysWow64\FlashPlayerApp.exe
2013-05-15 22:37:03    44032    ----a-w-    C:\Windows\SysWow64\UXInit.dll
2013-05-15 22:35:49    53760    ----a-w-    C:\Windows\System32\UXInit.dll
2013-05-14 13:14:01    2706432    ----a-w-    C:\Windows\System32\mshtml.tlb
2013-05-14 09:23:31    2706432    ----a-w-    C:\Windows\SysWow64\mshtml.tlb
2013-05-13 14:36:12    828872    ----a-w-    C:\Windows\System32\msvcr110.dll
2013-05-13 14:36:12    661448    ----a-w-    C:\Windows\System32\msvcp110.dll
2013-05-13 14:36:12    354264    ----a-w-    C:\Windows\System32\vccorlib110.dll
2013-05-13 14:36:12    251864    ----a-w-    C:\Windows\SysWow64\vccorlib110.dll
2013-05-13 14:36:10    862664    ----a-w-    C:\Windows\SysWow64\msvcr110.dll
2013-05-13 14:36:10    534480    ----a-w-    C:\Windows\SysWow64\msvcp110.dll
2013-05-13 14:36:06    50864    ----a-w-    C:\Windows\System32\drivers\point64.sys
2013-05-10 07:57:38    27208    ----a-w-    C:\Windows\System32\AdobePDFUI.dll
2013-05-10 07:57:34    55872    ----a-w-    C:\Windows\System32\AdobePDF.dll
2013-05-04 07:58:17    120736    ----a-w-    C:\Windows\System32\AuthHost.exe
2013-05-04 07:45:29    2233600    ----a-w-    C:\Windows\System32\drivers\tcpip.sys
2013-05-04 07:34:17    446720    ----a-w-    C:\Windows\System32\drivers\USBHUB3.SYS
2013-05-04 07:34:17    213248    ----a-w-    C:\Windows\System32\drivers\UCX01000.SYS
2013-05-04 07:34:15    284416    ----a-w-    C:\Windows\System32\drivers\spaceport.sys
2013-05-04 06:59:56    39424    ----a-w-    C:\Windows\System32\wuapp.exe
2013-05-04 06:59:51    1483776    ----a-w-    C:\Windows\System32\VSSVC.exe
2013-05-04 06:59:36    812544    ----a-w-    C:\Windows\System32\Magnify.exe
2013-05-04 06:59:25    98304    ----a-w-    C:\Windows\System32\wudriver.dll
2013-05-04 06:59:25    251904    ----a-w-    C:\Windows\System32\WUSettingsProvider.dll
2013-05-04 06:59:25    141824    ----a-w-    C:\Windows\System32\wuwebv.dll
2013-05-04 06:59:24    1619968    ----a-w-    C:\Windows\System32\wucltux.dll
2013-05-04 06:59:08    13644288    ----a-w-    C:\Windows\System32\Windows.UI.Xaml.dll
2013-05-04 06:58:54    328192    ----a-w-    C:\Windows\System32\ubpm.dll
2013-05-04 06:58:54    10116096    ----a-w-    C:\Windows\System32\twinui.dll
2013-05-04 06:58:49    173568    ----a-w-    C:\Windows\System32\storewuauth.dll
2013-05-04 06:58:49    1332736    ----a-w-    C:\Windows\System32\sysmain.dll
2013-05-04 06:58:48    330240    ----a-w-    C:\Windows\System32\stobject.dll
2013-05-04 06:58:28    93696    ----a-w-    C:\Windows\System32\psmsrv.dll
2013-05-04 06:58:02    470528    ----a-w-    C:\Windows\System32\netprofmsvc.dll
2013-05-04 06:58:02    151552    ----a-w-    C:\Windows\System32\netprofm.dll
2013-05-04 06:58:01    169984    ----a-w-    C:\Windows\System32\netplwiz.dll
2013-05-04 06:57:59    17408    ----a-w-    C:\Windows\System32\muifontsetup.dll
2013-05-04 06:57:46    560640    ----a-w-    C:\Windows\System32\mfmp4srcsnk.dll
2013-05-04 06:57:31    820736    ----a-w-    C:\Windows\System32\gpprefcl.dll
2013-05-04 06:57:15    501760    ----a-w-    C:\Windows\System32\DevicePairing.dll
2013-05-04 06:57:05    179712    ----a-w-    C:\Windows\System32\bisrv.dll
2013-05-04 06:57:05    122368    ----a-w-    C:\Windows\System32\biwinrt.dll
2013-05-04 06:57:04    389120    ----a-w-    C:\Windows\System32\BCP47Langs.dll
2013-05-04 06:57:04    2305024    ----a-w-    C:\Windows\System32\authui.dll
2013-05-04 06:57:00    708096    ----a-w-    C:\Windows\System32\AppXDeploymentExtensions.dll
2013-05-04 06:57:00    1131520    ----a-w-    C:\Windows\System32\AppXDeploymentServer.dll
2013-05-04 06:56:53    419840    ----a-w-    C:\Windows\System32\intl.cpl
2013-05-04 04:58:34    34304    ----a-w-    C:\Windows\SysWow64\wuapp.exe
2013-05-04 04:58:14    758784    ----a-w-    C:\Windows\SysWow64\Magnify.exe
2013-05-04 04:58:02    83968    ----a-w-    C:\Windows\SysWow64\wudriver.dll
2013-05-04 04:58:02    125952    ----a-w-    C:\Windows\SysWow64\wuwebv.dll
2013-05-04 04:57:49    10788864    ----a-w-    C:\Windows\SysWow64\Windows.UI.Xaml.dll
2013-05-04 04:57:39    8857088    ----a-w-    C:\Windows\SysWow64\twinui.dll
2013-05-04 04:57:39    247296    ----a-w-    C:\Windows\SysWow64\ubpm.dll
2013-05-04 04:57:35    303616    ----a-w-    C:\Windows\SysWow64\stobject.dll
2013-05-04 04:57:16    18432    ----a-w-    C:\Windows\SysWow64\npmproxy.dll
2013-05-04 04:57:04    151040    ----a-w-    C:\Windows\SysWow64\netplwiz.dll
2013-05-04 04:57:04    115712    ----a-w-    C:\Windows\SysWow64\netprofm.dll
2013-05-04 04:57:02    14336    ----a-w-    C:\Windows\SysWow64\muifontsetup.dll
2013-05-04 04:56:48    411136    ----a-w-    C:\Windows\SysWow64\mfmp4srcsnk.dll
2013-05-04 04:56:35    582144    ----a-w-    C:\Windows\SysWow64\gpprefcl.dll
2013-05-04 04:56:14    449536    ----a-w-    C:\Windows\SysWow64\DevicePairing.dll
2013-05-04 04:56:06    92160    ----a-w-    C:\Windows\SysWow64\biwinrt.dll
2013-05-04 04:56:05    309760    ----a-w-    C:\Windows\SysWow64\BCP47Langs.dll
2013-05-04 04:56:05    2035712    ----a-w-    C:\Windows\SysWow64\authui.dll
2013-05-04 04:55:58    389632    ----a-w-    C:\Windows\SysWow64\intl.cpl
2013-05-04 04:51:38    14848    ----a-w-    C:\Windows\System32\rars.rs
2013-05-04 04:48:33    83968    ----a-w-    C:\Windows\System32\drivers\hidclass.sys
2013-05-04 04:48:26    27648    ----a-w-    C:\Windows\System32\drivers\hidusb.sys
2013-05-04 04:47:02    427520    ----a-w-    C:\Windows\System32\drivers\rdbss.sys
2013-05-04 04:10:47    14848    ----a-w-    C:\Windows\SysWow64\rars.rs
2013-05-02 09:32:04    2274480    ----a-w-    C:\Windows\System32\coin94.dll
2013-05-01 02:59:12    94208    ----a-w-    C:\Windows\SysWow64\QuickTimeVR.qtx
2013-05-01 02:59:12    69632    ----a-w-    C:\Windows\SysWow64\QuickTime.qts
2013-04-28 22:30:55    1767936    ----a-w-    C:\Windows\SysWow64\wininet.dll
2013-04-28 22:30:12    2877440    ----a-w-    C:\Windows\SysWow64\jscript9.dll
2013-04-28 22:28:33    2241024    ----a-w-    C:\Windows\System32\wininet.dll
2013-04-28 22:28:29    915968    ----a-w-    C:\Windows\System32\uxtheme.dll
2013-04-28 22:28:00    3958784    ----a-w-    C:\Windows\System32\jscript9.dll
2013-04-27 05:20:12    733184    ----a-w-    C:\Windows\System32\win32spl.dll
2013-04-23 23:13:53    1013248    ----a-w-    C:\Windows\SysWow64\certutil.exe
2013-04-23 23:12:44    1569792    ----a-w-    C:\Windows\SysWow64\crypt32.dll
2013-04-23 23:12:44    109056    ----a-w-    C:\Windows\SysWow64\cryptnet.dll
2013-04-23 22:56:35    1255936    ----a-w-    C:\Windows\System32\certutil.exe
2013-04-23 22:55:48    68096    ----a-w-    C:\Windows\System32\cryptsvc.dll
2013-04-23 22:55:48    1889280    ----a-w-    C:\Windows\System32\crypt32.dll
2013-04-23 22:55:48    141312    ----a-w-    C:\Windows\System32\cryptnet.dll
2013-04-16 02:34:44    1455368    ----a-w-    C:\Windows\System32\drivers\dxgkrnl.sys
2013-04-13 05:56:35    444416    ----a-w-    C:\Windows\apppatch\AcSpecfc.dll
2013-04-11 10:06:54    39504    ----a-w-    C:\Windows\System32\drivers\gfiark.sys
2013-04-11 06:40:48    6987528    ----a-w-    C:\Windows\System32\ntoskrnl.exe
2013-04-09 05:33:02    489576    ----a-w-    C:\Windows\System32\AudioEng.dll
2013-04-09 05:33:02    446792    ----a-w-    C:\Windows\System32\AudioSes.dll
2013-04-09 05:33:02    253544    ----a-w-    C:\Windows\System32\audiodg.exe
2013-04-09 05:20:02    86280    ----a-w-    C:\Windows\System32\kdnet.dll
2013-04-09 05:20:02    306952    ----a-w-    C:\Windows\System32\kd_02_10ec.dll
2013-04-09 05:18:05    77960    ----a-w-    C:\Windows\System32\kdvm.dll
2013-04-09 05:17:57    1829408    ----a-w-    C:\Windows\System32\ntdll.dll
2013-04-09 04:52:07    816128    ----a-w-    C:\Windows\System32\SearchIndexer.exe
.
============= FINISH: 22:00:07.51 ===============
 

 

and

 

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 8 Pro
Boot Device: \Device\HarddiskVolume2
Install Date: 19/12/2012 21:48:30
System Uptime: 28/06/2013 21:19:24 (1 hours ago)
.
Motherboard: ASUSTeK COMPUTER INC. |  | P8Z77-V
Processor: Intel® Core i7-3770K CPU @ 3.50GHz | LGA1155 | 3501/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 111 GiB total, 49.518 GiB free.
D: is CDROM ()
E: is Removable
F: is Removable
G: is Removable
H: is Removable
I: is FIXED (NTFS) - 1863 GiB total, 940.95 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP25: 06/06/2013 11:40:48 - Installed Google AdWords Editor
RP26: 13/06/2013 15:26:38 - Installed Identity Cloaker
RP27: 14/06/2013 18:13:00 - Restore Operation
RP28: 22/06/2013 17:43:14 - Windows Update
RP29: 26/06/2013 11:27:40 - DCInstallRestorePoint
RP30: 28/06/2013 21:23:32 - Installed Identity Cloaker
.
==== Installed Programs ======================
.
 Update for Microsoft Office 2007 (KB2508958)
64 Bit HP CIO Components Installer
8GadgetPack
Adobe Acrobat X Pro - English, Français, Deutsch
Adobe AIR
Adobe CS6 Design and Web Premium
Adobe Flash Player 11 Plugin
Adobe Help Manager
Adobe Reader XI (11.0.03)
Adobe Widget Browser
Adobe® Content Viewer
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AuthenTec TrueSuite
Bonjour
Core Temp 1.0 RC4
CPUID CPU-Z 1.61.5
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Dropbox
EPSON Scan
Futuremark SystemInfo
Google AdWords Editor
Google Chrome
Google Update Helper
GoToMeeting 5.4.0.1082
Identity Cloaker
Intel® Management Engine Components
Intel® Trusted Connect Service Client
iTunes
Java 7 Update 15
Java Auto Updater
Macromedia HomeSite 5
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft Mouse and Keyboard Center
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (English) 2010
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Excel MUI (English) 2010
Microsoft Office Home and Student 2010
Microsoft Office Office 64-bit Components 2007
Microsoft Office Office 64-bit Components 2010
Microsoft Office OneNote MUI (English) 2010
Microsoft Office Outlook 2010
Microsoft Office Outlook MUI (English) 2010
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office Project 2007 Service Pack 3 (SP3)
Microsoft Office Project MUI (English) 2007
Microsoft Office Project Standard 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2007
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing (English) 2010
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Shared 64-bit MUI (English) 2007
Microsoft Office Shared 64-bit MUI (English) 2010
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Single Image 2010
Microsoft Office Visio 2007 Service Pack 3 (SP3)
Microsoft Office Visio MUI (English) 2007
Microsoft Office Visio Standard 2007
Microsoft Office Word MUI (English) 2010
Microsoft Outlook 2010
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
Microsoft_VC80_CRT_x86
Microsoft_VC90_CRT_x86
Mozilla Firefox 17.0.1 (x86 en-US)
Mozilla Firefox 21.0 (x86 en-US)
Mozilla Maintenance Service
NVIDIA 3D Vision Controller Driver 310.90
NVIDIA 3D Vision Driver 311.06
NVIDIA Control Panel 311.06
NVIDIA Graphics Driver 311.06
NVIDIA HD Audio Driver 1.3.18.0
NVIDIA Install Application
NVIDIA PhysX
NVIDIA PhysX System Software 9.12.1031
NVIDIA Stereoscopic 3D Driver
NVIDIA Update 1.11.3
NVIDIA Update Components
OpenAL
Opera 12.15
PDF Settings CS6
PokerStars
Pokki Download Helper
Protector Suite 2012
QuickTime
Realtek High Definition Audio Driver
Security Update for Microsoft Excel 2010 (KB2597126) 32-Bit Edition
Security Update for Microsoft Filter Pack 2.0 (KB2553501) 32-Bit Edition
Security Update for Microsoft InfoPath 2010 (KB2760406) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553091)
Security Update for Microsoft Office 2010 (KB2553096)
Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553447) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2598243) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2687501) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2687510) 32-Bit Edition
Security Update for Microsoft Office Visio 2007 suites (KB2596595) 32-Bit Edition
Security Update for Microsoft OneNote 2010 (KB2760600) 32-Bit Edition
Security Update for Microsoft Publisher 2010 (KB2553147) 32-Bit Edition
Security Update for Microsoft Visio 2010 (KB2810068) 32-Bit Edition
Security Update for Microsoft Visio Viewer 2010 (KB2687505) 32-Bit Edition
Security Update for Microsoft Word 2010 (KB2760410) 32-Bit Edition
Sky Go Desktop
SUPERAntiSpyware
TechPowerUp GPU-Z
TopStyle Lite (Version 3.0)
Trend Micro RUBotted 2.0 Beta
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553378) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition
Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition
Update for Microsoft Office Project 2007 Help (KB963668)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Visio 2007 Help (KB963666)
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2597090) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
Update for Microsoft PowerPoint 2010 (KB2598240) 32-Bit Edition
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition
VIPRE Internet Security
VLC media player 2.0.7
Wacom Tablet
WebTablet FB Plugin 32 bit
WebTablet FB Plugin 64 bit
WinPcap 4.1.1
.
==== Event Viewer Messages From Past Week ========
.
28/06/2013 21:21:36, Error: Service Control Manager [7038]  - The nvUpdatusService service was unable to log on as .\UpdatusUser with the currently configured password due to the following error:  The password for this account has expired. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).
28/06/2013 21:21:36, Error: Service Control Manager [7000]  - The NVIDIA Update Service Daemon service failed to start due to the following error:  The service did not start due to a log-on failure.
28/06/2013 21:19:25, Error: Microsoft-Windows-Kernel-General [6]  - An I/O operation initiated by the Registry failed unrecoverably.The Registry could not flush hive (file): ''.
28/06/2013 21:19:01, Error: Service Control Manager [7043]  - The Group Policy Client service did not shut down properly after receiving a pre-shutdown control.
28/06/2013 09:36:21, Error: NetBT [4307]  - Initialization failed because the transport refused to open initial addresses.
28/06/2013 09:36:19, Error: Service Control Manager [7011]  - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the FDResPub service.
26/06/2013 11:26:09, Error: NetBT [4319]  - A duplicate name has been detected on the TCP network.  The IP address of the computer that sent the message is in the data. Use nbtstat -n in a command window to see which name is in the Conflict state.
.
==== End Of File ===========================
 

any help much appreciated!

 

Best wishes

 

David

 

 

 

 

[link67]

Hi,

 

Forgot to say... the actual Malwarebytes quick scan said everything was okay. I'll leave it doing a deep scan now.

 

Best wishes and many thanks again

 

David

[MrCharlie]

Welcome to the forum.

Please download and run RogueKiller 32 Bit to your desktop.

RogueKiller 64 Bit <---use this one for 64 bit systems

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes)

P2P/Piracy Warning:

1. If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

2. If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

MrC

Note:

Please read all of my instructions completely including these.

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

[link67]

Hi MrC and many thanks for the help so far.

 

I've run Rogue Killer and it generated the following report:

 

RogueKiller V8.6.1 _x64_ [Jun 25 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 8 (6.2.9200 ) 64 bits version
Started in : Normal mode
User : David [Admin rights]
Mode : Scan -- Date : 06/29/2013 00:24:10
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤
[PROXY IE] HKCU\[...]\Internet Settings : ProxyServer (127.0.0.1:8080) -> FOUND
[iFEO] HKLM\[...]\sidebar.exe : Debugger (C:\Program Files (x86)\Windows Sidebar\8GadgetPack.exe -run [-]) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection :  ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts




¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST2000DM001-1CH164 +++++
--- User ---
[MBR] 9c5a0ec1dc7e93516aa4af91cd918d2e
[bSP] e94ba43271daa9605daf4449d7186e3c : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 1907727 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: ST2000DM001-1CH164 +++++
--- User ---
[MBR] 720ba24ead9200f87ab96c6fdc1771c0
[bSP] ef98f2f6e2dee84467294acd35599c24 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 350 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 718848 | Size: 114121 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_S_06292013_002410.txt >>




Meanwhile the warnings seem to have stopped for now. Maybe we scared them off already :-)

 

Best wishes

 

David

[MrCharlie]

Malwarebytes blocking sites may just be it doing what it's designed to do, we'll run some scans to make sure you're clean.

Download Malwarebytes Anti-Rootkit from HERE

• Unzip the contents to a folder in a convenient location.
• Open the folder where the contents were unzipped and run mbar.exe
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
• Wait while the system shuts down and the cleanup process is performed.
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
• When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

To attach a log if needed:

Bottom right corner of this page.

New window that comes up.

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot. It's located in the Plugins folder which is in the MBAR folder.

Just run fixdamage.exe.

Verify that they are now functioning normally.

MrC

[link67]

Hi again,

 

All seemed to run through without any problems. The results were clean. Logs attached...

 

system-log.txtmbar-log-2013-06-29 (00-56-30).txt

 

Still no more warnings either.

 

Best wishes again

 

David

 

 

 

 

[MrCharlie]

OK...Next:

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

 

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

[link67]

Hi again again,

 

The machine has been rebooted and all seems okay, but I am still getting the warning messages. Screenshot attached.

 

 

Interestingly it's only two warnings now, whereas it was three before, and they only seem to come up after a reboot. Previously it was every 30 seconds or so.

 

So, I'm still a bit baffled but very grateful for your help so far.

 

D.

[MrCharlie]

Did you run ComboFix as instructed?? MrC

[link67]

Yes, just done that... sorry that last reply was out of sequence!

 

Log attached.

ComboFix.txt

 

However... I think I may have found the culprit!

 

I have a program called Identity Cloaker so I can appear to search engines and the like that I'm abroad. (I use it for work - honest! It's a great tool for checking international SEO)

 

The "malicious" IPs look like they may be Identity Cloaker machines as the IP addresses of the proxy servers are very similar. There's 46.19.138.212, for example, listed for Switzerland, which is close, and the 193.105.134.142 is listed among the proxies for Sweden.

 

As all the scans appear to be clean, I strongly think that must be it but await your expert opinion!

 

Best wishes again

 

D.

 

[link67]

Hi again,

 

I emailed Identity Cloaker support and had a reply as follows:

 

-----

 

This problem used to affect only old versions of Malwarebytes, seems to have appeared again recently. I will check the IPs and will try to get them removed from the blacklists MB use. Identity Cloaker measures the response time/ping to each of the servers, that is apparently what triggers the alert. The ping is measured only every 30 minutes though, not sure why MB creates the popup warnings so frequently.
 

-----

So I think that must definitely be it, but await your further instruction.

 

Best wishes again

 

David

[MrCharlie]

OK, then just put add it to the ignore list,   MrC 

[link67]

Hi again,

 

Many many thanks for your help. Donation made in appreciation :-)

 

D.

[MrCharlie]

OK...Thank You

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller)

---------------------------------

If you used DeFogger to disable your CD Emulation drivers, please re-enable them.

-------------------------------

Please download OTC to your desktop.

http://oldtimer.geekstogo.com/OTC.exe

Double-click OTC to run it. (Vista and up users, please right click on OTC and select "Run as an Administrator")

Click on the CleanUp! button and follow the prompts.

(If you get a warning from your firewall or other security programs regarding OTC attempting to contact the Internet, please allow the connection.)

You will be asked to reboot the machine to finish the Cleanup process, choose Yes.

After the reboot all the tools we used should be gone.

Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, MBAR, etc....AdwCleaner > just run the program and click uninstall.

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[gringo_pr]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.