PUP.Bflix

FlynHawn · June 30, 2013

I found an old thread that refers to my problem; but rather than add a new reply there, I decided to make my own thread since you have to post your scan log. After a Malwarebytes Anti-Malware scan is the only time I see a file and a folder containing PUP.Bflix. They both appear to be within c:\programdata\thebflix\. I have searched my entire computer and cannot find that directory. Neither can I find PUP.Bflix, PUP.*, *.Bflix, thebflix, or anything else related to these supposed folder/files. I've also scanned with Ad-Aware Antivirus and the A/V within Kasperky PURE in addition to CCleaner and none of them find anything related to it either. I've looked in Add/Remove Programs and see nothing there either. Is this possibly a bug in the Malwarebytes program? If not, how can I find this program/file and delete it? Is this something that is known to reside within another program? Below is my last scan log:

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.06.30.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16618
John :: JOHN-PC [administrator]

6/30/2013 10:40:35 AM
MBAM-log-2013-06-30 (11-08-27).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 257885
Time elapsed: 3 minute(s), 41 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 1
c:\programdata\thebflix (PUP.BFlix) -> No action taken.

Files Detected: 1
c:\programdata\thebflix\background.html (PUP.BFlix) -> No action taken.

(end)

MrCharlie · June 30, 2013

Welcome to the forum, have you enabled hidden files??

http://www.howtogeek.com/howto/windows-vista/show-hidden-files-and-folders-in-windows-vista/

MrC

FlynHawn · June 30, 2013

I had not. Thank you for the link. However I scan with the Malwarebytes program every Sunday and have since deleted the folder and file in question and rebooted. While they show up each time I have scanned, they are not in my computer now. Will report back next week.

MrCharlie · June 30, 2013

OK, let me know.....MrC

FlynHawn · July 2, 2013

I usually scan on Sundays, but want to expedite this, so I ran a quick scan today and it found them again. This after having deleted them and rebooted only yesterday. I did a search for C:\programdata\thebflix and, yes, I have enabled hidden files with no results. The results of the scan are identical to the one posted above with the obvious exception of the date. Any thoughts?

MrCharlie · July 2, 2013

Lets take a closer look:

.......please start HERE

Post back the 2 logs here.....DDS.txt and Attach.txt

(please don't put logs in code or quotes)

P2P/Piracy Warning:

1. If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
2. If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

<====><====><====><====><====><====><====><====>

Next................

Please download and run RogueKiller 32 bit to your desktop.

RogueKiller<---use this one for 64 bit systems

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes)

MrC

Note:

Please read all of my instructions completely including these.

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

FlynHawn · July 2, 2013

MrC, first off thank you for your help. It is much appreciated. I won't be going anywhere until you decide the matter has been resolved to the best of your ability. Secondly, in answer to your warning, I do not use any P2P software. Neither am I a pirate. I'm going to assume you wanted me to post the generated reports in this thread rather than in a new forum as indicated by the dds post. Following are the reports including the RogueKiller scan - I will make 2 additional posts for the other reports for the sake of clear reading.

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16611 BrowserJavaVersion: 10.25.2
Run by John at 12:46:25 on 2013-07-02
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.8191.5654 [GMT -7:00]
.
AV: Kaspersky PURE *Enabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}
AV: Lavasoft Ad-Aware *Enabled/Updated* {E0D97DD4-42BA-B3F2-A5A7-22E9ACE81FC7}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Lavasoft Ad-Aware *Enabled/Updated* {5BB89C30-6480-BC7C-9F17-199BD76F557A}
SP: Kaspersky PURE *Enabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}
FW: Lavasoft Ad-Aware *Disabled* {D8E2FCF1-08D5-B2AA-8EF8-8BDC523B58BC}
FW: Kaspersky PURE *Enabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
E:\Ad-Aware Antivirus\AdAwareService.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\avp.exe
C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\ThreatFire\TFService.exe
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\Explorer.EXE
E:\PC Meter\PCMeter\PCMeterV0.3.exe
E:\Core Temp\Core Temp.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Users\John\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files (x86)\ThreatFire\TFTray.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\avp.exe
C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
E:\AD-AWA~1\AdAware.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
E:\Ad-Aware Antivirus\SBAMSvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\SearchIndexer.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\wbem\wmiprvse.exe
E:\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Microsoft Games\hearts\hearts.exe
E:\Mozilla Firefox\firefox.exe
E:\Mozilla Firefox\plugin-container.exe
E:\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.

mWinlogon: Userinit = userinit.exe,
BHO: IEVkbdBHO Class: {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\ievkbd.dll
BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
BHO: FilterBHO Class: {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll
uRun: [Google Update] "C:\Users\John\AppData\Local\Google\Update\GoogleUpdate.exe" /c
uRun: [spotify Web Helper] "C:\Users\John\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
uRun: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
mRun: [ThreatFire] C:\Program Files (x86)\ThreatFire\TFTray.exe
mRun: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\avp.exe"
mRun: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
mRun: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe"
mRun: [Ad-Aware Antivirus] "E:\Ad-Aware Antivirus\AdAwareLauncher" --windows-run
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: Add to Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\ie_banner_deny.htm
IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll
IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com

TCP: NameServer = 192.168.0.1 205.171.3.25 192.168.1.1
TCP: Interfaces\{8CB0F6F4-9D3D-4D76-800C-F49E45347A9C} : DHCPNameServer = 192.168.0.1 205.171.3.25 192.168.1.1
TCP: Interfaces\{B7D767C1-9441-4349-94E5-53D8DE8D16FE} : DHCPNameServer = 192.168.0.1 205.171.3.25 192.168.1.1
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll
AppInit_DLLs= C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll, C:\PROGRA~2\KASPER~1\KASPER~1\sbhook.dll
SSODL: WebCheck - <orphaned>
x64-BHO: IEVkbdBHO Class: {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\x64\ievkbd.dll
x64-BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
x64-BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-BHO: FilterBHO Class: {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\x64\klwtbbho.dll
x64-Run: [Nvtmru] "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" -f "C:\ProgramData\NVIDIA\Updatus\NvTmru\nvtmru.dat"
x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\x64\klwtbbho.dll
x64-IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\x64\klwtbbho.dll
x64-Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - <orphaned>
x64-Notify: klogon - C:\Windows\System32\klogon.dll
x64-Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\p9b16o02.default\
FF - prefs.js: network.proxy.type - 0
FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: C:\Users\John\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll
FF - plugin: C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\p9b16o02.default\extensions\{7D2FB79E-E58C-4DB5-A36F-AC1C73967F4D}\plugins\npqbc.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll
FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
FF - ExtSQL: 2013-06-29 12:54; {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}; C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\p9b16o02.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}.xpi
FF - ExtSQL: 2013-06-29 12:54; {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}; C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\p9b16o02.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF - ExtSQL: 2013-06-29 12:54; {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}; C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\p9b16o02.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi
.
============= SERVICES / DRIVERS ===============
.
R0 CSCrySec;InfoWatch Encrypt Sector Library driver;C:\Windows\System32\drivers\CSCrySec.sys [2012-3-26 85048]
R0 gfibto;gfibto;C:\Windows\System32\drivers\gfibto.sys [2013-6-23 14456]
R0 KLBG;Kaspersky Lab Boot Guard Driver;C:\Windows\System32\drivers\klbg.sys [2009-10-14 40464]
R0 TfFsMon;TfFsMon;C:\Windows\System32\drivers\TfFsMon.sys [2011-9-16 65072]
R0 TfSysMon;TfSysMon;C:\Windows\System32\drivers\TfSysMon.sys [2011-9-16 74824]
R1 CSVirtualDiskDrv;InfoWatch Virtual Disk driver;C:\Windows\System32\drivers\CSVirtualDiskDrv.sys [2012-3-26 66104]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\System32\drivers\klim6.sys [2009-9-14 27152]
R2 Ad-Aware Service;Ad-Aware Service;E:\Ad-Aware Antivirus\AdAwareService.exe [2013-6-13 1236336]
R2 AVP;Kaspersky PURE;C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\avp.exe [2010-10-1 348760]
R2 cpuz135;cpuz135;C:\Windows\System32\drivers\cpuz135_x64.sys [2011-9-16 21992]
R2 CSObjectsSrv;CryptoStorage control service;C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe [2009-12-21 743992]
R2 SBAMSvc;Ad-Aware;E:\Ad-Aware Antivirus\SBAMSvc.exe [2012-9-20 3677000]
R2 sbapifs;sbapifs;C:\Windows\System32\drivers\sbapifs.sys [2012-9-12 82872]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-12-29 383416]
R2 ThreatFire;ThreatFire;C:\Program Files (x86)\ThreatFire\TFService.exe service --> C:\Program Files (x86)\ThreatFire\TFService.exe service [?]
R3 klmouflt;Kaspersky Lab KLMOUFLT;C:\Windows\System32\drivers\klmouflt.sys [2009-10-2 21008]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2012-3-15 97280]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2012-3-15 217088]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2012-5-1 685672]
R3 TfNetMon;TfNetMon;C:\Windows\System32\drivers\TfNetMon.sys [2011-9-16 41888]
R3 usbfilter;AMD USB Filter Driver;C:\Windows\System32\drivers\usbfilter.sys [2012-5-1 56448]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 AODDriver4.01;AODDriver4.01;C:\Program Files (x86)\AMD\OverDrive\amd64\AODDriver2.sys [2011-5-25 55424]
S3 cpuz134;cpuz134;E:\CPUID\PC Wizard 2010\pcwiz_x64.sys [2011-10-15 21480]
S3 gfiark;gfiark;C:\Windows\System32\drivers\gfiark.sys [2013-5-22 39504]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-1-9 19456]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;E:\Benchmarks\SiSoftware\SiSoftware Sandra Lite 2013.SP3\RpcAgentSrv.exe [2013-4-8 71832]
S3 SWDUMon;SWDUMon;C:\Windows\System32\drivers\SWDUMon.sys [2013-4-9 16152]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-1-9 57856]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2013-1-9 30208]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-9-16 1255736]
S4 AODService;AODService;C:\Program Files (x86)\AMD\OverDrive\AODAssist.exe [2011-5-25 136616]
S4 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2011-10-25 79360]
S4 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2011-10-24 79360]
.
=============== Created Last 30 ================
.
2013-06-24 00:25:51   --------   d-----w-   C:\Users\John\AppData\Roaming\LavasoftStatistics
2013-06-24 00:22:47   --------   d-----w-   C:\ProgramData\blekko toolbars
2013-06-24 00:22:46   --------   d-----w-   C:\Users\John\AppData\Local\adawarebp
2013-06-24 00:22:44   --------   d-----w-   C:\ProgramData\Ad-Aware Browsing Protection
2013-06-24 00:22:40   --------   d-----w-   C:\Program Files (x86)\adawaretb
2013-06-24 00:22:39   --------   d-----w-   C:\Program Files (x86)\Toolbar Cleaner
2013-06-24 00:16:07   14456   ----a-w-   C:\Windows\System32\drivers\gfibto.sys
2013-06-22 11:57:39   96168   ----a-w-   C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2013-06-12 22:04:21   2706432   ----a-w-   C:\Windows\System32\mshtml.tlb
2013-06-12 21:59:30   1192448   ----a-w-   C:\Windows\System32\certutil.exe
2013-06-12 21:59:29   903168   ----a-w-   C:\Windows\SysWow64\certutil.exe
2013-06-12 21:59:28   1464320   ----a-w-   C:\Windows\System32\crypt32.dll
2013-06-12 21:59:25   1160192   ----a-w-   C:\Windows\SysWow64\crypt32.dll
2013-06-12 21:59:24   184320   ----a-w-   C:\Windows\System32\cryptsvc.dll
2013-06-12 21:59:24   139776   ----a-w-   C:\Windows\System32\cryptnet.dll
2013-06-12 21:59:23   140288   ----a-w-   C:\Windows\SysWow64\cryptsvc.dll
2013-06-12 21:59:23   103936   ----a-w-   C:\Windows\SysWow64\cryptnet.dll
2013-06-12 21:59:21   52224   ----a-w-   C:\Windows\System32\certenc.dll
2013-06-12 21:59:21   43008   ----a-w-   C:\Windows\SysWow64\certenc.dll
2013-06-12 21:59:13   1910632   ----a-w-   C:\Windows\System32\drivers\tcpip.sys
2013-06-12 21:58:21   751104   ----a-w-   C:\Windows\System32\win32spl.dll
2013-06-12 21:58:21   492544   ----a-w-   C:\Windows\SysWow64\win32spl.dll
.
==================== Find3M ====================
.
2013-06-22 11:56:44   867240   ----a-w-   C:\Windows\SysWow64\npDeployJava1.dll
2013-06-22 11:56:44   789416   ----a-w-   C:\Windows\SysWow64\deployJava1.dll
2013-06-17 04:14:18   71048   ----a-w-   C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-17 04:14:18   692104   ----a-w-   C:\Windows\SysWow64\FlashPlayerApp.exe
2013-06-08 11:13:19   2706432   ----a-w-   C:\Windows\SysWow64\mshtml.tlb
2013-05-22 06:29:02   16152   ----a-w-   C:\Windows\System32\drivers\SWDUMon.sys
2013-05-17 01:25:57   1767936   ----a-w-   C:\Windows\SysWow64\wininet.dll
2013-05-17 01:25:27   2877440   ----a-w-   C:\Windows\SysWow64\jscript9.dll
2013-05-17 01:25:26   61440   ----a-w-   C:\Windows\SysWow64\iesetup.dll
2013-05-17 01:25:26   109056   ----a-w-   C:\Windows\SysWow64\iesysprep.dll
2013-05-17 00:59:03   2241024   ----a-w-   C:\Windows\System32\wininet.dll
2013-05-17 00:58:10   3958784   ----a-w-   C:\Windows\System32\jscript9.dll
2013-05-17 00:58:08   67072   ----a-w-   C:\Windows\System32\iesetup.dll
2013-05-17 00:58:08   136704   ----a-w-   C:\Windows\System32\iesysprep.dll
2013-05-14 12:23:25   89600   ----a-w-   C:\Windows\System32\RegisterIEPKEYs.exe
2013-05-14 08:40:13   71680   ----a-w-   C:\Windows\SysWow64\RegisterIEPKEYs.exe
2013-05-02 09:06:08   278800   ------w-   C:\Windows\System32\MpSigStub.exe
2013-04-20 07:18:53   971680   ----a-w-   C:\Windows\System32\deployJava1.dll
2013-04-20 07:18:53   1092512   ----a-w-   C:\Windows\System32\npDeployJava1.dll
2013-04-20 07:18:53   108448   ----a-w-   C:\Windows\System32\WindowsAccessBridge-64.dll
2013-04-12 14:45:08   1656680   ----a-w-   C:\Windows\System32\drivers\ntfs.sys
2013-04-11 18:06:54   39504   ----a-w-   C:\Windows\System32\drivers\gfiark.sys
2013-04-10 06:01:54   265064   ----a-w-   C:\Windows\System32\drivers\dxgmms1.sys
2013-04-10 06:01:53   983400   ----a-w-   C:\Windows\System32\drivers\dxgkrnl.sys
2013-04-10 03:30:50   3153920   ----a-w-   C:\Windows\System32\win32k.sys
2013-04-04 21:50:32   25928   ----a-w-   C:\Windows\System32\drivers\mbam.sys
.
============= FINISH: 12:47:20.49 ===============

FlynHawn · July 2, 2013

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 9/16/2011 4:53:13 PM
System Uptime: 7/2/2013 12:35:24 PM (0 hours ago)
.
Motherboard: MSI | | 890FXA-GD70 (MS-7640)
Processor: AMD Phenom II X4 965 Processor | CPU1 | 3893/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 93 GiB total, 14.823 GiB free.
D: is CDROM ()
E: is FIXED (NTFS) - 931 GiB total, 775.444 GiB free.
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e96c-e325-11ce-bfc1-08002be10318}
Description: SB X-Fi Xtreme Audio
Device ID: PCI\VEN_1102&DEV_0007&SUBSYS_10121102&REV_00\4&2B4059EA&0&30A4
Manufacturer: Creative Technology Ltd.
Name: SB X-Fi Xtreme Audio
PNP Device ID: PCI\VEN_1102&DEV_0007&SUBSYS_10121102&REV_00\4&2B4059EA&0&30A4
Service: P17
.
==== System Restore Points ===================
.
RP280: 6/12/2013 3:03:03 PM - Windows Update
RP281: 6/15/2013 8:38:09 PM - Installed Debugging Tools for Windows (x64)
RP282: 6/16/2013 1:20:41 AM - Removed Debugging Tools for Windows (x86)
RP283: 6/22/2013 4:55:41 AM - Installed Java 7 Update 25
RP284: 6/29/2013 6:58:38 PM - Scheduled Checkpoint
.
==== Installed Programs ======================
.
3DMark 11
7-Zip 9.20 (x64 edition)
Ad-Aware Antivirus
Ad-Aware Browsing Protection
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader XI (11.0.03)
AMD Catalyst Install Manager
AMD OverDrive
Assassin's Creed
Assassin's Creed II
Belarc Advisor 8.3
Canon Camera Access Library
Canon Camera Window DC_DV 6 for ZoomBrowser EX
Canon Camera Window MC 6 for ZoomBrowser EX
Canon G.726 WMP-Decoder
Canon MovieEdit Task for ZoomBrowser EX
Canon RAW Image Task for ZoomBrowser EX
Canon RemoteCapture Task for ZoomBrowser EX
Canon Utilities EOS Utility
Canon Utilities ZoomBrowser EX
CCleaner
Core Temp version 0.99.8
CPUID HWMonitor 1.18
CrystalDiskInfo 5.6.2
CrystalDiskMark 3.0.2f
Curse Client
Debugging Tools for Windows (x64)
Diablo II
Diablo III
Diablo III Public Test
Dungeon Lords
Dungeon Siege III
EQ2MAP Updater 1.2.6
eReg
EverQuest II
FileHippo.com Update Checker
Fraps
Futuremark SystemInfo
Garmin Communicator Plugin x64
Garmin Lifetime Updater
Google Chrome
Heaven Benchmark version 4.0
Hero Editor V1.03
Impulse®
Java 7 Update 21 (64-bit)
Java 7 Update 25
Java Auto Updater
Java 6 Update 31
JavaFX 2.1.1
JMicron JMB36X Driver
Kaspersky PURE
Logitech SetPoint 6.32
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft .NET Framework 1.1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Mozilla Firefox 22.0 (x86 en-US)
Mozilla Maintenance Service
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NETGEAR Powerline Utility
NVIDIA 3D Vision Controller Driver 314.07
NVIDIA 3D Vision Driver 310.90
NVIDIA Control Panel 310.90
NVIDIA CUDA Toolkit v5.0 (64 bit)
NVIDIA GeForce Experience 1.0.1 (BETA)
NVIDIA Graphics Driver 310.90
NVIDIA HD Audio Driver 1.3.23.1
NVIDIA Install Application
NVIDIA PhysX
NVIDIA PhysX System Software 9.12.1031
NVIDIA Stereoscopic 3D Driver
NVIDIA Update 1.11.3
NVIDIA Update Components
Oblivion
OCZ SMART mon
OpenOffice.org 3.4.1
Path of Exile
PC Wizard 2010.1.96
PC Wizard 2012.2.11
PCMark 7
Realtek Ethernet Controller Driver
Realtek High Definition Audio Driver
Renesas Electronics USB 3.0 Host Controller Driver
SAMSUNG USB Driver for Mobile Phones
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft .NET Framework 4 Extended (KB2736428)
Security Update for Microsoft .NET Framework 4 Extended (KB2742595)
Sid Meier's Civilization 4
Sid Meier's Civilization V
SiSoftware Sandra Lite 2013.SP3
SlimDrivers
SpeedFan (remove only)
Spotify
Steam
System Requirements Lab
TechPowerUp GPU-Z
The Elder Scrolls V: Skyrim
The Lord of the Rings Online™
The Lord of the Rings Online™ v03.08.00.8029
The Witcher 2
The Witcher Enhanced Edition
ThreatFire
Torchlight 2
Total War: SHOGUN 2
Ubisoft Game Launcher
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
Ventrilo Client for Windows x64
Visual Studio 2008 x64 Redistributables
WinRAR 4.20 (64-bit)
.
==== Event Viewer Messages From Past Week ========
.
7/2/2013 12:37:44 PM, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80070422'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.
7/2/2013 12:37:43 PM, Error: Service Control Manager [7038] - The nvUpdatusService service was unable to log on as .\UpdatusUser with the currently configured password due to the following error: Logon failure: the specified account password has expired. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).
7/2/2013 12:37:43 PM, Error: Service Control Manager [7000] - The NVIDIA Update Service Daemon service failed to start due to the following error: The service did not start due to a logon failure.
7/2/2013 12:36:01 PM, Error: Service Control Manager [7000] - The WinRing0_1_2_0 service failed to start due to the following error: The system cannot find the file specified.
7/1/2013 8:15:26 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X86 service to connect.
7/1/2013 8:07:58 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Error Reporting Service service to connect.
6/30/2013 3:14:44 AM, Error: Microsoft-Windows-WHEA-Logger [18] - A fatal hardware error has occurred. Reported by component: Processor Core Error Source: Machine Check Exception Error Type: Cache Hierarchy Error Processor ID: 2 The details view of this entry contains further information.
6/30/2013 3:14:36 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x00000124 (0x0000000000000000, 0xfffffa80073f1028, 0x00000000f602a000, 0x0000000000000135). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 063013-11434-01.
6/29/2013 5:54:08 PM, Error: nvlddmkm [14] -
6/27/2013 6:45:42 PM, Error: Service Control Manager [7022] - The Ad-Aware service hung on starting.
6/27/2013 6:43:27 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X64 service to connect.
.
==== End Of File ===========================

FlynHawn · July 2, 2013

RogueKiller V8.6.2 _x64_ [Jul 2 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : John [Admin rights]
Mode : Scan -- Date : 07/02/2013 12:55:47
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 8 ¤¤¤
[RUN][sUSP PATH] HKLM\[...]\Run : Nvtmru ("C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" -f "C:\ProgramData\NVIDIA\Updatus\NvTmru\nvtmru.dat" [7][-]) -> FOUND
[HJ POL] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND
[HJ POL] HKLM\[...]\System : EnableLUA (0) -> FOUND
[HJ POL] HKLM\[...]\Wow6432Node\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND
[HJ POL] HKLM\[...]\Wow6432Node\[...]\System : EnableLUA (0) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[bROK VAL] HKCR\[...]\command : () -> MISSING

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: OCZ-VERTEX2 ATA Device +++++
--- User ---
[MBR] 2561c6c1518c3446e668cff94d138457
[bSP] 65de99694315db382c91170aceb685c3 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 95294 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: OCZ-VERTEX2 ATA Device +++++
--- User ---
[MBR] 0086f36f0b7bc8b257f89fc226376c3d
[bSP] 9e3b3c473b1db0daa516427cdae6e1cc : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] UNKNOWN (0x00) [VISIBLE] Offset (sectors): 1 | Size: 2097152 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_S_07022013_125547.txt >>

MrCharlie · July 2, 2013

Everyone gets the warnings, it wasn't specifically for you.

Please download AdwCleaner from here and save it on your Desktop.

AdwCleaner is a reliable removal tool for Adware, Foistware, toolbars and potentially unwanted programs.
AdwCleaner is a tool that deletes :
· Adwares (software ads)
· PUP/LPI (Potentially Undesirable Program)
· Toolbars
· Hijacker (Hijack of the browser's homepage)
It works with a Search and Deletion method. It can be easily uninstalled using the "Uninstall" mode.

Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.
Now click on the Search tab.
Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

Note:

Please look over what was found......especially any folders, we're going to permanently delete it all in the next step....if there's something you may want to keep...please let me know and I'll explain to why it shouldn't be on your system.

If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.

Please note that Antivir Webguard uses ASK Toolbar as part of its web security. If you remove ASK by using Adwcleaner, Antivir Webguard will no longer work properly. Therefore, if you use this program please use the instructions below to access the options screen where you should enable /DisableAskDetections before using AdwCleaner.
You can click on the question mark (?) in the upper left corner of the program and then click on Options. You will then be presented with a dialog where you can disable various detections. These options are described below:
/DisableAskDetection - This option disables Ask Toolbar detection.

MrC

FlynHawn · July 2, 2013

# AdwCleaner v2.303 - Logfile created 07/02/2013 at 14:33:08
# Updated 08/06/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : John - JOHN-PC
# Boot Mode : Normal
# Running from : C:\Users\John\Downloads\adwcleaner.exe
# Option [search]

***** [services] *****

***** [Files / Folders] *****

Folder Found : C:\Program Files (x86)\adawaretb
Folder Found : C:\ProgramData\blekko toolbars
Folder Found : C:\ProgramData\InstallMate
Folder Found : C:\ProgramData\Premium
Folder Found : C:\Users\John\AppData\Local\PackageAware
Folder Found : C:\Users\John\AppData\LocalLow\adawaretb
Folder Found : C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\p9b16o02.default\adawaretb

***** [Registry] *****

Key Found : HKCU\Software\IGearSettings
Key Found : HKLM\Software\adawaretb
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

***** [internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16611

[OK] Registry is clean.

-\\ Mozilla Firefox v22.0 (en-US)

File : C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\p9b16o02.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v28.0.1500.63

File : C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [1904 octets] - [02/07/2013 14:33:08]

########## EOF - C:\AdwCleaner[R1].txt - [1964 octets] ##########

MrCharlie · July 2, 2013

Lots of adware found....lets clear it out.....

Please re-run AdwCleaner
Click on Delete button.
Confirm each time with OK if asked.
Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.

Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.

Next run.......

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

MrC

FlynHawn · July 2, 2013

# AdwCleaner v2.303 - Logfile created 07/02/2013 at 15:41:02
# Updated 08/06/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : John - JOHN-PC
# Boot Mode : Normal
# Running from : C:\Users\John\Desktop\adwcleaner.exe
# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

Folder Deleted : C:\Program Files (x86)\adawaretb
Folder Deleted : C:\ProgramData\blekko toolbars
Folder Deleted : C:\ProgramData\InstallMate
Folder Deleted : C:\ProgramData\Premium
Folder Deleted : C:\Users\John\AppData\Local\PackageAware
Folder Deleted : C:\Users\John\AppData\LocalLow\adawaretb
Folder Deleted : C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\p9b16o02.default\adawaretb

***** [Registry] *****

Key Deleted : HKCU\Software\IGearSettings
Key Deleted : HKLM\Software\adawaretb
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

***** [internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16611

[OK] Registry is clean.

-\\ Mozilla Firefox v22.0 (en-US)

File : C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\p9b16o02.default\prefs.js

[OK] File is clean.

-\\ Google Chrome v28.0.1500.63

File : C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [2029 octets] - [02/07/2013 14:33:08]
AdwCleaner[R2].txt - [2087 octets] - [02/07/2013 15:40:36]
AdwCleaner[s1].txt - [2054 octets] - [02/07/2013 15:41:02]

########## EOF - C:\AdwCleaner[s1].txt - [2114 octets] ##########

FlynHawn · July 2, 2013

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Home Premium x64
Ran by John on Tue 07/02/2013 at 15:53:41.85
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\systweak

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\Users\John\appdata\local\adawarebp"

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 07/02/2013 at 16:04:19.21
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

MrCharlie · July 2, 2013

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

Please let me know how computer is running now, MrC

FlynHawn · July 2, 2013

Found them again. :\

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.07.02.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16618
John :: JOHN-PC [administrator]

7/2/2013 4:51:48 PM
mbam-log-2013-07-02 (16-51-48).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 258642
Time elapsed: 3 minute(s), 52 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 1
c:\programdata\thebflix (PUP.BFlix) -> Quarantined and deleted successfully.

Files Detected: 1
c:\programdata\thebflix\background.html (PUP.BFlix) -> Delete on reboot.

(end)

MrCharlie · July 3, 2013

What are the symptoms of BFlix??

How long does it take for it to come back??

MrC

FlynHawn · July 3, 2013

As to the first question, I don't know because I don't know what Bflix does or where it's hiding. My only clue is a rash of freezes and BSODs here just lately. I would say within the past 2-3 weeks. As to the second, I normally scan with the Malwarebytes program once a week; but since starting this thread I've now done it 2 days in a row and 4 times this week. It was found on Monday after having deleted and rebooted on Sunday; found just after you had me run all those malware programs and again just prior to posting this. Immediately before the last scan I looked in C:\ProgramData and saw no "thebflix". I then scanned with Malwarebytes and found the same file and folder that it has been reporting finding all along. Scan is below:

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.07.02.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16618
John :: JOHN-PC [administrator]

7/2/2013 6:47:30 PM
mbam-log-2013-07-02 (18-47-30).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 258706
Time elapsed: 4 minute(s), 42 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 1
c:\programdata\thebflix (PUP.BFlix) -> Quarantined and deleted successfully.

Files Detected: 1
c:\programdata\thebflix\background.html (PUP.BFlix) -> Delete on reboot.

(end)

MrCharlie · July 3, 2013

OK...do this:

Please download Farbar Recovery Scan Tool and save it to a folder. (64 bit version)

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

MrC

BHO

CLSID: {271AF871-88FD-41A4-AFB7-FF6CFF038410}

Name: TheBflix

Filename: bhoclass.dll

Location: %CommonAppData%\TheBflix

FlynHawn · July 3, 2013

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-07-2013
Ran by John (administrator) on 02-07-2013 19:26:13
Running from C:\Users\John\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Lavasoft Limited) E:\Ad-Aware Antivirus\AdAwareService.exe
(Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\avp.exe
(Infowatch) C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe
(PC Tools) C:\Program Files (x86)\ThreatFire\TFService.exe
(AddGadgets) E:\PC Meter\PCMeter\PCMeterV0.3.exe
() E:\Core Temp\Core Temp.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Spotify Ltd) C:\Users\John\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(PC Tools) C:\Program Files (x86)\ThreatFire\TFTray.exe
(Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\avp.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
(Lavasoft Limited) E:\AD-AWA~1\AdAware.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(GFI Software) E:\Ad-Aware Antivirus\SBAMSvc.exe
(Mozilla Corporation) E:\Mozilla Firefox\firefox.exe
(Mozilla Corporation) E:\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Nvtmru] "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" -f "C:\ProgramData\NVIDIA\Updatus\NvTmru\nvtmru.dat" [317440 2013-07-02] ()
HKLM\...\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [12503184 2012-06-11] (Realtek Semiconductor)
Winlogon\Notify\klogon: %SystemRoot%\System32\klogon.dll (Kaspersky Lab)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKCU\...\Run: [Google Update] "C:\Users\John\AppData\Local\Google\Update\GoogleUpdate.exe" /c [116648 2012-08-08] (Google Inc.)
HKCU\...\Run: [spotify Web Helper] "C:\Users\John\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [1105408 2013-05-05] (Spotify Ltd)
HKCU\...\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun [1475584 2010-11-20] (Microsoft Corporation)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
MountPoints2: {d023a437-e71c-11e0-abad-8c89a51936b7} - F:\ToolLauncher-Bootstrap.exe
HKLM-x32\...\Run: [ThreatFire] C:\Program Files (x86)\ThreatFire\TFTray.exe [378128 2011-02-22] (PC Tools)
HKLM-x32\...\Run: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\avp.exe" [348760 2010-10-01] (Kaspersky Lab)
HKLM-x32\...\Run: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [115048 2011-09-16] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe [43608 1999-12-31] ()
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe" [554408 2013-05-15] (Lavasoft)
HKLM-x32\...\Run: [Ad-Aware Antivirus] "E:\Ad-Aware Antivirus\AdAwareLauncher" --windows-run [x]
HKU\UpdatusUser.John-PC\...\Run: [spotify Web Helper] "C:\Users\John\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [1105408 2013-05-05] (Spotify Ltd)
HKU\UpdatusUser.John-PC\...\Run: [Google Update] "C:\Users\John\AppData\Local\Google\Update\GoogleUpdate.exe" /c [116648 2012-08-08] (Google Inc.)
AppInit_DLLs: C:\PROGRA~2\KASPER~1\KASPER~1\x64\sbhook64.dll,C:\PROGRA~2\KASPER~1\KASPER~1\x64\kloehk.dll [15448 2010-10-01] (Kaspersky Lab)
AppInit_DLLs-x32: C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll, C:\PROGRA~2\KASPER~1\KASPER~1\sbhook.dll [72280 2010-10-01] (Kaspersky Lab)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
BHO: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\x64\ievkbd.dll (Kaspersky Lab)
BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\x64\klwtbbho.dll (Kaspersky Lab)
BHO-x32: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\ievkbd.dll (Kaspersky Lab)
BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll (Kaspersky Lab)
DPF: HKLM-x32 {A4110378-789B-455F-AE86-3A1BFC402853} http://zone.msn.com/bingame/zpagames/zpa_shvl.cab55579.cab
DPF: HKLM-x32 {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/ZPAFramework.cab102118.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} http://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {E705A591-DA3C-4228-B0D5-A356DBA42FBF} http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - No File
Handler-x32: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll (Belarc, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 205.171.3.25 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\p9b16o02.default
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\John\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\John\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Extension: Ghostery - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\p9b16o02.default\Extensions\firefox@ghostery.com
FF Extension: Qualys BrowserCheck - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\p9b16o02.default\Extensions\{7D2FB79E-E58C-4DB5-A36F-AC1C73967F4D}
FF Extension: WOT - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\p9b16o02.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: ddfirefox - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\p9b16o02.default\Extensions\ddfirefox@dynamitedata.xpi
FF Extension: No Name - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\p9b16o02.default\Extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi
FF Extension: No Name - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\p9b16o02.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\John\AppData\Roaming\Mozilla\Firefox\Profiles\p9b16o02.default\Extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}.xpi
FF HKLM-x32\...\Thunderbird\Extensions: [{eea12ec4-729d-4703-bc37-106ce9879ce2}] C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\THBExt
FF Extension: Kaspersky Anti-Spam Extension - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\THBExt

Chrome:
=======

CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Users\John\AppData\Local\Google\Chrome\Application\21.0.1180.75\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\John\AppData\Local\Google\Chrome\Application\28.0.1500.52\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\John\AppData\Local\Google\Chrome\Application\28.0.1500.52\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\John\AppData\Local\Google\Chrome\Application\28.0.1500.52\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Java Platform SE 7 U5) - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.50.255) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Google Update) - C:\Users\John\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Extension: (YouTube) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Qualys BrowserCheck) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejhnkognlohdkpjkjongioociddgoibk\1.7.15.1_0
CHR Extension: (Hotcoolicious) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbaiecpeigjplekifkboiomcdmmbnmnb\1_0
CHR Extension: (Wow Secrets) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbpfednjpdfmfcbhiciagalkgilgpaep\1.0_0
CHR Extension: (World of Warcraft Search) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\ijloicdileadhbjdlccmbaihgjjhkmjl\2.0.0.4_0
CHR Extension: (World of Warcraft Talent Calculators) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpdejlednnbkhcjlnfancbnooejelchd\1.2_0
CHR Extension: (ArmoryLinks) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\llafjcaincmipfpkggjidjbebigmoclc\0.1.5.1_0
CHR Extension: (Chrome to Phone) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\oadboiipflhobonjjffjbfekfjcgkhco\2.3.1_0
CHR Extension: (Gmail) - C:\Users\John\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_2

==================== Services (Whitelisted) =================

R2 Ad-Aware Service; E:\Ad-Aware Antivirus\AdAwareService.exe [1236336 2013-06-13] (Lavasoft Limited)
S4 AODService; C:\Program Files (x86)\AMD\OverDrive\AODAssist.exe [136616 2011-05-25] ()
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE\avp.exe [348760 2010-10-01] (Kaspersky Lab)
S4 CCALib8; C:\Program Files (x86)\Canon\CAL\CALMAIN.exe [96341 2006-03-30] (Canon Inc.)
R2 CSObjectsSrv; C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe [743992 2009-12-21] (Infowatch)
S3 SandraAgentSrv; E:\Benchmarks\SiSoftware\SiSoftware Sandra Lite 2013.SP3\RpcAgentSrv.exe [71832 2009-03-27] (SiSoftware)
R2 SBAMSvc; E:\Ad-Aware Antivirus\SBAMSvc.exe [3677000 2012-09-20] (GFI Software)
R2 ThreatFire; C:\Program Files (x86)\ThreatFire\TFService.exe [70928 2011-02-22] (PC Tools)

==================== Drivers (Whitelisted) ====================

S3 AODDriver4.01; C:\Program Files (x86)\AMD\OverDrive\amd64\AODDriver2.sys [55424 2011-05-25] (Advanced Micro Devices)
S3 AODDriver4.01; C:\Program Files (x86)\AMD\OverDrive\amd64\AODDriver2.sys [55424 2011-05-25] (Advanced Micro Devices)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [88480 2012-01-30] ()
S3 cpuz134; E:\CPUID\PC Wizard 2010\pcwiz_x64.sys [21480 2010-07-09] (Windows ® Win 7 DDK provider)
S3 cpuz134; E:\CPUID\PC Wizard 2010\pcwiz_x64.sys [21480 2010-07-09] (Windows ® Win 7 DDK provider)
R2 cpuz135; C:\Windows\system32\drivers\cpuz135_x64.sys [21992 2010-11-09] (CPUID)
R0 CSCrySec; C:\Windows\System32\DRIVERS\CSCrySec.sys [85048 2009-12-14] (Infowatch)
R1 CSVirtualDiskDrv; C:\Windows\System32\DRIVERS\CSVirtualDiskDrv.sys [66104 2009-12-14] (Infowatch)
S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [39504 2013-04-11] (ThreatTrack Security)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-06-23] (GFI Software)
R1 kl1; C:\Windows\System32\DRIVERS\kl1.sys [157712 2009-09-01] (Kaspersky Lab)
R0 KLBG; C:\Windows\System32\DRIVERS\klbg.sys [40464 2009-10-14] (Kaspersky Lab)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [353296 2012-03-26] (Kaspersky Lab)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [27152 2009-09-14] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [21008 2009-10-02] (Kaspersky Lab)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [46400 2012-01-30] ()
S3 PcaSp50; C:\Windows\System32\Drivers\PcaSp50.sys [45624 2009-08-24] (Printing Communications Assoc., Inc. (PCAUSA))
S3 SANDRA; E:\Benchmarks\SiSoftware\SiSoftware Sandra Lite 2013.SP3\WNt500x64\Sandra.sys [23112 2009-08-07] (SiSoftware)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-13] (Brother Industries Ltd.)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2013-05-21] ()
R0 TfFsMon; C:\Windows\System32\drivers\TfFsMon.sys [65072 2011-02-22] (PC Tools)
R3 TfNetMon; C:\Windows\system32\drivers\TfNetMon.sys [41888 2011-02-22] (PC Tools)
R3 TfNetMon; C:\Windows\system32\drivers\TfNetMon.sys [41888 2011-02-22] (PC Tools)
R0 TfSysMon; C:\Windows\System32\drivers\TfSysMon.sys [74824 2011-02-22] (PC Tools)
R3 ALSysIO; \??\C:\Users\John\AppData\Local\Temp\ALSysIO64.sys [x]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S3 GPU-Z; \??\C:\Users\John\AppData\Local\Temp\GPU-Z.sys [x]
S3 MSI_MSIBIOS_010507; \??\C:\Program Files (x86)\MSI\Live Update 5\msibios64_100507.sys [x]
S3 NTIOLib_1_0_4; \??\C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [x]
R3 WinRing0_1_2_0; \??\C:\Users\John\AppData\Local\Temp\tmpA68B.tmp [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-07-02 19:25 - 2013-07-02 19:25 - 00000000 ____D C:\FRST
2013-07-02 19:24 - 2013-07-02 19:24 - 01933556 ____A (Farbar) C:\Users\John\Desktop\FRST64.exe
2013-07-02 17:02 - 2013-07-02 17:02 - 00000000 ____D C:\Users\John\AppData\Local\adawarebp
2013-07-02 16:04 - 2013-07-02 16:04 - 00000783 ____A C:\Users\John\Desktop\JRT.txt
2013-07-02 15:53 - 2013-07-02 15:53 - 00000000 ____D C:\Windows\ERUNT
2013-07-02 15:53 - 2013-07-02 15:53 - 00000000 ____D C:\JRT
2013-07-02 15:52 - 2013-07-02 15:52 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\John\Desktop\JRT.exe
2013-07-02 15:41 - 2013-07-02 15:47 - 00002179 ____A C:\Users\John\Desktop\AdwCleaner[s1].txt
2013-07-02 15:40 - 2013-07-02 15:40 - 00002087 ____A C:\AdwCleaner[R2].txt
2013-07-02 14:33 - 2013-07-02 14:33 - 00002029 ____A C:\AdwCleaner[R1].txt
2013-07-02 14:32 - 2013-07-02 14:32 - 00648201 ____A C:\Users\John\Desktop\adwcleaner.exe
2013-07-02 12:55 - 2013-07-02 12:55 - 00002301 ____A C:\Users\John\Desktop\RKreport[0]_S_07022013_125547.txt
2013-07-02 12:54 - 2013-07-02 12:57 - 00000000 ____D C:\Users\John\Desktop\RK_Quarantine
2013-07-02 12:52 - 2013-07-02 12:52 - 03775488 ____A C:\Users\John\Desktop\RogueKillerX64.exe
2013-07-02 12:47 - 2013-07-02 12:47 - 00018075 ____A C:\Users\John\Desktop\dds.txt
2013-07-02 12:47 - 2013-07-02 12:47 - 00009158 ____A C:\Users\John\Desktop\attach.txt
2013-07-02 12:46 - 2013-07-02 12:46 - 00688992 ____R (Swearware) C:\Users\John\Downloads\dds.com
2013-07-01 12:32 - 2013-07-01 12:32 - 00017920 __ASH C:\Users\John\Documents\Thumbs.db
2013-06-30 11:43 - 2013-07-02 19:02 - 00000448 ____A C:\Windows\setupact.log
2013-06-30 11:43 - 2013-06-30 11:43 - 00000000 ____A C:\Windows\setuperr.log
2013-06-30 11:42 - 2013-07-02 19:02 - 00001152 ____A C:\Windows\PFRO.log
2013-06-30 10:39 - 2013-06-30 10:39 - 00000250 ____A C:\Users\John\Documents\cc_20130630_103908.reg
2013-06-23 17:25 - 2013-06-25 05:25 - 00000000 ____D C:\Users\John\AppData\Roaming\LavasoftStatistics
2013-06-23 17:22 - 2013-06-23 17:22 - 00000000 ____D C:\ProgramData\Ad-Aware Browsing Protection
2013-06-23 17:22 - 2013-06-23 17:22 - 00000000 ____D C:\Program Files (x86)\Toolbar Cleaner
2013-06-23 17:16 - 2013-06-23 17:16 - 00014456 ____A (GFI Software) C:\Windows\System32\Drivers\gfibto.sys
2013-06-23 17:15 - 2013-06-23 17:15 - 05616264 ____A (Lavasoft Limited) C:\Users\John\Downloads\Adaware_Installer.exe
2013-06-23 11:05 - 2013-07-02 19:01 - 00000023 ____A C:\Users\John\AppData\Roaming\Network Meter_Usage.ini
2013-06-22 04:57 - 2013-06-22 04:56 - 00263592 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-06-22 04:57 - 2013-06-22 04:56 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-06-22 04:57 - 2013-06-22 04:56 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-06-22 04:57 - 2013-06-22 04:56 - 00096168 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-06-22 00:00 - 2013-07-02 19:00 - 00005708 ____A C:\Users\John\Network_Meter_Data.js
2013-06-21 23:31 - 2013-06-23 04:23 - 00000458 ____A C:\Users\John\AppData\Roaming\Weather Meter_Settings.ini
2013-06-21 23:29 - 2013-06-21 23:29 - 00161850 ____A C:\Users\John\Downloads\Drives_Meter.zip
2013-06-21 23:28 - 2013-06-21 23:28 - 00372320 ____A (Addgadgets.com) C:\Users\John\Downloads\GPUMeter.exe
2013-06-21 23:26 - 2013-06-21 23:26 - 00118698 ____A C:\Users\John\Downloads\Weather_Meter.zip
2013-06-21 23:24 - 2013-06-21 23:24 - 00372328 ____A (Addgadgets.com) C:\Users\John\Downloads\NetworkMeter.exe
2013-06-21 23:22 - 2013-06-21 23:22 - 00206064 ____A C:\Users\John\Downloads\All_CPU_Meter.zip
2013-06-21 23:19 - 2013-06-21 23:19 - 00108194 ____A C:\Users\John\Downloads\PCMeter.zip
2013-06-21 23:09 - 2013-06-21 23:09 - 01364543 ____A (Arthur Liberman ) C:\Users\John\Downloads\Core-Temp-setup.exe
2013-06-12 15:05 - 2013-05-16 18:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-12 15:05 - 2013-05-16 18:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-12 15:05 - 2013-05-16 18:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-12 15:05 - 2013-05-16 18:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-12 15:05 - 2013-05-16 18:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-12 15:05 - 2013-05-16 18:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-12 15:05 - 2013-05-16 18:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-12 15:05 - 2013-05-16 18:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-12 15:05 - 2013-05-16 17:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-12 15:05 - 2013-05-16 17:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-12 15:05 - 2013-05-16 17:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-12 15:05 - 2013-05-16 17:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-12 15:05 - 2013-05-16 17:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-12 15:05 - 2013-05-16 17:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-12 15:05 - 2013-05-16 17:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-12 15:05 - 2013-05-16 17:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-12 15:05 - 2013-05-16 17:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-12 15:05 - 2013-05-14 05:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-12 15:05 - 2013-05-14 01:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-12 15:04 - 2013-06-08 07:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-12 15:04 - 2013-06-08 07:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-12 15:04 - 2013-06-08 07:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-12 15:04 - 2013-06-08 07:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-12 15:04 - 2013-06-08 07:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-12 15:04 - 2013-06-08 05:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-12 15:04 - 2013-06-08 04:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-12 15:04 - 2013-06-08 04:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-12 15:04 - 2013-06-08 04:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-12 15:04 - 2013-06-08 04:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-12 15:04 - 2013-06-08 04:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-12 15:04 - 2013-06-08 04:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-12 14:59 - 2013-05-12 22:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 14:59 - 2013-05-12 22:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 14:59 - 2013-05-12 22:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 14:59 - 2013-05-12 22:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 14:59 - 2013-05-12 21:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 14:59 - 2013-05-12 21:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 14:59 - 2013-05-12 21:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 14:59 - 2013-05-12 20:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 14:59 - 2013-05-12 20:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 14:59 - 2013-05-12 20:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 14:59 - 2013-05-07 23:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 14:58 - 2013-04-25 22:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 14:58 - 2013-04-25 21:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-11 06:45 - 2013-06-11 06:45 - 00005074 ____A C:\Users\John\Documents\cc_20130611_064503.reg

==================== One Month Modified Files and Folders =======

2013-07-02 19:25 - 2013-07-02 19:25 - 00000000 ____D C:\FRST
2013-07-02 19:24 - 2013-07-02 19:24 - 01933556 ____A (Farbar) C:\Users\John\Desktop\FRST64.exe
2013-07-02 19:11 - 2009-07-13 22:13 - 00793298 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-02 19:10 - 2009-07-13 21:45 - 00029136 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-02 19:10 - 2009-07-13 21:45 - 00029136 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-02 19:03 - 2013-05-22 01:03 - 00000659 ____A C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2013-07-02 19:03 - 2011-09-16 18:05 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-07-02 19:02 - 2013-06-30 11:43 - 00000448 ____A C:\Windows\setupact.log
2013-07-02 19:02 - 2013-06-30 11:42 - 00001152 ____A C:\Windows\PFRO.log
2013-07-02 19:02 - 2012-11-13 13:59 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-02 19:02 - 2009-07-13 22:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-02 19:01 - 2013-06-23 11:05 - 00000023 ____A C:\Users\John\AppData\Roaming\Network Meter_Usage.ini
2013-07-02 19:01 - 2013-04-24 03:05 - 01309045 ____A C:\Windows\WindowsUpdate.log
2013-07-02 19:00 - 2013-06-22 00:00 - 00005708 ____A C:\Users\John\Network_Meter_Data.js
2013-07-02 18:29 - 2012-08-08 19:02 - 00000904 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1233412941-1350333207-1098498444-1001UA.job
2013-07-02 17:02 - 2013-07-02 17:02 - 00000000 ____D C:\Users\John\AppData\Local\adawarebp
2013-07-02 16:04 - 2013-07-02 16:04 - 00000783 ____A C:\Users\John\Desktop\JRT.txt
2013-07-02 15:53 - 2013-07-02 15:53 - 00000000 ____D C:\Windows\ERUNT
2013-07-02 15:53 - 2013-07-02 15:53 - 00000000 ____D C:\JRT
2013-07-02 15:52 - 2013-07-02 15:52 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\John\Desktop\JRT.exe
2013-07-02 15:47 - 2013-07-02 15:41 - 00002179 ____A C:\Users\John\Desktop\AdwCleaner[s1].txt
2013-07-02 15:40 - 2013-07-02 15:40 - 00002087 ____A C:\AdwCleaner[R2].txt
2013-07-02 14:33 - 2013-07-02 14:33 - 00002029 ____A C:\AdwCleaner[R1].txt
2013-07-02 14:32 - 2013-07-02 14:32 - 00648201 ____A C:\Users\John\Desktop\adwcleaner.exe
2013-07-02 12:57 - 2013-07-02 12:54 - 00000000 ____D C:\Users\John\Desktop\RK_Quarantine
2013-07-02 12:55 - 2013-07-02 12:55 - 00002301 ____A C:\Users\John\Desktop\RKreport[0]_S_07022013_125547.txt
2013-07-02 12:52 - 2013-07-02 12:52 - 03775488 ____A C:\Users\John\Desktop\RogueKillerX64.exe
2013-07-02 12:47 - 2013-07-02 12:47 - 00018075 ____A C:\Users\John\Desktop\dds.txt
2013-07-02 12:47 - 2013-07-02 12:47 - 00009158 ____A C:\Users\John\Desktop\attach.txt
2013-07-02 12:46 - 2013-07-02 12:46 - 00688992 ____R (Swearware) C:\Users\John\Downloads\dds.com
2013-07-02 10:29 - 2012-08-08 19:02 - 00000852 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1233412941-1350333207-1098498444-1001Core.job
2013-07-01 20:03 - 2011-09-16 16:53 - 00000000 ___AD C:\users\John
2013-07-01 12:32 - 2013-07-01 12:32 - 00017920 __ASH C:\Users\John\Documents\Thumbs.db
2013-06-30 11:43 - 2013-06-30 11:43 - 00000000 ____A C:\Windows\setuperr.log
2013-06-30 10:39 - 2013-06-30 10:39 - 00000250 ____A C:\Users\John\Documents\cc_20130630_103908.reg
2013-06-30 10:38 - 2012-11-20 23:24 - 00000000 ____D C:\Windows\Minidump
2013-06-29 18:03 - 2012-04-25 22:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-06-25 05:25 - 2013-06-23 17:25 - 00000000 ____D C:\Users\John\AppData\Roaming\LavasoftStatistics
2013-06-23 17:24 - 2013-05-22 01:09 - 00000000 ____D C:\Users\John\AppData\Roaming\Ad-Aware Antivirus
2013-06-23 17:22 - 2013-06-23 17:22 - 00000000 ____D C:\ProgramData\Ad-Aware Browsing Protection
2013-06-23 17:22 - 2013-06-23 17:22 - 00000000 ____D C:\Program Files (x86)\Toolbar Cleaner
2013-06-23 17:22 - 2011-10-03 12:01 - 00000000 ____D C:\ProgramData\Downloaded Installations
2013-06-23 17:16 - 2013-06-23 17:16 - 00014456 ____A (GFI Software) C:\Windows\System32\Drivers\gfibto.sys
2013-06-23 17:15 - 2013-06-23 17:15 - 05616264 ____A (Lavasoft Limited) C:\Users\John\Downloads\Adaware_Installer.exe
2013-06-23 04:23 - 2013-06-21 23:31 - 00000458 ____A C:\Users\John\AppData\Roaming\Weather Meter_Settings.ini
2013-06-22 04:56 - 2013-06-22 04:57 - 00263592 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-06-22 04:56 - 2013-06-22 04:57 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-06-22 04:56 - 2013-06-22 04:57 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-06-22 04:56 - 2013-06-22 04:57 - 00096168 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-06-22 04:56 - 2012-06-10 00:53 - 00867240 ____A (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-06-22 04:56 - 2012-03-25 19:35 - 00000000 ____D C:\Program Files (x86)\Java
2013-06-22 04:56 - 2011-10-22 03:14 - 00789416 ____A (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-06-21 23:29 - 2013-06-21 23:29 - 00161850 ____A C:\Users\John\Downloads\Drives_Meter.zip
2013-06-21 23:28 - 2013-06-21 23:28 - 00372320 ____A (Addgadgets.com) C:\Users\John\Downloads\GPUMeter.exe
2013-06-21 23:26 - 2013-06-21 23:26 - 00118698 ____A C:\Users\John\Downloads\Weather_Meter.zip
2013-06-21 23:24 - 2013-06-21 23:24 - 00372328 ____A (Addgadgets.com) C:\Users\John\Downloads\NetworkMeter.exe
2013-06-21 23:22 - 2013-06-21 23:22 - 00206064 ____A C:\Users\John\Downloads\All_CPU_Meter.zip
2013-06-21 23:19 - 2013-06-21 23:19 - 00108194 ____A C:\Users\John\Downloads\PCMeter.zip
2013-06-21 23:09 - 2013-06-21 23:09 - 01364543 ____A (Arthur Liberman ) C:\Users\John\Downloads\Core-Temp-setup.exe
2013-06-17 01:01 - 2011-09-16 17:45 - 00000000 ____D C:\Windows\Panther
2013-06-16 21:14 - 2012-04-01 18:17 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-16 21:14 - 2011-09-16 19:54 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-12 22:27 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\rescache
2013-06-12 15:06 - 2011-09-16 17:25 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-11 06:45 - 2013-06-11 06:45 - 00005074 ____A C:\Users\John\Documents\cc_20130611_064503.reg
2013-06-11 06:37 - 2011-10-24 09:56 - 00000000 ____D C:\Program Files\Creative
2013-06-11 06:33 - 2011-10-24 09:56 - 00000000 ___HD C:\Program Files (x86)\Creative Installation Information
2013-06-11 06:31 - 2011-10-24 09:55 - 00000000 ____D C:\ProgramData\Creative
2013-06-10 02:01 - 2012-07-15 01:37 - 00000000 ____D C:\Users\John\AppData\Roaming\Spotify
2013-06-10 01:26 - 2012-07-15 01:38 - 00000000 ____D C:\Users\John\AppData\Local\Spotify
2013-06-08 07:08 - 2013-06-12 15:04 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 07:07 - 2013-06-12 15:04 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 07:06 - 2013-06-12 15:04 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 07:06 - 2013-06-12 15:04 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 07:06 - 2013-06-12 15:04 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 05:28 - 2013-06-12 15:04 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-08 04:42 - 2013-06-12 15:04 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-08 04:40 - 2013-06-12 15:04 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-08 04:40 - 2013-06-12 15:04 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-08 04:40 - 2013-06-12 15:04 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-08 04:40 - 2013-06-12 15:04 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-08 04:13 - 2013-06-12 15:04 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2013-06-23 00:13

==================== End Of Log ============================

FlynHawn · July 3, 2013

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-07-2013
Ran by John at 2013-07-02 19:28:22
Running from C:\Users\John\Desktop
Boot Mode: Normal
==========================================================

==================== Installed Programs =======================

3DMark 11 (x32 Version: 1.0.2)
7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
Ad-Aware Antivirus (x32 Version: 10.5.3.4405)
Ad-Aware Browsing Protection (x32 Version: 1.0.1.106)
Adobe AIR (x32 Version: 3.6.0.5970)
Adobe Flash Player 11 ActiveX (x32 Version: 11.5.502.110)
Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224)
Adobe Reader XI (11.0.03) (x32 Version: 11.0.03)
AMD Catalyst Install Manager (Version: 8.0.873.0)
AMD OverDrive (x32 Version: 4.0.4.0506)
Assassin's Creed (x32 Version: 1.00)
Assassin's Creed II (x32 Version: 1.01)
Belarc Advisor 8.3 (x32 Version: 8.3.2.0)
Canon Camera Access Library (x32 Version: 8.2.0.1)
Canon Camera Window DC_DV 6 for ZoomBrowser EX (x32 Version: 6.3.0.11)
Canon Camera Window MC 6 for ZoomBrowser EX (x32 Version: 6.2.0.11)
Canon G.726 WMP-Decoder (x32 Version: 1.0.1.3)
Canon MovieEdit Task for ZoomBrowser EX (x32 Version: 2.3.0.19)
Canon RAW Image Task for ZoomBrowser EX (x32 Version: 2.4.0.7)
Canon RemoteCapture Task for ZoomBrowser EX (x32 Version: 1.6.0.9)
Canon Utilities EOS Utility (x32 Version: 1.0.4.18)
Canon Utilities ZoomBrowser EX (x32 Version: 5.7.0.74)
CCleaner (Version: 4.01)
Core Temp version 0.99.8 (Version: 0.99.8)
CPUID HWMonitor 1.18
CrystalDiskInfo 5.6.2 (x32 Version: 5.6.2)
CrystalDiskMark 3.0.2f (Version: 3.0.2f)
Curse Client (HKCU Version: 5.1.1.430)
Debugging Tools for Windows (x64) (Version: 6.12.2.633)
Diablo II (x32)
Diablo III (x32 Version: 1.0.8.16603)
Diablo III Public Test (x32 Version: 1.0.5.12480)
Dungeon Lords (x32 Version: 1.50.0)
Dungeon Siege III (x32)
EQ2MAP Updater 1.2.6 (x32 Version: 1.2.6)
eReg (x32 Version: 1.20.138.34)
EverQuest II (HKCU)
FileHippo.com Update Checker (x32)
Fraps (x32)
Futuremark SystemInfo (x32 Version: 4.2.0)
Garmin Communicator Plugin x64 (Version: 4.0.3)
Garmin Lifetime Updater (x32 Version: 2.1.11)
Google Chrome (HKCU Version: 28.0.1500.63)
Heaven Benchmark version 4.0 (x32 Version: 4.0)
Hero Editor V1.03 (x32)
Impulse® (x32 Version: 3.29)
Java 7 Update 21 (64-bit) (Version: 7.0.210)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
Java 6 Update 31 (x32 Version: 6.0.310)
JavaFX 2.1.1 (x32 Version: 2.1.1)
JMicron JMB36X Driver (x32 Version: 1.17.65.11)
Kaspersky PURE (x32 Version: 9.1.0.124)
Logitech SetPoint 6.32 (Version: 6.32.20)
Malwarebytes Anti-Malware version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322)
Microsoft .NET Framework 1.1 (x32)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (x32 Version: 9.0.30411)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Mozilla Firefox 22.0 (x86 en-US) (x32 Version: 22.0)
Mozilla Maintenance Service (x32 Version: 22.0)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
NETGEAR Powerline Utility (x32 Version: 2.0.0.8)
NVIDIA 3D Vision Controller Driver 314.07 (Version: 314.07)
NVIDIA 3D Vision Driver 310.90 (Version: 310.90)
NVIDIA Control Panel 310.90 (Version: 310.90)
NVIDIA CUDA Toolkit v5.0 (64 bit) (Version: 5.0.35.1)
NVIDIA GeForce Experience 1.0.1 (BETA) (Version: 1.0.1 (BETA))
NVIDIA Graphics Driver 310.90 (Version: 310.90)
NVIDIA HD Audio Driver 1.3.23.1 (Version: 1.3.23.1)
NVIDIA Install Application (Version: 2.1002.109.706)
NVIDIA PhysX (x32 Version: 9.12.1031)
NVIDIA PhysX System Software 9.12.1031 (Version: 9.12.1031)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1090)
NVIDIA Update 1.11.3 (Version: 1.11.3)
NVIDIA Update Components (Version: 1.11.3)
Oblivion (x32 Version: 1.00.0000)
OCZ SMART mon (x32 Version: 1.0.5)
OpenOffice.org 3.4.1 (x32 Version: 3.41.9593)
Path of Exile (x32 Version: 0.9.11.18500)
PC Wizard 2010.1.96 (x32)
PC Wizard 2012.2.11 (x32)
PCMark 7 (x32 Version: 1.0.4)
Realtek Ethernet Controller Driver (x32 Version: 7.56.316.2012)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6662)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.32.0)
SAMSUNG USB Driver for Mobile Phones (Version: 1.3.550.0)
Sid Meier's Civilization 4 (x32 Version: 1.74)
Sid Meier's Civilization V (x32)
SiSoftware Sandra Lite 2013.SP3 (Version: 19.40.2013.5)
SlimDrivers (x32 Version: 2.2.29035)
SpeedFan (remove only) (x32)
Spotify (HKCU Version: 0.9.0.133.gd18ed589)
Steam (x32 Version: 1.0.0.0)
System Requirements Lab (x32 Version: 4.5.1.0)
TechPowerUp GPU-Z (x32)
The Elder Scrolls V: Skyrim (x32)
The Lord of the Rings Online™ (x32)
The Lord of the Rings Online™ v03.08.00.8029 (x32 Version: 03.08.00.8029)
The Witcher 2 (x32 Version: 1.00.0000)
The Witcher Enhanced Edition (x32 Version: 1.00.0000)
ThreatFire (x32)
Torchlight 2 (x32 Version: 1.1.1.1)
Total War: SHOGUN 2 (x32)
Ubisoft Game Launcher (x32 Version: 1.0.0.0)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Ventrilo Client for Windows x64 (Version: 3.0.8.0)
Visual Studio 2008 x64 Redistributables (x32 Version: 10.0.0.2)
WinRAR 4.20 (64-bit) (Version: 4.20.0)

==================== Restore Points =========================

12-06-2013 22:03:03 Windows Update
16-06-2013 03:38:09 Installed Debugging Tools for Windows (x64)
16-06-2013 08:20:41 Removed Debugging Tools for Windows (x86)
22-06-2013 11:55:41 Installed Java 7 Update 25
30-06-2013 01:58:38 Scheduled Checkpoint

==================== Scheduled Tasks (whitelisted) =============

Task: {28EE2E20-E1DF-48DC-899E-9A1962705FA6} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-11-20] (Microsoft Corporation)
Task: {5A0BAEF2-A811-40EE-8F52-C7145D2FFCA8} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-04-23] (Piriform Ltd)
Task: {68187A5B-AFDF-4B6D-A1F7-16C4D487E872} - System32\Tasks\PC Meter\Startup => C:\Users\John\Downloads\PCMeter\PCMeter\PCMeter.exe No File
Task: {7917769E-B469-4E98-B70A-D31F1596C7AE} - System32\Tasks\PCMeter\Startup => C:\PC Meter\PCMeter\PCMeterV0.3.exe No File
Task: {B6DD5481-A838-4A57-9CBE-3E9284717416} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1233412941-1350333207-1098498444-1001UA => C:\Users\John\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-08] (Google Inc.)
Task: {B89F8F4B-E1A3-4EC2-9A37-1F11C66B05F9} - System32\Tasks\Ad-Aware Antivirus Scheduled Scan => C:\AD-AWA~1\AdAwareLauncher.exe No File
Task: {BCBDA2D0-08F6-4E43-9497-53D089B784BA} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1233412941-1350333207-1098498444-1001Core => C:\Users\John\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-08] (Google Inc.)
Task: {CB204954-3D05-4540-8A4F-B9E8732CDC15} - System32\Tasks\Core Temp Autostart => C:\Core Temp\Core Temp.exe No File
Task: {DAA20937-3F28-4EBF-BE7A-EA004F93DB7D} - System32\Tasks\{CBD05C2B-0ABA-4DF9-BA8E-32CA4B68C287} => C:\Diablo II\Diablo II.exe No File
Task: {EFC2D139-CAEA-496A-9305-74A480E3B626} - System32\Tasks\{FA1E49C3-A8EE-4B79-8706-430CD4624EBF} => C:\Diablo II\Diablo II.exe No File
Task: {F1D997F9-2BD7-4FB6-B5BC-C0024E9CE00E} - System32\Tasks\Core Temp Autostart John => C:\Core Temp\Core Temp.exe No File
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1233412941-1350333207-1098498444-1001Core.job => C:\Users\John\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1233412941-1350333207-1098498444-1001UA.job => C:\Users\John\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Faulty Device Manager Devices =============

Name: SB X-Fi Xtreme Audio
Description: SB X-Fi Xtreme Audio
Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}
Manufacturer: Creative Technology Ltd.
Service: P17
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (07/02/2013 07:05:04 PM) (Source: Service Control Manager) (User: )
Description: The NVIDIA Update Service Daemon service failed to start due to the following error:
%%1069

Error: (07/02/2013 07:05:04 PM) (Source: Service Control Manager) (User: )
Description: The nvUpdatusService service was unable to log on as .\UpdatusUser with the currently configured password due to the following error:
%%1330

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

Error: (07/02/2013 07:05:05 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80070422

Error: (07/02/2013 07:03:28 PM) (Source: Service Control Manager) (User: )
Description: The WinRing0_1_2_0 service failed to start due to the following error:
%%2

Error: (07/02/2013 07:03:24 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80070422

Error: (07/02/2013 05:03:50 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80070422

Error: (07/02/2013 05:03:50 PM) (Source: Service Control Manager) (User: )
Description: The NVIDIA Update Service Daemon service failed to start due to the following error:
%%1069

Error: (07/02/2013 05:03:50 PM) (Source: Service Control Manager) (User: )
Description: The nvUpdatusService service was unable to log on as .\UpdatusUser with the currently configured password due to the following error:
%%1330

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

Error: (07/02/2013 05:02:46 PM) (Source: Service Control Manager) (User: )
Description: The WinRing0_1_2_0 service failed to start due to the following error:
%%2

Error: (07/02/2013 05:02:29 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80070422

Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Percentage of memory in use: 28%
Total physical RAM: 8191.18 MB
Available physical RAM: 5897.28 MB
Total Pagefile: 16380.54 MB
Available Pagefile: 14030.82 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:93.06 GB) (Free:14.7 GB) NTFS (Disk=0 Partition=2)
Drive e: (Data) (Fixed) (Total:931.39 GB) (Free:775.8 GB) NTFS (Disk=1 Partition=2)

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 93 GB) (Disk ID: 59C529A4)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=93 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 00000000)

Partition: GPT Partition Type
==================== End Of Log ============================

FlynHawn · July 3, 2013

Apparently you can't edit posts here, thus I would have deleted the last post and attached it to this one as you had requested. My bad, I did not see it until after I posted.

FlynHawn · July 3, 2013

I hope you're researching the problem or otherwise occupied because thus far all I've been able to accomplish is a failure to load some valid nVidia and Windows services and one for desktop gadgets which prior to my inquiry had nothing to do with my current BSODs problem. I really have no idea if they're related to thebflix or not, however I've done a little research on my own and found that Bflix makes a desktop gadget which is reportedly filled with viruses. I know I have not installed this particular gadget - the ones I have came from addgadgets.com and have to do with processor and videocard usage and temps, drive usage, etc. I also added a weather widget, but from the same site.

Systemexplorer.net has determined the gadget files I already have are safe. Interestingly, systemexplorer.net reports that bflix.dll is a threat; but bflix.exe is safe with the caveat that it's installed in the \appdata\thebflix directory. If in any other directory it's a threat. Apparently, the .dll adds ads to your Facebook page (so I know I don't have that file) while the .exe is the main executable for an open source download manager called WxDFast or wxDownload Fast and I don't have that program either. It's also used for an app called TheBflix which was advertised as a browser add-on specifically for Facebook.

I know for sure that I do not have any add-ons or extensions to Firefox - which is my main browser - called TheBflix; but I'll check Chrome and IE too. Is it possible that some files were left over within a browser after having installed, then uninstalled an add-on? If so, how can I get rid of those?

MrCharlie · July 4, 2013

Here's what I want you to do instead of running MB, run FRST to delete that folder:

Download the attached fixlist.txt to the same folder as FRST.
Run FRST and click Fix only once and wait
The tool will create a log (Fixlog.txt) please post it to your reply.
Look at the Fixlog.txt and see if it moved the files/folder or they weren't found.

You can try it several times, this will determine if the files/folder is actually there.

MrC

FlynHawn · July 4, 2013

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-07-2013
Ran by John at 2013-07-03 18:23:09 Run:1
Running from E:\FRST64
Boot Mode: Normal
==============================================

c:\programdata\thebflix => File/Directory not found.
c:\programdata\thebflix\background.html => File/Directory not found.

==== End of Fixlog ====

PUP.Bflix

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information