Mixi.DJ wont go away

telly77 · July 7, 2013

Hello I have an infection on my computer that came from a website I was browsing. The Mixi.DJ toolbar, along with TopArcadeHits and FoodBuzz. I removed TopArcadehits and FoodFuzz, but when I removed Mixi.DJ, it keeps coming back by changing my homepage and search provider to delta search. I tried removing the search engine and homepage, but it just reappears by itself. I dont know whats causing it and I would like it removed. Any Help?

AdvancedSetup · July 7, 2013

Hello and :weclome:

Please run the following and post back the logs. Its a bit late for me so I'll check back on you sometime tomorrow if I can.

STEP 01

Backup the Registry:

Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.

Please download ERUNT from one of the following links: Link1 | Link2 | Link3
ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.
Double click on erunt-setup.exe to Install ERUNT by following the prompts.
Start ERUNT either by double clicking on the desktop icon or choosing to start the program at the end of the setup process.
Choose a location for the backup.
- Note: the default location is C:\Windows\ERDNT which is acceptable.
Make sure that at least the first two check boxes are selected.
Click on OK
Then click on YES to create the folder.
Note: if it is necessary to restore the registry, open the backup folder and start ERDNT.exe
STEP 02
Please download Malwarebytes Anti-Rootkit from HERE
- Unzip the contents to a folder in a convenient location.
- Open the folder where the contents were unzipped and run mbar.exe
- Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
- Click on the Cleanup button to remove any threats and reboot if prompted to do so.
- Wait while the system shuts down and the cleanup process is performed.
- Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
- When done, please post the two logs produced they will be in the MBAR folder... mbar-log.txt and system-log.txt
STEP 03
Please download Junkware Removal Tool to your desktop.
- Shutdown your antivirus to avoid any conflicts.
- Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
- The tool will open and start scanning your system.
- Please be patient as this can take a while to complete.
- On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
- Post the contents of JRT.txt into your next reply message
- When completed make sure to re-enable your antivirus
STEP 04
Please download AdwCleaner by Xplode to your desktop.
- Close all open programs and internet browsers.
- Double click on AdwCleaner.exe to run the tool.
- If prompted by the User Account Control click Yes to allow it to run.
- Under Actions click on the Delete button.
- Click OK on all prompts.
- You will be prompted to restart your computer. A text file will open after the restart.
- Please post the entire contents of that logfile to your next reply.
- You can find the logfile at C:\AdwCleaner[s1].txt where the number in brackets indicates how often it was run.
STEP 05

Please go here to run the online antivirus scannner from ESET.
- Turn off the real time scanner of any existing antivirus program while performing the online scan
- Tick the box next to YES, I accept the Terms of Use.
- Click Start
- When asked, allow the activex control to install
- Click Start
- Make sure that the option Remove found threats is unticked
- Click on Advanced Settings and ensure these options are ticked:
  - Scan for potentially unwanted applications
  - Scan for potentially unsafe applications
  - Enable Anti-Stealth Technology
- Click Scan
- Wait for the scan to finish
- If any threats were found, click the 'List of found threats' , then click Export to text file....
- Save it to your desktop, then please copy and paste that log as a reply to this topic.
Thanks

telly77 · July 7, 2013

I have done all the steps and this is the log:

Mbar-log:

Malwarebytes Anti-Rootkit BETA 1.06.0.1004

www.malwarebytes.org

Database version: v2013.07.07.05

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 10.0.9200.16618

GAMING :: GAMING-PC [administrator]

7/7/2013 10:02:25 AM

mbar-log-2013-07-07 (10-02-25).txt

Scan type: Quick scan

Scan options disabled: PUP

Objects scanned: 293415

Time elapsed: 7 minute(s), 12 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

Physical Sectors Detected: 0

(No malicious items detected)

(end)

system-log:

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.06.0.1004

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 10.0.9200.16618

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED

CPU speed: 3.392000 GHz

Memory total: 6423187456, free: 2488893440

Downloaded database version: v2013.07.07.05

Initializing...

------------ Kernel report ------------

07/07/2013 10:02:22

------------ Loaded modules -----------

\SystemRoot\system32\ntoskrnl.exe

\SystemRoot\system32\hal.dll

\SystemRoot\system32\kdcom.dll

\SystemRoot\system32\mcupdate_GenuineIntel.dll

\SystemRoot\system32\PSHED.dll

\SystemRoot\system32\CLFS.SYS

\SystemRoot\system32\CI.dll

\SystemRoot\system32\drivers\Wdf01000.sys

\SystemRoot\system32\drivers\WDFLDR.SYS

\SystemRoot\system32\drivers\ACPI.sys

\SystemRoot\system32\drivers\WMILIB.SYS

\SystemRoot\system32\drivers\msisadrv.sys

\SystemRoot\system32\drivers\pci.sys

\SystemRoot\system32\drivers\vdrvroot.sys

\SystemRoot\System32\drivers\partmgr.sys

\SystemRoot\system32\drivers\volmgr.sys

\SystemRoot\System32\drivers\volmgrx.sys

\SystemRoot\system32\drivers\pciide.sys

\SystemRoot\system32\drivers\PCIIDEX.SYS

\SystemRoot\system32\DRIVERS\jraid.sys

\SystemRoot\system32\DRIVERS\SCSIPORT.SYS

\SystemRoot\System32\drivers\mountmgr.sys

\SystemRoot\system32\drivers\atapi.sys

\SystemRoot\system32\drivers\ataport.SYS

\SystemRoot\system32\drivers\msahci.sys

\SystemRoot\system32\drivers\amdxata.sys

\SystemRoot\system32\drivers\fltmgr.sys

\SystemRoot\system32\drivers\fileinfo.sys

\SystemRoot\System32\Drivers\Ntfs.sys

\SystemRoot\System32\Drivers\msrpc.sys

\SystemRoot\System32\Drivers\ksecdd.sys

\SystemRoot\System32\Drivers\cng.sys

\SystemRoot\System32\drivers\pcw.sys

\SystemRoot\System32\Drivers\Fs_Rec.sys

\SystemRoot\system32\drivers\ndis.sys

\SystemRoot\system32\drivers\NETIO.SYS

\SystemRoot\System32\Drivers\ksecpkg.sys

\SystemRoot\System32\drivers\tcpip.sys

\SystemRoot\System32\drivers\fwpkclnt.sys

\SystemRoot\system32\drivers\volsnap.sys

\SystemRoot\System32\Drivers\spldr.sys

\SystemRoot\System32\drivers\sfvfs02.sys

\SystemRoot\System32\drivers\sfhlp02.sys

\SystemRoot\System32\drivers\sfdrv01.sys

\SystemRoot\System32\drivers\rdyboost.sys

\SystemRoot\System32\Drivers\mup.sys

\SystemRoot\System32\drivers\hwpolicy.sys

\SystemRoot\System32\DRIVERS\fvevol.sys

\SystemRoot\system32\drivers\disk.sys

\SystemRoot\system32\drivers\CLASSPNP.SYS

\SystemRoot\system32\DRIVERS\avgrkx64.sys

\SystemRoot\system32\DRIVERS\avgloga.sys

\SystemRoot\system32\DRIVERS\avgmfx64.sys

\SystemRoot\system32\DRIVERS\avgidsha.sys

\SystemRoot\system32\DRIVERS\cdrom.sys

\SystemRoot\System32\Drivers\Null.SYS

\SystemRoot\System32\Drivers\Beep.SYS

\SystemRoot\System32\Drivers\aswKbd.SYS

\SystemRoot\System32\drivers\vga.sys

\SystemRoot\System32\drivers\VIDEOPRT.SYS

\SystemRoot\System32\drivers\watchdog.sys

\SystemRoot\System32\DRIVERS\RDPCDD.sys

\SystemRoot\system32\drivers\rdpencdd.sys

\SystemRoot\system32\drivers\rdprefmp.sys

\SystemRoot\System32\Drivers\Msfs.SYS

\SystemRoot\System32\Drivers\Npfs.SYS

\SystemRoot\system32\DRIVERS\tdx.sys

\SystemRoot\system32\DRIVERS\TDI.SYS

\SystemRoot\system32\DRIVERS\avgtdia.sys

\SystemRoot\System32\DRIVERS\netbt.sys

\SystemRoot\system32\drivers\afd.sys

\SystemRoot\system32\DRIVERS\wfplwf.sys

\SystemRoot\system32\DRIVERS\pacer.sys

\SystemRoot\system32\DRIVERS\netbios.sys

\SystemRoot\system32\DRIVERS\wanarp.sys

\SystemRoot\system32\DRIVERS\VBoxUSBMon.sys

\SystemRoot\system32\DRIVERS\VBoxDrv.sys

\SystemRoot\system32\DRIVERS\termdd.sys

\SystemRoot\System32\Drivers\SCDEmu.SYS

\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS

\??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS

\SystemRoot\system32\DRIVERS\rdbss.sys

\SystemRoot\system32\drivers\nsiproxy.sys

\SystemRoot\system32\DRIVERS\mssmbios.sys

\SystemRoot\System32\drivers\discache.sys

\SystemRoot\System32\Drivers\dfsc.sys

\SystemRoot\system32\DRIVERS\blbdrive.sys

\SystemRoot\system32\DRIVERS\avgldx64.sys

\SystemRoot\system32\DRIVERS\avgidsdrivera.sys

\SystemRoot\system32\DRIVERS\tunnel.sys

\SystemRoot\system32\DRIVERS\nvlddmkm.sys

\SystemRoot\System32\drivers\dxgkrnl.sys

\SystemRoot\System32\drivers\dxgmms1.sys

\SystemRoot\system32\DRIVERS\HDAudBus.sys

\SystemRoot\system32\DRIVERS\HECIx64.sys

\SystemRoot\system32\DRIVERS\usbehci.sys

\SystemRoot\system32\DRIVERS\USBPORT.SYS

\SystemRoot\system32\DRIVERS\nusb3xhc.sys

\SystemRoot\system32\DRIVERS\USBD.SYS

\SystemRoot\system32\DRIVERS\Rt64win7.sys

\SystemRoot\system32\DRIVERS\1394ohci.sys

\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys

\SystemRoot\system32\DRIVERS\Smb_driver_Intel.sys

\SystemRoot\system32\DRIVERS\wmiacpi.sys

\SystemRoot\system32\DRIVERS\intelppm.sys

\SystemRoot\system32\DRIVERS\CompositeBus.sys

\SystemRoot\system32\DRIVERS\AgileVpn.sys

\SystemRoot\system32\DRIVERS\rasl2tp.sys

\SystemRoot\system32\DRIVERS\ndistapi.sys

\SystemRoot\system32\DRIVERS\ndiswan.sys

\SystemRoot\system32\DRIVERS\raspppoe.sys

\SystemRoot\system32\DRIVERS\raspptp.sys

\SystemRoot\system32\DRIVERS\rassstp.sys

\SystemRoot\system32\DRIVERS\hamachi.sys

\SystemRoot\system32\DRIVERS\kbdclass.sys

\SystemRoot\system32\DRIVERS\mouclass.sys

\SystemRoot\system32\DRIVERS\VBoxNetFlt.sys

\SystemRoot\system32\DRIVERS\swenum.sys

\SystemRoot\system32\DRIVERS\ks.sys

\SystemRoot\system32\DRIVERS\nvoclk64.sys

\SystemRoot\system32\DRIVERS\umbus.sys

\SystemRoot\system32\DRIVERS\usbhub.sys

\SystemRoot\System32\Drivers\NDProxy.SYS

\SystemRoot\system32\drivers\nvhda64v.sys

\SystemRoot\system32\drivers\portcls.sys

\SystemRoot\system32\drivers\drmk.sys

\SystemRoot\system32\drivers\ksthunk.sys

\SystemRoot\system32\drivers\RTKVHD64.sys

\SystemRoot\system32\DRIVERS\nusb3hub.sys

\SystemRoot\System32\Drivers\crashdmp.sys

\SystemRoot\System32\Drivers\dump_dumpata.sys

\SystemRoot\System32\Drivers\dump_msahci.sys

\SystemRoot\System32\Drivers\dump_dumpfve.sys

\SystemRoot\System32\win32k.sys

\SystemRoot\System32\drivers\Dxapi.sys

\SystemRoot\system32\DRIVERS\usbccgp.sys

\SystemRoot\system32\DRIVERS\hidusb.sys

\SystemRoot\system32\DRIVERS\HIDCLASS.SYS

\SystemRoot\system32\DRIVERS\HIDPARSE.SYS

\SystemRoot\system32\DRIVERS\kbdhid.sys

\SystemRoot\system32\DRIVERS\pmkbdfltr.sys

\SystemRoot\system32\DRIVERS\monitor.sys

\SystemRoot\system32\DRIVERS\MijXfilt.sys

\SystemRoot\system32\DRIVERS\xusb21.sys

\SystemRoot\system32\DRIVERS\mouhid.sys

\SystemRoot\System32\TSDDD.dll

\SystemRoot\System32\cdd.dll

\SystemRoot\System32\ATMFD.DLL

\SystemRoot\system32\drivers\luafv.sys

\??\C:\Windows\system32\drivers\mbam.sys

\??\C:\Program Files\Sandboxie\SbieDrv.sys

\SystemRoot\system32\DRIVERS\lltdio.sys

\SystemRoot\system32\DRIVERS\rspndr.sys

\SystemRoot\system32\drivers\HTTP.sys

\SystemRoot\system32\DRIVERS\bowser.sys

\SystemRoot\System32\drivers\mpsdrv.sys

\SystemRoot\system32\DRIVERS\mrxsmb.sys

\SystemRoot\system32\DRIVERS\mrxsmb10.sys

\SystemRoot\system32\DRIVERS\mrxsmb20.sys

\??\C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys

\SystemRoot\system32\drivers\peauth.sys

\SystemRoot\System32\Drivers\secdrv.SYS

\SystemRoot\System32\DRIVERS\srvnet.sys

\SystemRoot\System32\drivers\tcpipreg.sys

\SystemRoot\System32\DRIVERS\srv2.sys

\SystemRoot\System32\DRIVERS\srv.sys

\SystemRoot\System32\Drivers\fastfat.SYS

\SystemRoot\system32\DRIVERS\asyncmac.sys

\SystemRoot\System32\Drivers\usbaapl64.sys

\SystemRoot\system32\drivers\WudfPf.sys

\SystemRoot\system32\DRIVERS\WinUsb.sys

\SystemRoot\system32\DRIVERS\WUDFRd.sys

\??\C:\Windows\system32\drivers\mbamchameleon.sys

\??\C:\Windows\system32\drivers\mbamswissarmy.sys

\Windows\System32\ntdll.dll

\Windows\System32\smss.exe

\Windows\System32\apisetschema.dll

----------- End -----------

Done!

<<<1>>>

Upper Device Name: \Device\Harddisk0\DR0

Upper Device Object: 0xfffffa800651f790

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\

Lower Device Object: 0xfffffa80061a44e0

Lower Device Driver Name: \Driver\atapi\

<<<2>>>

Device number: 0, partition: 3

Physical Sector Size: 512

Drive: 0, DevicePointer: 0xfffffa800651f790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa800643b9d0, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa800651f790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa80061a6520, DeviceName: Unknown, DriverName: \Driver\ACPI\

DevicePointer: 0xfffffa80061a44e0, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\

------------ End ----------

Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

Upper DeviceData: 0x0, 0x0, 0x0

Lower DeviceData: 0x0, 0x0, 0x0

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

<<<2>>>

Device number: 0, partition: 3

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Scanning drivers directory: C:\Windows\system32\drivers...

<<<2>>>

Device number: 0, partition: 3

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Done!

Drive 0

Scanning MBR on drive 0...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: CB59CF06

Partition information:

Partition 0 type is Other (0xde)

Partition is NOT ACTIVE.

Partition starts at LBA: 63 Numsec = 80262

Partition 1 type is Primary (0x7)

Partition is ACTIVE.

Partition starts at LBA: 81920 Numsec = 17854464

Partition file system is NTFS

Partition is bootable

Partition 2 type is Primary (0x7)

Partition is NOT ACTIVE.

Partition starts at LBA: 17936384 Numsec = 1933535232

Partition 3 type is Extended with LBA (0xf)

Partition is NOT ACTIVE.

Partition starts at LBA: 1951473664 Numsec = 2048000

Disk Size: 1000204886016 bytes

Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-1953505168-1953525168)...

Done!

Read File: File "c:\programdata\avg2013\chjw\24de53e5de53ae34.dat:6bb86307-1f30-4a10-97a0-2103f81a0922" is sparse (flags = 32768)

Scan finished

=======================================

Removal queue found; removal started

Removing c:\programdata\malwarebytes' anti-malware (portable)\mbr_0_i.mbam...

Removing c:\programdata\malwarebytes' anti-malware (portable)\bootstrap_0_1_81920_i.mbam...

Removing c:\programdata\malwarebytes' anti-malware (portable)\mbr_0_r.mbam...

Removal finished

JRT.txt:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 4.9.4 (05.06.2013:1)

OS: Windows 7 Home Premium x64

Ran by Gaming on Sun 07/07/2013 at 10:21:11.96

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\conduit

Failed to delete: [Registry Key] HKEY_CURRENT_USER\Software\datamngr

Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\datamngr

Failed to delete: [Registry Key] HKEY_CURRENT_USER\Software\datamngr_toolbar

Failed to delete: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\windows\currentversion\ext\bprotectsettings

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\prod.cap

Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\datamngr

~~~ Files

Successfully deleted: [File] "C:\end"

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\babylon"

Successfully deleted: [Folder] "C:\Users\Game\AppData\Roaming\babylon"

Successfully deleted: [Folder] "C:\Users\Game\appdata\locallow\boost_interprocess"

Successfully deleted: [Folder] "C:\Users\Game\appdata\locallow\mixidj"

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Sun 07/07/2013 at 10:29:00.39

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

AdwCleaner:

# AdwCleaner v2.304 - Logfile created 07/07/2013 at 10:34:27

# Updated 03/07/2013 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Gaming - GAMING-PC

# Boot Mode : Normal

# Running from : C:\Users\Gaming\Downloads\AdwCleaner.exe

# Option [Delete]

***** [services] *****

Stopped & Deleted : BrowserDefendert

***** [Files / Folders] *****

Deleted on reboot : C:\ProgramData\BrowserDefender

File Deleted : C:\Users\Gaming\AppData\Local\Google\Chrome\User Data\Default\bProtector Web Data

File Deleted : C:\Users\Gaming\AppData\Local\Google\Chrome\User Data\Default\bprotectorpreferences

Folder Deleted : C:\Users\Gaming\AppData\Local\PackageAware

Folder Deleted : C:\Users\Gaming\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserDefender

***** [Registry] *****

Key Deleted : HKCU\Software\BabSolution

Key Deleted : HKCU\Software\DataMngr

Key Deleted : HKCU\Software\DataMngr_Toolbar

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Deleted : HKCU\Software\f53dbdae569ef45

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Key Deleted : HKLM\Software\DataMngr

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\f53dbdae569ef45

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Deleted : HKU\S-1-5-21-1031777678-2113526702-1104386463-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

***** [internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16611

[OK] Registry is clean.

-\\ Google Chrome v27.0.1453.116

File : C:\Users\Gaming\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[s1].txt - [2472 octets] - [07/07/2013 10:34:27]

########## EOF - C:\AdwCleaner[s1].txt - [2532 octets] ##########

ESET:

C:\Program Files (x86)\AlienRespawn\hstart.exe a variant of Win32/HiddenStart.A application

C:\Program Files (x86)\AlienRespawn\Components\DSUpdate\hstart.exe a variant of Win32/HiddenStart.A application

C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.dll a variant of Win32/bProtector.A application

C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe a variant of Win32/bProtector.A application

C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\uninstall.exe a variant of Win32/bProtector.A application

C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\bprotector.js Win32/bProtector.F application

C:\Users\All Users\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.dll a variant of Win32/bProtector.A application

C:\Users\All Users\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe a variant of Win32/bProtector.A application

C:\Users\All Users\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\uninstall.exe a variant of Win32/bProtector.A application

C:\Users\All Users\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\bprotector.js Win32/bProtector.F application

telly77 · July 8, 2013

Any Help?

AdvancedSetup · July 8, 2013

Please visit this webpage for instructions on downloading and running ComboFix: How to use ComboFix

Please make sure you disable your security applications before running ComboFix.

Once Combofix has completed it will produce and open a log file. Please attach that log file to your next reply.
If needed the file can be located here: C:\combofix.txt

NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.

telly77 · July 8, 2013

ComboFix 13-07-08.03 - Gaming 07/08/2013 9:40.1.8 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6126.2411 [GMT -7:00]

Running from: c:\users\Gaming\Downloads\ComboFix.exe

AV: AVG Internet Security 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

SP: AVG Internet Security 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Gaming\AppData\Local\Microsoft\Windows\Temporary Internet Files\{8FFC27B7-370F-4289-AE3C-3DF899AEB103}.xps

c:\users\Gaming\AppData\Local\Temp\D368.tmp

c:\users\Gaming\VCLimitAdjuster.exe

c:\windows\SysWow64\frapsvid.dll

.

((((((((((((((((((((((((( Files Created from 2013-06-08 to 2013-07-08 )))))))))))))))))))))))))))))))

.

2013-07-08 16:46 . 2013-07-08 16:46 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-07-08 16:46 . 2013-07-08 16:46 -------- d-----w- c:\users\Guest\AppData\Local\temp

2013-07-08 16:30 . 2013-07-08 16:30 -------- d-----w- c:\users\Default\AppData\Roaming\TuneUp Software

2013-07-07 17:49 . 2013-07-07 17:49 -------- d-----w- c:\program files (x86)\ESET

2013-07-07 17:35 . 2013-07-07 17:35 98 ----a-w- c:\windows\DeleteOnReboot.bat

2013-07-07 17:21 . 2013-07-07 17:21 -------- d-----w- c:\windows\ERUNT

2013-07-07 17:20 . 2013-07-07 17:20 -------- d-----w- C:\JRT

2013-07-07 17:02 . 2013-07-07 17:10 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)

2013-07-07 16:57 . 2013-07-07 16:57 -------- d-----w- c:\program files (x86)\ERUNT

2013-07-07 01:16 . 2013-07-07 01:16 -------- d-----w- c:\users\Gaming\AppData\Roaming\AVG2013

2013-07-07 01:16 . 2013-07-07 01:16 -------- d-----w- c:\users\Gaming\AppData\Roaming\TuneUp Software

2013-07-07 01:16 . 2013-07-07 01:16 -------- d-----w- c:\programdata\AVG2013

2013-07-07 01:16 . 2013-07-07 01:16 -------- d-----w- C:\$AVG

2013-07-07 01:16 . 2013-07-07 01:16 -------- d-----w- c:\program files (x86)\AVG

2013-07-07 01:03 . 2013-07-08 16:30 -------- d-----w- c:\programdata\MFAData

2013-07-07 01:03 . 2013-07-07 01:19 -------- d-----w- c:\users\Gaming\AppData\Local\Avg2013

2013-07-07 01:03 . 2013-07-07 01:03 -------- d-----w- c:\users\Gaming\AppData\Local\MFAData

2013-07-07 00:57 . 2013-07-07 00:57 -------- d-s---w- c:\windows\SysWow64\Microsoft

2013-07-06 22:08 . 2013-07-06 22:08 -------- d-----w- c:\windows\SysWow64\searchplugins

2013-07-06 22:08 . 2013-07-06 22:08 -------- d-----w- c:\windows\SysWow64\Extensions

2013-07-06 22:08 . 2013-07-06 22:08 -------- d-----w- c:\programdata\BrowserDefender

2013-07-06 21:56 . 2013-07-06 22:12 -------- d-----w- c:\program files (x86)\PFConfig

2013-07-06 21:32 . 2013-07-08 16:47 -------- d-----w- c:\users\Gaming\AppData\Local\LogMeIn Hamachi

2013-07-06 21:31 . 2013-07-06 21:31 -------- d-----w- c:\program files (x86)\LogMeIn Hamachi

2013-07-06 20:05 . 2013-07-06 20:05 -------- d-----w- c:\users\Gaming\torrents

2013-07-06 06:39 . 2013-07-06 07:04 -------- d-----w- c:\program files (x86)\Auto Window Manager

2013-07-06 06:23 . 2013-07-06 06:25 -------- d-----w- c:\users\Gaming\AppData\Roaming\Bloody Trapland Demo

2013-07-06 06:22 . 2013-07-06 06:22 -------- d-----w- c:\program files (x86)\Bloody trapland Demo

2013-07-05 12:45 . 2013-06-12 03:08 9552976 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C68E0F51-387B-45A6-84A7-543EABAC3C3C}\mpengine.dll

2013-07-04 22:00 . 2013-07-04 22:00 -------- d-----w- c:\users\Gaming\AppData\Roaming\NVIDIA

2013-07-04 22:00 . 2013-07-04 22:00 -------- d-----w- c:\users\Gaming\AppData\Roaming\Activision

2013-07-03 05:09 . 2013-07-07 17:37 -------- d-----w- c:\users\Gaming\AppData\Local\TSVNCache

2013-07-03 05:06 . 2013-07-03 05:06 -------- d-----w- c:\users\Gaming\AppData\Roaming\TortoiseSVN

2013-07-03 05:05 . 2013-07-03 05:05 -------- d-----w- c:\users\Gaming\AppData\Roaming\Subversion

2013-07-03 05:04 . 2013-07-03 05:04 -------- d-----w- c:\program files (x86)\Common Files\TortoiseOverlays

2013-07-03 05:03 . 2013-07-03 05:04 -------- d-----w- c:\program files\Common Files\TortoiseOverlays

2013-07-03 05:03 . 2013-07-03 05:04 -------- d-----w- c:\program files\TortoiseSVN

2013-07-02 03:49 . 2013-07-02 03:49 -------- d-----w- c:\program files (x86)\AGEIA Technologies

2013-07-02 03:49 . 2013-07-02 03:49 -------- d-----w- c:\users\UpdatusUser

2013-07-02 03:49 . 2013-06-21 10:23 3514656 ----a-w- c:\windows\system32\nvsvc64.dll

2013-07-02 03:49 . 2013-06-21 10:23 884512 ----a-w- c:\windows\system32\nvvsvc.exe

2013-07-02 03:49 . 2013-06-21 10:23 63776 ----a-w- c:\windows\system32\nvshext.dll

2013-07-02 03:49 . 2013-06-20 04:17 3253909 ----a-w- c:\windows\system32\nvcoproc.bin

2013-07-02 03:49 . 2013-06-21 10:23 6496544 ----a-w- c:\windows\system32\nvcpl.dll

2013-07-02 03:49 . 2013-06-21 10:23 237856 ----a-w- c:\windows\system32\nvmctray.dll

2013-07-02 03:48 . 2013-06-21 12:06 61216 ----a-w- c:\windows\system32\OpenCL.dll

2013-07-02 03:48 . 2013-06-21 12:06 53024 ----a-w- c:\windows\SysWow64\OpenCL.dll

2013-07-02 03:48 . 2013-07-02 03:54 -------- d-----w- c:\programdata\NVIDIA Corporation

2013-06-30 01:52 . 2013-06-30 01:52 -------- d-----w- c:\program files\CPUID

2013-06-28 06:10 . 2013-06-28 06:10 -------- d-----w- c:\program files (x86)\Common Files\Enterbrain

2013-06-27 01:59 . 2013-06-27 01:59 -------- d-----w- c:\users\Gaming\AppData\Roaming\MotioninJoy

2013-06-27 01:59 . 2011-12-08 02:42 328712 ----a-w- c:\windows\system32\MijFrc.dll

2013-06-27 01:59 . 2013-06-27 01:59 -------- d-----w- c:\program files\MotioninJoy

2013-06-24 05:37 . 2013-06-24 05:37 -------- d-----w- c:\programdata\Xilisoft

2013-06-24 05:37 . 2013-06-24 05:37 -------- d-----w- c:\program files (x86)\Xilisoft

2013-06-21 14:36 . 2013-06-21 14:36 -------- d-----w- C:\games

2013-06-21 12:16 . 2013-06-21 12:16 566048 ----a-w- c:\windows\SysWow64\nvStreaming.exe

2013-06-20 21:40 . 2013-06-13 04:47 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

2013-06-18 21:00 . 2013-06-18 21:00 -------- d-----w- c:\users\Gaming\AppData\Roaming\runic games

2013-06-18 21:00 . 2013-06-18 21:00 -------- d-----w- c:\program files (x86)\GOG.com

2013-06-14 14:34 . 2013-06-18 05:15 -------- d-----w- c:\users\Gaming\AppData\Local\ApplicationHistory

2013-06-14 14:30 . 2013-06-14 14:30 -------- d-----w- c:\windows\SysWow64\URTTEMP

2013-06-14 14:27 . 2013-06-14 14:27 -------- d-----w- c:\windows\San Andreas Mod Installer

2013-06-14 02:42 . 2012-05-12 19:31 121416 ----a-w- c:\windows\system32\drivers\MijXfilt.sys

2013-06-14 02:42 . 2011-12-08 02:42 74960 ----a-w- c:\windows\system32\drivers\xusb21.sys

2013-06-14 02:37 . 2008-04-15 12:00 619008 ----a-w- c:\windows\SysWow64\dx7vb.dll

2013-06-14 02:37 . 2008-04-15 12:00 1227264 ----a-w- c:\windows\SysWow64\dx8vb.dll

2013-06-12 17:32 . 2013-06-12 17:32 -------- d-----w- c:\users\Guest\AppData\Local\NVIDIA Corporation

2013-06-12 07:09 . 2013-05-08 06:39 1910632 ----a-w- c:\windows\system32\drivers\tcpip.sys

2013-06-12 07:09 . 2013-04-26 05:51 751104 ----a-w- c:\windows\system32\win32spl.dll

2013-06-12 07:09 . 2013-04-26 04:55 492544 ----a-w- c:\windows\SysWow64\win32spl.dll

2013-06-12 07:09 . 2013-05-13 03:43 1192448 ----a-w- c:\windows\system32\certutil.exe

2013-06-12 07:09 . 2013-05-13 05:51 1464320 ----a-w- c:\windows\system32\crypt32.dll

2013-06-12 07:09 . 2013-05-13 03:08 903168 ----a-w- c:\windows\SysWow64\certutil.exe

2013-06-12 07:08 . 2013-05-13 04:45 1160192 ----a-w- c:\windows\SysWow64\crypt32.dll

2013-06-12 07:08 . 2013-05-13 05:51 184320 ----a-w- c:\windows\system32\cryptsvc.dll

2013-06-12 07:08 . 2013-05-13 05:51 139776 ----a-w- c:\windows\system32\cryptnet.dll

2013-06-12 07:08 . 2013-05-13 04:45 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll

2013-06-12 07:08 . 2013-05-13 04:45 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll

2013-06-12 07:08 . 2013-05-13 05:50 52224 ----a-w- c:\windows\system32\certenc.dll

2013-06-12 07:08 . 2013-05-13 03:08 43008 ----a-w- c:\windows\SysWow64\certenc.dll

2013-06-08 23:18 . 2013-06-08 23:18 -------- d-----w- c:\program files\iPod

2013-06-08 23:18 . 2013-06-08 23:18 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69

2013-06-08 23:18 . 2013-06-08 23:18 -------- d-----w- c:\program files\iTunes

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-06-13 04:48 . 2013-01-20 17:26 867240 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

2013-06-13 04:48 . 2013-01-20 17:26 789416 ----a-w- c:\windows\SysWow64\deployJava1.dll

2013-06-12 09:48 . 2013-02-01 04:55 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2013-06-12 09:48 . 2013-02-01 04:54 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-06-04 01:16 . 2013-01-19 18:05 75898224 ----a-w- c:\windows\system32\MRT.exe

2013-06-02 04:26 . 2013-06-02 04:26 419840 ----a-w- c:\windows\system32\wrap_oal.dll

2013-06-02 04:26 . 2013-06-02 04:26 413696 ----a-w- c:\windows\SysWow64\wrap_oal.dll

2013-06-02 04:26 . 2013-06-02 04:26 133632 ----a-w- c:\windows\system32\OpenAL32.dll

2013-06-02 04:26 . 2013-06-02 04:26 110592 ----a-w- c:\windows\SysWow64\OpenAL32.dll

2013-06-01 04:02 . 2013-06-01 04:02 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll

2013-05-09 08:58 . 2013-01-19 19:10 287840 ----a-w- c:\windows\system32\aswBoot.exe

2013-05-02 09:06 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe

2013-04-12 14:45 . 2013-04-24 06:11 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys

2013-04-10 06:01 . 2013-05-15 13:03 265064 ----a-w- c:\windows\system32\drivers\dxgmms1.sys

2013-04-10 06:01 . 2013-05-15 13:03 983400 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys

2013-04-10 03:30 . 2013-05-15 13:02 3153920 ----a-w- c:\windows\system32\win32k.sys

2013-01-15 09:27 . 2013-01-15 09:27 2174976 ----a-w- c:\program files (x86)\Common Files\atimpenc.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]

@="{C5994560-53D9-4125-87C9-F193FC689CB2}"

[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]