Jump to content

this virus is driving me crazy...


Recommended Posts

I hope I'm in the right spot because I couldn't follow the link in the sticky.... but anyway.. my brother was trying to download a game and now I've got AT LEAST a MyPC Backup and VAFPlayer virus that i cannot remove. This computer had malware bytes registered on it, now it shows it unregistered and says my key is wrong (it is not) and when i try to scan with it it freezes up and stops responding. My browzer gets hijacked, with a new toolbar everytime its opened and i get pop ups from the MyPC Backup saying my computer is infected and needs to back up (I havn't touched these)

 

Here are the logs...not sure if you wanted them copied and pasted or attached so i did both...

 

 

DDS

 

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 7.0.6002.18005  BrowserJavaVersion: 10.25.2
Run by owner at 17:26:31 on 2013-07-15
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.1.1033.18.3071.1562 [GMT -5:00]
.
AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: AVG Internet Security 2012 *Disabled* {621CC794-9486-F902-D092-0484E8EA828B}
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\SLsvc.exe
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\AVG\AVG2012\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\SearchProtect\bin\CltMngSvc.exe
C:\Program Files\Kodak\AiO\Center\EKAiOHostService.exe
C:\Program Files\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Windows\System32\WUDFHost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\system32\schtasks.exe
C:\Program Files\AVG\AVG2012\avgtray.exe
C:\Windows\vVX3000.exe
C:\Program Files\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Users\owner\AppData\Roaming\SearchProtect\bin\cltmng.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\MyPC Backup\MyPC Backup.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\hp\kbd\kbd.exe
C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
C:\Program Files\AVG\AVG2012\avgcfgex.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
.
============== Pseudo HJT Report ===============
.


mURLSearchHooks: {55b95864-3251-45e9-bb30-1a82589aaff1} - <orphaned>
dURLSearchHooks: {A3BC75A2-1F87-4686-AA43-5347D756017C} - <orphaned>
BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: AVG Do Not Track: {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - c:\program files\avg\avg2012\avgdtiex.dll
BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files\avg\avg2012\avgssie.dll
BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - c:\program files\windows live\companion\companioncore.dll
BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [searchProtect] c:\users\owner\appdata\roaming\searchprotect\bin\cltmng.exe
mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe
mRun: [KBD] c:\hp\kbd\KbdStub.EXE
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe
mRun: [sunJavaUpdateReg] "c:\windows\system32\jureg.exe"
mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe"
mRun: [VX3000] c:\windows\vVX3000.exe
mRun: [Conime] c:\windows\system32\conime.exe
mRun: [LifeCam] "c:\program files\microsoft lifecam\LifeExp.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [EKStatusMonitor] c:\program files\kodak\aio\statusmonitor\EKStatusMonitor.exe
mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [searchProtectAll] c:\program files\searchprotect\bin\cltmng.exe
dRunOnce: [KodakHomeCenter] "c:\program files\kodak\aio\center\AiOHomeCenter.exe"
StartupFolder: c:\users\owner\appdata\roaming\micros~1\windows\startm~1\programs\startup\mypcba~1.lnk - c:\program files\mypc backup\MyPC Backup.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
uPolicies-Explorer: NoDrives = dword:0
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0
mPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveTypeAutoRun = dword:255
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - c:\program files\avg\avg2012\avgdtiex.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
LSP: c:\windows\system32\wpclsp.dll




TCP: NameServer = 192.168.1.254
TCP: Interfaces\{28FEDA5C-1BDF-412A-BBD2-0DF6BD1A3B06} : DHCPNameServer = 192.168.1.254
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
LSA: Security Packages =  kerberos msv1_0 schannel wdigest tspkg
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\28.0.1500.72\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\owner\appdata\roaming\mozilla\firefox\profiles\33a6f8sf.default\

FF - prefs.js: browser.search.selectedEngine - MixiDJ V34 Customized Web Search


FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\update\1.3.21.153\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.20513.0\npctrlui.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_7_700_224.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npmproxy.dll
FF - ExtSQL: 2013-07-13 23:52; {55b95864-3251-45e9-bb30-1a82589aaff1}; c:\users\owner\appdata\roaming\mozilla\firefox\profiles\33a6f8sf.default\extensions\{55b95864-3251-45e9-bb30-1a82589aaff1}
FF - ExtSQL: !HIDDEN! 2009-10-24 14:48; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - ExtSQL: !HIDDEN! 2010-10-06 14:43; smartwebprinting@hp.com; c:\program files\hp\digital imaging\smart web printing\MozillaAddOn3
.
---- FIREFOX POLICIES ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [2012-4-19 24896]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2012-1-31 31952]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2012-11-8 250080]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-12-23 41040]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2013-4-11 302368]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2012-2-14 193288]
R2 CltMngSvc;Search Protect by Conduit Updater;c:\program files\searchprotect\bin\CltMngSvc.exe [2013-5-8 97056]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-6-2 21504]
R2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\kodak\aio\center\EKAiOHostService.exe [2013-3-15 395640]
R2 Kodak AiO Status Monitor Service;Kodak AiO Status Monitor Service;c:\program files\kodak\aio\statusmonitor\EKPrinterSDK.exe [2013-1-15 780152]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [2012-12-10 142176]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\avgidsfilterx.sys [2011-12-23 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [2011-12-23 17232]
R3 HCW85BDA;Hauppauge WinTV 885 Video Capture;c:\windows\system32\drivers\HCW85BDA.sys [2009-7-14 1443584]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2013-7-13 40776]
R3 netr73;USB Wireless 802.11 b/g Adaptor Driver for Vista;c:\windows\system32\drivers\netr73.sys [2009-5-24 501248]
R3 slnt;Realtek RTL8139 PCI Fast Ethernet Adapter;c:\windows\system32\drivers\slnt.sys [2009-8-10 17999]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2012\avgidsagent.exe [2012-11-2 5174392]
S2 BackupStack;Computer Backup (MyPC Backup);c:\program files\mypc backup\backupstack.exe --> c:\program files\mypc backup\BackupStack.exe [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg10\toolbar\ToolbarBroker.exe [2011-8-26 167264]
S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2011-3-29 39272]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-9-23 1493352]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2013-4-18 754856]
S4 DQLWinService;DQLWinService;c:\program files\common files\intel\inteldh\nms\adpplugins\DQLWinService.exe [2006-9-3 208896]
S4 HPBtnSrv;HP Chasis Button Service;c:\hp\hpezbtn\HPBtnSrv.exe [2007-8-23 198240]
S4 IntelDHSvcConf;Intel DH Service;c:\program files\intel\inteldh\intel media server\tools\IntelDHSvcConf.exe [2006-5-10 29696]
S4 MCLServiceATL;Intel® Application Tracker;c:\program files\intel\inteldh\intel media server\shells\MCLServiceATL.exe [2006-9-11 167936]
S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]
.
=============== Created Last 30 ================
.
2013-07-14 05:32:42    --------    dcsh--w-    C:\$RECYCLE.BIN
2013-07-14 05:32:41    --------    d-----w-    c:\users\owner\appdata\local\temp
2013-07-14 05:14:26    256000    ----a-w-    c:\windows\PEV.exe
2013-07-14 05:04:56    --------    d-----w-    c:\users\owner\appdata\roaming\player
2013-07-14 04:55:57    --------    d-----w-    c:\users\owner\appdata\local\Conduit
2013-07-14 04:54:52    --------    d-----w-    c:\users\owner\appdata\local\CRE
2013-07-14 04:54:15    --------    d-----w-    c:\program files\MyPC Backup
2013-07-14 04:53:32    --------    d-----w-    c:\program files\SearchProtect
2013-07-14 04:52:45    --------    d-----w-    c:\users\owner\appdata\roaming\SearchProtect
2013-07-14 04:52:18    --------    d-----w-    c:\users\owner\appdata\roaming\Optimizer Pro
2013-07-14 04:51:36    40776    ----a-w-    c:\windows\system32\drivers\mbamswissarmy.sys
2013-07-14 04:49:53    --------    d-----w-    c:\users\owner\appdata\local\TopArcadeHits
2013-07-14 04:49:37    --------    d-----w-    c:\programdata\Tarma Installer
2013-07-11 08:56:27    2049024    ----a-w-    c:\windows\system32\win32k.sys
2013-07-11 08:52:50    798208    ----a-w-    c:\windows\system32\FntCache.dll
2013-07-11 08:52:50    486400    ----a-w-    c:\windows\system32\d3d10level9.dll
2013-07-11 08:52:50    219648    ----a-w-    c:\windows\system32\d3d10_1core.dll
2013-07-11 08:52:50    189952    ----a-w-    c:\windows\system32\d3d10core.dll
2013-07-11 08:52:50    1069056    ----a-w-    c:\windows\system32\DWrite.dll
2013-07-11 08:52:50    1029120    ----a-w-    c:\windows\system32\d3d10.dll
2013-07-11 08:52:49    683008    ----a-w-    c:\windows\system32\d2d1.dll
2013-07-11 08:52:49    160768    ----a-w-    c:\windows\system32\d3d10_1.dll
2013-07-11 08:52:49    1172480    ----a-w-    c:\windows\system32\d3d10warp.dll
2013-07-11 08:51:44    505344    ----a-w-    c:\windows\system32\qedit.dll
2013-07-11 08:50:41    1548288    ----a-w-    c:\windows\system32\WMVDECOD.DLL
2013-07-11 08:48:31    983552    ----a-w-    c:\program files\windows journal\JNTFiltr.dll
2013-07-11 08:48:31    964608    ----a-w-    c:\program files\windows journal\JNWDRV.dll
2013-07-11 08:48:31    936960    ----a-w-    c:\program files\common files\microsoft shared\ink\journal.dll
2013-07-11 08:48:31    1218048    ----a-w-    c:\program files\windows journal\NBDoc.DLL
2013-07-05 20:56:43    --------    d-----w-    c:\users\owner\appdata\local\iLivid
2013-07-03 04:11:33    --------    d-----w-    c:\users\owner\appdata\roaming\NVIDIA
2013-07-03 03:50:44    --------    d-----w-    c:\users\owner\jagexcache
2013-07-03 03:18:06    94632    ----a-w-    c:\windows\system32\WindowsAccessBridge.dll
2013-06-23 18:57:11    --------    d-----w-    c:\programdata\ElectricSheep
2013-06-23 18:57:11    --------    d-----w-    c:\program files\Electric Sheep
2013-06-23 18:57:10    2106216    ----a-w-    c:\windows\system32\D3DCompiler_43.dll
2013-06-23 18:57:09    1998168    ----a-w-    c:\windows\system32\D3DX9_43.dll
.
==================== Find3M  ====================
.
2013-07-03 03:17:51    867240    ----a-w-    c:\windows\system32\npDeployJava1.dll
2013-07-03 03:17:51    789416    ----a-w-    c:\windows\system32\deployJava1.dll
2013-06-13 19:13:45    71048    ----a-w-    c:\windows\system32\FlashPlayerCPLApp.cpl
2013-06-13 19:13:45    692104    ----a-w-    c:\windows\system32\FlashPlayerApp.exe
2013-06-04 04:19:50    834048    ----a-w-    c:\windows\system32\wininet.dll
2013-06-04 04:17:26    52736    ----a-w-    c:\windows\apppatch\iebrshim.dll
2013-06-04 02:32:34    389632    ----a-w-    c:\windows\system32\html.iec
2013-06-04 02:04:03    1383424    ----a-w-    c:\windows\system32\mshtml.tlb
2013-05-08 06:10:12    770384    ----a-w-    c:\windows\system32\msvcr100.dll
2013-05-08 06:10:12    421200    ----a-w-    c:\windows\system32\msvcp100.dll
2013-05-08 04:37:21    905576    ----a-w-    c:\windows\system32\drivers\tcpip.sys
2013-05-02 22:03:36    3603832    ----a-w-    c:\windows\system32\ntkrnlpa.exe
2013-05-02 22:03:36    3551096    ----a-w-    c:\windows\system32\ntoskrnl.exe
2013-05-02 04:04:25    443904    ----a-w-    c:\windows\system32\win32spl.dll
2013-05-02 04:03:42    37376    ----a-w-    c:\windows\system32\printcom.dll
2013-04-24 04:00:30    985600    ----a-w-    c:\windows\system32\crypt32.dll
2013-04-24 04:00:30    98304    ----a-w-    c:\windows\system32\cryptnet.dll
2013-04-24 04:00:30    133120    ----a-w-    c:\windows\system32\cryptsvc.dll
2013-04-24 04:00:24    41984    ----a-w-    c:\windows\system32\certenc.dll
2013-04-24 01:46:29    812544    ----a-w-    c:\windows\system32\certutil.exe
2013-04-17 12:30:06    24576    ----a-w-    c:\windows\system32\cryptdlg.dll
.
============= FINISH: 17:31:41.45 ===============

 

Attach

 

DDS (Ver_2012-11-20.01)
.
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 9/5/2007 3:45:06 AM
System Uptime: 7/15/2013 4:11:27 PM (1 hours ago)
.
Motherboard: ASUSTeK Computer INC. |  | Berkeley
Processor: Intel® Core2 Quad CPU    Q6600  @ 2.40GHz | CPU 1 | 2394/267mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 289 GiB total, 55.336 GiB free.
D: is FIXED (NTFS) - 9 GiB total, 0.278 GiB free.
E: is FIXED (NTFS) - 298 GiB total, 61.156 GiB free.
F: is CDROM ()
G: is Removable
H: is Removable
I: is Removable
J: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}
Description: Officejet 4500 G510n-z
Device ID: ROOT\MULTIFUNCTION\0000
Manufacturer: HP
Name: Officejet 4500 G510n-z
PNP Device ID: ROOT\MULTIFUNCTION\0000
Service:
.
==== System Restore Points ===================
.
RP4594: 7/3/2013 5:43:43 PM - Scheduled Checkpoint
RP4596: 7/4/2013 3:00:26 AM - Windows Update
RP4598: 7/5/2013 3:01:51 AM - Windows Update
RP4600: 7/5/2013 4:23:36 PM - Installed DirectX
RP4602: 7/6/2013 3:05:45 AM - Windows Update
RP4604: 7/7/2013 3:01:39 AM - Windows Update
RP4606: 7/8/2013 3:00:23 AM - Windows Update
RP4608: 7/9/2013 3:03:01 AM - Windows Update
RP4610: 7/11/2013 10:20:45 PM - Scheduled Checkpoint
RP4612: 7/12/2013 3:02:54 AM - Windows Update
RP4614: 7/12/2013 7:35:09 PM - Windows Modules Installer
RP4616: 7/13/2013 3:00:28 AM - Windows Update
RP4618: 7/14/2013 12:08:03 AM - Quitado VAFPlayer
RP4620: 7/14/2013 12:09:06 AM - Quitado VAFPlayer
RP4622: 7/14/2013 3:03:13 AM - Windows Update
RP4624: 7/15/2013 3:01:39 AM - Windows Update
.
==== Installed Programs ======================
.
32 Bit HP CIO Components Installer
4500_G510nz_Help
4500G510nz
4500G510nz_Software_Min
5600
5600_Help
5600Trb
ABBYY FineReader 6.0 Sprint
Adobe Flash Player 11 Plugin
Adobe Photoshop Lightroom 2.4
Adobe Reader X (10.1.7)
AIO_CDB_ProductContext
AIO_CDB_Software
AIO_Scan
aioscnnr
AVG 2012
AVG PC Tuneup 2011
AviSynth 2.5
Bonjour
BufferChm
C4USelfUpdater
CamStudio
center
ConvertXtoDVD 2.99.9.500
Copy
CoreAVC Pro (remove only)
CustomerResearchQFolder
D3DX10
Destinations
DeviceDiscovery
DeviceManagementQFolder
DivX 4.12 Codec
DocMgr
DocProc
DVD Shrink 3.2
Electric Sheep 2.7b34c
Enhanced Multimedia Keyboard Solution
ERUNT 1.1j
essentials
eSupportQFolder
FastStone Capture 5.3
Fax
Google Chrome
Google Update Helper
GPBaseService2
Haali Media Splitter
Hardware Diagnostic Tools
Hewlett-Packard Active Check for Health Check
Hewlett-Packard Asset Agent for Health Check
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Active Support Library 32 bit components
HP Customer Experience Enhancements
HP Customer Feedback
HP Customer Participation Program 13.0
HP Document Manager 2.0
HP Easy Setup - Frontend
HP Imaging Device Functions 13.0
HP Officejet 4500 G510n-z
HP Photosmart Essential 2.01
HP Photosmart Essential2.01
HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B
HP Picasso Media Center Add-In
HP Smart Web Printing 4.5
HP Solution Center 13.0
HP Update
HPProductAssistant
iLivid
Intel® Network Connections Drivers
Intel® Viiv™ Software
IZArc 3.81
Java 7 Update 25
Java Auto Updater
Junk Mail filter update
Kodak AIO Printer
KODAK AiO Software
LEGO Digital Designer
LightScribe  1.6.45.1
Malwarebytes Anti-Malware version 1.75.0.1300
MarketResearch
Mesh Runtime
Messenger Companion
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Application Error Reporting
Microsoft Corporation
Microsoft LifeCam
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Mozilla Firefox 22.0 (x86 en-US)
Mozilla Maintenance Service
MSVCRT
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
muvee autoProducer 6.0
Network
NVIDIA Control Panel 307.83
NVIDIA Graphics Driver 307.83
NVIDIA Install Application
NVIDIA Update 1.10.8
NVIDIA Update Components
NVIDIA WDM Drivers
ocr
OCR Software by I.R.I.S. 13.0
OLYMPUS Master 2
OpenOffice.org 3.0
PowerISO
PreReq
PrintProjects
PSSWCORE
Python 2.5
QuickTime
Realtek High Definition Audio Driver
Rhapsody Player Engine
Roxio Activation Module
Scan
Search Protect by conduit
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2840629)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2832407)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2736428)
Segoe UI
SmartWebPrinting
Soft Data Fax Modem with SmartCP
SolutionCenter
Status
The Playa
Toolbox
TopArcadeHits
TrayApp
Truck 3D
UnloadSupport
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
VAFPlayer
VideoLAN VLC media player 0.8.6d
VideoToolkit01
WeatherBug Gadget
WebReg
What's Running 2.2
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Sync
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
YouTube Downloader App 3.00
.
==== Event Viewer Messages From Past Week ========
.
7/15/2013 4:13:46 PM, Error: Service Control Manager [7026]  - The following boot-start or system-start driver(s) failed to load:  i8042prt is3srv SASKUTIL szkg5 szkgfs
7/15/2013 4:13:46 PM, Error: Service Control Manager [7000]  - The Computer Backup (MyPC Backup) service failed to start due to the following error:  The system cannot find the file specified.
7/15/2013 4:12:20 PM, Error: EventLog [6008]  - The previous system shutdown at 4:08:37 PM on 7/15/2013 was unexpected.
7/15/2013 3:14:50 PM, Error: EventLog [6008]  - The previous system shutdown at 1:47:56 PM on 7/15/2013 was unexpected.
7/14/2013 12:28:40 AM, Error: Service Control Manager [7030]  - The PEVSystemStart service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.
7/13/2013 3:00:48 AM, Error: Microsoft-Windows-WindowsUpdateClient [20]  - Installation Failure: Windows failed to install the following update with error 0x8024200d: Security Update for Microsoft .NET Framework 3.0 SP2 on Windows Vista SP2 and Windows Server 2008 SP2 x86 (KB2832412).
7/13/2013 3:00:43 AM, Error: Microsoft-Windows-Servicing [4375]  - Windows Servicing failed to complete the process of setting package KB2832412 (Security Update) into Staging(Staging) state
7/13/2013 3:00:43 AM, Error: Microsoft-Windows-Servicing [4375]  - Windows Servicing failed to complete the process of setting package KB2832412 (Security Update) into Resolved(Resolved) state
7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385]  - Windows Servicing failed to complete the process of changing update 2832412-9_neutral_LDR from package KB2832412(Security Update) into Staging(Staging) state
7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385]  - Windows Servicing failed to complete the process of changing update 2832412-8_neutral_GDR from package KB2832412(Security Update) into Staging(Staging) state
7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385]  - Windows Servicing failed to complete the process of changing update 2832412-7_neutral_LDR from package KB2832412(Security Update) into Staging(Staging) state
7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385]  - Windows Servicing failed to complete the process of changing update 2832412-6_neutral_GDR from package KB2832412(Security Update) into Staging(Staging) state
7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385]  - Windows Servicing failed to complete the process of changing update 2832412-5_neutral_LDR from package KB2832412(Security Update) into Staging(Staging) state
7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385]  - Windows Servicing failed to complete the process of changing update 2832412-4_neutral_GDR from package KB2832412(Security Update) into Staging(Staging) state
7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385]  - Windows Servicing failed to complete the process of changing update 2832412-3_neutral_LDR from package KB2832412(Security Update) into Staging(Staging) state
7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385]  - Windows Servicing failed to complete the process of changing update 2832412-22_neutral_GDR from package KB2832412(Security Update) into Staging(Staging) state
7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385]  - Windows Servicing failed to complete the process of changing update 2832412-21_neutral_LDR from package KB2832412(Security Update) into Staging(Staging) state
7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385]  - Windows Servicing failed to complete the process of changing update 2832412-20_neutral_GDR from package KB2832412(Security Update) into Staging(Staging) state
7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385]  - Windows Servicing failed to complete the process of changing update 2832412-2_neutral_GDR from package KB2832412(Security Update) into Staging(Staging) state
7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385]  - Windows Servicing failed to complete the process of changing update 2832412-19_neutral_LDR from package KB2832412(Security Update) into Staging(Staging) state
7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385]  - Windows Servicing failed to complete the process of changing update 2832412-18_neutral_GDR from package KB2832412(Security Update) into Staging(Staging) state
7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385]  - Windows Servicing failed to complete the process of changing update 2832412-17_neutral_LDR from package KB2832412(Security Update) into Staging(Staging) state
7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385]  - Windows Servicing failed to complete the process of changing update 2832412-16_neutral_GDR from package KB2832412(Security Update) into Staging(Staging) state
7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385]  - Windows Servicing failed to complete the process of changing update 2832412-15_neutral_LDR from package KB2832412(Security Update) into Staging(Staging) state
7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385]  - Windows Servicing failed to complete the process of changing update 2832412-14_neutral_GDR from package KB2832412(Security Update) into Staging(Staging) state
7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385]  - Windows Servicing failed to complete the process of changing update 2832412-13_neutral_LDR from package KB2832412(Security Update) into Staging(Staging) state
7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385]  - Windows Servicing failed to complete the process of changing update 2832412-12_neutral_GDR from package KB2832412(Security Update) into Staging(Staging) state
7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385]  - Windows Servicing failed to complete the process of changing update 2832412-11_neutral_LDR from package KB2832412(Security Update) into Staging(Staging) state
7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385]  - Windows Servicing failed to complete the process of changing update 2832412-10_neutral_GDR from package KB2832412(Security Update) into Staging(Staging) state
7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385]  - Windows Servicing failed to complete the process of changing update 2832412-1_neutral_LDR from package KB2832412(Security Update) into Staging(Staging) state
7/12/2013 8:03:05 PM, Error: Microsoft-Windows-WindowsUpdateClient [20]  - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft .NET Framework 4 on XP, Server 2003, Vista, Windows 7, Server 2008 x86 (KB2835393).
7/12/2013 7:40:14 PM, Error: Microsoft-Windows-WindowsUpdateClient [20]  - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft .NET Framework 3.5 SP1 on Windows XP, Server 2003, Vista, Server 2008 x86 (KB2840629).
7/12/2013 7:38:58 PM, Error: Microsoft-Windows-WindowsUpdateClient [20]  - Installation Failure: Windows failed to install the following update with error 0x800736cc: Security Update for Microsoft .NET Framework 3.0 SP2 on Windows Vista SP2 and Windows Server 2008 SP2 x86 (KB2832412).
7/12/2013 7:34:28 PM, Error: Microsoft-Windows-WindowsUpdateClient [20]  - Installation Failure: Windows failed to install the following update with error 0x80242007: Security Update for Microsoft .NET Framework 4 on XP, Server 2003, Vista, Server 2008 x86 (KB2832407).
.
==== End Of File ===========================

 

dds.txtattach.txt

 

 

Link to post
Share on other sites

download Farbar Recovery Scan Tool and save it to your desktop.

 

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

Kevin...

Link to post
Share on other sites

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 14-07-2013
Ran by owner (administrator) on 15-07-2013 17:50:06
Running from C:\Users\owner\Downloads
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: English(US)
Internet Explorer Version 7
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2012\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Conduit) C:\Program Files\SearchProtect\bin\CltMngSvc.exe
(Eastman Kodak Company) C:\Program Files\Kodak\AiO\Center\EKAiOHostService.exe
(Eastman Kodak Company) C:\Program Files\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS32.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Hewlett-Packard Company) C:\hp\support\hpsysdrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Microsoft Corporation) C:\Windows\system32\schtasks.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2012\avgtray.exe
(Microsoft Corporation) C:\Windows\vVX3000.exe
(Eastman Kodak Company) C:\Program Files\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Conduit) C:\Users\owner\AppData\Roaming\SearchProtect\bin\cltmng.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(MyPCBackup.com) C:\Program Files\MyPC Backup\MyPC Backup.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Hewlett-Packard Company) C:\hp\kbd\kbd.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2012\avgcfgex.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [hpsysdrv] - c:\hp\support\hpsysdrv.exe [65536 2007-04-18] (Hewlett-Packard Company)
HKLM\...\Run: [KBD] - C:\HP\KBD\KbdStub.EXE [65536 2006-12-08] ()
HKLM\...\Run: [RtHDVCpl] - RtHDVCpl.exe [x]
HKLM\...\Run: [HP Health Check Scheduler] - c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [71176 2007-05-24] (Hewlett-Packard)
HKLM\...\Run: [sunJavaUpdateReg] - "C:\Windows\system32\jureg.exe" [54936 2007-04-07] (Sun Microsystems, Inc.)
HKLM\...\Run: [AVG_TRAY] - "C:\Program Files\AVG\AVG2012\avgtray.exe" [2598520 2012-11-19] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [VX3000] - C:\Windows\vVX3000.exe [762736 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [Conime] - %windir%\system32\conime.exe [69120 2009-04-11] (Microsoft Corporation)
HKLM\...\Run: [LifeCam] - "C:\Program Files\Microsoft LifeCam\LifeExp.exe" [119152 2010-05-20] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [EKStatusMonitor] - C:\Program Files\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe [2750840 2013-01-15] (Eastman Kodak Company)
HKLM\...\Run: [sunJavaUpdateSched] - "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [searchProtectAll] - C:\Program Files\SearchProtect\bin\cltmng.exe [2852640 2013-05-08] (Conduit)
HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation)
HKCU\...\Run: [searchProtect] - C:\Users\owner\AppData\Roaming\SearchProtect\bin\cltmng.exe [2852640 2013-05-08] (Conduit)
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Default\...\Run: [HPADVISOR] - C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun [x]
HKU\Default User\...\Run: [HPADVISOR] - C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun [x]
HKU\Mcx1\...\Run: [HPADVISOR] - C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun [x]
HKU\Mcx1\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [ 2008-01-19] (Microsoft Corporation)
HKU\Mcx1\...\Winlogon: [shell] C:\Windows\eHome\McrMgr.exe [ 2009-04-11] (Microsoft Corporation) <==== ATTENTION
Startup: C:\ProgramData\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
BootExecute: autocheck autochk * C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&CUI=UN62004788929862104&UM=2&ctid=CT3298570
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=74&bd=Pavilion&pf=desktop
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
StartMenuInternet: IEXPLORE.EXE - "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
HKLM SearchScopes: DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3298570&CUI=UN62004788929862104&UM=2
SearchScopes: HKLM - {937C650B-D097-4782-B5A2-F3E4E94BA9DE} URL = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3298570&CUI=UN62004788929862104&UM=2
SearchScopes: HKLM - {cca2e567-1987-4100-a3c6-5b4267084510} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^YK^xdm209^S05797^us&si=CNDirNC34bcCFac7MgoduRIATg&ptb=61CBB1CA-4ED9-4966-9A8E-712785ED9FD4&psa=&ind=2013061515&st=sb&n=77fce18b&searchfor={searchTerms}
SearchScopes: HKLM - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} URL = http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg-chrome&type=yahoo_avg_hs2-tb-web_chrome_us&p={searchTerms}
SearchScopes: HKLM - {E071FE95-EA7A-4AB8-BA93-B1911E9C90B4} URL = http://search.live.com/results.aspx?q={searchTerms}&entrypoint={referrer:source?}&FORM=HVDUS7
SearchScopes: HKLM - {F75DDF04-551F-482A-9028-3E4144A76CDF} URL = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=hp-pvdt
HKCU SearchScopes: DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3298570&CUI=UN62004788929862104&UM=2
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=crm&q={searchTerms}&locale=&apn_ptnrs=TV&apn_dtid=OSJ000YYUS&apn_uid=01E61C81-3FAC-4929-A477-B9CDD39384C3&apn_sauid=3C8FE59A-08BB-4A79-B5DB-20433B2B03F1
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3298570&CUI=UN62004788929862104&UM=2
SearchScopes: HKCU - {cca2e567-1987-4100-a3c6-5b4267084510} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^YK^xdm209^S05797^us&si=CNDirNC34bcCFac7MgoduRIATg&ptb=61CBB1CA-4ED9-4966-9A8E-712785ED9FD4&psa=&ind=2013061515&st=sb&n=77fce18b&searchfor={searchTerms}
SearchScopes: HKCU - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} URL = http://search.avg.com/route/?d=4d916062&v=6.11.25.1&i=26&tp=chrome&q={searchTerms}&lng={language}&iy=&ychte=us
SearchScopes: HKCU - {E9FFE915-1B88-4B17-9B09-DF748F691CAB} URL = http://internetsearchservice.com/search?q={searchTerms}
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: AVG Do Not Track - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.)
BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_10-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
ShellExecuteHooks:  - {AEB6717E-7E19-11d0-97EE-00C04FD91972} -  No File [ ]
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [152864] (Apple Inc.)
Winsock: Catalog9 01 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation)
Winsock: Catalog9 02 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation)
Winsock: Catalog9 03 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation)
Winsock: Catalog9 04 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation)
Winsock: Catalog9 05 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation)
Winsock: Catalog9 06 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation)
Winsock: Catalog9 07 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation)
Winsock: Catalog9 08 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation)
Winsock: Catalog9 19 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

FireFox:
========
FF ProfilePath: C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default
FF user.js: detected! => C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\user.js
FF SelectedSearchEngine: Google


FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @real.com/RhapsodyPlayerEngine,version=1.0 - C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll (RealNetworks, Inc.)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc;version=0.8.6d - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN Team)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\searchplugins\alot-search.xml
FF SearchPlugin: C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\searchplugins\ask.xml
FF SearchPlugin: C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\searchplugins\conduit.xml
FF SearchPlugin: C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\searchplugins\search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\answers.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
FF Extension: No Name - C:\Users\owner\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: ALOT Appbar - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\Extensions\appbar@alot.com
FF Extension: Cooliris - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\Extensions\piclens@cooliris(15).com
FF Extension: TopArcadeHits - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\Extensions\{0113D088-8ED1-468C-B225-585A9C53B5E3}
FF Extension: Vista-aero - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\Extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}
FF Extension: Microsoft .NET Framework Assistant - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF Extension: MixiDJ V34  - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\Extensions\{55b95864-3251-45e9-bb30-1a82589aaff1}
FF Extension: Clear Cache Button - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\Extensions\{563e4790-7e70-11da-a72b-0800200c9a66}
FF Extension: No Name - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\Extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}(17)
FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\inspector@mozilla.org
FF Extension: Sotfone Tracker - C:\Program Files\Mozilla Firefox\extensions\sotfone-tracker@sotfone.ru
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKLM\...\Firefox\Extensions: [{1E73965B-8B48-48be-9C8D-68B920ABC1C4}] C:\Program Files\AVG\AVG2012\Firefox4\
FF Extension: AVG Safe Search - C:\Program Files\AVG\AVG2012\Firefox4\
FF HKLM\...\Firefox\Extensions: [{F53C93F1-07D5-430c-86D4-C9531B27DFAF}] C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\
FF Extension: AVG Do Not Track - C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

Chrome:
=======


CHR Extension: (Docs) - C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: () - C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdgdlcjhlbaphcjmagicjhhgfnkiihp\1.0.0_0
CHR Extension: (Gmail) - C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

========================== Services (Whitelisted) =================

S4 AlertService; C:\Program Files\Intel\IntelDH\CCU\AlertService.exe [188416 2006-09-11] (Intel® Corporation)
S3 AVG Security Toolbar Service; C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe [167264 2011-11-10] ()
S2 AVGIDSAgent; C:\Program Files\AVG\AVG2012\avgidsagent.exe [5174392 2012-11-02] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2012\avgwdsvc.exe [193288 2012-02-14] (AVG Technologies CZ, s.r.o.)
R2 CltMngSvc; C:\Program Files\SearchProtect\bin\CltMngSvc.exe [97056 2013-05-08] (Conduit)
S4 DQLWinService; C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [208896 2006-09-03] ()
S4 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [61440 2007-05-24] (Hewlett-Packard)
S4 HPBtnSrv; c:\hp\HPEZBTN\HPBtnSrv.exe [198240 2007-05-29] ()
S4 IntelDHSvcConf; C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe [29696 2006-05-10] (Intel® Corporation)
S4 ISSM; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe [75264 2006-09-11] (Intel® Corporation)
R2 Kodak AiO Network Discovery Service; C:\Program Files\Kodak\AiO\Center\EKAiOHostService.exe [395640 2013-03-15] (Eastman Kodak Company)
R2 Kodak AiO Status Monitor Service; C:\Program Files\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe [780152 2013-01-15] (Eastman Kodak Company)
S4 M1 Server; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe [26624 2006-09-01] ()
S4 MCLServiceATL; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe [167936 2006-09-11] (Intel® Corporation)
S4 Remote UI Service; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe [544256 2006-09-11] (Intel® Corporation)
S2 BackupStack; C:\Program Files\MyPC Backup\BackupStack.exe [x]

==================== Drivers (Whitelisted) ====================

R3 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [142176 2012-12-10] (AVG Technologies CZ, s.r.o. )
R3 AVGIDSFilter; C:\Windows\System32\DRIVERS\avgidsfilterx.sys [24144 2011-12-23] (AVG Technologies CZ, s.r.o. )
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [24896 2012-04-19] (AVG Technologies CZ, s.r.o. )
R3 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [17232 2011-12-23] (AVG Technologies CZ, s.r.o. )
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [250080 2012-11-08] (AVG Technologies CZ, s.r.o.)
R1 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [41040 2011-12-23] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [31952 2012-01-31] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [302368 2013-04-11] (AVG Technologies CZ, s.r.o.)
S3 FETNDIS; C:\Windows\System32\DRIVERS\fetnd5.sys [45568 2006-11-02] (VIA Technologies, Inc.              )
S3 KMWDFILTER; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [17408 2008-10-09] (Windows ® Codename Longhorn DDK provider)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\mbamswissarmy.sys [40776 2013-07-15] (Malwarebytes Corporation)
R3 slnt; C:\Windows\System32\DRIVERS\slnt.sys [17999 2007-03-10] (Silan Micro-Electronics Inc.)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 catchme; \??\C:\Users\owner\AppData\Local\Temp\catchme.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S0 is3srv; system32\drivers\is3srv.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S1 SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys [x]
S0 szkg5; system32\DRIVERS\szkg.sys [x]
S0 szkgfs; system32\drivers\szkgfs.sys [x]
S3 USBAAPL; System32\Drivers\usbaapl.sys [x]
U3 mbr; \??\C:\Users\owner\AppData\Local\Temp\mbr.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-15 17:50 - 2013-07-15 17:50 - 00000000 ___DC C:\FRST
2013-07-15 17:49 - 2013-07-15 17:49 - 01218214 _____ (Farbar) C:\Users\owner\Downloads\FRST.exe
2013-07-15 17:31 - 2013-07-15 17:31 - 00018696 _____ C:\Users\owner\Desktop\dds.txt
2013-07-15 17:31 - 2013-07-15 17:31 - 00016144 _____ C:\Users\owner\Desktop\attach.txt
2013-07-15 17:16 - 2013-07-15 17:16 - 00688992 ____R (Swearware) C:\Users\owner\Downloads\dds.scr
2013-07-15 17:09 - 2013-07-15 17:09 - 00000045 _____ C:\Users\owner\Desktop\Malwarebytes key.txt
2013-07-15 16:12 - 2013-07-15 16:12 - 520832733 _____ C:\Windows\MEMORY.DMP
2013-07-15 16:12 - 2013-07-15 16:12 - 00157016 _____ C:\Windows\Minidump\Mini071513-01.dmp
2013-07-14 00:32 - 2013-07-14 00:32 - 00016688 ____C C:\ComboFix.txt
2013-07-14 00:14 - 2011-06-26 01:45 - 00256000 _____ C:\Windows\PEV.exe
2013-07-14 00:14 - 2009-04-19 23:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-07-14 00:14 - 2000-08-30 19:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-07-14 00:14 - 2000-08-30 19:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-07-14 00:11 - 2013-07-14 00:12 - 05088600 ____R (Swearware) C:\Users\owner\Downloads\ComboFix.exe
2013-07-14 00:10 - 2013-07-14 00:11 - 04745728 _____ (AVAST Software) C:\Users\owner\Downloads\aswMBR.exe
2013-07-14 00:04 - 2013-07-14 00:04 - 00001906 _____ C:\Users\Public\Desktop\VAFPlayer.lnk
2013-07-14 00:04 - 2013-07-14 00:04 - 00000000 ____D C:\Users\owner\AppData\Roaming\player
2013-07-14 00:01 - 2013-07-14 00:01 - 00000541 _____ C:\Windows\KB893803v2.log
2013-07-13 23:55 - 2013-07-13 23:55 - 00000000 ____D C:\Users\owner\AppData\Local\Conduit
2013-07-13 23:54 - 2013-07-15 15:16 - 00000000 ____D C:\Program Files\MyPC Backup
2013-07-13 23:54 - 2013-07-13 23:55 - 00000000 ____D C:\Users\owner\AppData\Local\CRE
2013-07-13 23:54 - 2013-07-13 23:54 - 00000886 _____ C:\Users\owner\Desktop\MyPC Backup.lnk
2013-07-13 23:54 - 2013-07-13 23:54 - 00000000 ____D C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
2013-07-13 23:53 - 2013-07-13 23:53 - 00000000 ____D C:\Program Files\SearchProtect
2013-07-13 23:52 - 2013-07-13 23:58 - 00000000 ____D C:\Users\owner\AppData\Roaming\SearchProtect
2013-07-13 23:52 - 2013-07-13 23:52 - 00000000 ____D C:\Users\owner\AppData\Roaming\Optimizer Pro
2013-07-13 23:51 - 2013-07-15 16:53 - 00040776 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys
2013-07-13 23:49 - 2013-07-14 17:54 - 00000264 _____ C:\Windows\Tasks\TopArcadeHits.job
2013-07-13 23:49 - 2013-07-13 23:56 - 00000009 ____C C:\END
2013-07-13 23:49 - 2013-07-13 23:49 - 00000000 ____D C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TopArcadeHits
2013-07-13 23:49 - 2013-07-13 23:49 - 00000000 ____D C:\Users\owner\AppData\Local\TopArcadeHits
2013-07-13 23:48 - 2013-07-13 23:48 - 00525432 _____ C:\Users\owner\Downloads\Player_Setup.exe
2013-07-12 10:21 - 2013-07-12 10:28 - 00045173 _____ C:\Users\Public\A & D Agent 8300 Spreadsheet 7.ods
2013-07-12 10:21 - 2013-07-12 10:21 - 00000631 _____ C:\Users\owner\Desktop\A & D Agent 8300 Spreadsheet 1 - Shortcut.lnk
2013-07-11 03:56 - 2013-06-03 20:50 - 02049024 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-11 03:52 - 2013-04-17 06:28 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-07-11 03:52 - 2013-04-17 06:28 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-07-11 03:52 - 2013-04-17 06:28 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-07-11 03:52 - 2013-04-17 06:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-07-11 03:52 - 2013-04-17 05:34 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-07-11 03:52 - 2013-04-17 05:33 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-07-11 03:52 - 2013-04-17 05:14 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-07-11 03:52 - 2013-04-17 05:10 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-11 03:52 - 2013-04-17 05:10 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-07-11 03:51 - 2013-05-31 23:06 - 00505344 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-11 03:50 - 2013-05-07 23:04 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-11 03:49 - 2013-06-03 23:19 - 01176576 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-11 03:49 - 2013-06-03 23:19 - 00834048 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-11 03:49 - 2013-06-03 23:19 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-11 03:49 - 2013-06-03 23:18 - 03625472 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-11 03:49 - 2013-06-03 23:18 - 00671232 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2013-07-11 03:49 - 2013-06-03 23:18 - 00479744 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-07-11 03:49 - 2013-06-03 23:17 - 06118400 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-11 03:49 - 2013-06-03 23:17 - 00498688 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-11 03:49 - 2013-06-03 23:17 - 00380928 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-07-11 03:49 - 2013-06-03 23:17 - 00270336 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-11 03:49 - 2013-06-03 23:17 - 00193024 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-07-11 03:49 - 2013-06-03 23:17 - 00180736 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-11 03:49 - 2013-06-03 23:17 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-11 03:49 - 2013-06-03 21:32 - 00389632 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-07-11 03:49 - 2013-06-03 21:04 - 01383424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-08 09:44 - 2013-07-08 09:44 - 00047110 _____ C:\Users\owner\Downloads\prodrivf.exe
2013-07-05 16:24 - 2013-07-06 02:08 - 00000000 ____D C:\Users\owner\Desktop\Save
2013-07-05 16:24 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2013-07-05 16:24 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2013-07-05 16:24 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2013-07-05 16:24 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2013-07-05 16:24 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2013-07-05 16:24 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2013-07-05 16:24 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2013-07-05 16:24 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2013-07-05 16:24 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2013-07-05 16:24 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2013-07-05 16:24 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll
2013-07-05 16:24 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll
2013-07-05 16:24 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll
2013-07-05 16:24 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll
2013-07-05 16:24 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll
2013-07-05 16:24 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll
2013-07-05 16:24 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll
2013-07-05 16:24 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll
2013-07-05 16:24 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll
2013-07-05 16:24 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll
2013-07-05 16:24 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll
2013-07-05 16:24 - 2008-10-10 04:52 - 04379984 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2013-07-05 16:24 - 2008-10-10 04:52 - 02036576 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2013-07-05 16:24 - 2008-10-10 04:52 - 00452440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2013-07-05 16:24 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll
2013-07-05 16:24 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll
2013-07-05 16:24 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll
2013-07-05 16:24 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2013-07-05 16:24 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2013-07-05 16:24 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2013-07-05 16:24 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll
2013-07-05 16:24 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll
2013-07-05 16:24 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll
2013-07-05 16:24 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll
2013-07-05 16:24 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll
2013-07-05 16:24 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll
2013-07-05 16:24 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll
2013-07-05 16:24 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll
2013-07-05 16:24 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll
2013-07-05 16:24 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll
2013-07-05 16:24 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll
2013-07-05 16:24 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll
2013-07-05 16:24 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll
2013-07-05 16:18 - 2013-07-05 16:18 - 00292184 _____ (Microsoft Corporation) C:\Users\owner\Downloads\dxwebsetup.exe
2013-07-05 16:07 - 2013-07-05 16:11 - 33172507 _____ C:\Users\owner\Downloads\cw.rar
2013-07-05 16:06 - 2013-07-05 16:06 - 00000841 _____ C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iLivid.lnk
2013-07-05 15:56 - 2013-07-05 15:59 - 00000000 ____D C:\Users\owner\AppData\Local\iLivid
2013-07-05 15:56 - 2013-07-05 15:56 - 01624112 _____ (Bandoo Media Inc) C:\Users\owner\Downloads\iLividSetup-r362-n-bf.exe
2013-07-04 20:26 - 2013-07-04 20:26 - 00800208 _____ (Google Inc.) C:\Users\owner\Downloads\ChromeSetup.exe
2013-07-04 20:13 - 2013-07-04 20:13 - 00000049 _____ C:\Users\owner\jagex_cl_runescape_LIVE_BETA.dat
2013-07-02 23:11 - 2013-07-02 23:11 - 00000000 ____D C:\Users\owner\AppData\Roaming\NVIDIA
2013-07-02 22:50 - 2013-07-15 01:54 - 00000024 _____ C:\Users\owner\random.dat
2013-07-02 22:50 - 2013-07-15 00:28 - 00000044 _____ C:\Users\owner\jagex_cl_oldschool_LIVE.dat
2013-07-02 22:50 - 2013-07-04 20:13 - 00000000 ____D C:\Users\owner\jagexcache
2013-07-02 22:19 - 2013-07-15 00:26 - 00000032 _____ C:\Users\owner\jagex_cl_runescape_LIVE.dat
2013-07-02 22:18 - 2013-07-02 22:17 - 00263592 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-07-02 22:18 - 2013-07-02 22:17 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-07-02 22:18 - 2013-07-02 22:17 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-07-02 22:18 - 2013-07-02 22:17 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-07-02 22:07 - 2013-07-02 22:08 - 00903080 _____ (Oracle Corporation) C:\Users\owner\Downloads\jre-7u25-windows-i586-iftw.exe
2013-07-02 22:05 - 2013-07-02 22:11 - 41404760 _____ (Apple Inc.) C:\Users\owner\Downloads\QuickTimeInstaller(1).exe
2013-07-01 20:52 - 2013-07-08 02:50 - 00001618 _____ C:\Windows\setupact.log
2013-07-01 20:52 - 2013-07-01 20:52 - 00000000 _____ C:\Windows\setuperr.log
2013-06-30 12:00 - 2013-06-30 12:06 - 41404760 _____ (Apple Inc.) C:\Users\owner\Downloads\QuickTimeInstaller.exe
2013-06-24 23:26 - 2013-06-24 23:28 - 00229888 ___SH C:\Users\Public\Thumbs.db
2013-06-23 13:57 - 2013-06-23 14:51 - 00000000 ____D C:\ProgramData\ElectricSheep
2013-06-23 13:57 - 2013-06-23 14:08 - 00000000 ____D C:\Program Files\Electric Sheep
2013-06-23 13:57 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2013-06-23 13:57 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2013-06-23 13:51 - 2013-06-23 13:53 - 19980474 _____ C:\Users\owner\Downloads\electricsheep-2.7b34c.exe
2013-06-15 14:48 - 2013-06-15 14:48 - 00000000 ____D C:\Users\owner\Documents\My muvees
2013-06-15 14:34 - 2013-06-15 14:34 - 00000000 ____D C:\Users\owner\Documents\Poetry
2013-06-15 14:26 - 2013-06-15 14:26 - 00000000 ____D C:\Users\owner\AppData\Local\IAC
2013-06-15 14:09 - 2013-06-15 14:09 - 00000610 _____ C:\Users\owner\Desktop\Public - Shortcut.lnk

==================== One Month Modified Files and Folders =======

2013-07-15 17:50 - 2013-07-15 17:50 - 00000000 ___DC C:\FRST
2013-07-15 17:49 - 2013-07-15 17:49 - 01218214 _____ (Farbar) C:\Users\owner\Downloads\FRST.exe
2013-07-15 17:48 - 2006-11-02 07:47 - 00003696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-15 17:48 - 2006-11-02 07:47 - 00003696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-15 17:41 - 2013-03-14 21:42 - 00000884 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-15 17:36 - 2013-06-13 14:13 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-15 17:31 - 2013-07-15 17:31 - 00018696 _____ C:\Users\owner\Desktop\dds.txt
2013-07-15 17:31 - 2013-07-15 17:31 - 00016144 _____ C:\Users\owner\Desktop\attach.txt
2013-07-15 17:31 - 2007-10-15 19:55 - 00000000 ___RD C:\Users\owner\Desktop
2013-07-15 17:27 - 2007-09-05 03:42 - 01559368 _____ C:\Windows\WindowsUpdate.log
2013-07-15 17:16 - 2013-07-15 17:16 - 00688992 ____R (Swearware) C:\Users\owner\Downloads\dds.scr
2013-07-15 17:09 - 2013-07-15 17:09 - 00000045 _____ C:\Users\owner\Desktop\Malwarebytes key.txt
2013-07-15 16:53 - 2013-07-13 23:51 - 00040776 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys
2013-07-15 16:13 - 2013-03-14 21:42 - 00000880 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-15 16:12 - 2013-07-15 16:12 - 520832733 _____ C:\Windows\MEMORY.DMP
2013-07-15 16:12 - 2013-07-15 16:12 - 00157016 _____ C:\Windows\Minidump\Mini071513-01.dmp
2013-07-15 16:12 - 2012-06-14 13:07 - 00000000 ____D C:\ProgramData\Kodak
2013-07-15 16:12 - 2008-08-13 14:01 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2013-07-15 16:12 - 2008-08-11 19:16 - 00000000 ____D C:\Windows\Minidump
2013-07-15 16:12 - 2006-11-02 08:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-15 15:19 - 2011-03-28 23:28 - 00000000 ____D C:\Windows\system32\Drivers\AVG
2013-07-15 15:16 - 2013-07-13 23:54 - 00000000 ____D C:\Program Files\MyPC Backup
2013-07-15 15:15 - 2007-10-16 21:09 - 00000418 ____H C:\Windows\Tasks\User_Feed_Synchronization-{C19F805A-6953-4FE1-8FB9-206C6F3EEC50}.job
2013-07-15 15:14 - 2011-04-26 18:28 - 00104506 _____ C:\Windows\PFRO.log
2013-07-15 07:23 - 2006-11-02 06:18 - 00000000 ____D C:\Windows\tracing
2013-07-15 03:11 - 2006-11-02 06:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-07-15 03:07 - 2006-11-02 05:33 - 00750960 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-15 01:54 - 2013-07-02 22:50 - 00000024 _____ C:\Users\owner\random.dat
2013-07-15 00:28 - 2013-07-02 22:50 - 00000044 _____ C:\Users\owner\jagex_cl_oldschool_LIVE.dat
2013-07-15 00:28 - 2013-01-11 03:14 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-07-15 00:26 - 2013-07-02 22:19 - 00000032 _____ C:\Users\owner\jagex_cl_runescape_LIVE.dat
2013-07-14 17:54 - 2013-07-13 23:49 - 00000264 _____ C:\Windows\Tasks\TopArcadeHits.job
2013-07-14 03:03 - 2006-11-02 07:37 - 00000000 ____D C:\Windows\system32\XPSViewer
2013-07-14 00:32 - 2013-07-14 00:32 - 00016688 ____C C:\ComboFix.txt
2013-07-14 00:32 - 2009-10-26 18:51 - 00000000 ____D C:\Qoobox
2013-07-14 00:28 - 2006-11-02 05:23 - 00000215 ____C C:\Windows\system.ini
2013-07-14 00:12 - 2013-07-14 00:11 - 05088600 ____R (Swearware) C:\Users\owner\Downloads\ComboFix.exe
2013-07-14 00:11 - 2013-07-14 00:10 - 04745728 _____ (AVAST Software) C:\Users\owner\Downloads\aswMBR.exe
2013-07-14 00:04 - 2013-07-14 00:04 - 00001906 _____ C:\Users\Public\Desktop\VAFPlayer.lnk
2013-07-14 00:04 - 2013-07-14 00:04 - 00000000 ____D C:\Users\owner\AppData\Roaming\player
2013-07-14 00:04 - 2006-11-02 06:18 - 00000000 __RHD C:\Users\Public\Desktop
2013-07-14 00:01 - 2013-07-14 00:01 - 00000541 _____ C:\Windows\KB893803v2.log
2013-07-13 23:58 - 2013-07-13 23:52 - 00000000 ____D C:\Users\owner\AppData\Roaming\SearchProtect
2013-07-13 23:56 - 2013-07-13 23:49 - 00000009 ____C C:\END
2013-07-13 23:55 - 2013-07-13 23:55 - 00000000 ____D C:\Users\owner\AppData\Local\Conduit
2013-07-13 23:55 - 2013-07-13 23:54 - 00000000 ____D C:\Users\owner\AppData\Local\CRE
2013-07-13 23:54 - 2013-07-13 23:54 - 00000886 _____ C:\Users\owner\Desktop\MyPC Backup.lnk
2013-07-13 23:54 - 2013-07-13 23:54 - 00000000 ____D C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
2013-07-13 23:53 - 2013-07-13 23:53 - 00000000 ____D C:\Program Files\SearchProtect
2013-07-13 23:52 - 2013-07-13 23:52 - 00000000 ____D C:\Users\owner\AppData\Roaming\Optimizer Pro
2013-07-13 23:49 - 2013-07-13 23:49 - 00000000 ____D C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TopArcadeHits
2013-07-13 23:49 - 2013-07-13 23:49 - 00000000 ____D C:\Users\owner\AppData\Local\TopArcadeHits
2013-07-13 23:48 - 2013-07-13 23:48 - 00525432 _____ C:\Users\owner\Downloads\Player_Setup.exe
2013-07-13 03:21 - 2006-11-02 08:01 - 00032642 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-12 20:12 - 2006-11-02 07:47 - 00305176 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-12 20:10 - 2009-07-25 22:25 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-12 10:28 - 2013-07-12 10:21 - 00045173 _____ C:\Users\Public\A & D Agent 8300 Spreadsheet 7.ods
2013-07-12 10:28 - 2006-11-02 06:18 - 00000000 ___RD C:\Users\Public
2013-07-12 10:21 - 2013-07-12 10:21 - 00000631 _____ C:\Users\owner\Desktop\A & D Agent 8300 Spreadsheet 1 - Shortcut.lnk
2013-07-12 03:03 - 2006-11-02 07:37 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-08 19:07 - 2013-04-07 20:58 - 00000000 ____D C:\Users\Public\Documents\Work
2013-07-08 09:44 - 2013-07-08 09:44 - 00047110 _____ C:\Users\owner\Downloads\prodrivf.exe
2013-07-08 02:50 - 2013-07-01 20:52 - 00001618 _____ C:\Windows\setupact.log
2013-07-06 02:08 - 2013-07-05 16:24 - 00000000 ____D C:\Users\owner\Desktop\Save
2013-07-05 16:24 - 2008-08-19 00:19 - 00000000 ____D C:\Windows\system32\directx
2013-07-05 16:18 - 2013-07-05 16:18 - 00292184 _____ (Microsoft Corporation) C:\Users\owner\Downloads\dxwebsetup.exe
2013-07-05 16:11 - 2013-07-05 16:07 - 33172507 _____ C:\Users\owner\Downloads\cw.rar
2013-07-05 16:06 - 2013-07-05 16:06 - 00000841 _____ C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iLivid.lnk
2013-07-05 15:59 - 2013-07-05 15:56 - 00000000 ____D C:\Users\owner\AppData\Local\iLivid
2013-07-05 15:56 - 2013-07-05 15:56 - 01624112 _____ (Bandoo Media Inc) C:\Users\owner\Downloads\iLividSetup-r362-n-bf.exe
2013-07-04 20:31 - 2007-10-27 08:22 - 00000000 ____D C:\Users\owner\AppData\Local\Google
2013-07-04 20:31 - 2007-10-16 16:06 - 00000000 ____D C:\Program Files\Google
2013-07-04 20:26 - 2013-07-04 20:26 - 00800208 _____ (Google Inc.) C:\Users\owner\Downloads\ChromeSetup.exe
2013-07-04 20:13 - 2013-07-04 20:13 - 00000049 _____ C:\Users\owner\jagex_cl_runescape_LIVE_BETA.dat
2013-07-04 20:13 - 2013-07-02 22:50 - 00000000 ____D C:\Users\owner\jagexcache
2013-07-04 20:13 - 2007-10-15 19:55 - 00000000 ____D C:\Users\owner
2013-07-03 16:22 - 2012-12-19 13:59 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-07-02 23:11 - 2013-07-02 23:11 - 00000000 ____D C:\Users\owner\AppData\Roaming\NVIDIA
2013-07-02 22:17 - 2013-07-02 22:18 - 00263592 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-07-02 22:17 - 2013-07-02 22:18 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-07-02 22:17 - 2013-07-02 22:18 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-07-02 22:17 - 2013-07-02 22:18 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-07-02 22:17 - 2012-08-15 11:02 - 00867240 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-07-02 22:17 - 2012-04-03 03:18 - 00789416 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-07-02 22:17 - 2007-08-23 08:03 - 00000000 ____D C:\Program Files\Java
2013-07-02 22:11 - 2013-07-02 22:05 - 41404760 _____ (Apple Inc.) C:\Users\owner\Downloads\QuickTimeInstaller(1).exe
2013-07-02 22:08 - 2013-07-02 22:07 - 00903080 _____ (Oracle Corporation) C:\Users\owner\Downloads\jre-7u25-windows-i586-iftw.exe
2013-07-01 20:52 - 2013-07-01 20:52 - 00000000 _____ C:\Windows\setuperr.log
2013-07-01 17:18 - 2013-04-07 20:59 - 00000000 ____D C:\Users\owner\Documents\sissy
2013-06-30 12:06 - 2013-06-30 12:00 - 41404760 _____ (Apple Inc.) C:\Users\owner\Downloads\QuickTimeInstaller.exe
2013-06-24 23:28 - 2013-06-24 23:26 - 00229888 ___SH C:\Users\Public\Thumbs.db
2013-06-23 14:51 - 2013-06-23 13:57 - 00000000 ____D C:\ProgramData\ElectricSheep
2013-06-23 14:08 - 2013-06-23 13:57 - 00000000 ____D C:\Program Files\Electric Sheep
2013-06-23 13:53 - 2013-06-23 13:51 - 19980474 _____ C:\Users\owner\Downloads\electricsheep-2.7b34c.exe
2013-06-15 16:14 - 2007-12-02 21:04 - 00173568 _____ C:\Users\owner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-06-15 14:49 - 2007-12-09 11:08 - 00000000 ____D C:\Users\owner\AppData\Roaming\muvee Technologies
2013-06-15 14:48 - 2013-06-15 14:48 - 00000000 ____D C:\Users\owner\Documents\My muvees
2013-06-15 14:38 - 2008-03-14 10:48 - 00000000 ___RD C:\Users\owner\Documents\Notes
2013-06-15 14:37 - 2008-02-28 08:36 - 00000000 ____D C:\Users\owner\Documents\My Scans
2013-06-15 14:34 - 2013-06-15 14:34 - 00000000 ____D C:\Users\owner\Documents\Poetry
2013-06-15 14:26 - 2013-06-15 14:26 - 00000000 ____D C:\Users\owner\AppData\Local\IAC
2013-06-15 14:09 - 2013-06-15 14:09 - 00000610 _____ C:\Users\owner\Desktop\Public - Shortcut.lnk

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-15 16:24

==================== End Of Log ============================

Addition.txt

Link to post
Share on other sites

OK continue:

 

Download attached fixlist.txt file and save it to the Desktop.

 

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

 

Run FRST/FRST64 and press the Fix button just once and wait.

 

The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

Next,

 

Download http://www.bleepingcomputer.com/download/adwcleaner/ by Xplode onto your Desktop.

 

 

  •  

     

  •   Please close all open programs and internet browsers.

     

     

  •   Double click on Adwcleaner.exe to run the tool.

     

     

  •   Click on Delete.

     

     

  •   Confirm each time with OK.

     

     

  •   Your computer will be rebooted automatically. A text file will open after the restart.

     

     

  •   Please post the content of that logfile in your reply.

     

     

  •   You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.

     

     

 

 

Next,

 

download RKill from here: http://www.bleepingcomputer.com/download/rkill/

 

There are three buttons to choose from with different names on, select the first one and save it to your desktop.

 

 

  •  

     

  • Double-click on the Rkill desktop icon to run the tool.

     

     

  • If using Vista or Windows 7, right-click on it and Run As Administrator.

     

     

  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

     

     

  • A log pops up at the end of the run. This log file is located at C:\rkill.log. Please post this in your next reply.

     

     

  • If you do not see the black box flash on the screen delete the icon from the desktop and go back to the link for the download, select the next button and try to run the tool again, continue to repeat this process using the remaining buttons until the tool runs. You will find further links if you scroll down the page with other names, try them one at a time.

     

     

  • If the tool does not run from any of the links provided, please let me know.

     

     

 

 

Next,

 

Open Malwarebytes, check for updates then run Quick scan. Full instructions follow if  Malwarebytes is not installed:

 

Download Malwarebytes from one of the following links and save it to your desktop.:

 

 

http://www.malwarebytes.org/mbam.php 

http://www.softpedia.com/get/Antivirus/Malwarebytes-Anti-Malware.shtml[/url]

http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html

 

Double Click mbam-setup.exe to install the application.

 

 

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

 

Post those logs..

fixlist.txt

Link to post
Share on other sites

So I did everything I was supposed too... it was fine, i re-downloaded mbam from your link and updated it ect...  everytime i try to run a scan it stops responding halfway through and always at different points... but, i cannot get it to finish a scan and i never had that issue with malware bytes before... here is all of the other logs

 

FIXLOG

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 14-07-2013
Ran by owner at 2013-07-15 18:19:42 Run:1
Running from C:\Users\owner\Desktop
Boot Mode: Normal

==============================================

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\SearchProtect] - C:\Users\owner\AppData\Roaming\SearchProtect\bin\cltmng.exe [2852640 2013-05-08 => Value not found.
HKU\Mcx1\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
C:\Program Files\MyPC Backup\MyPC Backup.exe => Moved successfully.
BackupStack => Service deleted successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\bin\cltmng.exe => Moved successfully.
Could not move "C:\Windows\eHome\McrMgr.exe" => Scheduled to move on reboot.
C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup => Moved successfully.
C:\Program Files\SearchProtect => Moved successfully.

"C:\Users\owner\AppData\Roaming\SearchProtect" directory move:

C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\abstraction.js => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\application.js => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\nsprotector.js => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\popupTransparent.xul => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\SProtectorRepository\EN => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\SProtectorRepository\searchProtectorData => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\dialogsApi.js => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\main.html => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\SearchProtector.css => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\settings.js => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\images\ok-button.png => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\images\separation-line.png => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\images\warning.png => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\bubble.css => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\bubble.js => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\main.html => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\images\information.png => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\images\x-default-LTR.png => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\images\x-default-RTL.png => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\images\x-mouseover-LTR.png => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\images\x-mouseover-RTL.png => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\lib\jquery.min.js => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\lib\json2.js => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\dialogsApi.js => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spsd\main.html => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spsd\SearchProtector.css => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spsd\settings.js => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spsd\images\ok-button.png => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spsd\images\separation-line.png => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spsd\images\warning.png => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spbd\bubble.css => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spbd\bubble.js => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spbd\main.html => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spbd\images\information.png => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spbd\images\x-default-LTR.png => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spbd\images\x-default-RTL.png => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spbd\images\x-mouseover-LTR.png => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spbd\images\x-mouseover-RTL.png => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\lib\jquery.min.js => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\lib\json2.js => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\bin\ChromeModule.dll => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\bin\CltMngSvc.exe => Moved successfully.
Could not move "C:\Users\owner\AppData\Roaming\SearchProtect\bin\FirefoxModule.dll" => Scheduled to move on reboot.
C:\Users\owner\AppData\Roaming\SearchProtect\bin\InternetExplorerModule.dll => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\bin\msvcp100.dll => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\bin\msvcr100.dll => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\bin\rep.dat => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\bin\SPHook32.dll => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\bin\SPRunner.exe => Moved successfully.
Could not move "C:\Users\owner\AppData\Roaming\SearchProtect" directory. => Scheduled to move on reboot.

C:\Windows\Tasks\TopArcadeHits.job => Moved successfully.
C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TopArcadeHits => Moved successfully.
C:\Users\owner\AppData\Local\TopArcadeHits => Moved successfully.

"C:\Program Files\MyPC Backup" directory move:

C:\Program Files\MyPC Backup\AWSSDK.dll => Moved successfully.
C:\Program Files\MyPC Backup\GetText.dll => Moved successfully.
C:\Program Files\MyPC Backup\MPCBClient.dll => Moved successfully.
C:\Program Files\MyPC Backup\Shared Stack.dll => Moved successfully.
C:\Program Files\MyPC Backup\x86\System.Data.SQLite.dll => Moved successfully.
C:\Program Files\MyPC Backup\log\APPLICATION.log => Moved successfully.
C:\Program Files\MyPC Backup\Database\mpcb_backup_conf.db => Moved successfully.
C:\Program Files\MyPC Backup\Database\mpcb_file_cache.db => Moved successfully.
C:\Program Files\MyPC Backup\Database\mpcb_queues.db => Moved successfully.
Could not move "C:\Program Files\MyPC Backup\Database\mpcb_settings.db" => Scheduled to move on reboot.
C:\Program Files\MyPC Backup\Database\mpcb_sig_cache.db => Moved successfully.
Could not move "C:\Program Files\MyPC Backup" directory. => Scheduled to move on reboot.

C:\Users\owner\Desktop\MyPC Backup.lnk => Moved successfully.

=========== Result of Scheduled Files to move ===========
C:\Windows\eHome\McrMgr.exe => File moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect\bin\FirefoxModule.dll => Moved successfully.
C:\Users\owner\AppData\Roaming\SearchProtect => Moved successfully.
C:\Program Files\MyPC Backup\Database\mpcb_settings.db => Moved successfully.
"C:\Program Files\MyPC Backup" => Directory could not move.

==== End of Fixlog ====

 

 

_______________________________________________________________________________________________

 

AdwCleaner

 

# AdwCleaner v2.305 - Logfile created 07/15/2013 at 18:29:40
# Updated 11/07/2013 by Xplode
# Operating system : Windows Vista Home Premium Service Pack 2 (32 bits)
# User : owner - OWNER-PC
# Boot Mode : Normal
# Running from : C:\Users\owner\Downloads\AdwCleaner.exe
# Option [Delete]


***** [services] *****

Stopped & Deleted : CltMngSvc

***** [Files / Folders] *****

File Deleted : C:\END
File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
File Deleted : C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iLivid.lnk
File Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\searchplugins\alot-search.xml
File Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\searchplugins\Ask.xml
File Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\searchplugins\Askcom.xml
File Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\searchplugins\Conduit.xml
File Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\searchplugins\search.xml
Folder Deleted : C:\Program Files\Free Offers from Freeze.com
Folder Deleted : C:\Program Files\Freeze.com
Folder Deleted : C:\ProgramData\Ask
Folder Deleted : C:\ProgramData\AVG Security Toolbar
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\optimizer pro
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\Users\owner\AppData\Local\AVG Security Toolbar
Folder Deleted : C:\Users\owner\AppData\Local\Conduit
Folder Deleted : C:\Users\owner\AppData\Local\iac
Folder Deleted : C:\Users\owner\AppData\Local\Ilivid
Folder Deleted : C:\Users\owner\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\owner\AppData\LocalLow\MixiDJ_V34
Folder Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\alot-appbar
Folder Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\CT3298570
Folder Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\extensions\{55b95864-3251-45e9-bb30-1a82589aaff1}
Folder Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\extensions\appbar@alot.com
Folder Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\StumbleUpon
Folder Deleted : C:\Users\owner\AppData\Roaming\optimizer pro
Folder Deleted : C:\Users\owner\Desktop\Save
Folder Deleted : C:\Windows\Installer\{EBE677C0-CBCB-4EBF-8098-E27E1B5271CF}

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\AVG Security Toolbar
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\MixiDJ_V34
Key Deleted : HKCU\Software\AppDataLow\Software\ShoppingReport
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\AppDataLow\Toolbar
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\ilivid
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{EBE677C0-CBCB-4EBF-8098-E27E1B5271CF}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ilivid
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MixiDJ_V34 Toolbar
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SearchProtect
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Optimizer Pro
Key Deleted : HKCU\Software\SearchProtect
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKLM\Software\AVG Security Toolbar
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{12C9B011-2C73-45B7-9BAA-443D31B5502E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{50F4B09B-DCDB-4292-A257-0EE136120D8E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\Software\Classes\Installer\Features\0C776EBEBCBCFBE408892EE7B12517FC
Key Deleted : HKLM\Software\Classes\Installer\Products\0C776EBEBCBCFBE408892EE7B12517FC
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3298570
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\Freeze.com
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{18B78798-92B2-4767-9B6F-0DCDF6046C0F}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B047C614-72D0-4CFE-9020-687D0104828B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{12C9B011-2C73-45B7-9BAA-443D31B5502E}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FD79F359-E577-46DB-AA74-D6E6B8B45BA8}
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0C776EBEBCBCFBE408892EE7B12517FC
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\0C776EBEBCBCFBE408892EE7B12517FC
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EBE677C0-CBCB-4EBF-8098-E27E1B5271CF}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ilivid
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Key Deleted : HKLM\Software\MixiDJ_V34
Key Deleted : HKLM\Software\SearchProtect
Key Deleted : HKLM\SOFTWARE\Software
Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [searchprotect]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{55B95864-3251-45E9-BB30-1A82589AAFF1}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [searchProtectAll]
Value Deleted : HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist [1]

***** [internet Browsers] *****

-\\ Internet Explorer v7.0.6002.18005



-\\ Mozilla Firefox v22.0 (en-US)

File : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\prefs.js

C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\user.js ... Deleted !

Deleted : user_pref("CT3298570.FF19Solved", "true");
Deleted : user_pref("CT3298570.UserID", "UN26981634552045028");
Deleted : user_pref("CT3298570.browser.search.defaultthis.engineName", "true");
Deleted : user_pref("CT3298570.fullUserID", "UN26981634552045028.IN.20130713235243");
Deleted : user_pref("CT3298570.installDate", "13/07/2013 23:52:43");
Deleted : user_pref("CT3298570.installSessionId", "{01C7A2AD-4A28-4957-B371-59489627FF20}");
Deleted : user_pref("CT3298570.installSp", "TRUE");
Deleted : user_pref("CT3298570.installerVersion", "1.5.4.4");
Deleted : user_pref("CT3298570.keyword", "true");


Deleted : user_pref("CT3298570.originalSearchEngine", "Google");
Deleted : user_pref("CT3298570.originalSearchEngineName", "Ask");
Deleted : user_pref("CT3298570.searchRevert", "false");
Deleted : user_pref("CT3298570.searchUserMode", "2");
Deleted : user_pref("CT3298570.smartbar.homepage", "true");
Deleted : user_pref("CT3298570.versionFromInstaller", "10.16.4.19");
Deleted : user_pref("CT3298570.xpeMode", "0");


Deleted : user_pref("browser.search.defaultengine", "Ask.com");
Deleted : user_pref("browser.search.defaultthis.engineName", "MixiDJ V34 Customized Web Search");

Deleted : user_pref("browser.search.order.1", "Ask.com");


Deleted : user_pref("extensions.mywebsearch.prevDefaultEngine", "Google");
Deleted : user_pref("extensions.mywebsearch.prevKwdEnabled", true);

Deleted : user_pref("extensions.mywebsearch.prevSelectedEngine", "Google");

Deleted : user_pref("smartbar.addressBarOwnerCTID", "CT3298570");


Deleted : user_pref("smartbar.defaultSearchOwnerCTID", "CT3298570");
Deleted : user_pref("smartbar.homePageOwnerCTID", "CT3298570");
Deleted : user_pref("smartbar.machineId", "N39IKIBBUDXIONNKHS9CYDC3E966HXEVG9G1J1ZH/XOQBDEKWMDBZO0U9UJARL1HV0U[...]

-\\ Google Chrome v28.0.1500.72

File : C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.1] : icon_url ={"browser":{"window_placement":{"bottom":734,"left":20,"maximized":false,"right":1070,"top":20,"work[...]

*************************

AdwCleaner[s1].txt - [12519 octets] - [15/07/2013 18:29:40]

########## EOF - C:\AdwCleaner[s1].txt - [12580 octets] ##########

 

_________________________________________________________________________________________________

 

Link to post
Share on other sites

Why did you choose to reinstall Malwarebytes, that was not the intention in the given instructions, I quote the opening line:

 

 

Open Malwarebytes, check for updates then run Quick scan. Full instructions follow if  Malwarebytes is not installed:

 

Obviously if you already have MB installed all that is required is an update check and Quick scan....

 

OK if Malwarebytes no longer works maybe is best to try to uninstall/install again as follows:

 

Download and save mbam-clean.exe and save to your desktop from the following:

 

http://www.malwarebytes.org/mbam-clean.exe

 

Now do the following:

 

  •   
       
  • Click on Start and select Control Panel
       
  • Open Uninstall a Program
       
  • Uninstall Malwarebytes' Anti-Malware
       
  • Restart your computer, very important to do that!!
       
  • Run mbam-clean.exe
       
  • It will ask to restart your computer, please allow it to do so, very important!!
     
    Next, D/L and install Malwarebytes again and update as follows :-
     
    mbamicontw5.gif Please download Malwarebytes Anti-Malware and save it to your desktop.
    Alernative D/L mirror
    Alternative D/L mirror
     
    Double Click mbam-setup.exe to install the application.
     
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • Please save the log to a location you will remember.
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the entire report in your next reply.

 

Extra Note:

 

If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

 

Next,

 

Run Eset Online Scanner

 

**Note** You will need to use Internet explorer for this scan - Vista and win 7 right click on IE shortcut and run as admin

 

Go to Eset web page http://www.eset.com/home/products/online-scanner/ to run an online scan from ESET.

 

  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • click on the Run ESET Online Scanner button
  • Tick the box next to YES, I accept the Terms of Use.
    Click Start
  • When asked, allow the add/on to be installed
    Click Start
  • Make sure that the option Remove found threats is unticked
  • Click on Advanced Settings, ensure the options
  • Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
    Click Scan
  • wait for the virus definitions to be downloaded
  • Wait for the scan to finish

 

When the scan is complete

 

  • If no threats were found
  • put a checkmark in "Uninstall application on close"
  • close program
  • report to me that nothing was found

 

If threats were found

 

  • click on "list of threats found"
  • click on "export to text file" and save it as ESET SCAN and save to the desktop
  • Click on back
  • put a checkmark in "Uninstall application on close"
  • click on finish

 

close program

 

copy and paste the report here

 

Let me see those logs, also give update on any remaining issues or concerns..

 

Thank you,

 

Kevin

Link to post
Share on other sites

Malwarebyte ran for about 5 minutes then froze up with a white screen and said no responding for about an hour and a half, then this txt log popped up.. Malwarebytes is still not responding but heres what the log says..

 

Malwarebytes Anti-Malware (Trial) 1.75.0.1300
www.malwarebytes.org

Database version: v2013.07.16.05

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 7.0.6002.18005
owner :: OWNER-PC [administrator]

Protection: Enabled

7/16/2013 11:21:02 AM
mbam-log-2013-07-16 (11-21-02).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 288433
Time elapsed: 1 hour(s), 29 minute(s), 49 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
___________________________________________

 

Ive attached the ESET scan results as well as some screenshots of whats going on incase that helps

ESET SCAN.txt

post-142819-0-03036900-1373999590_thumb.

post-142819-0-91426100-1373999600_thumb.

post-142819-0-62753300-1373999609_thumb.

post-142819-0-62978900-1373999702_thumb.

Link to post
Share on other sites

Download OTM from either of the following links and save to your Desktop:

http://oldtimer.geekstogo.com/OTM.exe
http://www.itxassociates.com/OT-Tools/OTM.com
http://www.itxassociates.com/OT-Tools/OTM.exe  

Double click OTM.exe to start the tool. Vista or Windows 7 users accepy UAC alert. Be aware all processes will be stopped during run, also Desktop will disappear, this will be put back on completion....
 

  • Copy the text from the code box belowbelow to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :FilesC:\Program Files\Mozilla Firefox\browser\nsprotector.jsC:\Program Files\True Sword 4C:\Users\owner\AppData\Roaming\FrostWire\.AppSpecialShare\frostwire-5.3.3.windows.exeC:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\prefs.jsC:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\prefs.js.BAKC:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\prefs.js.newC:\Users\owner\Downloads\Player_Setup.exe:Commands[EmptyTemp]
  • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red btnmoveit.png button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTM

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

If the machine reboots, the Results log can be found here:

c:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log

Where mmddyyyy_hhmmss is the date of the tool run.

 

Next,

 

Please download RogueKiller from here:

] <- 32 bit version

] <- 64 bit version

 

 

 

 

Next,

 

Download OTL from any of the following links and save to your desktop.

 

http://itxassociates.com/OT-Tools/OTL.com

http://oldtimer.geekstogo.com/OTL.exe

http://www.itxassociates.com/OT-Tools/OTL.scr

 

Double click the OTL icon to start the tool. (Note: If you are running on Vista or Windows 7 accept UAC alert)

 

 

 

 

Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of OTL.Txt and the Extras.txt in your next reply.

 

Kevin

 

Link to post
Share on other sites

here is the log for OTM.. the links that you have for rouge killer are bad. I stopped there because I don't know if the order matters or not...

All processes killed
========== FILES ==========
C:\Program Files\Mozilla Firefox\browser\nsprotector.js moved successfully.
C:\Program Files\True Sword 4\backuped\9 folder moved successfully.
C:\Program Files\True Sword 4\backuped\8 folder moved successfully.
C:\Program Files\True Sword 4\backuped\7 folder moved successfully.
C:\Program Files\True Sword 4\backuped\6 folder moved successfully.
C:\Program Files\True Sword 4\backuped\5\Bin\2.5.0 folder moved successfully.
C:\Program Files\True Sword 4\backuped\5\Bin folder moved successfully.
C:\Program Files\True Sword 4\backuped\5 folder moved successfully.
C:\Program Files\True Sword 4\backuped\4 folder moved successfully.
C:\Program Files\True Sword 4\backuped\3 folder moved successfully.
C:\Program Files\True Sword 4\backuped\2 folder moved successfully.
C:\Program Files\True Sword 4\backuped\13 folder moved successfully.
C:\Program Files\True Sword 4\backuped\12 folder moved successfully.
C:\Program Files\True Sword 4\backuped\11 folder moved successfully.
C:\Program Files\True Sword 4\backuped\10 folder moved successfully.
C:\Program Files\True Sword 4\backuped\1 folder moved successfully.
C:\Program Files\True Sword 4\backuped\0 folder moved successfully.
C:\Program Files\True Sword 4\backuped folder moved successfully.
C:\Program Files\True Sword 4 folder moved successfully.
C:\Users\owner\AppData\Roaming\FrostWire\.AppSpecialShare\frostwire-5.3.3.windows.exe moved successfully.
C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\prefs.js moved successfully.
C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\prefs.js.BAK moved successfully.
C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\prefs.js.new moved successfully.
C:\Users\owner\Downloads\Player_Setup.exe moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: IUSR_NMPR
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Mcx1
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
 
User: owner
->Temp folder emptied: 3094333 bytes
->Temporary Internet Files folder emptied: 36841871 bytes
->Java cache emptied: 61681235 bytes
->FireFox cache emptied: 115899442 bytes
->Google Chrome cache emptied: 23807509 bytes
->Flash cache emptied: 3602 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
 
%systemdrive% .tmp files removed: 8607860 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 400007846 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 2332763 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 25426867 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 646.00 mb
 
 
OTM by OldTimer - Version 3.1.21.0 log created on 07162013_145147

Files moved on Reboot...

Registry entries deleted on Reboot...

Link to post
Share on other sites

RogueKiller V8.6.2 [Jul  5 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.adlice.com/forum/
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Started in : Normal mode
User : owner [Admin rights]
Mode : Scan -- Date : 07/16/2013 15:23:14
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 9 ¤¤¤
[HJ POL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowPrinters (0) -> FOUND
[HJ SMENU] HKCU\[...]\Advanced : Start_ShowRun (0) -> FOUND
[HJ SMENU] HKCU\[...]\Advanced : Start_TrackProgs (0) -> FOUND
[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ DESK] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[sCREENSVR][sUSP PATH] HKCU\[...]\Desktop : SCRNSAVE.EXE (C:\Windows\es.scr [-]) -> FOUND

¤¤¤ Scheduled tasks : 1 ¤¤¤
[V2][sUSP PATH] TopArcadeHits : C:\Users\owner\AppData\Local\TopArcadeHits\updater.exe [x] -> FOUND

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection :  ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1       localhost


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: Hitachi HDT725032VLA380 ATA Device +++++
--- User ---
[MBR] 91391958f5c7f391dfbc71051d84a654
[bSP] 2552b2d2227b2ea2b3c92a526a1a6f5d : MBR Code unknown
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 295978 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 606164580 | Size: 9264 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: Hitachi HDT725032VLA380 ATA Device +++++
--- User ---
[MBR] 9b4723ee49a02855032f34349a1fed7e
[bSP] 15bfa7208b69fa7369545c4b6121896c : MBR Code unknown
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 305242 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_S_07162013_152314.txt >>
 

 

OTL.Txt

 

Extras.Txt

Link to post
Share on other sites

Quit all programs that you may have started.

 

  • Please disconnect any USB or external drives from the computer before you run this scan!
  • For Vista or Windows 7, right-click and select "Run as Administrator" to start
  • For Windows XP, double-click to start.
  • Wait until Prescan has finished ...
  • Then Click on "Scan" button
  • Wait until the Status box shows "Scan Finished"
  • click on "delete"
  • Wait until the Status box shows "Deleting Finished"
  • Click on "Report" and copy/paste the content of the Notepad into your next reply.
  • The log should be found in RKreport[?].txt on your Desktop
  • Exit/Close RogueKiller

 

Next,

 

Re-Run otlDesktopIcon.png  by double left click, Vista and Widows 7 users accept UAC alert.



Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process.
If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start > All Programs > Accessories > Notepad), click File > Open, in the File Name box enter  *.log and press the Enter key, navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

 

Next,

 

Will Malwarebytes update and run a quick scan?

Link to post
Share on other sites

Malwarebytes is still freezing up very quickly after i start a quick scan

 

+++++ PhysicalDrive0: Hitachi HDT725032VLA380 ATA Device +++++
--- User ---
[MBR] 91391958f5c7f391dfbc71051d84a654
[bSP] 2552b2d2227b2ea2b3c92a526a1a6f5d : MBR Code unknown
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 295978 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 606164580 | Size: 9264 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: Hitachi HDT725032VLA380 ATA Device +++++
--- User ---
[MBR] 9b4723ee49a02855032f34349a1fed7e
[bSP] 15bfa7208b69fa7369545c4b6121896c : MBR Code unknown
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 305242 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_S_07162013_174735.txt >>
RKreport[0]_S_07162013_152314.txt
 

____________________________________________________________________________

 

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{937C650B-D097-4782-B5A2-F3E4E94BA9DE}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{937C650B-D097-4782-B5A2-F3E4E94BA9DE}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{cca2e567-1987-4100-a3c6-5b4267084510}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cca2e567-1987-4100-a3c6-5b4267084510}\ not found.
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\URLSearchHooks\\{A3BC75A2-1F87-4686-AA43-5347D756017C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C}\ not found.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\URLSearchHooks\\{A3BC75A2-1F87-4686-AA43-5347D756017C} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C}\ not found.
Registry key HKEY_USERS\S-1-5-21-1776157465-2995741927-3370165431-1001\Software\Microsoft\Internet Explorer\SearchScopes\{cca2e567-1987-4100-a3c6-5b4267084510}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cca2e567-1987-4100-a3c6-5b4267084510}\ not found.
Registry key HKEY_USERS\S-1-5-21-1776157465-2995741927-3370165431-1001\Software\Microsoft\Internet Explorer\SearchScopes\{E9FFE915-1B88-4B17-9B09-DF748F691CAB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9FFE915-1B88-4B17-9B09-DF748F691CAB}\ not found.
C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\33a6f8sf.default\extensions\{0113D088-8ED1-468C-B225-585A9C53B5E3}\skin folder moved successfully.
C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\33a6f8sf.default\extensions\{0113D088-8ED1-468C-B225-585A9C53B5E3}\chrome\content folder moved successfully.
C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\33a6f8sf.default\extensions\{0113D088-8ED1-468C-B225-585A9C53B5E3}\chrome folder moved successfully.
C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\33a6f8sf.default\extensions\{0113D088-8ED1-468C-B225-585A9C53B5E3} folder moved successfully.
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found.
C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk moved successfully.
C:\FRST\Quarantine\MyPC Backup.exe moved successfully.
ADS C:\ProgramData\TEMP:0B4227B4 deleted successfully.
ADS C:\ProgramData\TEMP:DEE7A5E5 deleted successfully.
ADS C:\ProgramData\TEMP:687E6626 deleted successfully.
ADS C:\ProgramData\TEMP:6B803FAA deleted successfully.
File ptytemp] not found.
File EATERESTOREPOINT] not found.
 
OTL by OldTimer - Version 3.2.69.0 log created on 07162013_175041

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
 

Link to post
Share on other sites

RogueKiller log you post is not from the Delete action.

 

Run the following then try Malwarebytes again..

 

download RKill from here: http://www.bleepingcomputer.com/download/rkill/

 

There are three buttons to choose from with different names on, select the first one and save it to your desktop.

 

  • Double-click on the Rkill desktop icon to run the tool.
  • If using Vista or Windows 7, right-click on it and Run As Administrator.
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • A log pops up at the end of the run. This log file is located at C:\rkill.log. Please post this in your next reply.
  • If you do not see the black box flash on the screen delete the icon from the desktop and go back to the link for the download, select the next button and try to run the tool again, continue to repeat this process using the remaining buttons until the tool runs. You will find further links if you scroll down the page with other names, try them one at a time.
  • If the tool does not run from any of the links provided, please let me know.

Link to post
Share on other sites

1.Download Malwarebytes Anti-Rootkit from this link:

 http://www.malwarebytes.org/products/mbar/

2. Unzip the File to a convenient location. (Recommend the Desktop)
3. Open the folder where the contents were unzipped to run mbar.exe

Image1.png

4. Double-click on the mbar.exe file, you may receive a User Account Control prompt asking if you are sure you wish to allow the program to run. Please allow the program to run and MBAR will now start to install any necessary drivers that are required for the program to operate correctly. If a rootkit is interfering with the installation of the drivers you will see a message that states that the DDA driver was not installed and that you should reboot your computer to install it. You will see this image:

mbarwm.png

5. If you receive this message, please click on the Yes button and Malwarebytes Anti-Rootkit will now restart your computer. Once the computer is rebooted and you login, MBAR will automatically start and you will now be at the start screen. (If no Rootkit warning you will go from step 4 to 6.)

6. The following image opens, select Next.

Image2.png

7. The following image opens, select Update

Image3.png

8. When the update completes select Next.

Image4.png

9. In the following window ensure "Targets" are ticked. Then select "Scan"

Image5.png

10. If an infection is found select the "Cleanup Button" to remove threats, Reboot if prompted. Wait while the system shuts down and the cleanup process is performed.

MBAntiRKcleanA.png

11. Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click "Cleanup Button" once more and repeat the process.
12. If no threats were found you will see the following image, Select Exit:

Image6.png

13. Verify that your system is now running normally, making sure that the following items are functional:


  •      
  • Internet access
         
  • Windows Update
         
  • Windows Firewall



14.  If there are additional problems with your system, such as any of those listed above or other system issues, then run the 'fixdamage' tool included within Malwarebytes Anti-Rootkit folder.

15. Select "Y" from your Keyboard, tap Enter.

16. The fix will be applied, select any key to Exit.

17. Let me know how your system now responds. Copy and paste the two following logs from the mbar folder:

System - log
Mbar - log   Date and time of scan will also be shown

Thanks,

Kevin...

Link to post
Share on other sites

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.