Jump to content

Rundll Error at startup after deleting a virus

Kristy
 Share

Recommended Posts

Kristy

Kristy

Posted
Posted

After I deleted a virus that kept redirecting me when I was using google, I started to get an error at start up saying that rundll specified module could not be found. I've attached the requested reports. The virus I think that I deleted was

 

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|cdnsd (Trojan.RedirRdll2.Gen) -> Data: "C:\Windows\System32\rundll32.exe" "C:\Users\REMI\AppData\Roaming\cdnsd.dll",RuntimeWarning -> Quarantined and deleted successfully.

 

attach.txt

dds.txt

Link to post
Share on other sites
  • Replies 52
  • Created
  • Last Reply

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Posted Images

MrCharlie

MrCharlie

Posted
Posted

Welcome to the forum.

Please download and run RogueKiller 32 Bit to your desktop.

RogueKiller 64 Bit <---use this one for 64 bit systems

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes)

P2P/Piracy Warning:

1. If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

2. If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

MrC

Note:

Please read all of my instructions completely including these.

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

Link to post
Share on other sites
Kristy

Kristy

Posted
  • Author
Posted

RogueKiller V8.6.3 _x64_ [Jul 17 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.adlice.com/forum/

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : REMI [Admin rights]

Mode : Scan -- Date : 07/19/2013 16:06:01

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 5 ¤¤¤

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-21-1388678563-3424193338-2402621213-1000\$25b0913f11e3de1a0963c62a86c12aaf\n. [x]) -> FOUND

[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-18\$25b0913f11e3de1a0963c62a86c12aaf\n. [x]) -> FOUND

[HJ INPROC][ZeroAccess] HKLM\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-18\$25b0913f11e3de1a0963c62a86c12aaf\n. [x]) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

　

　

　

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: Hitachi HDT721064SLA360 SATA Disk Device +++++

--- User ---

[MBR] 263a68260db680eeed00f7090f0881ff

[bSP] ec6431652de5e2a4d59e7fd946eccd50 : Windows Vista/7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 597171 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 1223213056 | Size: 13207 Mo

User = LL1 ... OK!

User != LL2 ... KO!

--- LL2 ---

[MBR] 88e42e907aec80f2e3f36dffeac43632

[bSP] 096ca65415799301792a33c93b5e78da : Windows XP MBR Code

Partition table:

+++++ PhysicalDrive1: Hitachi HDT721064SLA360 SATA Disk Device +++++

--- User ---

[MBR] 0cc19402417b787f04007be46d5a7d5b

[bSP] 33a07a59d299ab4ea9f4ab0156f9d86f : Windows XP MBR Code

Partition table:

0 - [ACTIVE] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 48 | Size: 15600 Mo

User = LL1 ... OK!

Error reading LL2 MBR!

Finished : << RKreport[0]_S_07192013_160601.txt >>

RKreport[0]_S_07192013_160410.txt

　

　

　

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Please read the following information first.

 

You're infected with Rootkit.ZeroAccess, a BackDoor Trojan also.

BACKDOOR WARNING

------------------------------

One or more of the identified infections is known to use a backdoor.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

http://www.dslreports.com/faq/10451

When Should I Format, How Should I Reinstall

http://www.dslreports.com/faq/10063

I will try my best to clean this machine but I can't guarantee that it will be 100% secure afterwards.

Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.

-----------------------------------------

Run RogueKiller again and click Scan

When the scan completes > click on the Registry tab

Put a check next to all of these and uncheck the rest: (if found)

 

[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-21-1388678563-3424193338-2402621213-1000\$25b0913f11e3de1a0963c62a86c12aaf\n. [x]) -> FOUND

[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-18\$25b0913f11e3de1a0963c62a86c12aaf\n. [x]) -> FOUND

[HJ INPROC][ZeroAccess] HKLM\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-18\$25b0913f11e3de1a0963c62a86c12aaf\n.

Now click Delete on the right hand column under Options

-------------

Then...............

Download Malwarebytes Anti-Rootkit from HERE

  • Unzip the contents to a folder in a convenient location.
  • Open the folder where the contents were unzipped and run mbar.exe
  • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  • Wait while the system shuts down and the cleanup process is performed.
  • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt
To attach a log if needed:

Bottom right corner of this page.

more-reply-options.jpg

New window that comes up.

choose-files1.jpg

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot. It's located in the Plugins folder which is in the MBAR folder.

Just run fixdamage.exe.

Verify that they are now functioning normally.

MrC

Link to post
Share on other sites
Kristy

Kristy

Posted
  • Author
Posted

Mr.C

Anti-Rootkit says it was clean the second run but when I restarted the rundll error still came up.

My Firewall is up and running, the pc indicates. It was not before.

The internet is slow and the windows defeneder has an access denied when trying to turn it on. Should I try to see if the computer will update yet?

 

 

mbar-log-2013-07-19 (16-46-51).txt

mbar-log-2013-07-19 (17-08-55).txt

system-log.txt

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

We'll get it all, just be patient....Next:

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

That looks Good, please do this:

 

Please download Farbar Recovery Scan Tool and save it to a folder. (64bit version)

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
MrC
Link to post
Share on other sites
Kristy

Kristy

Posted
  • Author
Posted

If I try to open Internet explorer on the infected pc it says

 

"c:\program files (x86)\Inter explorer\iexplore.exe    

Illegal operation attempted on a registry key that has been marked for deletion."

 

I can download it to the flash drive and try to run it on the infected pc?

Link to post
Share on other sites
Kristy

Kristy

Posted
  • Author
Posted
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-07-2013

Ran by REMI (administrator) on 19-07-2013 18:50:38

Running from C:\Users\REMI\Desktop\Farbar

Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)

Internet Explorer Version 9

Boot Mode: Normal

 

==================== Processes (Whitelisted) =================

 

(AMD) C:\Windows\system32\atiesrxx.exe

(AMD) C:\Windows\system32\atieclxx.exe

(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE

(Andrea Electronics Corporation) C:\Windows\system32\AEADISRV.EXE

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe

(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe

(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe

(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Desktop Keyboard\HPKEYBOARDx.EXE

() C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe

(Analog Devices, Inc.) C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe

(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\Buttons & OSDs control application gen3\FastUserSwitching.exe

(Hewlett-Packard) C:\Program Files (x86)\hp\HP Software Update\hpwuschd2.exe

(SHARP CORPORATION) C:\Program Files (x86)\Sharp\Sharpdesk\SharpTray.exe

(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\Buttons & OSDs control application gen3\JAN2OSD.exe

(SHARP CORPORATION) C:\Program Files (x86)\Sharp\Sharpdesk\FTPServer.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(SHARP CORPORATION) C:\Program Files (x86)\Sharp\Sharpdesk\nsapp.exe

() C:\Program Files (x86)\Hewlett-Packard\HP Desktop Keyboard\Keystatus.exe

(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\HPTouchSmartSyncCalReminderApp.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_7_700_224_ActiveX.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

 

==================== Registry (Whitelisted) ==================

 

HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1281512 2013-01-27] (Microsoft Corporation)

HKCU\...\Run: [iSUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)

HKLM-x32\...\Run: [hpsysdrv] - c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)

HKLM-x32\...\Run: [HP KEYBOARDx] - "C:\Program Files (x86)\Hewlett-Packard\HP Desktop Keyboard\HPKEYBOARDx.EXE" [715264 2009-07-15] (Hewlett-Packard)

HKLM-x32\...\Run: [HP Remote Solution] - %ProgramFiles%\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe [656896 2009-05-26] ()

HKLM-x32\...\Run: [soundMAXPnP] - C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1314816 2009-06-22] (Analog Devices, Inc.)

HKLM-x32\...\Run: [buttons & OSDs control application gen3] - c:\Program Files (x86)\Hewlett-Packard\Buttons & OSDs control application gen3\FastUserSwitching.exe [212992 2009-07-03] (Hewlett-Packard)

HKLM-x32\...\Run: [HP Software Update] - c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54576 2008-12-08] (Hewlett-Packard)

HKLM-x32\...\Run: [updatePRCShortCut] - "C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Hewlett-Packard\Recovery" UpdateWithCreateOnce "Software\CyberLink\PowerRecover" [222504 2009-05-20] (CyberLink Corp.)

HKLM-x32\...\Run: [startCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2010-02-02] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [sharpTray.exe] - "C:\Program Files (x86)\Sharp\Sharpdesk\SharpTray.exe" [131584 2009-12-08] (SHARP CORPORATION)

HKLM-x32\...\Run: [FtpServer.exe] - "C:\Program Files (x86)\Sharp\Sharpdesk\FtpServer.exe" -usedefault [819712 2009-12-08] (SHARP CORPORATION)

HKLM-x32\...\Run: [indexTray.exe] - "C:\Program Files (x86)\Sharp\Sharpdesk\IndexTray.exe" /n [395264 2009-12-08] (SHARP CORPORATION)

HKLM-x32\...\Run: [Nuance PDF Reader-reminder] - "C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\PDF Reader\Ereg\Ereg.ini" [333088 2010-07-05] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-11-28] (Apple Inc.)

HKLM-x32\...\Run: [sunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)

HKU\Default\...\Run: [HPADVISOR] -  [x]

HKU\Default User\...\Run: [HPADVISOR] -  [x]

 

==================== Internet (Whitelisted) ====================

 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://remanagementinc.onesite.realpage.com/

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - "C:\Program Files (x86)\Internet Explorer\iexplore.exe"

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM - {A301F322-0CE8-424C-BAE2-C006BFC5E047} URL = http://www.bing.com/search?q={searchTerms}&FORM=HPDTDF&pc=HPDTDF&src=IE-SearchBox

SearchScopes: HKLM - {A3E00317-782F-42C1-BFDB-55E379314EA6} URL = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd

SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 


SearchScopes: HKLM-x32 - {A301F322-0CE8-424C-BAE2-C006BFC5E047} URL = http://www.bing.com/search?q={searchTerms}&FORM=HPDTDF&pc=HPDTDF&src=IE-SearchBox

SearchScopes: HKLM-x32 - {A3E00317-782F-42C1-BFDB-55E379314EA6} URL = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd

SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 

SearchScopes: HKCU - {110a9ea2-8810-4c04-b916-cfd4e9427fec} URL = 

SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 

SearchScopes: HKCU - {A301F322-0CE8-424C-BAE2-C006BFC5E047} URL = 

SearchScopes: HKCU - {A3E00317-782F-42C1-BFDB-55E379314EA6} URL = 

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Telephony Toolbar Services - {431A60E6-675F-4b9f-B3F0-66E0FECC8B34} - C:\Program Files (x86)\TDS managedIP Assistant\bin\BW_Assistant_Enterprise_IE_S.dll (BroadSoft® Australia Pty Ltd)

BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Telephony Toolbar Call Control - {8F1FF1A7-C048-4d6b-B052-56E42CE427CB} - C:\Program Files (x86)\TDS managedIP Assistant\bin\BW_Assistant_Enterprise_IE_CC.dll (BroadSoft® Australia Pty Ltd)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Microsoft Live Search Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0560.0\msneshellx.dll (Microsoft Corp.)

BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)

Toolbar: HKLM-x32 - Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0560.0\msneshellx.dll (Microsoft Corp.)

Toolbar: HKLM-x32 - Telephony Toolbar Call Control - {6F6690B9-C5DB-4F08-8833-F2EF4DEE956B} - C:\Program Files (x86)\TDS managedIP Assistant\bin\BW_Assistant_Enterprise_IE_CC.dll (BroadSoft® Australia Pty Ltd)

Toolbar: HKLM-x32 - Telephony Toolbar Services - {F10D927F-D3DF-4734-98AB-DD258253F5FD} - C:\Program Files (x86)\TDS managedIP Assistant\bin\BW_Assistant_Enterprise_IE_S.dll (BroadSoft® Australia Pty Ltd)

Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

DPF: HKLM-x32 {0A05107F-7560-4F2F-8ADC-D498677447A5} http://hf678482.hwddns.com/NSRDVRCtrlX.ocx

DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: HKLM-x32 {4AEF8AEE-3DE8-4B69-8B6E-6353B6C59B50} http://onesite.realpage.com/coreglobal/RealpageCab/Realpage.cab

DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: sds - {79E0F14C-9C52-4218-89A7-7C4B0563D121} -  No File

Handler-x32: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files (x86)\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

Handler-x32: sds - {79E0F14C-9C52-4218-89A7-7C4B0563D121} - C:\Program Files (x86)\Sharp\Sharpdesk\ExplorerExtensions.dll (SHARP CORPORATION)

Tcpip\Parameters: [DhcpNameServer] 216.165.129.157 216.170.153.146

 

Chrome: 

=======



CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\gcswf32.dll No File

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File

CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll No File

CHR Plugin: (Chrome NaCl) - C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\ppGoogleNaClPluginChrome.dll No File

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.89\pdf.dll No File

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll No File

CHR Plugin: (Hulu Desktop) - C:\Windows\..\Users\Default\AppData\Local\HuluDesktop\instances\0.9.7.1\npHDPlg.dll (Hulu LLC)

CHR Plugin: (Default Plug-in) - default_plugin No File

CHR Extension: (YouTube) - C:\Users\REMI\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0

CHR Extension: (Google Search) - C:\Users\REMI\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0

CHR Extension: (Gmail) - C:\Users\REMI\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

 

==================== Services (Whitelisted) =================

 

R2 AEADIFilters; C:\Windows\system32\AEADISRV.EXE [111616 2008-07-15] (Andrea Electronics Corporation)

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22056 2013-01-27] (Microsoft Corporation)

S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [379360 2013-01-27] (Microsoft Corporation)

S2 WinDefend; C:\Windows\System32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)

 

==================== Drivers (Whitelisted) ====================

 

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [230320 2013-01-20] (Microsoft Corporation)

S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [130008 2013-01-20] (Microsoft Corporation)

S3 NW1950; C:\Windows\system32\DRIVERS\NW1950.sys [25080 2009-09-17] ()

R3 NWVoltron; C:\Windows\System32\DRIVERS\NWVoltron.sys [28920 2013-02-04] ()

S3 catchme; \??\C:\ComboFix\catchme.sys [x]

 

==================== NetSvcs (Whitelisted) ===================

 

 

==================== One Month Created Files and Folders ========

 

2013-07-19 18:50 - 2013-07-19 18:50 - 00000000 ____D C:\FRST

2013-07-19 18:49 - 2013-07-19 18:49 - 00000000 ____D C:\Users\REMI\Desktop\Farbar

2013-07-19 18:19 - 2013-07-19 18:19 - 00017309 _____ C:\ComboFix.txt

2013-07-19 18:08 - 2013-07-19 18:19 - 00000000 ____D C:\Qoobox

2013-07-19 18:08 - 2013-07-19 18:18 - 00000000 ____D C:\Windows\erdnt

2013-07-19 18:08 - 2011-06-26 01:45 - 00256000 _____ C:\Windows\PEV.exe

2013-07-19 18:08 - 2010-11-07 12:20 - 00208896 _____ C:\Windows\MBR.exe

2013-07-19 18:08 - 2009-04-19 23:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-07-19 18:08 - 2000-08-30 19:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-07-19 18:08 - 2000-08-30 19:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-07-19 18:08 - 2000-08-30 19:00 - 00098816 _____ C:\Windows\sed.exe

2013-07-19 18:08 - 2000-08-30 19:00 - 00080412 _____ C:\Windows\grep.exe

2013-07-19 18:08 - 2000-08-30 19:00 - 00068096 _____ C:\Windows\zip.exe

2013-07-19 18:05 - 2013-07-19 18:05 - 05091168 ____R (Swearware) C:\Users\REMI\Desktop\ComboFix.exe

2013-07-19 16:46 - 2013-07-19 17:30 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2013-07-19 16:42 - 2013-07-19 16:42 - 00000000 ____D C:\Users\REMI\Desktop\New folder

2013-07-19 16:38 - 2013-07-19 16:38 - 00002729 _____ C:\Users\REMI\Desktop\RKreport[0]_D_07192013_163852.txt

2013-07-19 16:38 - 2013-07-19 16:38 - 00002554 _____ C:\Users\REMI\Desktop\RKreport[0]_S_07192013_163828.txt

2013-07-19 16:06 - 2013-07-19 16:06 - 00002520 _____ C:\Users\REMI\Desktop\RKreport[0]_S_07192013_160601.txt

2013-07-19 16:04 - 2013-07-19 16:04 - 00002487 _____ C:\Users\REMI\Desktop\RKreport[0]_S_07192013_160410.txt

2013-07-19 16:02 - 2013-07-19 16:38 - 00000000 ____D C:\Users\REMI\Desktop\RK_Quarantine

2013-07-19 16:02 - 2013-07-19 16:02 - 03778560 _____ C:\Users\REMI\Desktop\RogueKillerX64.exe

2013-07-19 15:11 - 2013-07-19 15:11 - 00017570 _____ C:\Users\REMI\Desktop\attach.txt

2013-07-19 15:11 - 2013-07-19 15:11 - 00017138 _____ C:\Users\REMI\Desktop\dds.txt

2013-07-19 14:55 - 2013-07-19 14:55 - 00001115 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-07-19 14:55 - 2013-07-19 14:55 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-07-19 14:55 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2013-07-19 14:41 - 2013-07-19 14:41 - 00001945 _____ C:\Windows\epplauncher.mif

2013-07-19 14:41 - 2013-07-19 14:41 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client

2013-07-19 14:40 - 2013-07-19 14:41 - 00000000 ____D C:\Program Files\Microsoft Security Client

2013-07-18 10:51 - 2013-07-18 10:51 - 00808832 _____ C:\Windows\SysWOW64\PerfStringBackup.INI

2013-07-18 10:50 - 2013-07-18 10:55 - 00110477 _____ C:\Windows\iis7.log

2013-07-18 10:48 - 2013-07-19 15:02 - 00000000 ____D C:\inetpub

2013-07-18 10:41 - 2013-07-18 10:43 - 00000000 ____D C:\Windows\system32\MRT

2013-07-18 10:27 - 2013-07-19 15:07 - 00000000 ____D C:\Windows\Minidump

2013-07-18 10:27 - 2013-07-18 10:27 - 503611944 _____ C:\Windows\MEMORY.DMP

2013-07-18 10:27 - 2013-07-18 10:27 - 00276640 _____ C:\Windows\Minidump\071813-17206-01.dmp

2013-07-15 09:00 - 2013-07-15 09:00 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1ce8163a350f8e6.job

2013-07-11 16:33 - 2013-07-11 16:33 - 00015301 _____ C:\Users\REMI\Desktop\Copy of WP June 2013 TR and HAP Comparable.xlsx

2013-07-10 17:06 - 2013-05-29 01:15 - 17829376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-07-10 17:06 - 2013-05-29 00:50 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-07-10 17:06 - 2013-05-29 00:43 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-07-10 17:06 - 2013-05-29 00:36 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-07-10 17:06 - 2013-05-29 00:35 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-07-10 17:06 - 2013-05-29 00:34 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2013-07-10 17:06 - 2013-05-29 00:33 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll

2013-07-10 17:06 - 2013-05-29 00:31 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-07-10 17:06 - 2013-05-29 00:29 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-07-10 17:06 - 2013-05-29 00:29 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2013-07-10 17:06 - 2013-05-29 00:29 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2013-07-10 17:06 - 2013-05-29 00:27 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-07-10 17:06 - 2013-05-29 00:27 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-07-10 17:06 - 2013-05-29 00:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-07-10 17:06 - 2013-05-29 00:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2013-07-10 17:06 - 2013-05-29 00:18 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-07-10 17:06 - 2013-05-28 20:56 - 12333568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-07-10 17:06 - 2013-05-28 20:50 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-07-10 17:06 - 2013-05-28 20:48 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-07-10 17:06 - 2013-05-28 20:41 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2013-07-10 17:06 - 2013-05-28 20:41 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-07-10 17:06 - 2013-05-28 20:41 - 01104384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-07-10 17:06 - 2013-05-28 20:40 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll

2013-07-10 17:06 - 2013-05-28 20:38 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-07-10 17:06 - 2013-05-28 20:37 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2013-07-10 17:06 - 2013-05-28 20:36 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2013-07-10 17:06 - 2013-05-28 20:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-07-10 17:06 - 2013-05-28 20:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-07-10 17:06 - 2013-05-28 20:33 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-07-10 17:06 - 2013-05-28 20:33 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-07-10 17:06 - 2013-05-28 20:33 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2013-07-10 17:06 - 2013-05-28 20:29 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-07-10 08:33 - 2013-06-04 22:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-07-10 08:33 - 2013-06-04 01:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2013-07-10 08:33 - 2013-06-03 23:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2013-07-10 08:33 - 2013-05-06 01:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-07-10 08:33 - 2013-05-05 23:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-07-10 08:33 - 2013-04-09 18:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2013-07-10 08:33 - 2013-04-02 17:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2013-07-09 14:54 - 2013-07-09 14:54 - 00011874 _____ C:\Users\REMI\Desktop\July Pay-Vacate and Balances Due.xlsx

2013-07-03 11:15 - 2013-07-03 11:15 - 00000000 ____D C:\Users\REMI\AppData\Roaming\Malwarebytes

2013-07-03 11:15 - 2013-07-03 11:15 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-07-02 16:53 - 2013-07-02 16:53 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll

2013-07-02 16:53 - 2013-07-02 16:53 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2013-07-02 16:52 - 2013-07-02 16:52 - 00000000 ____D C:\ProgramData\McAfee

2013-07-02 15:12 - 2013-07-02 15:12 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_NWVoltron_01009.Wdf

2013-07-02 14:55 - 2013-05-13 00:51 - 01464320 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll

2013-07-02 14:55 - 2013-05-13 00:51 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll

2013-07-02 14:55 - 2013-05-13 00:51 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll

2013-07-02 14:55 - 2013-05-13 00:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll

2013-07-02 14:55 - 2013-05-12 23:45 - 01160192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll

2013-07-02 14:55 - 2013-05-12 23:45 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll

2013-07-02 14:55 - 2013-05-12 23:45 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

2013-07-02 14:55 - 2013-05-12 22:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe

2013-07-02 14:55 - 2013-05-12 22:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe

2013-07-02 14:55 - 2013-05-12 22:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll

2013-07-02 14:55 - 2013-05-10 00:49 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll

2013-07-02 14:55 - 2013-05-09 22:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll

2013-07-02 14:55 - 2013-03-19 00:53 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll

2013-07-02 14:55 - 2013-03-19 00:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll

2013-07-02 14:55 - 2013-02-27 01:02 - 00111448 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe

2013-07-02 14:55 - 2013-02-27 00:52 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2013-07-02 14:55 - 2013-02-27 00:52 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll

2013-07-02 14:55 - 2013-02-27 00:48 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2013-07-02 14:55 - 2013-02-27 00:47 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll

2013-07-02 14:55 - 2013-02-26 23:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2013-07-02 14:55 - 2013-02-26 23:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll

2013-07-02 14:55 - 2013-02-26 23:49 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2013-07-02 14:54 - 2013-05-08 01:39 - 01910632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-07-02 14:54 - 2013-04-10 01:01 - 00983400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys

2013-07-02 14:54 - 2013-04-10 01:01 - 00265064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys

2013-07-02 14:54 - 2011-02-03 06:25 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll

2013-07-02 14:51 - 2013-04-26 00:51 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll

2013-07-02 14:51 - 2013-04-25 23:55 - 00492544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll

2013-07-02 14:51 - 2013-04-25 18:30 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll

2013-07-02 14:51 - 2013-04-17 02:02 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll

2013-07-02 14:51 - 2013-04-17 01:24 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll

2013-07-02 14:51 - 2013-03-31 17:52 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll

2013-07-02 10:42 - 2013-07-02 10:42 - 01035696 _____ (Ask.com) C:\Users\REMI\Downloads\OffercastInstaller_AVR_U-0008-01-P.exe

2013-06-28 11:56 - 2013-06-28 16:58 - 00015512 _____ C:\Users\REMI\Desktop\WP June 2013 TR and HAP 2nd comparable.xlsx

2013-06-28 11:06 - 2013-06-28 14:00 - 00015612 _____ C:\Users\REMI\Desktop\Trail Creek June 2013 TR & Hap Comparable 2nd.xlsx

2013-06-27 13:10 - 2013-06-27 13:10 - 00017858 _____ C:\Users\REMI\Desktop\Trail Creek June 2013 TR & Hap Comparable.xlsx

2013-06-27 10:02 - 2013-06-27 10:02 - 00019347 _____ C:\Users\REMI\Desktop\WP June 2013 TR and HAP.xlsx

2013-06-20 11:10 - 2013-06-20 11:10 - 00302784 _____ C:\Users\REMI\Downloads\432 (2)

2013-06-20 11:10 - 2013-06-20 11:10 - 00302784 _____ C:\Users\REMI\Downloads\432 (1)

2013-06-19 09:02 - 2013-06-19 09:02 - 00302784 _____ C:\Users\REMI\Downloads\432

 

==================== One Month Modified Files and Folders =======

 

2013-07-19 18:50 - 2013-07-19 18:50 - 00000000 ____D C:\FRST

2013-07-19 18:49 - 2013-07-19 18:49 - 00000000 ____D C:\Users\REMI\Desktop\Farbar

2013-07-19 18:45 - 2009-07-13 23:51 - 00070760 _____ C:\Windows\setupact.log

2013-07-19 18:44 - 2010-03-10 02:36 - 01117126 _____ C:\Windows\WindowsUpdate.log

2013-07-19 18:23 - 2009-07-13 23:45 - 00015792 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-07-19 18:23 - 2009-07-13 23:45 - 00015792 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-07-19 18:19 - 2013-07-19 18:19 - 00017309 _____ C:\ComboFix.txt

2013-07-19 18:19 - 2013-07-19 18:08 - 00000000 ____D C:\Qoobox

2013-07-19 18:19 - 2009-07-13 22:20 - 00000000 __RHD C:\Users\Default

2013-07-19 18:18 - 2013-07-19 18:08 - 00000000 ____D C:\Windows\erdnt

2013-07-19 18:15 - 2009-07-13 21:34 - 00000215 _____ C:\Windows\system.ini

2013-07-19 18:14 - 2010-01-25 01:21 - 00348962 _____ C:\Windows\PFRO.log

2013-07-19 18:14 - 2009-07-13 21:34 - 78118912 _____ C:\Windows\system32\config\software.bak

2013-07-19 18:14 - 2009-07-13 21:34 - 14942208 _____ C:\Windows\system32\config\system.bak

2013-07-19 18:14 - 2009-07-13 21:34 - 00262144 _____ C:\Windows\system32\config\security.bak

2013-07-19 18:14 - 2009-07-13 21:34 - 00262144 _____ C:\Windows\system32\config\sam.bak

2013-07-19 18:14 - 2009-07-13 21:34 - 00262144 _____ C:\Windows\system32\config\default.bak

2013-07-19 18:05 - 2013-07-19 18:05 - 05091168 ____R (Swearware) C:\Users\REMI\Desktop\ComboFix.exe

2013-07-19 17:30 - 2013-07-19 16:46 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2013-07-19 16:42 - 2013-07-19 16:42 - 00000000 ____D C:\Users\REMI\Desktop\New folder

2013-07-19 16:38 - 2013-07-19 16:38 - 00002729 _____ C:\Users\REMI\Desktop\RKreport[0]_D_07192013_163852.txt

2013-07-19 16:38 - 2013-07-19 16:38 - 00002554 _____ C:\Users\REMI\Desktop\RKreport[0]_S_07192013_163828.txt

2013-07-19 16:38 - 2013-07-19 16:02 - 00000000 ____D C:\Users\REMI\Desktop\RK_Quarantine

2013-07-19 16:06 - 2013-07-19 16:06 - 00002520 _____ C:\Users\REMI\Desktop\RKreport[0]_S_07192013_160601.txt

2013-07-19 16:04 - 2013-07-19 16:04 - 00002487 _____ C:\Users\REMI\Desktop\RKreport[0]_S_07192013_160410.txt

2013-07-19 16:02 - 2013-07-19 16:02 - 03778560 _____ C:\Users\REMI\Desktop\RogueKillerX64.exe

2013-07-19 15:27 - 2010-11-16 09:55 - 00000000 ____D C:\ProgramData\Recovery

2013-07-19 15:26 - 2011-11-18 11:07 - 00000000 ____D C:\Users\REMI\Documents\Outlook Files

2013-07-19 15:11 - 2013-07-19 15:11 - 00017570 _____ C:\Users\REMI\Desktop\attach.txt

2013-07-19 15:11 - 2013-07-19 15:11 - 00017138 _____ C:\Users\REMI\Desktop\dds.txt

2013-07-19 15:08 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\system32\NDF

2013-07-19 15:08 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\system32\inetsrv

2013-07-19 15:07 - 2013-07-18 10:27 - 00000000 ____D C:\Windows\Minidump

2013-07-19 15:07 - 2010-09-01 11:37 - 00000000 ____D C:\Users\REMI\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Recovery Manager

2013-07-19 15:07 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\servicing

2013-07-19 15:06 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\registration

2013-07-19 15:06 - 2009-07-13 22:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared

2013-07-19 15:03 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\PolicyDefinitions

2013-07-19 15:02 - 2013-07-18 10:48 - 00000000 ____D C:\inetpub

2013-07-19 14:55 - 2013-07-19 14:55 - 00001115 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-07-19 14:55 - 2013-07-19 14:55 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-07-19 14:41 - 2013-07-19 14:41 - 00001945 _____ C:\Windows\epplauncher.mif

2013-07-19 14:41 - 2013-07-19 14:41 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client

2013-07-19 14:41 - 2013-07-19 14:40 - 00000000 ____D C:\Program Files\Microsoft Security Client

2013-07-19 14:40 - 2010-01-25 01:51 - 00000000 ____D C:\ProgramData\Symantec

2013-07-19 12:33 - 2010-09-01 11:37 - 00000000 ____D C:\Users\REMI

2013-07-19 11:58 - 2009-07-14 02:44 - 00000000 ___RD C:\Users\Public\Recorded TV

2013-07-19 10:50 - 2012-03-26 11:35 - 01494016 ___SH C:\Users\REMI\Desktop\Thumbs.db

2013-07-19 09:14 - 2010-09-01 11:47 - 00000000 ___RD C:\Users\REMI\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2013-07-18 10:55 - 2013-07-18 10:50 - 00110477 _____ C:\Windows\iis7.log

2013-07-18 10:52 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\inetsrv

2013-07-18 10:51 - 2013-07-18 10:51 - 00808832 _____ C:\Windows\SysWOW64\PerfStringBackup.INI

2013-07-18 10:51 - 2009-07-14 00:13 - 00852386 _____ C:\Windows\system32\PerfStringBackup.INI

2013-07-18 10:43 - 2013-07-18 10:41 - 00000000 ____D C:\Windows\system32\MRT

2013-07-18 10:27 - 2013-07-18 10:27 - 503611944 _____ C:\Windows\MEMORY.DMP

2013-07-18 10:27 - 2013-07-18 10:27 - 00276640 _____ C:\Windows\Minidump\071813-17206-01.dmp

2013-07-17 08:42 - 2012-10-04 08:51 - 00021961 _____ C:\Users\REMI\Desktop\Leave, Lockouts & Guests.xlsx

2013-07-16 08:50 - 2012-07-11 15:57 - 00000000 ____D C:\Users\REMI\Desktop\Kristy

2013-07-15 13:27 - 2013-03-26 09:04 - 00000000 ____D C:\Users\REMI\Desktop\Homework

2013-07-15 09:00 - 2013-07-15 09:00 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1ce8163a350f8e6.job

2013-07-11 16:33 - 2013-07-11 16:33 - 00015301 _____ C:\Users\REMI\Desktop\Copy of WP June 2013 TR and HAP Comparable.xlsx

2013-07-11 08:09 - 2009-07-13 23:45 - 05062824 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-11 08:07 - 2013-03-13 20:28 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-07-11 08:07 - 2013-03-13 20:28 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-07-11 08:07 - 2009-07-14 02:45 - 00000000 ____D C:\Program Files\Windows Journal

2013-07-11 08:07 - 2009-07-14 00:32 - 00000000 ____D C:\Program Files\Windows Defender

2013-07-11 08:07 - 2009-07-14 00:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2013-07-10 17:13 - 2011-11-18 09:53 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-07-09 16:49 - 2012-04-12 07:49 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-07-09 16:36 - 2010-09-20 14:07 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-07-09 14:54 - 2013-07-09 14:54 - 00011874 _____ C:\Users\REMI\Desktop\July Pay-Vacate and Balances Due.xlsx

2013-07-09 12:21 - 2010-09-13 11:12 - 00003918 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{ECC53184-6F94-4BDF-97B7-3DC900F641B6}

2013-07-09 08:51 - 2012-01-27 10:47 - 00000426 _____ C:\Windows\BRWMARK.INI

2013-07-09 08:09 - 2011-05-27 12:43 - 00000328 _____ C:\Windows\Tasks\HPCeeScheduleForREMI.job

2013-07-09 08:09 - 2009-07-14 00:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-07-08 10:22 - 2010-09-01 11:53 - 00000456 _____ C:\Windows\Tasks\PCDRScheduledMaintenance.job

2013-07-08 08:36 - 2011-11-03 13:37 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt

2013-07-08 08:36 - 2011-05-27 12:43 - 00003180 _____ C:\Windows\System32\Tasks\HPCeeScheduleForREMI

2013-07-08 08:36 - 2010-09-09 14:14 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log

2013-07-08 08:35 - 2010-09-07 08:47 - 00000000 ____D C:\Users\REMI\AppData\Roaming\HP Support Assistant

2013-07-08 08:35 - 2010-09-02 13:03 - 00000000 ____D C:\Users\REMI\AppData\Roaming\HpUpdate

2013-07-08 08:31 - 2010-09-01 11:45 - 00119184 _____ C:\Users\REMI\AppData\Local\GDIPFONTCACHEV1.DAT

2013-07-03 11:15 - 2013-07-03 11:15 - 00000000 ____D C:\Users\REMI\AppData\Roaming\Malwarebytes

2013-07-03 11:15 - 2013-07-03 11:15 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-07-03 08:11 - 2010-09-01 11:47 - 00000000 ___RD C:\Users\REMI\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

2013-07-03 04:01 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\rescache

2013-07-02 16:53 - 2013-07-02 16:53 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll

2013-07-02 16:53 - 2013-07-02 16:53 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2013-07-02 16:53 - 2011-12-13 09:41 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll

2013-07-02 16:53 - 2011-12-13 09:41 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2013-07-02 16:53 - 2011-12-13 09:41 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2013-07-02 16:53 - 2011-12-13 09:41 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2013-07-02 16:53 - 2011-12-13 09:41 - 00000000 ____D C:\Program Files (x86)\Java

2013-07-02 16:52 - 2013-07-02 16:52 - 00000000 ____D C:\ProgramData\McAfee

2013-07-02 15:12 - 2013-07-02 15:12 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_NWVoltron_01009.Wdf

2013-07-02 10:42 - 2013-07-02 10:42 - 01035696 _____ (Ask.com) C:\Users\REMI\Downloads\OffercastInstaller_AVR_U-0008-01-P.exe

2013-06-28 16:58 - 2013-06-28 11:56 - 00015512 _____ C:\Users\REMI\Desktop\WP June 2013 TR and HAP 2nd comparable.xlsx

2013-06-28 14:00 - 2013-06-28 11:06 - 00015612 _____ C:\Users\REMI\Desktop\Trail Creek June 2013 TR & Hap Comparable 2nd.xlsx

2013-06-27 13:10 - 2013-06-27 13:10 - 00017858 _____ C:\Users\REMI\Desktop\Trail Creek June 2013 TR & Hap Comparable.xlsx

2013-06-27 10:02 - 2013-06-27 10:02 - 00019347 _____ C:\Users\REMI\Desktop\WP June 2013 TR and HAP.xlsx

2013-06-24 00:57 - 2010-09-13 11:11 - 78277128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2013-06-20 11:10 - 2013-06-20 11:10 - 00302784 _____ C:\Users\REMI\Downloads\432 (2)

2013-06-20 11:10 - 2013-06-20 11:10 - 00302784 _____ C:\Users\REMI\Downloads\432 (1)

2013-06-19 09:02 - 2013-06-19 09:02 - 00302784 _____ C:\Users\REMI\Downloads\432

 

==================== Bamital & volsnap Check =================

 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

 

 

LastRegBack: 2013-07-03 03:54

 

==================== End Of Log ============================

Addition.txt

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted
Check the Device Manager.

 

1. Click START

2. Right click 'Computer' and select 'Properties'

3. Click 'Device Manager' in the upper left corner of the screen

 

Are there any devices with Yellow Triangles/Exclamation Points next to them?

 

MrC

Link to post
Share on other sites
Kristy

Kristy

Posted
  • Author
Posted

It says:

 

the best driver software for your device is already installed.

Windows has determined the driver software for your device is up to date.

 

 

 

But...

Device status in the general tab says:

Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged (Code 19)

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.