Trojan.FakeMS detected

[Pauline]

sorry, was called away for an emergency and will be able to be back later in the day or so.  will perform the AVG CD rescue and revert.  thanks.

[Pauline]

I am not successful in getting the AVG Rescue DC to run.  Here are the details:

 

I burned onto a CD-R 700mb and it was successful.  I changed the BIOS to have CDROM at number 1.  I double checked this.  I could hear the CD spinning but it opened up to the usual Windows desktop.  There was no Boot Menu for me to choose AVG Resuce DC(1) and no Discaimer screen.

 

I checked that my CD player was OK by viewing some old CD-R and it was fine.

 

The CD I burned appears to hae zero free space and 101 Mb used space (106,354,688 bytes). 

 

In the process of downloading the Iso Burner a window opened to say "No SPTD Viewer detected".

 

Please advise next move and if I should reset the BIOS to previous setting.

[Pauline]

I tested the CD I burned on another laptop and the Boot Up Menu popped up as you described.

[gringo_pr]

Hello Pauline

lets see if ESET will clean them

Go ahead and run eset again and allow it to delete what it finds

Gringo

[Pauline]

I ran ESET and opted for "remove found threats".  The computer then rebooted itself.  I have been browsing and so far so good. 

[gringo_pr]

Hello

That is good

I want you to run it again and let me know if it comes back clean - it is a nasty virus and want to make sure it is gone

Gringo

[Pauline]

Should I run it without removing threats so that if any are present they will show up in the log?

[gringo_pr]

Hello

that will work

gringo

[Pauline]

Unfortunately, this the result of the latest ESET scan (120+ threats)

 

C:\OEM\CHANGECOMPUTERICON\CABARC.EXE Win32/Expiro.NBF virus
C:\OEM\CHANGECOMPUTERICON\ComputerHardwareIds.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\CheckFiles.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\APP\Adobe Flash Player\Install Flash Player 10 ActiveX.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\APP\Bing Bar\InstallManager_GEN_GEN.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\APP\Bing Bar\OEM\Packages\default\ARPManager.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\APP\Bing Bar\OEM\Packages\default\SearchEnhancementPackSetup.EXE Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\APP\Bing Bar\OEM\Packages\default\Silverlight.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\APP\Gateway MyBackup\Setup.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\APP\Gateway Power Management\changeInstallPeriod.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\APP\Gateway Power Management\CompileMOF.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\APP\Gateway Power Management\ePowerIdentifier_20100113_1512_sign.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\APP\Gateway Power Management\RemoveAutorun.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\APP\Nero 9 Essentials Gateway Edition\Nero 9 Essentials\setupx.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\APP\Netflix Shortcut\StartURL.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\APP\PowerDVD v9.0\brs.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\APP\PowerDVD v9.0\changeInstallPeriod.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\APP\PowerDVD v9.0\chkODD.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\APP\PowerDVD v9.0\instmsiw.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\APP\PowerDVD v9.0\vcredist_x86.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\APP\Social Networks\vcredist_x86.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\AutorunX\AutorunX.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Broadcom Lan BCM57780\setup.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Dritek Launch Manager (GTW)\dsiwmis.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Dritek Launch Manager (GTW)\LManager.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Dritek Launch Manager (GTW)\LMconfig.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Dritek Launch Manager (GTW)\LMworker.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Dritek Launch Manager (GTW)\MkServis.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Dritek Launch Manager (GTW)\MMDx64Fx.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Dritek Launch Manager (GTW)\runxx.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Dritek Launch Manager (GTW)\Setup.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Dritek Launch Manager (GTW)\UNINST32.EXE Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Dritek Launch Manager (GTW)\x64Commander.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Intel iAMT MEI\Setup.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Intel iAMT MEI\Intel Control Center\SetupICC.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Intel iAMT MEI\LMS\LMS.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Intel iAMT MEI\UNS\UNS.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Intel iAMT MEI\x64\Drv64.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Intel iAMT MEI\x64\MEcp64.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Intel NB Chipset HM55\Setup.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Intel NB Chipset HM55\x64\Difx64.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Intel Turbo Boost TBT Driver\Setup.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Intel Turbo Boost TBT Driver\x64\Drv64.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Intel Turbo Boost Turbo Boost Monitor\devcon_x64.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Intel Turbo Boost Turbo Boost Monitor\RemoveAutorun.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Intel VGA Chip UMA\Setup.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Intel VGA Chip UMA\Graphics\difx64.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Intel VGA Chip UMA\Graphics\igxpun.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Intel VGA Chip UMA\Intel Control Center\SetupICC.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Intel VGA Chip UMA\x64\Drv64.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\HDMI\Vista\RtkAudioSrvATI.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\HDMI\Vista64\RtkAudioSrvATI64.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\MSHDQFE\Win2K3\us\kb888111srvrtm.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\MSHDQFE\Win2K_XP\us\kb888111w2ksp4.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\MSHDQFE\Win2K_XP\us\kb888111xpsp1.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\MSHDQFE\Win2K_XP\us\kb888111xpsp2.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista\AERTSrv.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista\RtHDVBg.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista\RtHDVCpl.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista\RtkAudioService.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista\RtkNGUI.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista\SkyTel.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista\vncutil.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista64\AERTSr64.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista64\RAVBg64.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista64\RAVCpl64.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista64\RtkAudioService64.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista64\RtkNGUI64.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista64\SkyTel.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista64\vncutil64.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\WDM\RtkAudioService.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\WDM\RtkAudioService64.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\WDM\SkyTel.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\WDM\vncutil.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\WDM\vncutil64.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Realtek Card Reader Chip RTS5159-GR\RmbChange.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Realtek Card Reader Chip RTS5159-GR\DriverBin_32bit\revcon.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Realtek Card Reader Chip RTS5159-GR\DriverBin_64bit\revcon.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Suyin Camera utility Crystal Eye\INT15_Detect.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Suyin Camera utility Crystal Eye\RemoveAutorun.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Synaptics Touchpad\WinWDF\x64\dpinst.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Synaptics Touchpad\WinWDF\x64\SynMood.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Synaptics Touchpad\WinWDF\x64\SynTPEnh.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Synaptics Touchpad\WinWDF\x64\SynTPHelper.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\DRV\Synaptics Touchpad\WinWDF\x64\SynZMetr.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Synaptics Touchpad\WinWDF\x86\dpinst.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Synaptics Touchpad\WinWDF\x86\SynMood.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Synaptics Touchpad\WinWDF\x86\SynTPEnh.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Synaptics Touchpad\WinWDF\x86\SynTPHelper.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\DRV\Synaptics Touchpad\WinWDF\x86\SynZMetr.exe Win32/Expiro.NBF virus
C:\OEM\Preload\Autorun\GUI\Gateway InfoCenter\EN\set.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\GUI\Gateway InfoCenter\ES\set.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\GUI\Gateway InfoCenter\FR\set.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\GUI\Gateway InfoCenter\ID\set.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\GUI\Gateway InfoCenter\JA\set.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\GUI\Gateway InfoCenter\PT\set.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\GUI\Gateway InfoCenter\SC\set.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\GUI\Gateway InfoCenter\TC\set.exe Win64/Expiro.A virus
C:\OEM\Preload\Autorun\GUI\Gateway InfoCenter\TH\set.exe Win64/Expiro.A virus
C:\OEM\Preload\Command\AlaunchX\AppInRun.exe Win64/Expiro.A virus
C:\OEM\Preload\Command\AlaunchX\LaunchAlaunchX.exe Win64/Expiro.A virus
C:\OEM\Preload\utility\devcon.exe Win64/Expiro.A virus
C:\OEM\Preload\utility\Dummy_X64.exe Win64/Expiro.A virus
C:\OEM\Preload\utility\Dummy_X86.exe Win32/Expiro.NBF virus
C:\OEM\Preload\utility\NowIntoDT.exe Win32/Expiro.NBF virus
C:\OEM\Preload\utility\RunCmd_X64.exe Win64/Expiro.A virus
C:\OEM\Preload\utility\setEvent.exe Win32/Expiro.NBF virus
C:\OEM\Preload\utility\SetScreenSaver.exe Win32/Expiro.NBF virus
C:\OEM\Preload\utility\waitEvent.exe Win32/Expiro.NBF virus
C:\OEM\Preload\utility\Audit\Factory\AcrShutDown.exe Win64/Expiro.A virus
C:\OEM\Preload\utility\Audit\Factory\BackupPwrPfl.exe Win64/Expiro.A virus
C:\OEM\Preload\utility\OOBEOffer\CallProcessNoWait.exe Win32/Expiro.NBF virus
C:\OEM\Preload\utility\OOBEOffer\HS.exe Win32/Expiro.NBF virus
C:\OEM\Preload\utility\OOBEOffer\OnlyBackGround.exe Win32/Expiro.NBF virus
C:\OEM\Preload\utility\OOBEOffer\OOBESWUtil.exe Win32/Expiro.NBF virus
C:\Qoobox\Quarantine\C\Users\S and P\AppData\Roaming\Mozilla\Firefox\Profiles\9bvs2kj0.default\extensions\{ec9032c7-c20a-464f-7b0e-13a3a9e97385}\components\red.js.vir JS/Redirector.NBI trojan
C:\Users\S and P\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlddmedljhmbgdhapibnagaanenmajcm\1.0_0\background.js JS/Agent.NJR trojan
C:\Users\S and P\AppData\Roaming\Real\Update\temp\~Upg0\rnupgagent.exe Win32/Expiro.NBF virus
C:\Users\S and P\AppData\Roaming\Real\Update\temp\~Upg1\rnupgagent.exe Win32/Expiro.NBF virus
C:\Users\S and P\AppData\Roaming\Real\Update\temp\~Upg3\rnupgagent.exe Win32/Expiro.NBF virus
C:\Users\S and P\AppData\Roaming\Real\Update\temp\~Upg6\rnupgagent.exe Win32/Expiro.NBF virus
C:\Users\S and P\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\rnupgagent.exe Win32/Expiro.NBF virus
C:\Users\S and P\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\stub_data\RealPlayer.exe Win32/Expiro.NBF virus
C:\Users\S and P\Documents\Steves\LGGCC\Autorun.exe Win32/Expiro.NBF virus
C:\Windows\AutoKMS.exe MSIL/HackKMS.A application
C:\Windows\KMSEmulator.exe Win32/HackKMS.A application
C:\Windows\setpwlin.exe Win32/Expiro.NBF virus
C:\Windows\UNINSTLMv4.EXE Win32/Expiro.NBF virus
C:\Windows\DeployWinRE2\DeployWinRE_x64.exe Win64/Expiro.A virus
 

[Pauline]

The computer now reboots itself now and then while I am browsing.  Not freezing up like previously but just rebooting.

[gringo_pr]

Hello Pauline

Lets see if this will run now.

Dr.Web CureIt

Download to the desktop: Dr.Web CureIt

• Doubleclick the drweb-cureit.exe file and Allow to run the express scan
• This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
• Once the short scan has finished, Click Options > Change settings
• Choose the "Scan"-tab, remove the mark at "Heuristic analysis".
• Back at the main window, mark the drives that you want to scan.
• Select all drives. A red dot shows which drives have been chosen.
• Click the green arrow at the right, and the scan will start.
• Click 'Yes to all' if it asks if you want to cure/move the file.
• When the scan has finished, look if you can click next icon next to the files found:

  

  If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:

  

  This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)

• After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
• Save the report to your desktop. The report will be called DrWeb.csv
• Close Dr.Web Cureit.
• Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
• After reboot, post the contents of the log from Dr.Web you saved previously in your next reply with a new hijackthis log.

Gringo

[Pauline]

I have not yet Dr Web CureIt for 2 reasons:

1.  I am a little confused by your very last line - After reboot...........in your next reply with a NEW HIJACKTHIS LOG.  What do you mean new Hijackthis log?  Did you want me to run HijackThis after Dr Web CureIt?  Or is it a typograhical mistake?

2.  I was a ittle suspicious that on my atttempt to disinfect with ESET, the computer just rebooted and did not show me a window of what was accomplished.  Therefore, I took the liberty of runnng ESET again and the result is that 129 infected files were found, of which only 121 were cleaned.  Below is the log:

 

Please advise if you want me to run Dr CureIt after this.  If so, kindly clairfy the disambiguity about HijackThis.

 

Also please advise how I should treat the quarantined files ESET found, and the next steps to address the 8 files not cleaned.  Thanks.

 

 

C:\Users\S and P\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\rnupgagent.exe Win32/Expiro.NBF virus 
C:\Users\S and P\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\stub_data\RealPlayer.exe Win32/Expiro.NBF virus 
C:\Users\S and P\Documents\Steves\LGGCC\Autorun.exe Win32/Expiro.NBF virus 
C:\Windows\AutoKMS.exe MSIL/HackKMS.A application 
C:\Windows\KMSEmulator.exe Win32/HackKMS.A application 
C:\Windows\setpwlin.exe Win32/Expiro.NBF virus 
C:\Windows\UNINSTLMv4.EXE Win32/Expiro.NBF virus 
C:\Windows\DeployWinRE2\DeployWinRE_x64.exe Win64/Expiro.A virus 
C:\OEM\CHANGECOMPUTERICON\CABARC.EXE Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\CHANGECOMPUTERICON\ComputerHardwareIds.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\CheckFiles.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\APP\Adobe Flash Player\Install Flash Player 10 ActiveX.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\APP\Bing Bar\InstallManager_GEN_GEN.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\APP\Bing Bar\OEM\Packages\default\ARPManager.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\APP\Bing Bar\OEM\Packages\default\SearchEnhancementPackSetup.EXE Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\APP\Bing Bar\OEM\Packages\default\Silverlight.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\APP\Gateway MyBackup\Setup.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\APP\Gateway Power Management\changeInstallPeriod.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\APP\Gateway Power Management\CompileMOF.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\APP\Gateway Power Management\ePowerIdentifier_20100113_1512_sign.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\APP\Gateway Power Management\RemoveAutorun.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\APP\Nero 9 Essentials Gateway Edition\Nero 9 Essentials\setupx.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\APP\Netflix Shortcut\StartURL.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\APP\PowerDVD v9.0\brs.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\APP\PowerDVD v9.0\changeInstallPeriod.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\APP\PowerDVD v9.0\chkODD.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\APP\PowerDVD v9.0\instmsiw.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\APP\PowerDVD v9.0\vcredist_x86.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\APP\Social Networks\vcredist_x86.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\AutorunX\AutorunX.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Broadcom Lan BCM57780\setup.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Dritek Launch Manager (GTW)\dsiwmis.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Dritek Launch Manager (GTW)\LManager.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Dritek Launch Manager (GTW)\LMconfig.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Dritek Launch Manager (GTW)\LMworker.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Dritek Launch Manager (GTW)\MkServis.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Dritek Launch Manager (GTW)\MMDx64Fx.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Dritek Launch Manager (GTW)\runxx.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Dritek Launch Manager (GTW)\Setup.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Dritek Launch Manager (GTW)\UNINST32.EXE Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Dritek Launch Manager (GTW)\x64Commander.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Intel iAMT MEI\Setup.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Intel iAMT MEI\Intel Control Center\SetupICC.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Intel iAMT MEI\LMS\LMS.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Intel iAMT MEI\UNS\UNS.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Intel iAMT MEI\x64\Drv64.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Intel iAMT MEI\x64\MEcp64.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Intel NB Chipset HM55\Setup.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Intel NB Chipset HM55\x64\Difx64.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Intel Turbo Boost TBT Driver\Setup.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Intel Turbo Boost TBT Driver\x64\Drv64.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Intel Turbo Boost Turbo Boost Monitor\devcon_x64.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Intel Turbo Boost Turbo Boost Monitor\RemoveAutorun.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Intel VGA Chip UMA\Setup.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Intel VGA Chip UMA\Graphics\difx64.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Intel VGA Chip UMA\Graphics\igxpun.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Intel VGA Chip UMA\Intel Control Center\SetupICC.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Intel VGA Chip UMA\x64\Drv64.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\HDMI\Vista\RtkAudioSrvATI.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\HDMI\Vista64\RtkAudioSrvATI64.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\MSHDQFE\Win2K3\us\kb888111srvrtm.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\MSHDQFE\Win2K_XP\us\kb888111w2ksp4.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\MSHDQFE\Win2K_XP\us\kb888111xpsp1.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\MSHDQFE\Win2K_XP\us\kb888111xpsp2.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista\AERTSrv.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista\RtHDVBg.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista\RtHDVCpl.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista\RtkAudioService.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista\RtkNGUI.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista\SkyTel.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista\vncutil.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista64\AERTSr64.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista64\RAVBg64.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista64\RAVCpl64.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista64\RtkAudioService64.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista64\RtkNGUI64.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista64\SkyTel.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\Vista64\vncutil64.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\WDM\RtkAudioService.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\WDM\RtkAudioService64.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\WDM\SkyTel.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\WDM\vncutil.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Audio Codec ALC272X\WDM\vncutil64.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Card Reader Chip RTS5159-GR\RmbChange.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Card Reader Chip RTS5159-GR\DriverBin_32bit\revcon.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Realtek Card Reader Chip RTS5159-GR\DriverBin_64bit\revcon.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Suyin Camera utility Crystal Eye\INT15_Detect.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Suyin Camera utility Crystal Eye\RemoveAutorun.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Synaptics Touchpad\WinWDF\x64\dpinst.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Synaptics Touchpad\WinWDF\x64\SynMood.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Synaptics Touchpad\WinWDF\x64\SynTPEnh.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Synaptics Touchpad\WinWDF\x64\SynTPHelper.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Synaptics Touchpad\WinWDF\x64\SynZMetr.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Synaptics Touchpad\WinWDF\x86\dpinst.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Synaptics Touchpad\WinWDF\x86\SynMood.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Synaptics Touchpad\WinWDF\x86\SynTPEnh.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Synaptics Touchpad\WinWDF\x86\SynTPHelper.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\DRV\Synaptics Touchpad\WinWDF\x86\SynZMetr.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\Autorun\GUI\Gateway InfoCenter\EN\set.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\GUI\Gateway InfoCenter\ES\set.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\GUI\Gateway InfoCenter\FR\set.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\GUI\Gateway InfoCenter\ID\set.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\GUI\Gateway InfoCenter\JA\set.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\GUI\Gateway InfoCenter\PT\set.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\GUI\Gateway InfoCenter\SC\set.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\GUI\Gateway InfoCenter\TC\set.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Autorun\GUI\Gateway InfoCenter\TH\set.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Command\AlaunchX\AppInRun.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\Command\AlaunchX\LaunchAlaunchX.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\utility\devcon.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\utility\Dummy_X64.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\utility\Dummy_X86.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\utility\NowIntoDT.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\utility\RunCmd_X64.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\utility\setEvent.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\utility\SetScreenSaver.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\utility\waitEvent.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\utility\Audit\Factory\AcrShutDown.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\utility\Audit\Factory\BackupPwrPfl.exe Win64/Expiro.A virus cleaned - quarantined
C:\OEM\Preload\utility\OOBEOffer\CallProcessNoWait.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\utility\OOBEOffer\HS.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\utility\OOBEOffer\OnlyBackGround.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\OEM\Preload\utility\OOBEOffer\OOBESWUtil.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\Qoobox\Quarantine\C\Users\S and P\AppData\Roaming\Mozilla\Firefox\Profiles\9bvs2kj0.default\extensions\{ec9032c7-c20a-464f-7b0e-13a3a9e97385}\components\red.js.vir JS/Redirector.NBI trojan cleaned by deleting - quarantined
C:\Users\S and P\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlddmedljhmbgdhapibnagaanenmajcm\1.0_0\background.js JS/Agent.NJR trojan cleaned by deleting - quarantined
C:\Users\S and P\AppData\Roaming\Real\Update\temp\~Upg0\rnupgagent.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\Users\S and P\AppData\Roaming\Real\Update\temp\~Upg1\rnupgagent.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\Users\S and P\AppData\Roaming\Real\Update\temp\~Upg3\rnupgagent.exe Win32/Expiro.NBF virus cleaned - quarantined
C:\Users\S and P\AppData\Roaming\Real\Update\temp\~Upg6\rnupgagent.exe Win32/Expiro.NBF virus cleaned - quarantined
 

[gringo_pr]

Yes it was - typograhical mistake?

It was part of some instructions I used to run and didn't see that part in there

Gringo

[Pauline]

OK. Now that I have been successful in running ESET properly and it was succesful in taking care of 121 of the 129 infected files, what do I do next to get rid of the remaining 8?  Also what do I tell ESET to do to the files it quarantined?  Tks.

Pauline

[gringo_pr]

Hello Pauline

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Please start by opening Notepad and copy/paste the text in the box into the window:

ClearJavaCache::File::C:\Users\S and P\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\rnupgagent.exeC:\Users\S and P\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\stub_data\RealPlayer.exeC:\Users\S and P\Documents\Steves\LGGCC\Autorun.exeC:\Windows\AutoKMS.exeC:\Windows\KMSEmulator.exeC:\Windows\setpwlin.exeC:\Windows\UNINSTLMv4.EXEC:\Windows\DeployWinRE2\DeployWinRE_x64.exe 

Save it to your desktop as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.

Restart if you have to.

Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

• In your next post I need the following
  • report from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now after running the script?

Gringo

[Pauline]

The process of running CF script ran smoothly, no errors or restarts.

 

Computer appears to be working smoothly SO FAR, no freezes or stalls, everything that I tried works.  From experience the past days, problems do not show itself very often.  So everytime I report to you that all is well, it turns our that it is not so as the problem surfaces later.  So I am wary to say it is completely OK.  Is there a way to be sure all traces of the virus is removed?

 

Combofix log as below:

 

 

ComboFix 13-08-05.03 - S and P 05-Aug-13  19:53:14.2.4 - x64
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.1.1033.18.5815.4211 [GMT -5:00]
Running from: c:\users\S and P\Desktop\ComboFix.exe
Command switches used :: c:\users\S and P\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
FW: ZoneAlarm Free Firewall Firewall *Disabled* {E6380B7E-D4B2-19F1-083E-56486607704B}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Created a new restore point
.
FILE ::
"c:\users\S and P\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\rnupgagent.exe"
"c:\users\S and P\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\stub_data\RealPlayer.exe"
"c:\users\S and P\Documents\Steves\LGGCC\Autorun.exe"
"c:\windows\AutoKMS.exe"
"c:\windows\DeployWinRE2\DeployWinRE_x64.exe"
"c:\windows\KMSEmulator.exe"
"c:\windows\setpwlin.exe"
"c:\windows\UNINSTLMv4.EXE"
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\S and P\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\rnupgagent.exe
c:\users\S and P\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\stub_data\RealPlayer.exe
c:\users\S and P\Documents\Steves\LGGCC\Autorun.exe
c:\windows\AutoKMS.exe
c:\windows\DeployWinRE2\DeployWinRE_x64.exe
c:\windows\KMSEmulator.exe
c:\windows\setpwlin.exe
c:\windows\UNINSTLMv4.EXE
.
.
(((((((((((((((((((((((((   Files Created from 2013-07-06 to 2013-08-06  )))))))))))))))))))))))))))))))
.
.
2013-08-06 00:57 . 2013-08-06 00:57 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-08-02 16:41 . 2013-08-02 16:41 -------- d-----w- c:\program files (x86)\ESET
2013-08-01 15:51 . 2013-08-01 15:51 834544 ----a-w- c:\windows\system32\drivers\sptd.sys
2013-08-01 15:50 . 2013-08-01 15:50 -------- d-----w- c:\program files (x86)\LSoft Technologies
2013-07-29 20:57 . 2013-07-29 20:57 -------- d-----w- c:\programdata\Kaspersky Lab
2013-07-26 19:02 . 2013-07-26 19:02 -------- d-----w- c:\program files\CCleaner
2013-07-26 18:53 . 2013-07-26 18:53 -------- d-----w- c:\program files (x86)\Common Files\Java
2013-07-26 18:53 . 2013-07-26 18:53 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-07-26 18:52 . 2013-07-26 18:52 -------- d-----w- c:\program files (x86)\Java
2013-07-26 18:15 . 2013-07-26 18:15 -------- d-----w- c:\program files (x86)\VS Revo Group
2013-07-24 17:11 . 2013-07-24 17:11 -------- d-----w- c:\windows\ERUNT
2013-07-22 16:57 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2013-07-22 16:57 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2013-07-22 16:57 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2013-07-22 16:57 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2013-07-22 16:57 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2013-07-22 16:57 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2013-07-22 16:57 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2013-07-22 16:57 . 2012-06-02 20:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2013-07-22 16:57 . 2012-06-02 20:15 36864 ----a-w- c:\windows\system32\wuapp.exe
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-26 18:53 . 2012-11-27 16:58 789416 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-07-26 18:53 . 2012-11-27 16:58 867240 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-05-15 20:23 . 2010-06-24 19:33 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-08 12:23 . 2013-05-14 18:59 114280 ----a-w- c:\windows\SysWow64\acaptuser32.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-06-21 19875432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-04-13 284696]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Gateway MyBackup\BackupManagerTray.exe" [2010-06-28 258304]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2010-08-10 975952]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-09-06 3722416]
"ConnectionCenter"="c:\program files (x86)\Citrix\ICA Client\concentr.exe" [2012-05-23 371896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]
R3 AthDfu;Atheros Valkyrie USB BootROM;c:\windows\system32\Drivers\AthDfu.sys;c:\windows\SYSNATIVE\Drivers\AthDfu.sys [x]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_hcrp.sys [x]
R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_rcp.sys [x]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys;c:\windows\SYSNATIVE\DRIVERS\ctxusbm.sys [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe;c:\program files (x86)\Launch Manager\dsiwmis.exe [x]
S2 ePowerSvc;Acer ePower Service;c:\program files\Gateway\Gateway Power Management\ePowerSvc.exe;c:\program files\Gateway\Gateway Power Management\ePowerSvc.exe [x]
S2 GREGService;GREGService;c:\program files (x86)\Gateway\Registration\GREGsvc.exe;c:\program files (x86)\Gateway\Registration\GREGsvc.exe [x]
S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [x]
S2 IswSvc;ZoneAlarm LTD Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\IswSvc.exe;c:\program files\CheckPoint\ZAForceField\IswSvc.exe [x]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe;c:\program files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [x]
S2 Updater Service;Updater Service;c:\program files\Gateway\Gateway Updater\UpdaterService.exe;c:\program files\Gateway\Gateway Updater\UpdaterService.exe [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys;c:\windows\SYSNATIVE\DRIVERS\btath_bus.sys [x]
S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-08-01 00:02 1173456 ----a-w- c:\program files (x86)\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-08-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-23 17:19]
.
2013-08-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-23 17:19]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 20:45 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-07-23 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-07-23 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-07-23 415256]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [bU]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-06-22 10920552]
"Acer ePower Management"="c:\program files\Gateway\Gateway Power Management\ePowerTray.exe" [2010-06-11 861216]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-01-21 112512]
"AtherosBtStack"="c:\program files (x86)\ASUS Bluetooth Suite\BtvStack.exe" [2009-10-28 388608]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2012-07-14 1127592]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\acaptuser64.dll
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uLocal Page = c:\windows\system32\blank.htm


mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
Trusted Zone: ally.com\secure
Trusted Zone: centerpointenergy.com\myaccount
Trusted Zone: houstontx.gov\www.houstonwaterbills
Trusted Zone: maerskoil.com\citrix
Trusted Zone: maerskoil.com\hou-citrix
Trusted Zone: maerskoil.com\scphapp01.mog
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\users\S and P\AppData\Roaming\Mozilla\Firefox\Profiles\9bvs2kj0.default\


FF - ExtSQL: !HIDDEN! 2011-12-11 18:08; {ec9032c7-c20a-464f-7b0e-13a3a9e97385}; c:\users\S and P\AppData\Roaming\Mozilla\Firefox\Profiles\9bvs2kj0.default\extensions\{ec9032c7-c20a-464f-7b0e-13a3a9e97385}
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
SafeBoot-45816141.sys
AddRemove-LManager - c:\windows\UNINSTLMv4.EXE
AddRemove-{BF06BEBB-2C47-4D9F-AB6F-07C07EB54F09}_is1 - c:\program files (x86)\Wondershare\PDFtoWord\unins000.exe
AddRemove-{DE718DF0-3874-4873-9BC3-3A94944C916E}_is1 - c:\program files (x86)\Wondershare\PDFtoWord\unins000.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-08-05  19:59:05
ComboFix-quarantined-files.txt  2013-08-06 00:59
ComboFix2.txt  2013-07-25 14:56
.
Pre-Run: 425,830,166,528 bytes free
Post-Run: 425,403,609,088 bytes free
.
- - End Of File - - F6E8837D93063C440D6EA1D46A9C0D79
D41D8CD98F00B204E9800998ECF8427E
 

[gringo_pr]

Lets run this one and see what we get

F-Secure Online Scan

You can use either Internet Explorer or Mozilla FireFox for this scan.

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

• Please go HERE to run an online scan from F-Secure
• Click on Run Now
• it will download the scanner
• then will open a new window
• click on "start"
• click on "accept"
• the scan will start - when finished let me know if it found anything

Gringo

[Pauline]

F-Secure did not find any harmful items.

[gringo_pr]

Hello Pauline

Very well done!! This is my general post for when your logs show no more signs of malware - Please let me know if you still are having problems with your computer and what these problems are.

:Why we need to remove some of our tools:

• Some of the tools we have used to clean your computer were made by fellow malware fighters and are very powerful and if used incorrectly or at the wronge time can make the computer an expensive paper weight.

  They are updated all the time and some of them more than once a day so by the time you are ready to use them again they will already be outdated.

  The following procedures will implement some cleanup procedures to remove these tools. It will also reset your System Restore by flushing out previous restore points and create a new restore point. It will also remove all the backups our tools may have made.

:DeFogger:

Note** Defogger only needs to be run if it was run when we first started. If you have not already run it then skip this.

• To re-enable your Emulation drivers, double click DeFogger to run the tool.
  • The application window will appear
  • Click the Re-enable button to re-enable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger will now ask to reboot the machine - click OK.
  Your Emulation drivers are now re-enabled.

:Uninstall ComboFix:

• turn off all active protection software
• push the "windows key" + "R" (between the "Ctrl" button and "Alt" Button)
• please copy and past the following into the box ComboFix /Uninstall and click OK.
• Note the space between the X and the /Uninstall, it needs to be there.
• 

:Remove the rest of our tools:

Please download OTCleanIt and save it to desktop. This tool will remove all the tools we used to clean your pc.

• Double-click OTCleanIt.exe.
• Click the CleanUp! button.
• Select Yes when the "Begin cleanup Process?" prompt appears.
• If you are prompted to Reboot during the cleanup, select Yes.
• The tool will delete itself once it finishes, if not delete it by yourself.
• If asked to restart the computer, please do so

Note: If you receive a warning from your firewall or other security programs regarding OTCleanIt attempting to contact the internet, please allow it to do so.

:The programs you can keep:

Some of the programs that we have used would be a good idea to keep and used often in helping to keep the computer clean. I use these programs on my computer.

• Revo Uninstaller Free - this is the uninstaller that I had you download and works allot better than add/remove in windows and has saved me more than once from corrupted installs and uninstalls

  CCleaner - This is a good program to clean out temp files, I would use this once a week or before any malware scan to remove unwanted temp files - It has a built in registry cleaner but I would leave that alone and not use any registry cleaner

  Malwarebytes' Anti-Malware The Gold standerd today in antimalware scanners

:Security programs:

One of the questions I am asked all the time is "What programs do you use" I have at this time 4 computers in my home and I have this setup on all 4 of them.

• Microsoft Security Essentials - provides real-time protection for your home PC that guards against viruses, spyware, and other malicious software.
• WinPatrol As a robust security monitor, WinPatrol will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. WinPatrol takes snapshot of your critical system resources and alerts you to any changes that may occur without your knowledge.
• Malwarebytes' Anti-Malware Malwarebytes' Anti-Malware is a new and powerful anti-malware tool. It is

  totally free but for real-time protection you will have to pay a small one-time fee. We used this to help clean your computer and recomend keeping it and using often. (I have upgraded to the paid version of MBAM and I am glad I did)

  Note** If you decide to install MSE you will need to uninstall your present Antivirus

:Security awareness:

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article

Strong passwords: How to create and use them Then consider a password keeper, to keep all your passwords safe. KeePass is a small utility that allows you to manage all your passwords.

As Java seems to get exploited on a daily basis I advise to disable java in your web browsers - How to disable java in your web browsers - Disable Java

The other question I am asked all the time is "How can I prevent this from happening again." and the short answer to that is to be aware of what is out there and how to start spotting dangers.

Here are some articles that are must reads and should be read by everybody in your household that uses the internet

• internetsafety

  Internet Safety for Kids

Here is some more reading for you from some of my colleges

• PC Safety and Security - What Do I Need? from my friends at Tech Support Forum

  COMPUTER SECURITY - a short guide to staying safer online from my friends at Malware Removal

quoted from Tech Support Forum

Conclusion

There is no such thing as ‘perfect security’. This applies to many things, not just computer systems. Using the above guide you should be able to take all the reasonable steps you can to prevent infection. However, the most important part of all this is you, the user. Surf sensibly and think before you download a file or click on a link. Take a few moments to assess the possible risks and you should be able to enjoy all the internet has to offer.

I'd be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can then be closed.

I Will Keep This Open For About Three Days, If Anything Comes Up - Just Come Back And Let Me Know, after that time you will have to send me a PM

My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here --><-- Don't worry every little bit helps.

Gringo

[Pauline]

Gringo

 

I have not yet performs all the actions you stated in your post above.  I will so so within 3 days and go over in details the links attached carefully, and revert should a question pop up.

 

Meanwhile, I have this concern.  As Kapersky found a greater number of threats than ESET did (which it eliminated), I re-ran Kapersky again to see if any threats remain which were not picked up by ESET.  Results as below.  The first item troubles me.  Please advise.

 

Status: Detected   (events: 7) 
07-Aug-13 7:01:02 PM Detected virus Virus.Win64.Expiro.c C:\OEM\Preload\Autorun\DRV\Intel NB Chipset HM55\ia64\Difx64.exe High 
07-Aug-13 7:14:44 PM Detected virus Virus.Win32.Expiro.ai C:\Qoobox\Quarantine\C\Users\S and P\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\rnupgagent.exe.vir High 
07-Aug-13 7:14:44 PM Detected virus Virus.Win32.Expiro.ai C:\Qoobox\Quarantine\C\Users\S and P\Documents\Steves\LGGCC\Autorun.exe.vir High 
07-Aug-13 7:14:49 PM Detected virus Virus.Win32.Expiro.ai C:\Qoobox\Quarantine\C\Users\S and P\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\stub_data\RealPlayer.exe.vir High 
07-Aug-13 7:15:35 PM Detected virus Virus.Win32.Expiro.ai C:\Qoobox\Quarantine\C\Windows\setpwlin.exe.vir High 
07-Aug-13 7:15:45 PM Detected virus Virus.Win32.Expiro.ai C:\Qoobox\Quarantine\C\Windows\UNINSTLMv4.EXE.vir High 
07-Aug-13 7:15:47 PM Detected virus Virus.Win64.Expiro.c C:\Qoobox\Quarantine\C\Windows\DeployWinRE2\DeployWinRE_x64.exe.vir High 
 

[gringo_pr]

Hello

Remove this one as all the others are in a quarantine folder

C:\OEM\Preload\Autorun\DRV\Intel NB Chipset HM55\ia64\Difx64.exe High

Gringo

[Pauline]

Am I to remove it with Kapersky?,  If so, which option?  From memory, there is an option for something like disinfect or quarantine and another option which says something like delete?

[gringo_pr]

Yes go ahead and try disinfect first

Gringo

[Pauline]

Disinfected the one file with Kapersky.  Here is the log.  Is it OK now to remove the tools used and Combofix?

 

Status: Disinfected   (events: 1) 
09-Aug-13 7:38:55 AM Disinfected virus Virus.Win64.Expiro.c C:\OEM\Preload\Autorun\DRV\Intel NB Chipset HM55\ia64\Difx64.exe High 
Status: Detected   (events: 6) 
09-Aug-13 7:25:12 AM Detected virus Virus.Win32.Expiro.ai C:\Qoobox\Quarantine\C\Users\S and P\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\rnupgagent.exe.vir High 
09-Aug-13 7:25:16 AM Detected virus Virus.Win32.Expiro.ai C:\Qoobox\Quarantine\C\Users\S and P\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.40\agent\stub_data\RealPlayer.exe.vir High 
09-Aug-13 7:38:55 AM Detected virus Virus.Win32.Expiro.ai C:\Qoobox\Quarantine\C\Users\S and P\Documents\Steves\LGGCC\Autorun.exe.vir High 
09-Aug-13 7:39:01 AM Detected virus Virus.Win32.Expiro.ai C:\Qoobox\Quarantine\C\Windows\setpwlin.exe.vir High 
09-Aug-13 7:39:02 AM Detected virus Virus.Win32.Expiro.ai C:\Qoobox\Quarantine\C\Windows\UNINSTLMv4.EXE.vir High 
09-Aug-13 7:39:02 AM Detected virus Virus.Win64.Expiro.c C:\Qoobox\Quarantine\C\Windows\DeployWinRE2\DeployWinRE_x64.exe.vir High 
 

[gringo_pr]

Yes you can go ahead and do the cleanup

gringo