Jump to content

Reinstalled Malwarebytes and keep getting these messages

MsGems

By MsGems
in Resolved Malware Removal Logs

 Share

Recommended Posts

MsGems

MsGems

Posted
Posted

I just downloaded Malwarebytes onto my computer and opted for the free trial of pro. I've had Win 8 reinstalled for a few weeks and had forgotten to install Malwarebytes again until today.

I keep getting this message popping up and listing the two ip addresses in seperate bubbles.

"Sucessfully blocked access to a potetially dangerous website 93.114.45.123"

"Sucessfully blocked access to a potetially dangerous website 93.114.45.9"

DDS.txt Results

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 10.0.9200.16537 BrowserJavaVersion: 10.25.2

Run by .Jaclyn at 21:28:57 on 2013-08-18

Microsoft Windows 8 6.2.9200.0.1252.1.1033.18.6001.2142 [GMT -5:00]

.

AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Program Files\IDT\WDM\STacSV64.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\dashost.exe

C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe

C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe

C:\Program Files\Intel\iCLS Client\HeciServer.exe

C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe

C:\Program Files (x86)\Western Digital\WD SmartWare\WDRulesEngine.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\system32\SearchIndexer.exe

C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe

C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\dwm.exe

C:\Windows\system32\taskhostex.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskhost.exe

C:\Program Files\Classic Shell\ClassicStartMenu.exe

C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4206.722_x64__8wekyb3d8bbwe\LiveComm.exe

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\system32\igfxsrvc.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\IDT\WDM\sttray64.exe

C:\Program Files\DellTPad\Apoint.exe

C:\Program Files\DellTPad\ApMsgFwd.exe

C:\Program Files\DellTPad\Apntex.exe

C:\Program Files\DellTPad\HidFind.exe

C:\Program Files (x86)\Western Digital\WD Security\WDDriveAutoUnlock.exe

C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Dell Backup and Recovery\TOASTER.EXE

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\ImmersiveControlPanel\SystemSettings.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files\Windows NT\Accessories\wordpad.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

mWinlogon: Userinit = userinit.exe

BHO: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

BHO: ExplorerBHO Class: {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

BHO: LastPass Vault: {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPToolbar.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

BHO: ClassicIEBHO Class: {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIEDLL_32.dll

BHO: Hotspot Shield Class: {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE.dll

TB: LastPass Toolbar: {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll

TB: Classic Explorer Bar: {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll

uRun: [Google Update] "C:\Users\.Jaclyn\AppData\Local\Google\Update\GoogleUpdate.exe" /c

uRun: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

mRun: [WD Drive Unlocker] C:\Program Files (x86)\Western Digital\WD Security\WDDriveAutoUnlock.exe

mRun: [WD Quick View] C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe

mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

mRunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\StartUp\INSTAL~1.LNK - C:\Program Files (x86)\Common Files\lpuninstall.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\StartUp\UVREAL~1.LNK - C:\Program Files (x86)\UV Realtime\UVRTAutostart.exe

mPolicies-System: ConsentPromptBehaviorAdmin = dword:0

IE: LastPass - C:\Users\.Jaclyn\AppData\LocalLow\LastPass\context.html?cmd=lastpass

IE: LastPass Fill Forms - C:\Users\.Jaclyn\AppData\LocalLow\LastPass\context.html?cmd=fillforms

IE: {43699cd0-e34f-11de-8a39-0800200c9a66} - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPToolbar.dll

IE: {56753E59-AF1D-4FBA-9E15-31557124ADA2} - C:\Program Files\Classic Shell\ClassicIE_32.exe

Trusted Zone: dell.com

TCP: NameServer = 192.168.1.254

TCP: Interfaces\{C41A36A1-DCB6-493E-913D-00C8EFEEC3C5} : DHCPNameServer = 192.168.1.254

Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll

SSODL: WebCheck - <orphaned>

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.57\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

x64-BHO: ExplorerBHO Class: {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll

x64-BHO: LastPass Vault: {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll

x64-BHO: ClassicIEBHO Class: {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIEDLL_64.dll

x64-BHO: Hotspot Shield Class: {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll

x64-TB: LastPass Toolbar: {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll

x64-TB: Classic Explorer Bar: {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll

x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

x64-Run: [iAStorIcon] "C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIconLaunch.exe" "C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" 60

x64-Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe

x64-Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe

x64-Run: [Logitech Download Assistant] C:\Windows\System32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch

x64-mPolicies-System: ConsentPromptBehaviorAdmin = dword:0

x64-IE: {43699cd0-e34f-11de-8a39-0800200c9a66} - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll

x64-IE: {56753E59-AF1D-4FBA-9E15-31557124ADA2} - C:\Program Files\Classic Shell\ClassicIE_32.exe

x64-Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - <orphaned>

x64-Notify: igfxcui - igfxdev.dll

x64-SSODL: WebCheck - <orphaned>

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\.Jaclyn\AppData\Roaming\Mozilla\Firefox\Profiles\amxbrd8g.default\

FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll

FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll

FF - plugin: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll

FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrlui.dll

FF - plugin: C:\Users\.Jaclyn\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll

FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll

FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

FF - ExtSQL: 2013-07-12 05:04; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; C:\Users\.Jaclyn\AppData\Roaming\Mozilla\Firefox\Profiles\amxbrd8g.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

FF - ExtSQL: 2013-07-12 17:40; {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}; C:\Users\.Jaclyn\AppData\Roaming\Mozilla\Firefox\Profiles\amxbrd8g.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi

FF - ExtSQL: 2013-07-13 08:43; support@lastpass.com; C:\Users\.Jaclyn\AppData\Roaming\Mozilla\Firefox\Profiles\amxbrd8g.default\extensions\support@lastpass.com

FF - ExtSQL: 2013-08-16 20:23; {23fcfd51-4958-4f00-80a3-ae97e717ed8b}; C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

.

============= SERVICES / DRIVERS ===============

.

R0 iaStorA;iaStorA;C:\Windows\System32\Drivers\iaStorA.sys [2013-3-22 678384]

R1 HssDRV6;Hotspot Shield Routing Driver 6;C:\Windows\System32\Drivers\hssdrv6.sys [2013-6-20 46792]

R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]

R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2013-5-23 143120]

R2 hshld;Hotspot Shield Service;C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe [2013-6-20 831272]

R2 HssWd;Hotspot Shield Monitoring Service;C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe [2013-6-20 548136]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2013-3-22 15344]

R2 IconMan_R;IconMan_R;C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2013-7-14 2451456]

R2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2013-5-11 733696]

R2 jhi_service;Intel® Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe [2013-7-13 169432]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-8-18 418376]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-8-18 701512]

R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe [2013-7-11 1914728]

R2 WDBackup;WD Backup;C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe [2012-9-19 1157056]

R2 WDDriveService;WD Drive Manager;C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [2012-9-6 248248]

R2 WDRulesService;WD Rules;C:\Program Files (x86)\Western Digital\WD SmartWare\WDRulesEngine.exe [2012-9-19 1177536]

R3 ICCS;Intel® Integrated Clock Controller Service - Intel® ICCS;C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe [2013-7-10 169752]

R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\Drivers\IntcDAud.sys [2013-5-7 442368]

R3 MBAMProtector;MBAMProtector;C:\Windows\System32\Drivers\mbam.sys [2013-8-18 25928]

R3 NETwNe64;@oem17.inf,___ %NIC_Service_DispName_WIN8_64%;___ Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 8 - 64 Bit;C:\Windows\System32\Drivers\NETwew00.sys [2013-5-2 3341792]

R3 RTL8168;Realtek 8168 NT Driver;C:\Windows\System32\Drivers\Rt630x64.sys [2012-6-2 589824]

R3 taphss6;Anchorfree HSS VPN Adapter;C:\Windows\System32\Drivers\taphss6.sys [2013-6-20 42184]

S1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]

S3 Intel® Capability Licensing Service TCP IP Interface;Intel® Capability Licensing Service TCP IP Interface;C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2013-5-11 822232]

S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;C:\Windows\System32\Drivers\RtsUVStor.sys [2013-7-14 315536]

S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\Drivers\wdcsam64.sys [2011-2-16 14464]

.

=============== Created Last 30 ================

.

2013-08-18 21:09:23 -------- d-----w- C:\Users\.Jaclyn\AppData\Local\ElevatedDiagnostics

2013-08-18 20:45:10 -------- d-----w- C:\Users\.Jaclyn\AppData\Roaming\Malwarebytes

2013-08-18 20:44:34 -------- d-----w- C:\ProgramData\Malwarebytes

2013-08-18 20:44:31 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

2013-08-18 20:44:30 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-08-18 20:43:42 -------- d-----w- C:\Users\.Jaclyn\AppData\Roaming\SUPERAntiSpyware.com

2013-08-18 20:43:23 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com

2013-08-18 20:43:23 -------- d-----w- C:\Program Files\SUPERAntiSpyware

2013-08-18 20:42:44 -------- d-----w- C:\Users\.Jaclyn\AppData\Local\Programs

2013-08-18 07:14:40 9460976 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{897731E3-30CB-463C-8144-DFE5FBCEF89F}\mpengine.dll

2013-08-17 01:37:55 -------- d-----w- C:\Program Files (x86)\VideoLAN

2013-08-17 01:24:50 -------- d-----w- C:\Users\.Jaclyn\AppData\Local\DDMSettings

2013-08-17 01:22:44 -------- d-----w- C:\Program Files\DivX

2013-08-17 01:22:41 -------- d-----w- C:\Program Files (x86)\Common Files\DivX Shared

2013-08-17 01:21:06 -------- d-----w- C:\Program Files (x86)\DivX

2013-08-17 01:17:56 -------- d-----w- C:\ProgramData\DivX

2013-08-15 21:40:30 9460976 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll

2013-08-03 21:56:51 -------- d-----w- C:\Users\.Jaclyn\AppData\Roaming\PotPlayerMini

2013-08-03 21:56:51 -------- d-----w- C:\Users\.Jaclyn\AppData\Local\Daum

2013-08-03 21:44:59 -------- d-----w- C:\Program Files (x86)\Daum

2013-07-31 05:48:47 -------- d-----w- C:\Users\.Jaclyn\AppData\Roaming\Apple Computer

2013-07-31 05:46:42 -------- d-----w- C:\Windows\SysWow64\Hotspot Shield

2013-07-31 05:24:14 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin5.dll

2013-07-31 05:24:14 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin4.dll

2013-07-31 05:24:14 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin3.dll

2013-07-31 05:24:14 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin2.dll

2013-07-31 05:24:14 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin.dll

2013-07-31 05:22:45 -------- d-----w- C:\Users\.Jaclyn\AppData\Local\Apple

2013-07-28 07:45:51 -------- d-----w- C:\Windows\System32\MRT

2013-07-28 07:38:18 2367528 ----a-w- C:\Windows\System32\WSService.dll

2013-07-28 07:38:10 3265256 ----a-w- C:\Windows\System32\drivers\evbda.sys

2013-07-28 07:38:01 2397184 ----a-w- C:\Windows\System32\WpcMon.exe

2013-07-28 07:36:04 3236864 ----a-w- C:\Program Files\Common Files\Microsoft Shared\ink\tipskins.dll

2013-07-28 07:36:01 1395712 ----a-w- C:\Windows\System32\Windows.UI.Immersive.dll

2013-07-28 07:36:01 1265152 ----a-w- C:\Windows\System32\lsasrv.dll

2013-07-28 07:36:00 793200 ----a-w- C:\Windows\System32\mfplat.dll

2013-07-28 07:36:00 590848 ----a-w- C:\Windows\System32\SHCore.dll

2013-07-28 07:36:00 579584 ----a-w- C:\Windows\System32\StructuredQuery.dll

2013-07-28 07:36:00 1226752 ----a-w- C:\Windows\SysWow64\Windows.UI.Immersive.dll

2013-07-28 07:34:59 951808 ----a-w- C:\Windows\System32\Windows.Globalization.dll

2013-07-28 07:33:00 301568 ----a-w- C:\Windows\System32\newdev.dll

2013-07-28 07:33:00 275968 ----a-w- C:\Windows\SysWow64\newdev.dll

2013-07-28 07:32:59 76288 ----a-w- C:\Windows\System32\newdev.exe

2013-07-28 07:32:59 75264 ----a-w- C:\Windows\System32\ndadmin.exe

2013-07-28 07:32:59 74240 ----a-w- C:\Windows\SysWow64\newdev.exe

2013-07-28 07:32:59 73728 ----a-w- C:\Windows\SysWow64\ndadmin.exe

2013-07-28 07:32:58 68608 ----a-w- C:\Windows\System32\wwanprotdim.dll

2013-07-28 07:32:38 109568 ----a-w- C:\Windows\System32\dskquota.dll

2013-07-28 07:32:36 82944 ----a-w- C:\Windows\SysWow64\dskquota.dll

2013-07-28 07:30:14 1172992 ----a-w- C:\Windows\System32\mfnetsrc.dll

2013-07-28 07:30:13 929792 ----a-w- C:\Windows\SysWow64\mfnetsrc.dll

2013-07-28 07:30:13 677888 ----a-w- C:\Windows\System32\mfnetcore.dll

2013-07-28 07:30:13 673280 ----a-w- C:\Windows\System32\mfmpeg2srcsnk.dll

2013-07-28 07:30:13 568832 ----a-w- C:\Windows\SysWow64\mfnetcore.dll

2013-07-28 07:30:13 513024 ----a-w- C:\Windows\SysWow64\mfmpeg2srcsnk.dll

2013-07-28 07:23:52 19187712 ----a-w- C:\Program Files\Common Files\Microsoft Shared\Microsoft Camera Codec Pack\MicrosoftRawCodec.dll

2013-07-28 07:20:54 3552768 ----a-w- C:\Windows\System32\tquery.dll

2013-07-28 07:19:52 8552448 ----a-w- C:\Windows\SysWow64\glcndFilter.dll

2013-07-28 07:18:16 1184256 ----a-w- C:\Windows\System32\Display.dll

2013-07-28 07:18:15 7168 ----a-w- C:\Windows\System32\KBDKURD.DLL

2013-07-28 07:18:15 6656 ----a-w- C:\Windows\SysWow64\KBDKURD.DLL

2013-07-28 07:18:15 641536 ----a-w- C:\Windows\System32\WSShared.dll

2013-07-28 07:18:15 1164800 ----a-w- C:\Windows\SysWow64\Display.dll

2013-07-28 07:18:14 523776 ----a-w- C:\Windows\SysWow64\WSShared.dll

2013-07-28 07:18:14 198656 ----a-w- C:\Windows\System32\Windows.ApplicationModel.Store.dll

2013-07-28 07:18:14 163840 ----a-w- C:\Windows\System32\Windows.ApplicationModel.Store.TestingFramework.dll

2013-07-28 07:18:14 143872 ----a-w- C:\Windows\SysWow64\Windows.ApplicationModel.Store.dll

2013-07-28 07:18:14 124928 ----a-w- C:\Windows\SysWow64\Windows.ApplicationModel.Store.TestingFramework.dll

2013-07-25 12:35:53 -------- d-----w- C:\ProgramData\Hotspot Shield

2013-07-25 12:35:41 -------- d-----w- C:\Program Files (x86)\Hotspot Shield

2013-07-25 12:35:31 -------- d-----w- C:\Users\.Jaclyn\AppData\Roaming\Hotspot Shield

2013-07-22 11:18:04 -------- d-----w- C:\Program Files\CCleaner

2013-07-21 08:47:07 -------- d-----w- C:\Program Files\Classic Shell

.

==================== Find3M ====================

.

2013-07-15 05:26:20 275456 ----a-w- C:\Windows\System32\StartMenuHelper64.dll

2013-07-15 05:25:56 226304 ----a-w- C:\Windows\SysWow64\StartMenuHelper32.dll

2013-07-14 00:09:47 96168 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll

2013-07-14 00:09:42 867240 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll

2013-07-14 00:09:42 789416 ----a-w- C:\Windows\SysWow64\deployJava1.dll

2013-07-11 00:19:49 14880256 ----a-w- C:\Program Files (x86)\Common Files\lpuninstall.exe

2013-06-27 22:04:51 78200 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2013-06-27 22:04:51 693112 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2013-06-21 01:09:44 42184 ----a-w- C:\Windows\System32\drivers\taphss6.sys

2013-06-21 01:07:16 46792 ----a-w- C:\Windows\System32\drivers\hssdrv6.sys

2013-06-16 22:41:31 997632 ----a-w- C:\Windows\System32\drivers\ndis.sys

2013-06-11 23:43:37 1767936 ----a-w- C:\Windows\SysWow64\wininet.dll

2013-06-11 23:43:00 2877440 ----a-w- C:\Windows\SysWow64\jscript9.dll

2013-06-11 23:26:20 2241024 ----a-w- C:\Windows\System32\wininet.dll

2013-06-11 23:25:16 3958784 ----a-w- C:\Windows\System32\jscript9.dll

2013-06-06 00:47:52 279024 ----a-w- C:\Windows\SysWow64\IntelCpHeciSvc.exe

2013-06-06 00:47:50 529904 ----a-w- C:\Windows\System32\igfxsrvc.exe

2013-06-06 00:47:50 444400 ----a-w- C:\Windows\System32\igfxpers.exe

2013-06-06 00:47:50 251888 ----a-w- C:\Windows\System32\igfxext.exe

2013-06-06 00:47:50 165872 ----a-w- C:\Windows\System32\igfxtray.exe

2013-06-06 00:47:48 7569392 ----a-w- C:\Windows\System32\GfxUIEx.exe

2013-06-06 00:47:48 752624 ----a-w- C:\Windows\System32\GfxUIHotKeyMenu.exe

2013-06-06 00:47:48 534000 ----a-w- C:\Windows\System32\DPTopologyApp.exe

2013-06-06 00:47:48 407536 ----a-w- C:\Windows\System32\hkcmd.exe

2013-06-06 00:47:46 397296 ----a-w- C:\Windows\System32\CustomModeApp.exe

2013-06-06 00:47:46 153072 ----a-w- C:\Windows\System32\difx64.exe

2013-06-01 11:54:16 194816 ----a-w- C:\Windows\System32\drivers\sdbus.sys

2013-06-01 11:54:10 125184 ----a-w- C:\Windows\System32\drivers\dumpsd.sys

2013-06-01 11:34:21 2391280 ----a-w- C:\Windows\explorer.exe

2013-06-01 11:33:13 2233600 ----a-w- C:\Windows\System32\drivers\tcpip.sys

2013-06-01 11:29:35 337152 ----a-w- C:\Windows\System32\drivers\USBXHCI.SYS

2013-06-01 11:29:35 213248 ----a-w- C:\Windows\System32\drivers\UCX01000.SYS

2013-06-01 11:26:33 327936 ----a-w- C:\Windows\System32\drivers\volsnap.sys

2013-06-01 11:26:31 6987008 ----a-w- C:\Windows\System32\ntoskrnl.exe

2013-06-01 10:24:46 2106176 ----a-w- C:\Windows\SysWow64\explorer.exe

2013-06-01 09:25:52 364544 ----a-w- C:\Windows\SysWow64\XpsGdiConverter.dll

2013-06-01 09:25:05 67584 ----a-w- C:\Windows\SysWow64\samlib.dll

2013-06-01 09:25:03 496640 ----a-w- C:\Windows\SysWow64\qedit.dll

2013-06-01 09:24:19 493056 ----a-w- C:\Windows\SysWow64\mscms.dll

2013-06-01 09:24:09 850944 ----a-w- C:\Windows\SysWow64\mfasfsrcsnk.dll

2013-06-01 09:24:09 1453568 ----a-w- C:\Windows\SysWow64\mfcore.dll

2013-06-01 09:23:46 1842176 ----a-w- C:\Windows\SysWow64\dwmcore.dll

2013-06-01 09:23:06 680960 ----a-w- C:\Windows\System32\vds.exe

2013-06-01 09:22:47 80896 ----a-w- C:\Windows\System32\MbaeParserTask.exe

2013-06-01 09:22:33 523264 ----a-w- C:\Windows\System32\XpsGdiConverter.dll

2013-06-01 09:22:33 446976 ----a-w- C:\Windows\System32\wwansvc.dll

2013-06-01 09:22:09 190976 ----a-w- C:\Windows\System32\vdsutil.dll

2013-06-01 09:21:39 729600 ----a-w- C:\Windows\System32\samsrv.dll

2013-06-01 09:21:39 106496 ----a-w- C:\Windows\System32\samlib.dll

2013-06-01 09:21:34 595968 ----a-w- C:\Windows\System32\qedit.dll

2013-06-01 09:20:45 583168 ----a-w- C:\Windows\System32\mscms.dll

2013-06-01 09:20:34 1527808 ----a-w- C:\Windows\System32\mfcore.dll

2013-06-01 09:20:34 1048576 ----a-w- C:\Windows\System32\mfasfsrcsnk.dll

2013-06-01 09:20:04 2219520 ----a-w- C:\Windows\System32\dwmcore.dll

2013-06-01 09:19:58 207872 ----a-w- C:\Windows\System32\DeviceSetupManager.dll

2013-06-01 09:19:42 785408 ----a-w- C:\Windows\System32\audiosrv.dll

2013-06-01 03:08:57 37632 ----a-w- C:\Windows\System32\drivers\BthAvrcpTg.sys

2013-05-31 18:30:06 99800 ----a-w- C:\Windows\System32\drivers\TeeDriverx64.sys

2013-05-31 18:30:06 1795952 ----a-w- C:\Windows\System32\WdfCoInstaller01011.dll

2013-05-31 18:30:06 16344 ----a-w- C:\Windows\System32\drivers\IntelMEFWVer.dll

2013-05-30 23:14:23 4036096 ----a-w- C:\Windows\System32\win32k.sys

2013-05-24 22:09:20 1403296 ----a-w- C:\Windows\System32\winload.efi

2013-05-24 22:09:20 1271584 ----a-w- C:\Windows\System32\winload.exe

2013-05-24 22:09:20 1217352 ----a-w- C:\Windows\System32\winresume.efi

2013-05-24 22:09:20 1093904 ----a-w- C:\Windows\System32\winresume.exe

2013-05-23 23:01:46 1300992 ----a-w- C:\Windows\System32\gdi32.dll

2013-05-23 22:27:05 1022464 ----a-w- C:\Windows\SysWow64\gdi32.dll

.

============= FINISH: 21:29:05.44 ===============

----------------------------------------

Attach.txt Results

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 8

Boot Device: \Device\HarddiskVolume1

Install Date: 7/10/2013 6:50:50 PM

System Uptime: 8/16/2013 12:02:54 AM (69 hours ago)

.

Motherboard: Dell Inc. | | 023HTX

Processor: Intel® Core i5-3210M CPU @ 2.50GHz | CPU Socket - U3E1 | 2501/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 925 GiB total, 893.049 GiB free.

D: is CDROM ()

E: is FIXED (NTFS) - 6 GiB total, 0.409 GiB free.

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP7: 8/8/2013 12:34:57 AM - Scheduled Checkpoint

RP9: 8/16/2013 1:48:31 AM - Windows Update

.

==== Installed Programs ======================

.

Adobe Flash Player 11 Plugin

Apple Application Support

Apple Software Update

Belarc Advisor 8.3

calibre

CCleaner

Classic Shell

Daum PotPlayer 1.5.39007

Dell Backup and Recovery

Dell Backup and Recovery - Support Software

Dell System Detect Bootstrapper

Dell Touchpad

DivX Setup

Driver Genius

Google Chrome

Google Chrome Canary

Google Update Helper

Hotspot Shield 3.09

IDT Audio

Intel® Management Engine Components

Intel® Processor Graphics

Intel® Rapid Storage Technology

Intel® SDK for OpenCL - CPU Only Runtime Package

Intel® Trusted Connect Service Client

Java 7 Update 25

Java Auto Updater

LastPass(uninstall only)

Malwarebytes Anti-Malware version 1.75.0.1300

Microsoft Silverlight

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319

Mozilla Firefox 23.0 (x86 en-US)

Mozilla Maintenance Service

QuickTime

Realtek USB 2.0 Card Reader

RRDtool

SES Driver

SUPERAntiSpyware

System Requirements Lab for Intel

TweakUAC

UV Realtime

VC80CRTRedist - 8.0.50727.6195

VLC media player 2.0.8

WD Drive Utilities

WD Security

WD SmartWare

Windows Driver Package - Western Digital Technologies (WDC_SAM) WDC_SAM (01/19/2011 1.0.0009.0)

WinPcap 4.1.3

WinRAR 5.00 beta 6 (64-bit)

.

==== Event Viewer Messages From Past Week ========

.

8/18/2013 2:46:03 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SftService service.

8/16/2013 12:03:24 AM, Error: BTHUSB [30] - The local adapter does not support an important Low Energy controller state. The minimum required supported state mask is 0x1f7fffff, got 0x1f3fffff. Low Energy functionality will be disabled.

.

==== End Of File ===========================

Link to post
Share on other sites
Maniac

Maniac

Posted
Posted

Hello MsGems! My name is Borislav and I will be glad to help you solve your malware problem.

Please note:

  • If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.
  • I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
  • Make sure you read all of the instructions and fixes thoroughly before continuing with them.
  • Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
  • Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.
  • Do not perform any kind of scanning and fixing without my instructions. If you want to proceed on your own, please let me know.
Step 1

Please uninstall this application: Hotspot Shield 3.09

Step 2

Please download Junkware Removal Tool to your desktop.

  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
Step 3

Please download AdwCleaner by Xplode onto your desktop.

  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Delete.
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[s1].txt as well.
Step 3
  • Launch Malwarebytes' Anti-Malware
  • Go to Update tab and select Check for Updates. If an update is found, it will download and install the latest version.
  • Go to Scanner tab and select Perform Quick Scan, then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer,please do so immediately.

In your next reply, post the following log files:

  • Junkware Removal Tool log
  • AdwCleaner log
  • Malwarebytes' Anti-Malware log
Link to post
Share on other sites
MsGems

MsGems

Posted
  • Author
Posted

I didn't know AdwCleaner.exe was going to delete all of my Chrome extensions. At least it didn't delete all the other Chrome stuff like sites I've visited and etc. Luckily to my surprise when I reinstalled my extensions none of the settings had been deleted.. 
 

  • Junkware Removal Tool log

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Thisisu
    Version: 5.5.2 (08.20.2013:1)
    OS: Windows 8 x64
    Ran by .Jaclyn on Tue 08/20/2013 at 23:55:19.97
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
     
     
     
    ~~~ Services
     
     
     
    ~~~ Registry Values
     
     
     
    ~~~ Registry Keys
     
     
     
    ~~~ Files
     
     
     
    ~~~ Folders
     
    Failed to delete: [Folder] "C:\Program Files (x86)\driver-soft"
     
     
     
    ~~~ Event Viewer Logs were cleared
     
     
     
     
     
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Tue 08/20/2013 at 23:57:03.72
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
  • AdwCleaner log

     AdwCleaner v3.000 - Report created 20/08/2013 at 23:23:22
    # Updated 20/08/2013 by Xplode
    # Operating System : Windows 8  (64 bits)
    # Username : .Jaclyn - RAVENSWOOD
    # Running from : C:\Users\.Jaclyn\Downloads\AdwCleaner.exe
    # Option : Clean
     
    ***** [ Services ] *****
     
     
    ***** [ Files / Folders ] *****
     
    File Deleted : C:\END
     
    ***** [ Shortcuts ] *****
     
     
    ***** [ Registry ] *****
     
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
    Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
    Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
     
    ***** [ Browsers ] *****
     
    -\\ Internet Explorer v10.0.9200.16660
     
     
    -\\ Mozilla Firefox v23.0 (en-US)
     
    [ File : C:\Users\.Jaclyn\AppData\Roaming\Mozilla\Firefox\Profiles\amxbrd8g.default\prefs.js ]
     
     
    -\\ Google Chrome v29.0.1547.57
     
    [ File : C:\Users\.Jaclyn\AppData\Local\Google\Chrome\User Data\Default\preferences ]
     
     
    *************************
     
    AdwCleaner[R0].txt - [1347 octets] - [20/08/2013 23:19:13]
    AdwCleaner[R1].txt - [1407 octets] - [20/08/2013 23:22:35]
    AdwCleaner[s0].txt - [1330 octets] - [20/08/2013 23:23:22]
     
    ########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [1390 octets] ##########
     
  • Malwarebytes' Anti-Malware log
2013/08/20 23:24:27 -0500 RAVENSWOOD .Jaclyn MESSAGE Executing scheduled update:  Daily
2013/08/20 23:24:29 -0500 RAVENSWOOD .Jaclyn MESSAGE Database already up-to-date
2013/08/20 23:24:31 -0500 RAVENSWOOD .Jaclyn MESSAGE Starting protection
2013/08/20 23:24:31 -0500 RAVENSWOOD .Jaclyn MESSAGE Protection started successfully
2013/08/20 23:24:31 -0500 RAVENSWOOD .Jaclyn MESSAGE Starting IP protection
2013/08/20 23:24:33 -0500 RAVENSWOOD .Jaclyn MESSAGE IP Protection started successfully
2013/08/20 23:30:25 -0500 RAVENSWOOD .Jaclyn DETECTION C:\Windows\ERUNT\JRT\ERDNT.EXE Exploit.Drop.70 QUARANTINE

 

Link to post
Share on other sites
MsGems

MsGems

Posted
  • Author
Posted
Malwarebytes Anti-Malware (Trial) 1.75.0.1300

www.malwarebytes.org

 

Database version: v2013.08.21.04

 

Windows 8 x64 NTFS

Internet Explorer 10.0.9200.16660

.Jaclyn :: RAVENSWOOD [administrator]

 

Protection: Enabled

 

8/21/2013 9:09:18 AM

mbam-log-2013-08-21 (09-09-18).txt

 

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 215107

Time elapsed: 1 minute(s), 34 second(s)

 

Memory Processes Detected: 0

(No malicious items detected)

 

Memory Modules Detected: 0

(No malicious items detected)

 

Registry Keys Detected: 0

(No malicious items detected)

 

Registry Values Detected: 0

(No malicious items detected)

 

Registry Data Items Detected: 0

(No malicious items detected)

 

Folders Detected: 0

(No malicious items detected)
Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.