Jump to content

Want to get rid of PUM.UserWLoad and Trojan.Ransom

muratheblack
 Share

Recommended Posts

muratheblack

muratheblack

Posted
Posted

Malwarebytes found Trajon.Ransom and PUM.UserWLoad but when I restart my laptop and scan again they reappear. I've read a very similar topic, but I hesitated to take a step. I downloaded RogueKiller and scan my laptop.

 

RogueKiller V8.6.6 [Aug 19 2013] by Tigzy
eposta : tigzyRK<at>gmail<dot>com
Geribesleme : http://www.adlice.com/forum/
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://tigzyrk.blogspot.com/

İşletim Sistemi : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Zamanında başladı : Normal mod
Kullanıcı : Toshiba [Yönetici Hakları]
Mod : Tarama yap -- Tarih : 08/25/2013 09:23:03
| ARK || FAK || MBR |

¤¤¤ Kötü Niyetli İşlemler : 0 ¤¤¤

¤¤¤ Kayıt Defteri Girişleri : 11 ¤¤¤
[RUN][sUSP PATH] HKCU\[...]\Run : Google Update ("C:\Users\Toshiba\AppData\Local\Google\Update\GoogleUpdate.exe" /c [7]) -> BULUNDU
[RUN][sUSP PATH] HKUS\S-1-5-21-3184794996-814937175-2401593632-1000\[...]\Run : Google Update ("C:\Users\Toshiba\AppData\Local\Google\Update\GoogleUpdate.exe" /c [7]) -> BULUNDU
[sHELL][Rans.Gendarm] HKCU\[...]\Windows : load (C:\Users\Toshiba\LOCALS~1\Temp\mswuuwr.bat [x]) -> BULUNDU
[sHELL][Rans.Gendarm] HKUS\[...]\Windows : load (C:\Users\Toshiba\LOCALS~1\Temp\mswuuwr.bat [x]) -> BULUNDU
[HJ POL] HKLM\[...]\System : DisableRegistryTools (0) -> BULUNDU
[HJ POL] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> BULUNDU
[HJ POL] HKLM\[...]\System : EnableLUA (0) -> BULUNDU
[HJ DESK] HKCU\[...]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> BULUNDU
[HJ DESK] HKCU\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> BULUNDU
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> BULUNDU
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> BULUNDU

¤¤¤ Planlanmış Görevler : 5 ¤¤¤
[V1][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-3184794996-814937175-2401593632-1000UA.job : C:\Users\Toshiba\AppData\Local\Google\Update\GoogleUpdate.exe - /ua /installsource scheduler [7][x] -> BULUNDU
[V1][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-3184794996-814937175-2401593632-1000Core.job : C:\Users\Toshiba\AppData\Local\Google\Update\GoogleUpdate.exe - /c [7] -> BULUNDU
[V2][sUSP PATH] Google Updater and Installer : C:\Users\Toshiba\AppData\Local\Google\Update\GoogleUpdate.exe - /c [7] -> BULUNDU
[V2][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-3184794996-814937175-2401593632-1000Core : C:\Users\Toshiba\AppData\Local\Google\Update\GoogleUpdate.exe - /c [7] -> BULUNDU
[V2][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-3184794996-814937175-2401593632-1000UA : C:\Users\Toshiba\AppData\Local\Google\Update\GoogleUpdate.exe - /ua /installsource scheduler [7][x] -> BULUNDU

¤¤¤ Başlangıç girişleri : 0 ¤¤¤

¤¤¤ Web Tarayıcıları : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Sürücü : [YÜKLENDİ] ¤¤¤

¤¤¤ Dışarıdaki kovanlar: ¤¤¤

¤¤¤ Bulaşma var : Rans.Gendarm ¤¤¤

¤¤¤ HOSTS Dosyası: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1       localhost


¤¤¤ MBR Denetimi: ¤¤¤

+++++ PhysicalDrive0: ST9500325AS ATA Device +++++
--- User ---
[MBR] c9028d56335524a8ec1aebad68ab3010
[bSP] 6404aa1f60ab69548b1ad22051e71073 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 400 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 821248 | Size: 156381 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 321091160 | Size: 238229 Mo
3 - [XXXXXX] EXTEN (0x05) [VISIBLE] Offset (sectors): 808985205 | Size: 81925 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Tamamlandı : << RKreport[0]_S_08252013_092303.txt >>


 

 

 

 

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Please download Farbar Recovery Scan Tool and save it to a folder. (32bit version)

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

MrC

Link to post
Share on other sites
muratheblack

muratheblack

Posted
  • Author
Posted

FRST.text

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 25-08-2013 02
Ran by Toshiba (administrator) on 25-08-2013 22:14:09
Running from C:\Users\Toshiba\Desktop\Scan
Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: 041F
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(AMD) C:\Windows\system32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(ABBYY (BIT Software)) C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\ekrn.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Samsung Electronics Co., Ltd.) C:\Windows\system32\spool\drivers\w32x86\3\NetFaxServer.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files\AveaConnectionManager\WTGService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesApp32.exe
(Zbshareware Lab) C:\Program Files\USB Disk Security\USBGuard.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Tonec Inc.) C:\Program Files\Internet Download Manager\IDMan.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe
(Google Inc.) C:\Users\Toshiba\AppData\Local\Google\Update\1.3.21.153\GoogleCrashHandler.exe
(WebToGo Mobiles Internet GmbH) C:\Program Files\AveaConnectionManager\AveaConnectionManager.exe
() C:\Program Files\AveaConnectionManager\Avea_Launcher.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
(WebConnect) C:\Program Files\WebConnect\updateWebConnect.exe
(Wsys Co., Ltd.) C:\ProgramData\eSafe\eGdpSvc.exe
(Taiwan Shui Mu Chih Ching Technology Limited.) C:\Program Files\WinZipper\winzipersvc.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [uSB Security] - C:\Program Files\USB Disk Security\USBGuard.exe [623520 2011-01-31] (Zbshareware Lab)
HKLM\...\Run: [egui] - C:\Program Files\ESET\ESET Smart Security\egui.exe [3080264 2011-09-22] (ESET)
HKCU\...\Run: [iDMan] - C:\Program Files\Internet Download Manager\IDMan.exe [3437976 2011-11-14] (Tonec Inc.)
HKCU\...\Run: [Google Update] - C:\Users\Toshiba\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-08-27] (Google Inc.)
HKCU\...\CurrentVersion\Windows: [Load] C:\Users\Toshiba\LOCALS~1\Temp\mswuuwr.bat <===== ATTENTION
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.qvo6.com/?utm_source=b&utm_medium=cor&from=cor&uid=ST9500325AS_6VEJ5DZDXXXX6VEJ5DZD&ts=1377457280
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.qvo6.com/?utm_source=b&utm_medium=cor&from=cor&uid=ST9500325AS_6VEJ5DZDXXXX6VEJ5DZD&ts=1377457280
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.qvo6.com/?utm_source=b&utm_medium=cor&from=cor&uid=ST9500325AS_6VEJ5DZDXXXX6VEJ5DZD&ts=1377457280
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.qvo6.com/?utm_source=b&utm_medium=cor&from=cor&uid=ST9500325AS_6VEJ5DZDXXXX6VEJ5DZD&ts=1377457280
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&from=newgdp&uid=ST9500325AS_6VEJ5DZDXXXX6VEJ5DZD&ts=1377457392
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.qvo6.com/web/?utm_source=b&utm_medium=cor&from=cor&uid=ST9500325AS_6VEJ5DZDXXXX6VEJ5DZD&ts=1377457280
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.qvo6.com/web/?utm_source=b&utm_medium=cor&from=cor&uid=ST9500325AS_6VEJ5DZDXXXX6VEJ5DZD&ts=1377457280
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.qvo6.com/web/?utm_source=b&utm_medium=cor&from=cor&uid=ST9500325AS_6VEJ5DZDXXXX6VEJ5DZD&ts=1377457280
SearchScopes: HKCU - {1F096B29-E9DA-4D64-8D63-936BE7762CC5} URL = http://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=ca995255000000000000b4749f11fd88&tlver=1.4.19.19&affID=16553
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.qvo6.com/web/?utm_source=b&utm_medium=cor&from=cor&uid=ST9500325AS_6VEJ5DZDXXXX6VEJ5DZD&ts=1377457280
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://isearch.avg.com/search?cid={4E8B9AC9-3252-4D93-9676-A09DF194F9F1}&mid=8fdfe9ed97e647d0ae74d16f2a4d6df3-e3e02924094d2c320da53ef0b505bf8bd7656539〈=tr&ds=gm011&pr=sa&d=2012-06-24 13:26:04&v=11.1.1.7&sap=dsp&q={searchTerms}
SearchScopes: HKCU - {BF01DE78-557F-4137-BA01-E465B492D333} URL = http://websearch.ask.com/redirect?client=ie&tb=FF&o=14594&src=kw&q={searchTerms}&locale=&apn_ptnrs=FV&apn_dtid=YYYYYYYYTR&apn_uid=c1e1dd3f-409d-47c5-9876-c59104199ef3&apn_sauid=7A0712DC-300F-452B-9116-8B9C41B2B9CD&
BHO: IDM integration (IDMIEHlprObj Class) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.)
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: WebConnect - {2316c625-b487-4410-a1a5-ff040b65245f} - C:\Program Files\WebConnect\WebConnectbho.dll (Web Connect)
BHO: CescrtHlpr Object - {2EECD738-5844-4a99-B4B6-146BF802613B} -  No File
BHO: SMART Notebook Download Utility - {67BCF957-85FC-4036-8DC4-D4D80E00A77B} - C:\Program Files\SMART Technologies\Education Software\Win32\NotebookPlugin.dll (SMART Technologies ULC.)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~4\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Babylon - {965B54B0-71E0-4611-8DE7-F73FA0B20E26} -  No File
Toolbar: HKLM - Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} -  No File
DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Winsock: Catalog5 09 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{5D3E0DA7-5D00-46AB-B097-493CEF8FEC16}: [NameServer]8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{F08E89B3-F330-479B-A785-C3CDE86EF861}: [NameServer]195.175.39.39 217.174.47.54

FireFox:
========
FF ProfilePath: C:\Users\Toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\l1d2zhtf.default
FF user.js: detected! => C:\Users\Toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\l1d2zhtf.default\user.js
FF SelectedSearchEngine: Google
FF Homepage: www.google.com
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameeu.dll No File
FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin: @videolan.org/vlc,version=1.1.11 - C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Toshiba\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Toshiba\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Toshiba\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\Toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\l1d2zhtf.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\qvo6.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\wikipedia-tr.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\yahoo-tr.xml
FF Extension: No Name - C:\Users\Toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\l1d2zhtf.default\Extensions\WebSiteRecommendation@weliketheweb.com
FF Extension: 505cc9dccc9a8 - C:\Users\Toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\l1d2zhtf.default\Extensions\505cc9dccc9a8@505cc9dccc9e1.com.xpi
FF Extension: firefox - C:\Users\Toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\l1d2zhtf.default\Extensions\firefox@webconnect.co.xpi
FF Extension: No Name - C:\Users\Toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\l1d2zhtf.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Default - C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF HKCU\...\Firefox\Extensions: [mozilla_cc@internetdownloadmanager.com] C:\Users\Toshiba\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\Toshiba\AppData\Roaming\IDM\idmmzcc5
FF HKCU\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] C:\Users\Toshiba\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\Toshiba\AppData\Roaming\IDM\idmmzcc5
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files\Mozilla Firefox\firefox.exe http://www.qvo6.com/?utm_source=b&utm_medium=cor&from=cor&uid=ST9500325AS_6VEJ5DZDXXXX6VEJ5DZD&ts=1377457280

Chrome:
=======
CHR Extension: (Skype Click to Call) - C:\Users\Toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.10.0.13089_0
CHR Extension: () - C:\Users\Toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\olakgnkoldmagdblaalodobkmeokmgjj\1.7_0
CHR HKLM\...\Chrome\Extension: [dhkplhfnhceodhffomolpfigojocbpcb] - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonChrome.crx
CHR HKLM\...\Chrome\Extension: [ieakfmpjhljbpbfpldjkddkjmmgjmgon] - C:\Program Files\WebConnect\ieakfmpjhljbpbfpldjkddkjmmgjmgon.crx
CHR HKLM\...\Chrome\Extension: [ifohbjbgfchkkfhphahclmkpgejiplfo] - C:\Users\Toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
CHR StartMenuInternet: Google Chrome - C:\Users\Toshiba\AppData\Local\Google\Chrome\Application\chrome.exe http://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&from=newgdp&uid=ST9500325AS_6VEJ5DZDXXXX6VEJ5DZD&ts=1377457392

========================== Services (Whitelisted) =================

R2 ABBYY.Licensing.FineReader.Professional.9.0; C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [660768 2007-12-06] (ABBYY (BIT Software))
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [974944 2011-09-22] (ESET)
S2 KMService; C:\Windows\system32\srvany.exe [8192 2013-03-20] ()
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
S3 npggsvc; C:\Windows\system32\GameMon.des [4606816 2011-12-21] (INCA Internet Co., Ltd.)
R2 Samsung Network Fax Server; C:\Windows\system32\spool\drivers\w32x86\3\NetFaxServer.exe [181760 2012-07-20] (Samsung Electronics Co., Ltd.)
R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3291008 2013-08-14] (Skype Technologies S.A.)
R2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe [1514304 2011-12-14] (TuneUp Software)
R2 Update WebConnect; C:\Program Files\WebConnect\updateWebConnect.exe [206632 2013-08-23] (WebConnect)
R2 winzipersvc; C:\Program Files\WinZipper\winzipersvc.exe [424104 2013-08-25] (Taiwan Shui Mu Chih Ching Technology Limited.)
R2 WsysSvc; C:\ProgramData\eSafe\eGdpSvc.exe [303680 2013-08-22] (Wsys Co., Ltd.)
R2 WTGService; C:\Program Files\AveaConnectionManager\WTGService.exe [343024 2012-06-06] ()

==================== Drivers (Whitelisted) ====================

S3 ACTIVhidmini; C:\Windows\System32\DRIVERS\ACTIVhidmini.sys [82176 2010-05-26] (Promethean Technologies Ltd)
R3 ActivHidSerMini; C:\Windows\System32\DRIVERS\activhidsermini.sys [74752 2010-05-26] (Promethean Technologies Ltd)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
S3 DrvAgent32; C:\Windows\system32\Drivers\DrvAgent32.sys [23456 2011-10-14] (Phoenix Technologies)
R2 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [163424 2011-08-09] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [118104 2011-08-04] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [147480 2011-08-04] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [33656 2011-08-04] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [50624 2011-08-04] (ESET)
R3 LGBusEnum; C:\Windows\System32\drivers\LGBusEnum.sys [19720 2009-11-24] (Logitech Inc.)
R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [42040 2012-10-03] (Logitech Inc.)
S3 LGVirHid; C:\Windows\System32\drivers\LGVirHid.sys [14856 2009-11-24] (Logitech Inc.)
S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2013-01-25] (MBB Incorporated)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 prmvmouse; C:\Windows\System32\DRIVERS\activmouse.sys [6144 2010-05-26] (Promethean Technologies Ltd)
R3 SMARTMouseFilterx86; C:\Windows\System32\DRIVERS\SMARTMouseFilterx86.sys [11632 2011-07-13] (SMART Technologies ULC)
R3 SMARTVHidMini2000x86; C:\Windows\System32\DRIVERS\SMARTVHidMini2000x86.sys [14704 2011-07-13] (SMART Technologies ULC)
R3 SMARTVTabletPCx86; C:\Windows\System32\DRIVERS\SMARTVTabletPCx86.sys [21872 2011-07-13] (SMART Technologies ULC)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2012-02-15] (Samsung Electronics)
R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys [10064 2011-12-12] (TuneUp Software)
S1 661ef6; \??\C:\Windows\system32\drivers\661ef6.sys [x]
S3 catchme; \??\C:\Users\Toshiba\AppData\Local\Temp\catchme.sys [x]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
S3 XDva359; \??\C:\Windows\system32\XDva359.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-25 22:03 - 2013-08-25 22:03 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\WinZipper
2013-08-25 22:03 - 2013-08-25 22:03 - 00000000 ____D C:\Program Files\WinZipper
2013-08-25 22:01 - 2013-08-25 22:03 - 00000000 ____D C:\ProgramData\eSafe
2013-08-25 22:01 - 2013-08-25 22:01 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\SimilarSites
2013-08-25 22:01 - 2013-08-25 22:01 - 00000000 ____D C:\Program Files\WebConnect
2013-08-25 22:01 - 2013-08-25 22:01 - 00000000 ____D C:\Program Files\SimilarSites
2013-08-25 22:01 - 2013-08-25 22:01 - 00000000 ____D C:\FRST
2013-08-25 21:50 - 2013-08-25 21:50 - 00003216 ____N C:\bootsqm.dat
2013-08-25 11:27 - 2013-08-25 11:27 - 00000000 ____D C:\Users\Toshiba\Desktop\Trojan
2013-08-25 11:27 - 2013-08-25 11:27 - 00000000 ____D C:\Users\Toshiba\Desktop\Forum
2013-08-25 11:18 - 2013-08-25 21:50 - 00000224 _____ C:\Windows\setupact.log
2013-08-25 11:18 - 2013-08-25 11:18 - 00000000 _____ C:\Windows\setuperr.log
2013-08-25 09:19 - 2013-08-25 09:23 - 00000000 ____D C:\Users\Toshiba\Desktop\RK_Quarantine
2013-08-25 09:15 - 2013-08-25 09:15 - 00923136 _____ C:\Users\Toshiba\Desktop\RogueKiller.exe
2013-08-20 12:23 - 2013-08-22 17:39 - 00004899 _____ C:\Users\Toshiba\Desktop\resim yerine sorular.txt
2013-08-16 11:22 - 2013-08-16 11:22 - 00000000 ____D C:\Users\Toshiba\Desktop\Resimler
2013-08-15 13:11 - 2013-08-15 13:11 - 00000000 ____D C:\Program Files\Common Files\Java
2013-08-15 13:11 - 2013-08-15 13:10 - 00867240 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-08-15 13:11 - 2013-08-15 13:10 - 00263592 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-08-15 13:11 - 2013-08-15 13:10 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-08-15 13:11 - 2013-08-15 13:10 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-08-15 13:11 - 2013-08-15 13:10 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-08-15 10:07 - 2013-08-18 10:08 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-08-15 10:07 - 2013-08-15 10:07 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-08-14 23:16 - 2013-07-26 06:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-14 23:16 - 2013-07-26 06:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-14 23:16 - 2013-07-26 06:13 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-14 23:16 - 2013-07-26 06:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-14 23:16 - 2013-07-26 06:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-14 23:16 - 2013-07-26 06:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-14 23:16 - 2013-07-26 06:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-14 23:16 - 2013-07-26 06:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-14 23:16 - 2013-07-26 06:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-14 23:16 - 2013-07-26 06:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-14 23:16 - 2013-07-26 06:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-14 23:16 - 2013-07-26 06:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-14 23:16 - 2013-07-26 06:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-14 23:16 - 2013-07-26 06:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-14 23:16 - 2013-07-26 05:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-14 23:16 - 2013-07-26 04:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-14 15:22 - 2013-07-25 11:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 15:22 - 2013-07-19 04:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 15:22 - 2013-07-09 08:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-08-14 15:22 - 2013-07-09 08:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 15:22 - 2013-07-09 07:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 15:22 - 2013-07-09 07:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 15:22 - 2013-07-09 07:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 15:22 - 2013-07-09 07:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 15:22 - 2013-07-09 07:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 15:22 - 2013-07-09 07:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 15:22 - 2013-07-06 08:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 15:21 - 2013-06-15 06:40 - 00918528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2013-08-14 15:21 - 2013-06-15 06:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-14 13:25 - 2013-08-14 13:26 - 00000051 _____ C:\Users\Toshiba\Desktop\tercih.txt
2013-08-13 10:39 - 2013-08-13 14:54 - 00004636 _____ C:\Users\Toshiba\Desktop\Empathy.txt
2013-08-07 18:39 - 2013-08-25 21:54 - 01493194 _____ C:\Windows\WindowsUpdate.log
2013-08-05 15:42 - 2013-08-21 08:42 - 00000000 ___RD C:\Program Files\Skype
2013-08-05 15:42 - 2013-08-05 17:30 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\Skype
2013-08-05 15:42 - 2013-08-05 15:43 - 00000000 ____D C:\ProgramData\Skype
2013-08-05 15:42 - 2013-08-05 15:42 - 00002507 _____ C:\Users\Public\Desktop\Skype.lnk
2013-08-05 15:42 - 2013-08-05 15:42 - 00000000 ____D C:\Program Files\Common Files\Skype

==================== One Month Modified Files and Folders =======

2013-08-25 22:03 - 2013-08-25 22:03 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\WinZipper
2013-08-25 22:03 - 2013-08-25 22:03 - 00000000 ____D C:\Program Files\WinZipper
2013-08-25 22:03 - 2013-08-25 22:01 - 00000000 ____D C:\ProgramData\eSafe
2013-08-25 22:03 - 2012-06-21 17:40 - 00773800 _____ (Microsoft Corporation) C:\Windows\system32\msvcr100.dll
2013-08-25 22:03 - 2012-06-21 17:40 - 00421032 _____ (Microsoft Corporation) C:\Windows\system32\msvcp100.dll
2013-08-25 22:01 - 2013-08-25 22:01 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\SimilarSites
2013-08-25 22:01 - 2013-08-25 22:01 - 00000000 ____D C:\Program Files\WebConnect
2013-08-25 22:01 - 2013-08-25 22:01 - 00000000 ____D C:\Program Files\SimilarSites
2013-08-25 22:01 - 2013-08-25 22:01 - 00000000 ____D C:\FRST
2013-08-25 22:01 - 2011-08-27 16:44 - 00001615 _____ C:\Users\Toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-08-25 21:59 - 2011-09-02 11:09 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\DMCache
2013-08-25 21:58 - 2011-09-04 23:16 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\IDM
2013-08-25 21:58 - 2009-07-14 07:34 - 00026576 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-25 21:58 - 2009-07-14 07:34 - 00026576 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-25 21:54 - 2013-08-07 18:39 - 01493194 _____ C:\Windows\WindowsUpdate.log
2013-08-25 21:52 - 2011-08-27 17:06 - 00001038 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3184794996-814937175-2401593632-1000UA.job
2013-08-25 21:51 - 2009-07-14 07:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-25 21:50 - 2013-08-25 21:50 - 00003216 ____N C:\bootsqm.dat
2013-08-25 21:50 - 2013-08-25 11:18 - 00000224 _____ C:\Windows\setupact.log
2013-08-25 15:41 - 2013-05-22 23:55 - 00000814 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-25 14:08 - 2012-03-25 22:58 - 00001036 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3184794996-814937175-2401593632-1000UA.job
2013-08-25 11:27 - 2013-08-25 11:27 - 00000000 ____D C:\Users\Toshiba\Desktop\Trojan
2013-08-25 11:27 - 2013-08-25 11:27 - 00000000 ____D C:\Users\Toshiba\Desktop\Forum
2013-08-25 11:24 - 2011-04-12 10:02 - 27994038 _____ C:\Windows\system32\perfh01F.dat
2013-08-25 11:24 - 2011-04-12 10:02 - 09914242 _____ C:\Windows\system32\perfc01F.dat
2013-08-25 11:24 - 2010-11-21 00:01 - 00006670 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-25 11:18 - 2013-08-25 11:18 - 00000000 _____ C:\Windows\setuperr.log
2013-08-25 09:52 - 2011-08-27 17:06 - 00000986 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3184794996-814937175-2401593632-1000Core.job
2013-08-25 09:23 - 2013-08-25 09:19 - 00000000 ____D C:\Users\Toshiba\Desktop\RK_Quarantine
2013-08-25 09:15 - 2013-08-25 09:15 - 00923136 _____ C:\Users\Toshiba\Desktop\RogueKiller.exe
2013-08-24 11:08 - 2012-03-25 22:58 - 00001014 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3184794996-814937175-2401593632-1000Core.job
2013-08-24 09:56 - 2011-08-27 17:06 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-22 23:49 - 2013-04-23 14:20 - 00000000 ____D C:\Guild Wars 2
2013-08-22 17:39 - 2013-08-20 12:23 - 00004899 _____ C:\Users\Toshiba\Desktop\resim yerine sorular.txt
2013-08-21 15:41 - 2012-07-28 03:34 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-08-21 15:41 - 2011-08-27 17:02 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-08-21 08:42 - 2013-08-05 15:42 - 00000000 ___RD C:\Program Files\Skype
2013-08-18 10:08 - 2013-08-15 10:07 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-08-17 14:55 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\rescache
2013-08-16 17:18 - 2009-07-14 05:04 - 00000560 _____ C:\Windows\win.ini
2013-08-16 11:22 - 2013-08-16 11:22 - 00000000 ____D C:\Users\Toshiba\Desktop\Resimler
2013-08-15 15:22 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-08-15 14:22 - 2011-08-27 17:02 - 00000000 ____D C:\Windows\system32\Adobe
2013-08-15 13:11 - 2013-08-15 13:11 - 00000000 ____D C:\Program Files\Common Files\Java
2013-08-15 13:10 - 2013-08-15 13:11 - 00867240 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-08-15 13:10 - 2013-08-15 13:11 - 00263592 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-08-15 13:10 - 2013-08-15 13:11 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-08-15 13:10 - 2013-08-15 13:11 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-08-15 13:10 - 2013-08-15 13:11 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-08-15 13:10 - 2011-08-27 17:04 - 00789416 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-08-15 13:10 - 2011-08-27 17:04 - 00000000 ____D C:\Program Files\Java
2013-08-15 10:10 - 2011-08-27 17:02 - 00000000 ____D C:\Users\Toshiba\AppData\Local\Adobe
2013-08-15 10:07 - 2013-08-15 10:07 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-08-15 08:38 - 2011-08-27 17:34 - 00000000 ____D C:\Windows\Panther
2013-08-15 08:35 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\system32\tr-TR
2013-08-14 23:25 - 2013-07-16 00:14 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 23:21 - 2011-08-27 17:45 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-14 13:26 - 2013-08-14 13:25 - 00000051 _____ C:\Users\Toshiba\Desktop\tercih.txt
2013-08-14 11:01 - 2009-07-14 05:37 - 00000000 ____D C:\Windows\system32\NDF
2013-08-13 16:35 - 2011-12-09 16:12 - 00000000 ____D C:\Windows\massfilter
2013-08-13 14:54 - 2013-08-13 10:39 - 00004636 _____ C:\Users\Toshiba\Desktop\Empathy.txt
2013-08-08 19:39 - 2012-05-11 19:32 - 00000000 ____D C:\Users\Toshiba\Documents\Guild Wars 2
2013-08-05 17:30 - 2013-08-05 15:42 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\Skype
2013-08-05 15:43 - 2013-08-05 15:42 - 00000000 ____D C:\ProgramData\Skype
2013-08-05 15:42 - 2013-08-05 15:42 - 00002507 _____ C:\Users\Public\Desktop\Skype.lnk
2013-08-05 15:42 - 2013-08-05 15:42 - 00000000 ____D C:\Program Files\Common Files\Skype
2013-08-03 10:12 - 2011-08-27 17:07 - 00000971 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-08-03 10:12 - 2011-08-27 17:07 - 00000000 ____D C:\Program Files\CCleaner
2013-08-02 10:29 - 2009-07-14 07:53 - 00032584 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-26 06:13 - 2013-08-14 23:16 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-26 06:13 - 2013-08-14 23:16 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-26 06:13 - 2013-08-14 23:16 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-26 06:12 - 2013-08-14 23:16 - 14329344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-26 06:12 - 2013-08-14 23:16 - 02877440 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-26 06:12 - 2013-08-14 23:16 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-26 06:12 - 2013-08-14 23:16 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-26 06:12 - 2013-08-14 23:16 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-26 06:12 - 2013-08-14 23:16 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-26 06:12 - 2013-08-14 23:16 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-26 06:12 - 2013-08-14 23:16 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-26 06:12 - 2013-08-14 23:16 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-26 06:11 - 2013-08-14 23:16 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-26 06:11 - 2013-08-14 23:16 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-26 05:49 - 2013-08-14 23:16 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-26 04:59 - 2013-08-14 23:16 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

Files to move or delete:
====================
C:\Users\Toshiba\AppData\Local\Temp\nsjBF3A.tmp\nsProcess.dll
C:\Users\Toshiba\AppData\Local\Temp\is1326335552\1263511_Setup.EXE
C:\Users\Toshiba\AppData\Local\Temp\is1326335552\1263511_Setup.EXE.part
C:\Users\Toshiba\AppData\Local\Temp\is1326335552\1306344_Setup.EXE
C:\Users\Toshiba\AppData\Local\Temp\is1326335552\1306344_Setup.EXE.part
C:\Users\Toshiba\AppData\Local\Temp\is1326335552\587866_Setup.EXE
C:\Users\Toshiba\AppData\Local\Temp\is1326335552\587866_Setup.EXE.part
C:\Users\Toshiba\AppData\Local\Temp\is1326335552\cor_ar_201381417179_qvo6.exe
C:\Users\Toshiba\AppData\Local\Temp\is1326335552\SimilarBundleGenericDl.exe
C:\Users\Toshiba\AppData\Local\Temp\is1326335552\WebConnect.exe
C:\Users\Toshiba\AppData\Local\Temp\is1326335552\YandexPackSetup.exe
C:\Users\Toshiba\AppData\Local\Temp\gw2cache-{CAD8D7B4-0829-1727-B7D7-D8CA29082717}\icudt.dll
C:\Users\Toshiba\AppData\Local\Temp\eIntaller\712B695E0873408999EE5B25D927724C\eXQ.exe
C:\Users\Toshiba\AppData\Local\Temp\eIntaller\6FE38B7AE58F4f68800EEC93E307853F\eGdpSvc.exe
C:\Users\Toshiba\AppData\Local\Temp\eIntaller\6FE38B7AE58F4f68800EEC93E307853F\eXQ.exe

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-13 17:22

==================== End Of Log ============================

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Run RogueKiller again and click Scan

When the scan completes > click on the Registry tab

Put a check next to all of these and uncheck the rest: (if found)

[sHELL][Rans.Gendarm] HKCU\[...]\Windows : load (C:\Users\Toshiba\LOCALS~1\Temp\mswuuwr.bat [x]) -> BULUNDU

[sHELL][Rans.Gendarm] HKUS\[...]\Windows : load (C:\Users\Toshiba\LOCALS~1\Temp\mswuuwr.bat [x]) -> BULUNDU

Now click Delete on the right hand column under Options

-------------

Then.............

Download Malwarebytes Anti-Rootkit from HERE

  • Unzip the contents to a folder in a convenient location.
  • Open the folder where the contents were unzipped and run mbar.exe
  • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  • Wait while the system shuts down and the cleanup process is performed.
  • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt
To attach a log if needed:

Bottom right corner of this page.

more-reply-options.jpg

New window that comes up.

choose-files1.jpg

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot. It's located in the Plugins folder which is in the MBAR folder.

Just run fixdamage.exe.

Verify that they are now functioning normally.

MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Good......

Lets check for any adware while you're here:

Please download AdwCleaner by Xplode and save to your Desktop.

  • Double click on AdwCleaner.exe to run the tool.

    Vista/Windows 7/8 users right-click and select Run As Administrator

  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.
If you agree with everything listed to be removed...........

Double click on AdwCleaner.exe to run the tool again.

  • Click on the Scan button.
  • AdwCleaner will begin to scan your computer like it did before.
  • After the scan has finished...
  • This time click on the Clean button.
  • Press OK when asked to close all programs and follow the onscreen prompts.
  • Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
  • After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of that logfile will also be saved in the C:\AdwCleaner folder.
Then..................

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

Please let me know how computer is running now, MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Good......

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • If you get Unsupported operating system. Aborting now, just reboot and try again.
  • A Notepad document should open automatically called checkup.txt.
  • Please Post the contents of that document.
  • Do Not Attach It!!!
MrC
Link to post
Share on other sites
muratheblack

muratheblack

Posted
  • Author
Posted

Sorry for the unnecessary attachments :)

Results of screen317's Security Check version 0.99.73  
 Windows 7 Service Pack 1 x86 (UAC is enabled)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:``````````````
avast! Internet Security   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:`````````
 TuneUp Utilities 2012   
 TuneUp Utilities Language Pack (en-US)
 CCleaner     
 Java 6 Update 26  
 Java 7 Update 25  
 Adobe Flash Player     11.8.800.94  
 Adobe Reader 10.1.7 Adobe Reader out of Date!  
 Mozilla Firefox (9.0.1)
 Google Chrome 28.0.1500.72  
 Google Chrome 28.0.1500.95  
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbamgui.exe  
 Malwarebytes' Anti-Malware mbamscheduler.exe   
 AVAST Software Avast AvastSvc.exe  
 AVAST Software Avast afwServ.exe  
 AVAST Software Avast AvastUI.exe  
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Out dated programs on the system are vulnerable to malware.
Please update or uninstall them:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Java™ 6 Update 26 <----please uninstall from your add/remove progrms
Java 7 Update 25 <---OK


Adobe Reader 10.1.7 Adobe Reader out of Date! <---please check for an update if available or uninstall and download and install Foxit Reader which is less vulnerable to malware and much better than Adobe. Don't install any toolbars that may come with it (ASK Toolbar).

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

cf2.jpg

Then hit enter.
This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller)

---------------------------------

If you used FRST:
Download the fixlist.txt to the same folder as FRST.
Run FRST and click Fix only once and wait
That will delete the quarantine folder created by FRST.

-----------------------------

If you used DeFogger to disable your CD Emulation drivers, please re-enable them.

-------------------------------

Please download OTC to your desktop.
http://oldtimer.geekstogo.com/OTC.exe

Double-click OTC to run it. (Vista and up users, please right click on OTC and select "Run as an Administrator")
Click on the CleanUp! button and follow the prompts.
(If you get a warning from your firewall or other security programs regarding OTC attempting to contact the Internet, please allow the connection.)
You will be asked to reboot the machine to finish the Cleanup process, choose Yes.
After the reboot all the tools we used should be gone.
Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.

Any other programs or logs you can manually delete.
IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, MBAR, etc....AdwCleaner > just run the program and click uninstall.

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

Link to post
Share on other sites
LDTate

LDTate

Posted
Posted

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.