Malwarebytes freezes when I try to remove threats

janedoe1776 · October 13, 2013

As the title states, when I run malwarebytes, I have 12 threats that show up, but when I select remove threats the program freezes. I have tried leaving it be for a while to see if it would start back up on it's own, but it just sits there. I am hoping you can help.

I read a bit on your forum, so I am going to try to get the ball rolling with the dds and attach logs pasted below:

Thanks in advance

DDS (Ver_2012-11-20.01) - NTFS_x86 NETWORK
Internet Explorer: 9.0.8112.16514 BrowserJavaVersion: 10.40.2
Run by Karli at 21:34:01 on 2013-10-12
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\Explorer.EXE
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
.
============== Pseudo HJT Report ===============
.

uProxyOverride = 192.168.*.*

BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\programdata\realnetworks\realdownloader\browserplugins\ie\rndlbrowserrecordplugin.dll
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - c:\program files\windows live\companion\companioncore.dll
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
TB: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll
uRun: [Weather] c:\program files\aws\weatherbug\Weather.exe 1
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRunOnce: [Report] c:\adwcleaner\AdwCleaner[s2].txt
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
mRun: [ZoneAlarm] "c:\program files\checkpoint\zonealarm\zatray.exe"
mRun: [Windows Defender] c:\program files\windows defender\MSASCui.exe -hide
mRun: [TvOutSwitch] c:\program files\fujitsu\dispswitch\DispSwitchLauncher.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [LoadFujitsuQuickTouch] c:\program files\fujitsu\application panel\QuickTouch.exe
mRun: [LoadFUJ02E3] c:\program files\fujitsu\fuj02e3\FUJ02E3.exe
mRun: [LoadBtnHnd] c:\program files\fujitsu\btnhnd\BtnHnd.exe
mRun: [LanguageShortcut] "c:\program files\cyberlink\powerdvd\language\Language.exe"
mRun: [indicatorUtility] c:\program files\fujitsu\fujitsu hotkey utility\IndicatorUty.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [FJUPDNV_Chitose] c:\program files\fujitsu\fjdvrupd\updatenv.exe
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [331BigDog] c:\windows\VM331_STI.EXE
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
dRun: [Picasa Media Detector] c:\program files\picasa2\PicasaMediaDetector.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
uPolicies-Explorer: HideSCAHealth = dword:1
mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {A5ABA0BB-F195-40d8-A5E9-0801153E6597} - {2151DA8C-C5B6-4B4F-86AB-BDA449BF8747} - c:\program files\evernote\evernote\enbar.dll

TCP: NameServer = 209.18.47.61 209.18.47.62
TCP: Interfaces\{1DF7BA55-7F2F-4B03-B502-8D3288B5317D} : DHCPNameServer = 209.18.47.61 209.18.47.62
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
SEH: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\superantispyware\SASSEH.DLL
LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg
mASetup: ccc-core-static - msiexec /fums {9FB9E409-423F-8B24-BF0D-1172F67EFA2F} /qb
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\karli\appdata\roaming\mozilla\firefox\profiles\2fsnzhkb.default-1372970557911\

FF - prefs.js: keyword.URL -
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.20913.0\npctrlui.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprpplugin.dll
FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll
FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\programdata\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlchromebrowserrecordext.dll
FF - plugin: c:\programdata\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlhtml5videoshim.dll
FF - plugin: c:\programdata\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlpepperflashvideoshim.dll
FF - plugin: c:\programdata\realnetworks\realdownloader\browserplugins\npdlplugin.dll
FF - plugin: c:\users\karli\appdata\local\facebook\video\skype\npFacebookVideoCalling.dll
FF - plugin: c:\windows\system32\adobe\director\np32dsw_1168638.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_9_900_117.dll
FF - plugin: c:\windows\system32\npdeployJava1.dll
FF - plugin: c:\windows\system32\npmproxy.dll
FF - ExtSQL: 2013-09-11 04:46; {DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}; c:\programdata\realnetworks\realdownloader\browserplugins\firefox\Ext
.
============= SERVICES / DRIVERS ===============
.
R? ADVNTDRV;ADVNTDRV
R? aswFsBlk;aswFsBlk
R? aswMonFlt;aswMonFlt
R? aswRvrt;aswRvrt
R? aswSnx;aswSnx
R? aswSP;aswSP
R? aswVmm;aswVmm
R? avast! Antivirus;avast! Antivirus
R? avast! Firewall;avast! Firewall
R? BTCFilterService;USB Networking Driver Filter Service
R? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86
R? FontCache;Windows Font Cache Service
R? MBAMSwissArmy;MBAMSwissArmy
R? motccgp;Motorola USB Composite Device Driver
R? motccgpfl;MotCcgpFlService
R? Motousbnet;Motorola USB Networking Driver Service
R? motusbdevice;Motorola USB Dev Driver
R? RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service
R? SASDIFSV;SASDIFSV
R? SASKUTIL;SASKUTIL
R? UpdateNaviInstallService;UpdateNaviInstallService
R? vm331avs;VC0334 USB2.0 Digital Camera
R? vsdatant7;vsdatant7
R? WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0
R? ZAPrivacyService;ZoneAlarm Privacy Service
S? !SASCORE;SAS Core Service
S? aswFW;avast! TDI Firewall Driver
S? aswKbd;aswKbd
S? aswNdis;avast! Firewall NDIS Filter Service
S? aswNdis2;avast! Firewall Core Firewall Service
S? FBIOSDRV;FBIOSDRV
S? FUJ02E3;Fujitsu FUJ02E3 Device Driver
S? O2MDRDR;O2MDRDR
S? O2SDRDR;O2SDRDR
.
=============== Created Last 30 ================
.
2013-10-13 00:24:39   40776   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2013-10-13 00:23:50   --------   d-----w-   c:\users\karli\appdata\roaming\CleanMyPC Software
2013-10-09 08:25:02   1069056   ----a-w-   c:\windows\system32\DWrite.dll
2013-10-09 08:25:01   798208   ----a-w-   c:\windows\system32\FntCache.dll
2013-10-09 08:25:01   486400   ----a-w-   c:\windows\system32\d3d10level9.dll
2013-10-09 08:25:00   683008   ----a-w-   c:\windows\system32\d2d1.dll
2013-10-09 08:25:00   219648   ----a-w-   c:\windows\system32\d3d10_1core.dll
2013-10-09 08:25:00   189952   ----a-w-   c:\windows\system32\d3d10core.dll
2013-10-09 08:25:00   160768   ----a-w-   c:\windows\system32\d3d10_1.dll
2013-10-09 08:25:00   1172480   ----a-w-   c:\windows\system32\d3d10warp.dll
2013-10-09 08:25:00   1029120   ----a-w-   c:\windows\system32\d3d10.dll
2013-10-05 14:18:54   204784   ----a-w-   c:\windows\system32\drivers\aswNdis2.sys
2013-10-05 14:18:53   104752   ----a-w-   c:\windows\system32\drivers\aswFW.sys
2013-10-05 14:18:52   21576   ----a-w-   c:\windows\system32\drivers\aswKbd.sys
2013-10-05 14:18:40   12112   ----a-w-   c:\windows\system32\drivers\aswNdis.sys
2013-09-27 01:57:30   --------   d-----w-   c:\programdata\Oracle
2013-09-27 01:54:20   94632   ----a-w-   c:\windows\system32\WindowsAccessBridge.dll
.
==================== Find3M ====================
.
2013-10-10 09:45:38   692616   ----a-w-   c:\windows\system32\FlashPlayerApp.exe
2013-10-10 09:45:37   71048   ----a-w-   c:\windows\system32\FlashPlayerCPLApp.cpl
2013-09-27 01:54:06   868264   ----a-w-   c:\windows\system32\npdeployJava1.dll
2013-09-27 01:54:05   790440   ----a-w-   c:\windows\system32\deployJava1.dll
2013-09-22 10:22:59   1800704   ----a-w-   c:\windows\system32\jscript9.dll
2013-09-22 10:14:39   1427968   ----a-w-   c:\windows\system32\inetcpl.cpl
2013-09-22 10:13:22   1129472   ----a-w-   c:\windows\system32\wininet.dll
2013-09-22 10:08:41   142848   ----a-w-   c:\windows\system32\ieUnatt.exe
2013-09-22 10:06:58   420864   ----a-w-   c:\windows\system32\vbscript.dll
2013-09-22 10:03:18   2382848   ----a-w-   c:\windows\system32\mshtml.tlb
2013-09-11 09:42:36   499712   ----a-w-   c:\windows\system32\msvcp71.dll
2013-09-11 09:42:36   348160   ----a-w-   c:\windows\system32\msvcr71.dll
2013-08-30 07:48:13   177864   ----a-w-   c:\windows\system32\drivers\aswVmm.sys
2013-08-30 07:48:12   770344   ----a-w-   c:\windows\system32\drivers\aswSnx.sys
2013-08-30 07:48:12   49376   ----a-w-   c:\windows\system32\drivers\aswRvrt.sys
2013-08-30 07:48:11   66336   ----a-w-   c:\windows\system32\drivers\aswMonFlt.sys
2013-08-30 07:47:40   41664   ----a-w-   c:\windows\avastSS.scr
2013-08-29 07:36:04   2050048   ----a-w-   c:\windows\system32\win32k.sys
2013-08-02 04:09:35   1548288   ----a-w-   c:\windows\system32\WMVDECOD.DLL
2013-08-01 03:16:32   638400   ----a-w-   c:\windows\system32\drivers\dxgkrnl.sys
2013-08-01 02:49:15   37376   ----a-w-   c:\windows\system32\cdd.dll
2013-07-20 10:44:53   102608   ----a-w-   c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-07-17 19:41:34   2048   ----a-w-   c:\windows\system32\tzres.dll
2013-07-16 04:35:16   615936   ----a-w-   c:\windows\system32\themeui.dll
.
============= FINISH: 21:34:10.07 ===============

.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
32 Bit HP CIO Components Installer
4300
4300_Help
4300Trb
7-Zip 9.20
Activation Assistant for the 2007 Microsoft Office suites
Adobe AIR
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.8)
Adobe Shockwave Player 11.6
Agere Systems HDA Modem
AIO_CDB_ProductContext
AIO_CDB_Software
AIO_Scan
ALPS Touch Pad Driver
ArcSoft WebCam Companion 2
ATI Catalyst Install Manager
ATI Uninstaller
avast! Internet Security
Big Fish Games: Game Manager
Brain Games: Mahjongg
Branding
BufferChm
Business Plan Pro 15th Anniversary Edition
calibre
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center Localization Chinese Standard
Catalyst Control Center Localization Chinese Traditional
Catalyst Control Center Localization Czech
Catalyst Control Center Localization Danish
Catalyst Control Center Localization Dutch
Catalyst Control Center Localization Finnish
Catalyst Control Center Localization French
Catalyst Control Center Localization German
Catalyst Control Center Localization Greek
Catalyst Control Center Localization Hungarian
Catalyst Control Center Localization Italian
Catalyst Control Center Localization Japanese
Catalyst Control Center Localization Korean
Catalyst Control Center Localization Norwegian
Catalyst Control Center Localization Polish
Catalyst Control Center Localization Portuguese
Catalyst Control Center Localization Russian
Catalyst Control Center Localization Spanish
Catalyst Control Center Localization Swedish
Catalyst Control Center Localization Thai
Catalyst Control Center Localization Turkish
ccc-core-static
ccc-utility
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
CleanMyPC - Registry Cleaner
Compatibility Pack for the 2007 Office system
Copy
CustomerResearchQFolder
D3DX10
Destinations
DeviceManagementQFolder
DocProc
DocProcQFolder
Dropbox
eSupportQFolder
EverNote 2
Facebook Video Calling 1.1.1.1
Facebook Video Calling 1.2.0.159
Facebook Video Calling 1.2.0.287
Fax
Fujitsu A Series Retail Demo
Fujitsu Display Manager
Fujitsu Driver Update
Fujitsu Hotkey Utility
Fujitsu MobilityCenter Extension Utility
Fujitsu System Extension Utility
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Customer Participation Program 8.0
HP Imaging Device Functions 8.0
HP OCR Software 8.0
HP Photosmart Essential
HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B
HP Product Assistant
HP Solution Center 8.0
HP Update
HPProductAssistant
HPSSupply
Java 7 Update 40
Java Auto Updater
LifeBook Application Panel
Mahjong Escape Ancient China
Malwarebytes Anti-Malware version 1.75.0.1300
MarketResearch
Messenger Companion
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Application Error Reporting
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook Connector
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Professional Plus 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable - KB2467175
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Works
Miro
MotoHelper MergeModules
Motorola Mobile Drivers Installation 6.0.0
Mozilla Firefox 24.0 (x86 en-US)
Mozilla Maintenance Service
MSVCRT
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP3 Parser
MSXML 4.0 SP3 Parser (KB2758694)
O2Micro Flash Memory Card Windows Driver
OGA Notifier 2.0.0048.0
Picasa 2
PowerDVD
RealDownloader
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealNetworks - Microsoft Visual C++ 2010 Runtime
RealPlayer
Realtek High Definition Audio Driver
RealUpgrade 1.1
Roxio Activation Module
Roxio Easy Media Creator Home
Scan
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2840629)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2861697)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2832407)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2858302v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2861188)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft .NET Framework 4 Extended (KB2736428)
Security Update for Microsoft .NET Framework 4 Extended (KB2742595)
Security Update for Microsoft .NET Framework 4 Extended (KB2858302v2)
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596825) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597973) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687309) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760411) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760585) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760591) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2827326) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2827329) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2827324) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office Outlook 2007 (KB2825999) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2597971) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2827330) 32-Bit Edition
Segoe UI
Skins
SolutionCenter
Status
SUPERAntiSpyware
swMSM
Toolbox
TrayApp
UnloadSupport
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2836939)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2827325) 32-Bit Edition
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VC 9.0 Runtime
VC0331 USB2.0 Digital Camera
VC80CRTRedist - 8.0.50727.6195
WeatherBug
WebReg
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live Photo Common
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Y!TunnelPro 2.6
Yahoo! Messenger
Yahoo! Software Update
ZoneAlarm Firewall
ZoneAlarm Free Firewall
ZoneAlarm Security
.
==== End Of File ===========================

gringo_pr · October 13, 2013

Hello janedoe1776

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

These are the programs I would like you to run next, if you have any problems with one of these just skip it and move on to the next one.

-AdwCleaner-

Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Scan.
After the scan is complete click on "Clean"
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

-Junkware-Removal-Tool-

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

When they are complete let me have the two reports and let me know how things are running.

Gringo

janedoe1776 · October 13, 2013

Ok, here are the two log files you requested:

# AdwCleaner v3.007 - Report created 13/10/2013 at 15:35:16
# Updated 09/10/2013 by Xplode
# Operating System : Windows Vista Home Premium Service Pack 2 (32 bits)
# Username : Karli - KARLI-PC
# Running from : C:\Users\Karli\Downloads\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16514

-\\ Mozilla Firefox v24.0 (en-US)

[ File : C:\Users\Karli\AppData\Roaming\Mozilla\Firefox\Profiles\2fsnzhkb.default-1372970557911\prefs.js ]

*************************

AdwCleaner[R1].txt - [795 octets] - [13/10/2013 15:32:44]
AdwCleaner[R2].txt - [854 octets] - [13/10/2013 15:34:15]
AdwCleaner[s1].txt - [776 octets] - [13/10/2013 15:35:16]

########## EOF - C:\AdwCleaner\AdwCleaner[s1].txt - [835 octets] ##########

# AdwCleaner v3.007 - Report created 13/10/2013 at 15:35:16
# Updated 09/10/2013 by Xplode
# Operating System : Windows Vista Home Premium Service Pack 2 (32 bits)
# Username : Karli - KARLI-PC
# Running from : C:\Users\Karli\Downloads\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16514

-\\ Mozilla Firefox v24.0 (en-US)

[ File : C:\Users\Karli\AppData\Roaming\Mozilla\Firefox\Profiles\2fsnzhkb.default-1372970557911\prefs.js ]

*************************

AdwCleaner[R1].txt - [795 octets] - [13/10/2013 15:32:44]
AdwCleaner[R2].txt - [854 octets] - [13/10/2013 15:34:15]
AdwCleaner[s1].txt - [776 octets] - [13/10/2013 15:35:16]

########## EOF - C:\AdwCleaner\AdwCleaner[s1].txt - [835 octets] ##########
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.4 (10.06.2013:1)
OS: Windows Vista Home Premium x86
Ran by Karli on Sun 10/13/2013 at 15:46:09.58
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sun 10/13/2013 at 15:49:09.13
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

gringo_pr · October 13, 2013

Hello janedoe1776

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

janedoe1776 · October 13, 2013

Ok, so combo fix is stalled for over45 minutes. Tried rebooting and starting it over, but it stopped in the same spot again. The computer is no different now than when we started. What ever is there is still causing mbam to freeze instead of removing the threats. I will post an mbam log below the screenshot so that you know what it is we are dealing with

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.10.13.06

Windows Vista Service Pack 2 x86 NTFS (Safe Mode/Networking)
Internet Explorer 9.0.8112.16421
Karli :: KARLI-PC [administrator]

10/13/2013 5:07:31 PM
MBAM-log-2013-10-13 (17-35-02).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 206180
Time elapsed: 9 minute(s), 50 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 12
C:\Users\Karli\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3} (PUP.Optional.TopArcadeHits.A) -> No action taken.
C:\Users\Karli\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\chrome (PUP.Optional.TopArcadeHits.A) -> No action taken.
C:\Users\Karli\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\chrome\content (PUP.Optional.TopArcadeHits.A) -> No action taken.
C:\Users\Karli\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{0113D088-8ED1-468C-B225-585A9C53B5E3}\skin (PUP.Optional.TopArcadeHits.A) -> No action taken.
C:\Users\Karli\AppData\Local\Temp\ct3239904 (PUP.Optional.Conduit.A) -> No action taken.
C:\Users\Karli\AppData\Local\Temp\ct3239904\xpi (PUP.Optional.Conduit.A) -> No action taken.
C:\Users\Karli\AppData\Local\Temp\ct3239904\xpi\defaults (PUP.Optional.Conduit.A) -> No action taken.
C:\Users\Karli\AppData\Local\Temp\ct3239904\xpi\defaults\preferences (PUP.Optional.Conduit.A) -> No action taken.
C:\Users\Karli\AppData\Local\Temp\ct3291326 (PUP.Optional.Conduit.A) -> No action taken.
C:\Users\Karli\AppData\Local\Temp\ct3291326\xpi (PUP.Optional.Conduit.A) -> No action taken.
C:\Users\Karli\AppData\Local\Temp\ct3291326\xpi\defaults (PUP.Optional.Conduit.A) -> No action taken.
C:\Users\Karli\AppData\Local\Temp\ct3291326\xpi\defaults\preferences (PUP.Optional.Conduit.A) -> No action taken.

Files Detected: 0
(No malicious items detected)

(end)

gringo_pr · October 14, 2013

Hello janedoe1776

Ok lets try this, I want you to run combofix in safe mode but it is very important that when combofix reboots the computer for you to direct it back into safe mode so it can finish the scan.

Boot into Safe Mode

Reboot your computer in Safe Mode.

If the computer is running, shut down Windows, and then turn off the power.
Wait 30 seconds, and then turn the computer on.
Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
Ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.
Login on your usual account.

after combofix has finished its scan please post the report back here.

Gringo

janedoe1776 · October 14, 2013

Well Gringo,

Here is what I have tried, like you asked, I booted into safe mode and ran combofix, left for work, was gone 9 hours and came back to the program being stalled in the same place it stalled in regular mode. Then, I remembered that sometimes if you use a different name for the program you can fool the virus into ignoring the program, so I deleted combofix, downloaded it again and renamed it prior to running it. That didn't help either. It still stalls in the same place. <tearing hair out> So, where do we go from here?

gringo_pr · October 15, 2013

Hello janedoe1776

I would like you to try and run these next.

TDSSKiller

Please download the latest version of TDSSKiller from here and save it to your Desktop.

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
Put a checkmark beside loaded modules.
A reboot will be needed to apply the changes. Do it.
TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
Then click on Change parameters in TDSSKiller.
Check all boxes then click OK.
Click the Start Scan button.
The scan should take no longer than 2 minutes.
If a suspicious object is detected, the default action will be Skip, click on Continue.
If malicious objects are found, they will show in the Scan results
Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
more than one report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". The one that I need is the larger one. Please copy and paste the contents of that file here.
Note** this report can be very long - so if the website gives you an error saying it is to long you may attache it
If the forum still complains about it being to long send me everything that is at the end of the report after where it says
==================
Scan finished
==================

and I will see if I want to see the whole report

--RogueKiller--

Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit

Quit all programs that you may have started.
Please disconnect any external drives from the computer before you run this scan!
For Vista or Windows 7, right-click and select "Run as Administrator to start"
For Windows XP, double-click to start.
Wait until Prescan has finished ...
Then Click on "Scan" button
Wait until the Status box shows "Scan Finished"
click on "delete"
Wait until the Status box shows "Deleting Finished"
Click on "Report" and copy/paste the content of the Notepad into your next reply.
the scan will make two reports the one I would like to see is called RKreport[2].txt on your Desktop
Exit/Close RogueKiller+

send me the reports made from TDSSKiller and Roguekiller and also let me know how the computer is doing at this time.

Gringo

janedoe1776 · October 15, 2013

Ok, here is the log from the TdssKiller and I am off to the the RogueKiller now. Oh and you were right about the board ot accepting the long log too. so let me know if you need the rest of it.

Thanks for your help with this Gringo. I feel like maybe we can make some progress now

20:35:35.0602 0x1738 ============================================================
20:35:35.0602 0x1738 Scan finished
20:35:35.0602 0x1738 ============================================================
20:35:35.0618 0x1730 Detected object count: 8
20:35:35.0618 0x1730 Actual detected object count: 8
20:37:52.0400 0x1730 ADVNTDRV ( UnsignedFile.Multi.Generic ) - skipped by user
20:37:52.0400 0x1730 ADVNTDRV ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:37:52.0416 0x1730 FBIOSDRV ( UnsignedFile.Multi.Generic ) - skipped by user
20:37:52.0416 0x1730 FBIOSDRV ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:37:52.0416 0x1730 hpqcxs08 ( UnsignedFile.Multi.Generic ) - skipped by user
20:37:52.0416 0x1730 hpqcxs08 ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:37:52.0416 0x1730 hpqddsvc ( UnsignedFile.Multi.Generic ) - skipped by user
20:37:52.0416 0x1730 hpqddsvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:37:52.0416 0x1730 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
20:37:52.0416 0x1730 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:37:52.0416 0x1730 O2Flash ( UnsignedFile.Multi.Generic ) - skipped by user
20:37:52.0416 0x1730 O2Flash ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:37:52.0416 0x1730 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
20:37:52.0416 0x1730 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:37:52.0432 0x1730 UpdateNaviInstallService ( UnsignedFile.Multi.Generic ) - skipped by user
20:37:52.0432 0x1730 UpdateNaviInstallService ( UnsignedFile.Multi.Generic ) - User select action: Skip

gringo_pr · October 15, 2013

Hello

No what I see there is fine and I will be waiting for the next report

gringo

janedoe1776 · October 15, 2013

Ok here is the report from RK

RogueKiller V8.7.2 [Oct 3 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.adlice.com/forum/
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Started in : Normal mode
User : Karli [Admin rights]
Mode : Remove -- Date : 10/14/2013 20:58:52
| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤
[sUSP PATH] {5E1BB28C-EC29-4111-BF07-8930F62850E9}.exe -- C:\Users\Karli\AppData\Local\Temp\{5E1BB28C-EC29-4111-BF07-8930F62850E9}.exe [7] -> KILLED [TermThr]

¤¤¤ Registry Entries : 2 ¤¤¤
[HJ POL][PUM] HKCU\[...]\System : DisableTaskMgr (0) -> DELETED
[HJ POL][PUM] HKCU\[...]\System : DisableRegistryTools (0) -> DELETED

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤
[inline] EAT @explorer.exe (FwDoNothingOnObject) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36AE6566)
[inline] EAT @explorer.exe (FwEnableMemTracing) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36AE6566)
[inline] EAT @explorer.exe (FwSetMemLeakPolicy) : FirewallAPI.dll -> HOOKED (Unknown @ 0x36AE6566)

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1   localhost
127.0.0.1   www.007guard.com
127.0.0.1   007guard.com
127.0.0.1   008i.com
127.0.0.1   www.008k.com
127.0.0.1   008k.com
127.0.0.1   www.00hq.com
127.0.0.1   00hq.com
127.0.0.1   010402.com
127.0.0.1   www.032439.com
127.0.0.1   032439.com
127.0.0.1   www.0scan.com
127.0.0.1   0scan.com
127.0.0.1   1000gratisproben.com
127.0.0.1   www.1000gratisproben.com
127.0.0.1   1001namen.com
127.0.0.1   www.1001namen.com
127.0.0.1   100888290cs.com
127.0.0.1   www.100888290cs.com
127.0.0.1   www.100sexlinks.com
[...]

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) (Standard disk drives) - FUJITSU MHY2200BH ATA Device +++++
--- User ---
[MBR] e4365f7a488759d7e933a0de4af663ef
[bSP] dd994dfa1597ebea0f49d35f7e74cbe7 : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1536 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 3147776 | Size: 188208 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 388597760 | Size: 1036 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_D_10142013_205852.txt >>
RKreport[0]_S_10142013_205621.txt

gringo_pr · October 15, 2013

Hello janedoe1776

If it does not progress after running for 30 min then stop it - if you see that it is progreessing then leave it alone

I would like you to try this to see if combofix will run

combofix

push the "windows key" + "R" (between the "Ctrl" button and "Alt" Button)
please copy and past the following into the box

ComboFix /nombr

click ok

copy and paste the report into this topic for me to review

Gringo

janedoe1776 · October 15, 2013

When I paste that into the run box that comes up, I get an error that says Windows can't find ComboFix even though it's sitting right there on the desktop.

gringo_pr · October 16, 2013

Hello janedoe1776

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Gringo

janedoe1776 · October 17, 2013

Well Gringo,

I tried and what happened this time was that the scan was running along and then I got a pop up that said something about some

issue and another panel came up that said "Windows is seeking a solution online" when that stopped searching it said it couldn't find a solution so it was closing Farbar.

So I am wondering it OLT is a program log with which you may be familiar? A friend suggested I try that and I was able to generate a log with it. I am copying and pasting the log here in the event it will help the cause. I did not run fix nor did I click the cleanup button in this program because you asked in your first post that no programs be run without being told to. I am just getting desperate for this ordeal to be over is all and this is just a log after all.

OTL Extras logfile created on: 10/16/2013 5:24:42 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Karli\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.93 Gb Total Physical Memory | 1.45 Gb Available Physical Memory | 75.11% Memory free
4.10 Gb Paging File | 3.80 Gb Available in Paging File | 92.53% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 183.80 Gb Total Space | 107.39 Gb Free Space | 58.43% Space Free | Partition Type: NTFS
Drive D: | 1.01 Gb Total Space | 0.89 Gb Free Space | 88.06% Space Free | Partition Type: NTFS

Computer Name: KARLI-PC | User Name: Karli | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] -- Reg Error: Value error.
https [open] -- Reg Error: Value error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"UacDisableNotify" = 1
"InternetSettingsDisableNotify" = 1
"AutoUpdateDisableNotify" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 1
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0333300B-345F-4EE5-8656-541865001273}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{05C84E66-02DE-431B-9287-5A262B8506C9}" = lport=138 | protocol=17 | dir=in | app=system |
"{0617D83B-B3A7-489A-9FCC-4844B14877D8}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{086FC063-0F20-450F-9BD1-515B48A0C495}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{094E3635-F6CF-4994-91EF-4BEDDF92E412}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{10F57E7C-CE83-4AAC-9890-C3D3355F4354}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{14F3C2B4-D398-4C79-84E3-656040567359}" = rport=137 | protocol=17 | dir=out | app=system |
"{166ABA51-8C49-4B68-8A13-1533246CBA7D}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{1EE10F69-CA26-4948-BD80-531DBC272973}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{27E31C2C-F8CD-4F06-BDC9-42EB8F7D3F6E}" = rport=10243 | protocol=6 | dir=out | app=system |
"{2B28A7CC-AEF1-4647-BDBB-83854DEECB5E}" = rport=138 | protocol=17 | dir=out | app=system |
"{2DC61C3A-EFBC-4F37-AA26-B1A54D4C2C30}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{2F207C39-9FB9-4C4F-897D-7FA2B25DCD33}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{373860E9-C0E8-4C7A-BD12-2DDE9932383A}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{42ED3DA9-258E-48F7-9837-8C73B92C60D0}" = lport=445 | protocol=6 | dir=in | app=system |
"{493D14D3-667A-43E1-9D88-541BE0A7B585}" = lport=10243 | protocol=6 | dir=in | app=system |
"{4CBE5B32-79D0-4950-A083-D167FCFDE003}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{4EF2DF90-D9D2-4A48-9731-42D9A4DCDC50}" = rport=445 | protocol=6 | dir=out | app=system |
"{57B06CD3-A975-4F75-A993-E09ED09028D6}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{6261B315-3303-414F-8CB1-C52D0D194294}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{699D75F2-993A-4B93-A15A-D671D31722E0}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{73472542-B843-4705-9A7A-A8B00061F6B6}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{783F750F-BDAD-4EC0-B816-75925D261D81}" = rport=139 | protocol=6 | dir=out | app=system |
"{7F8CA566-65EF-4BAE-A617-497D97B7A65A}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{80C07241-BE43-46C8-90F6-B1C4CE976039}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{80CD9F8E-CD35-49D7-A9AA-223CBFBD4455}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{8A0C835F-1CAB-4BE6-80F4-2E1A0FAB8AAD}" = lport=137 | protocol=17 | dir=in | app=system |
"{8EBF9818-3336-4B6C-94EF-D7FDCF12553E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8F125284-834E-4382-A2E1-7216E77BA6B5}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{AD367401-F650-40CF-8AB8-35F431B0D266}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{BEFD5D00-A8CC-4EFB-9409-F870DD1DDCB7}" = lport=2869 | protocol=6 | dir=in | app=system |
"{BF5E5F63-E7C4-4F54-8460-50DBBB12B73D}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C03FBF70-4A71-4331-9807-11C953D168EE}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{C62E848D-407E-4ECA-9DAF-46F36E1CC164}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CAB028B3-19AD-462C-B987-2EE2CBCB2267}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{DCD6D9A0-178F-4E24-BD92-960C54F6E46C}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{E803E419-8396-498B-AFE9-30849A8D64B9}" = lport=139 | protocol=6 | dir=in | app=system |
"{FD4E0329-2C27-4EB7-AEF8-C574AD59CE4D}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{036292F7-600A-4320-82F3-497170890D38}" = protocol=6 | dir=in | app=c:\users\karli\appdata\local\temp\7zs88a5.tmp\symnrt.exe |
"{04B68E66-BA7D-41B0-A5E4-29A825D749C5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{09256D71-6F8E-4457-A6CF-66464141EA1F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{12DCF758-2F60-4A8C-9E29-AFD2B2816CF2}" = protocol=17 | dir=in | app=c:\users\karli\appdata\local\temp\7zsc28f.tmp\symnrt.exe |
"{148EDCCC-CF59-4EE3-AA5C-FB291528D531}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{19A3CB4C-E34D-4E16-AB9D-6DA5B94D591A}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{2150DD97-9211-47FA-9BA4-573811B30B18}" = protocol=17 | dir=in | app=c:\program files\imesh applications\imesh\imesh.exe |
"{22F13890-1FA2-4D9A-870A-78F8241851F9}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{26315707-5834-4277-92B0-4366A54F0AA9}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{299FFFD4-C295-4A7D-8101-45F7BF218E75}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{3D7E3B37-CB25-4BDA-9A01-44076A52CB3F}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{45041E39-4647-4757-8772-1FF5AB5B189D}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{49DBFC8E-0208-40FF-8329-5C2A29E47BEE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4A7C91AC-9DBD-4080-915F-32928CBCA8F8}" = protocol=17 | dir=in | app=c:\users\karli\appdata\local\temp\7zs88a5.tmp\symnrt.exe |
"{51072E88-83BF-401C-B296-664FE390A821}" = protocol=6 | dir=in | app=c:\program files\imesh applications\imesh\imesh.exe |
"{529AB43C-D5D3-4FBC-9B5A-D32C431768D7}" = protocol=6 | dir=in | app=c:\program files\imesh applications\imesh\imesh.exe |
"{552A404B-F9F8-47AD-BA10-E3387B74A140}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{569AB3E8-B2D9-4ED5-99E2-CE7260D698DB}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{5812A0DB-1481-472F-B62E-DD7A818C8A9B}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{5A5E08AD-C604-481A-B397-29111B22177A}" = protocol=17 | dir=in | app=c:\program files\frostwire\frostwire.exe |
"{5A751732-7587-497F-A63F-001426441640}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{5B4E7A51-1556-418D-B7AB-C6EFFCCAA739}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6ACEFF02-75A9-4CD8-8797-31FE03666AD0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6C4E20BA-F0DE-4B12-BA73-4CA610D67161}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6D416017-69D3-4131-9AEB-53977BAC2A76}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{6D71989B-6498-45E2-8E6D-F8250472BBF8}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{6E4DD161-27C8-4B64-91A3-CCB21091AA0C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{733A6A2C-0F3C-4438-AD3F-EDEE7B43C596}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8165A808-DCFF-4A9E-BD99-5B2FA623E49D}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{820FD1DB-B7A4-45BC-BA7F-860BD84CE62B}" = dir=in | app=c:\users\karli\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"{89CAE88B-3FC0-4B20-96B4-6C8047E03983}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{8B21D88A-0353-4977-8BCB-6A93100BDBC1}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{94D7CDFB-7EDD-4181-AE44-6FC5091F498F}" = protocol=17 | dir=in | app=c:\users\karli\appdata\roaming\dropbox\bin\dropbox.exe |
"{96A4598D-19BB-4583-BD43-72099917A5EA}" = protocol=6 | dir=in | app=c:\users\karli\appdata\roaming\dropbox\bin\dropbox.exe |
"{9EF27F31-8CE0-4AAF-83E6-2C9A9C335745}" = protocol=6 | dir=in | app=c:\users\karli\appdata\local\temp\7zsc28f.tmp\symnrt.exe |
"{A8B30F33-8E05-4E4E-B344-D5F115D66DA2}" = protocol=6 | dir=in | app=c:\program files\frostwire\frostwire.exe |
"{AAB651C1-9BAB-4837-9BFB-9F7A665CD77B}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{AFE320AC-537E-4C8B-945A-FF2B12FE49E0}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{B09BE375-5149-4EE6-A4D1-AF617DB89934}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{B959F579-B8E2-4CC9-8355-FABE350A5C1B}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{BFFC0763-C8EA-4AC7-AE82-020D99311CB9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C08311A7-42AB-422C-916B-6B3636A3DB79}" = protocol=17 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe |
"{C1418C3C-249F-4249-AFD9-61594EEF9CEB}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{CAE82A2E-8944-4497-A8DC-780E6F17872A}" = protocol=17 | dir=in | app=c:\program files\frostwire\frostwire.exe |
"{E95FFBDF-AFCF-41A0-A00B-E1FC50F5F9A8}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{ED74BE6A-8E19-46DB-BD43-32165F99BF7F}" = protocol=6 | dir=out | app=system |
"{EDF68B4B-BC26-4441-8810-DFA655B1B33A}" = protocol=17 | dir=in | app=c:\program files\imesh applications\imesh\imesh.exe |
"{F118328B-1E04-4E82-BF8B-1553F58ACD2A}" = protocol=6 | dir=in | app=c:\program files\frostwire\frostwire.exe |
"{F47718E9-2BB7-407B-B080-45C2670B930C}" = protocol=6 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe |
"{F4F4D12D-9FDC-4F3E-9ECE-6E152C3E327E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{140F15D7-B2A5-4A75-A64F-0F770E894C13}C:\program files\participatory culture foundation\miro\miro_downloader.exe" = protocol=6 | dir=in | app=c:\program files\participatory culture foundation\miro\miro_downloader.exe |
"TCP Query User{75964E12-9136-421F-B570-22C823E2009F}C:\program files\digital asphyxia\y!tunnelpro 2.5\ytpro.exe" = protocol=6 | dir=in | app=c:\program files\digital asphyxia\y!tunnelpro 2.5\ytpro.exe |
"TCP Query User{982DC103-C14C-4593-AA41-B3CCDA36C923}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"TCP Query User{99C5FB50-607C-4033-8D97-2EB56908B397}C:\users\karli\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\karli\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{ACE2DA7E-0352-4F1A-928A-FD1467DE4D4B}C:\program files\paltalk messenger\paltalk.exe" = protocol=6 | dir=in | app=c:\program files\paltalk messenger\paltalk.exe |
"TCP Query User{B55684EB-DE7E-4754-9451-8DBD1FDC0128}C:\program files\participatory culture foundation\miro\miro_downloader.exe" = protocol=6 | dir=in | app=c:\program files\participatory culture foundation\miro\miro_downloader.exe |
"UDP Query User{39DD17BB-773E-4FBC-A51F-009ED60FAE06}C:\program files\participatory culture foundation\miro\miro_downloader.exe" = protocol=17 | dir=in | app=c:\program files\participatory culture foundation\miro\miro_downloader.exe |
"UDP Query User{59AFB86E-7562-459B-A215-0A96725FB0D1}C:\program files\paltalk messenger\paltalk.exe" = protocol=17 | dir=in | app=c:\program files\paltalk messenger\paltalk.exe |
"UDP Query User{6207958E-7463-4505-9A78-1E65356433F9}C:\program files\digital asphyxia\y!tunnelpro 2.5\ytpro.exe" = protocol=17 | dir=in | app=c:\program files\digital asphyxia\y!tunnelpro 2.5\ytpro.exe |
"UDP Query User{707B3C07-8967-4FD1-8E8E-06F2F5313C0E}C:\users\karli\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\karli\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{9495A4B1-8589-4AC9-B101-B495285C73C7}C:\program files\participatory culture foundation\miro\miro_downloader.exe" = protocol=17 | dir=in | app=c:\program files\participatory culture foundation\miro\miro_downloader.exe |
"UDP Query User{CDCD4B70-95A9-4D86-9672-AA6C589AB49E}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{00C297B1-02F3-4BEE-8B57-7BCA695A41DA}" = EverNote 2
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{0363BA15-B041-099C-7C9A-870EDD1A00B2}" = Catalyst Control Center Localization French
"{07159635-9DFE-4105-BFC0-2817DB540C68}" = Roxio Activation Module
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0AE2D65E-001C-45CF-A6E5-665B3F5109F4}" = ArcSoft WebCam Companion 2
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan
"{10188938-5CD3-1892-54FB-615D8E04CE19}" = CCC Help Turkish
"{13E373BA-EE82-ECA9-3762-148677923E15}" = CCC Help Polish
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{191C41F6-4BA8-4D3D-BBC5-AAC8F3077E3F}" = Fujitsu MobilityCenter Extension Utility
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{204C2E58-99C9-F88A-23A8-53B26519CD71}" = CCC Help Thai
"{20DA65DE-4441-1D76-524F-BC805574F867}" = Catalyst Control Center Localization Spanish
"{23BA3D03-C404-50C7-CB3D-3777B1A3AAC0}" = CCC Help German
"{26A24AE4-039D-4CA4-87B4-2F83217040FF}" = Java 7 Update 40
"{27EFE61D-8A19-D287-3573-A871EADC4D2B}" = Catalyst Control Center Localization Finnish
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{297DCADA-86A1-4A42-8A13-66B7D7A09FD2}" = WeatherBug
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2C00FDE4-B395-2C43-47CD-4F34BFC7FF58}" = Catalyst Control Center Localization Chinese Traditional
"{2F9A6B72-2ECC-B2D8-9B8A-70D634FEF0A5}" = CCC Help Italian
"{335C7901-BA1A-6E78-C38E-6FACC8E03FDF}" = ccc-utility
"{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant
"{3AA7AA2E-6D84-EE7D-6B20-2834F275D118}" = Catalyst Control Center Localization Greek
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3DB264F1-5300-BE54-F655-474538E5B7AE}" = Catalyst Control Center Graphics Full Existing
"{3E9E68FB-49FA-410A-8787-424F2A506E0F}" = Business Plan Pro 15th Anniversary Edition
"{4160DC5B-4C56-D0C3-C5FD-F5BDAD3C882B}" = ATI Catalyst Install Manager
"{43C67425-D321-60A2-7DDD-5AD7D9DA34AF}" = Catalyst Control Center Localization Turkish
"{47BC37A3-35C8-484A-8CBD-851914EB095E}" = Fujitsu Driver Update
"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4DB6E497-187A-4095-157B-77242FD24844}" = Catalyst Control Center Localization Polish
"{4EEACDD5-E652-A888-E7AE-D345C93108D6}" = Catalyst Control Center Localization Italian
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{509AB552-924D-8CDA-CE9F-6E3549817B09}" = CCC Help Korean
"{52E225FC-FCB4-41F7-837B-6E37FB05BD7B}" = Adobe AIR
"{535C3494-F852-062B-0380-B118A20D42E9}" = Catalyst Control Center Localization Danish
"{574157B0-9D84-49d9-B08B-5296638BF5EE}" = 4300_Help
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5A46CDF0-B0F4-4FDF-972A-A6AA3FEB8859}" = CCC Help Norwegian
"{5BBE51E2-0809-8E7D-763F-D878FEBEC7B1}" = CCC Help Dutch
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{61AA490B-5BA7-48F8-CE04-F16A3A81FC84}" = CCC Help Japanese
"{6226477E-444F-4DFE-BA19-9F4F7D4565BC}" = LifeBook Application Panel
"{624E54D0-E4F4-434F-9EF6-D4D066EE4348}" = Facebook Video Calling 1.1.1.1
"{641CD90D-17FF-3711-4846-9F02E0EBB115}" = Catalyst Control Center Localization Chinese Standard
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68A3D383-6E0A-A84D-0A76-9091175417CE}" = CCC Help Swedish
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{7A7DC702-DEDE-42A8-8722-B3BA724D546F}" = Fax
"{7CAC6A44-C3DE-4153-ACA6-7524602C789E}" = Facebook Video Calling 1.2.0.159
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{83C5CF93-B393-6945-0B74-A2EDC64F6CAD}" = Catalyst Control Center Graphics Light
"{8445F041-CA54-279A-7D15-F6F406AF402D}" = CCC Help French
"{8679FBA3-4098-1A88-E662-9D449F665A9D}" = Catalyst Control Center Localization Thai
"{868A72A9-B90D-5E29-3D91-0D5339AD7597}" = Catalyst Control Center Localization Korean
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A226FD4-37CE-4B74-93FB-658D943BA544}" = Catalyst Control Center Graphics Previews Vista
"{8AC823B4-918E-E9DA-014A-D035CF3D1360}" = Catalyst Control Center Core Implementation
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E30D11F-4F74-3EE1-AE2F-830C3CAEA972}" = Catalyst Control Center Localization Swedish
"{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007
"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}_PROPLUS_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}_PROPLUS_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROPLUS_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}_PROPLUS_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROPLUS_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{915C56D7-1EFD-4BF3-9FBE-2B0D39F36525}" = calibre
"{91EA42B7-06FD-2834-858B-B219A6A8CE6C}" = Catalyst Control Center Localization Russian
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{94CAC2F1-C856-47F4-AF24-65A1E75AEDB9}" = MotoHelper MergeModules
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-007F-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
"{97486FBE-A3FC-4783-8D55-EA37E9D171CC}" = HP Update
"{978C25EE-5777-46e4-8988-732C297CBDBD}" = Status
"{98CCC577-9ED6-E291-F512-800C6BC9B485}" = CCC Help Chinese Standard
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B1FD9CE-0776-4f0b-A6F5-C6AB7B650CDF}" = Destinations
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9F56D0C8-731E-93F2-584A-34C6A486D876}" = Catalyst Control Center Localization Norwegian
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{9FB9E409-423F-8B24-BF0D-1172F67EFA2F}" = ccc-core-static
"{9FEAE825-0C49-8268-6B15-7453BE451243}" = CCC Help English
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A2B79FA6-AD59-4D84-AE55-89C58D1F48B9}" = Branding
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{A3B7C670-4A1E-4EE2-950E-C875BC1965D0}" = Copy
"{A5B96AC4-1E88-9219-6AD7-D7EF74F73839}" = Catalyst Control Center Localization Japanese
"{A80FA752-C491-4ED9-ABF0-4278563160B2}" = 32 Bit HP CIO Components Installer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAECF7BA-E83B-4A10-87EA-DE0B333F8734}" = RealNetworks - Microsoft Visual C++ 2010 Runtime
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.8)
"{ACF4BF67-2A6F-ADCA-5B96-79686DD9A1CC}" = Catalyst Control Center Localization German
"{ADE16A9D-FBDC-4ecc-B6BD-9C31E51D0332}" = VC0331 USB2.0 Digital Camera
"{B0B2407C-AA1A-4812-85DA-E833D5BC3E97}" = 4300
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B7FB0C86-41A4-4402-9A33-912C462042A0}" = Roxio Easy Media Creator Home
"{B8375BAD-9A94-C89F-44E2-B9189391294A}" = Catalyst Control Center Localization Hungarian
"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287
"{BA0CC975-682B-4678-A35C-05E607F36387}" = Fujitsu Hotkey Utility
"{BC153E04-35D7-F24A-5E86-B1209EA5D898}" = Catalyst Control Center Localization Dutch
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{BEE332DD-5CAD-5356-0C68-EFA083DB7A50}" = CCC Help Greek
"{C1D8CEBB-BFEE-4E82-92E0-7579211F3ADF}" = Fujitsu Display Manager
"{C47B36EC-0639-4462-A9CE-7809CF2F6100}" = ZoneAlarm Security
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{C667F699-861A-4AB5-AC2C-A8276DCCFDA9}" = O2Micro Flash Memory Card Windows Driver
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}" = RealDownloader
"{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}" = HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B
"{CA7FD33E-C25D-2739-A08C-D984117158B3}" = CCC Help Hungarian
"{CBAD355D-3FFD-215F-0383-5791ACFDC2C2}" = CCC Help Danish
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D4FB136D-2802-4578-A023-E7243BD0D7D5}" = ZoneAlarm Firewall
"{D6B25B8D-0566-42B1-A23D-7576138435D6}" = Y!TunnelPro 2.6
"{D732E36A-B0C2-4DFF-8C60-4AC06233B2BC}" = Motorola Mobile Drivers Installation 6.0.0
"{D802C6C2-E757-3DDE-F1BB-EDEE6857257F}" = CCC Help Finnish
"{DDE262BD-7C23-0F41-BABC-F8F2137FF9E0}" = Catalyst Control Center Graphics Full New
"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
"{E09575B2-498D-4C8B-A9D2-623F78574F29}" = AIO_CDB_Software
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E0B09C9A-1408-43BD-5987-1FBD1A92D751}" = Catalyst Control Center Localization Portuguese
"{E3724B2E-84FC-D816-6189-9C5ED026C803}" = CCC Help Spanish
"{E4FEA654-A06E-356F-0188-79B9AD58F43B}" = CCC Help Russian
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E7112940-5F8E-4918-B9FE-251F2F8DC81F}" = AIO_CDB_ProductContext
"{E7299127-E1B4-3416-51D6-8D606C817C2B}" = CCC Help Portuguese
"{E8A5B78F-4456-4511-AB3D-E7BFFB974A7A}" = Fujitsu System Extension Utility
"{E94C7572-FD59-3829-453C-7AA01BBF6A2B}" = CCC Help Czech
"{EADFC162-CC19-C5D8-3269-59B9EC9C270B}" = CCC Help Chinese Traditional
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply
"{EBA1F484-F4AE-B16A-940C-545FFB2D0E19}" = Skins
"{EBEAF45A-58C3-44c8-8714-87909EBD6BC2}" = 4300Trb
"{F00103AD-4552-1329-38F5-E0138426B303}" = Catalyst Control Center Localization Czech
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF075778-6E50-47ed-991D-3B07FD4E3250}" = TrayApp
"7-Zip" = 7-Zip 9.20
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"ATI Uninstaller" = ATI Uninstaller
"avast" = avast! Internet Security
"BFG-Brain Games - Mahjongg" = Brain Games: Mahjongg
"BFGC" = Big Fish Games: Game Manager
"BFG-Mahjong Escape Ancient China" = Mahjong Escape Ancient China
"CleanMyPC - Registry Cleaner_is1" = CleanMyPC - Registry Cleaner
"Fujitsu A Series Retail Demo" = Fujitsu A Series Retail Demo
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"HPExtendedCapabilities" = HP Customer Participation Program 8.0
"HPOCR" = HP OCR Software 8.0
"InstallShield_{191C41F6-4BA8-4D3D-BBC5-AAC8F3077E3F}" = Fujitsu MobilityCenter Extension Utility
"InstallShield_{6226477E-444F-4DFE-BA19-9F4F7D4565BC}" = LifeBook Application Panel
"InstallShield_{BA0CC975-682B-4678-A35C-05E607F36387}" = Fujitsu Hotkey Utility
"InstallShield_{C1D8CEBB-BFEE-4E82-92E0-7579211F3ADF}" = Fujitsu Display Manager
"InstallShield_{C667F699-861A-4AB5-AC2C-A8276DCCFDA9}" = O2Micro Flash Memory Card Windows Driver
"InstallShield_{E8A5B78F-4456-4511-AB3D-E7BFFB974A7A}" = Fujitsu System Extension Utility
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox 24.0 (x86 en-US)" = Mozilla Firefox 24.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Picasa2" = Picasa 2
"PROPLUS" = Microsoft Office Professional Plus 2007
"RealPlayer 16.0" = RealPlayer
"WinLiveSuite" = Windows Live Essentials
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Software Update" = Yahoo! Software Update
"ZoneAlarm Free Firewall" = ZoneAlarm Free Firewall

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 10/16/2013 5:46:05 PM | Computer Name = Karli-PC | Source = EventSystem | ID = 4609
Description =

Error - 10/16/2013 5:46:22 PM | Computer Name = Karli-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe".
Dependent
Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 10/16/2013 5:46:22 PM | Computer Name = Karli-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe".
Dependent
Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 10/16/2013 5:51:25 PM | Computer Name = Karli-PC | Source = Application Error | ID = 1000
Description = Faulting application FRST.exe, version 3.3.8.1, time stamp 0x4f25baec,
faulting module ntdll.dll, version 6.0.6002.18881, time stamp 0x51da3e27, exception
code 0xc0000005, fault offset 0x0006657b, process id 0x124, application start time
0x01cecab9a796428a.

Error - 10/16/2013 5:56:00 PM | Computer Name = Karli-PC | Source = Microsoft-Windows-CAPI2 | ID = 131584
Description =

Error - 10/16/2013 5:58:10 PM | Computer Name = Karli-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe".
Dependent
Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 10/16/2013 5:58:11 PM | Computer Name = Karli-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe".
Dependent
Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 10/16/2013 6:22:38 PM | Computer Name = Karli-PC | Source = EventSystem | ID = 4609
Description =

Error - 10/16/2013 6:22:54 PM | Computer Name = Karli-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe".
Dependent
Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 10/16/2013 6:22:54 PM | Computer Name = Karli-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe".
Dependent
Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

[ System Events ]
Error - 10/16/2013 5:46:11 PM | Computer Name = Karli-PC | Source = DCOM | ID = 10005
Description =

Error - 10/16/2013 5:46:55 PM | Computer Name = Karli-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 10/16/2013 5:46:55 PM | Computer Name = Karli-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 10/16/2013 6:19:42 PM | Computer Name = Karli-PC | Source = DCOM | ID = 10010
Description =

Error - 10/16/2013 6:22:27 PM | Computer Name = Karli-PC | Source = DCOM | ID = 10005
Description =

Error - 10/16/2013 6:22:38 PM | Computer Name = Karli-PC | Source = DCOM | ID = 10005
Description =

Error - 10/16/2013 6:22:41 PM | Computer Name = Karli-PC | Source = DCOM | ID = 10005
Description =

Error - 10/16/2013 6:22:44 PM | Computer Name = Karli-PC | Source = DCOM | ID = 10005
Description =

Error - 10/16/2013 6:23:28 PM | Computer Name = Karli-PC | Source = Service Control Manager | ID = 7001
Description =

Error - 10/16/2013 6:23:28 PM | Computer Name = Karli-PC | Source = Service Control Manager | ID = 7026
Description =

< End of report >

janedoe1776 · October 17, 2013

ok Gringo,

After looking around trying to figure out what needed to be done with this, I ran rkill. That made it possible to run Combofix. So here is that log.

ComboFix 13-10-16.02 - Karli 10/16/2013 21:35:00.2.2 - x86
Running from: c:\users\Karli\Desktop\ComboFix.exe
.
.
(((((((((((((((((((((((((   Files Created from 2013-09-17 to 2013-10-17 )))))))))))))))))))))))))))))))
.
.
2013-10-17 02:47 . 2013-10-17 02:47   --------   d-----w-   c:\users\Default\AppData\Local\temp
2013-10-17 01:29 . 2013-10-17 01:29   --------   d-----w-   c:\users\Karli\AppData\Roaming\CleanMyPC Software
2013-10-16 02:40 . 2013-10-17 00:34   40776   ----a-w-   c:\windows\system32\drivers\MBAMSwissArmy.sys
2013-10-16 02:24 . 2013-10-16 02:25   75992   ----a-w-   c:\windows\system32\drivers\mbamchameleon.sys
2013-10-15 07:30 . 2013-09-16 05:50   7328304   ----a-w-   c:\programdata\Microsoft\Windows Defender\Definition Updates\{AA957FF3-5D86-469E-BC1A-EFF0705EB987}\mpengine.dll
2013-10-14 04:25 . 2013-10-14 04:30   --------   d-----w-   c:\programdata\Spybot - Search & Destroy
2013-10-13 17:06 . 2013-10-13 20:35   --------   d-----w-   C:\AdwCleaner
2013-10-13 13:00 . 2013-10-13 13:00   --------   d-----w-   c:\programdata\Malwarebytes' Anti-Malware (portable)
2013-10-13 12:29 . 2013-10-13 12:29   --------   d-----w-   c:\users\Karli\AppData\Local\ElevatedDiagnostics
2013-10-13 02:38 . 2013-10-13 02:38   --------   d-----w-   C:\FRST
2013-10-09 08:25 . 2013-08-27 01:28   1069056   ----a-w-   c:\windows\system32\DWrite.dll
2013-10-09 08:25 . 2013-08-27 01:50   486400   ----a-w-   c:\windows\system32\d3d10level9.dll
2013-10-09 08:25 . 2013-08-27 01:28   798208   ----a-w-   c:\windows\system32\FntCache.dll
2013-10-09 08:25 . 2013-08-27 02:47   219648   ----a-w-   c:\windows\system32\d3d10_1core.dll
2013-10-09 08:25 . 2013-08-27 02:47   189952   ----a-w-   c:\windows\system32\d3d10core.dll
2013-10-09 08:25 . 2013-08-27 02:47   160768   ----a-w-   c:\windows\system32\d3d10_1.dll
2013-10-09 08:25 . 2013-08-27 02:47   1029120   ----a-w-   c:\windows\system32\d3d10.dll
2013-10-09 08:25 . 2013-08-27 01:52   1172480   ----a-w-   c:\windows\system32\d3d10warp.dll
2013-10-09 08:25 . 2013-08-27 01:32   683008   ----a-w-   c:\windows\system32\d2d1.dll
2013-10-05 14:18 . 2013-08-30 07:48   204784   ----a-w-   c:\windows\system32\drivers\aswNdis2.sys
2013-10-05 14:18 . 2013-08-30 07:48   104752   ----a-w-   c:\windows\system32\drivers\aswFW.sys
2013-10-05 14:18 . 2013-08-30 07:48   21576   ----a-w-   c:\windows\system32\drivers\aswKbd.sys
2013-10-05 14:18 . 2013-07-17 09:17   12112   ----a-w-   c:\windows\system32\drivers\aswNdis.sys
2013-09-27 01:57 . 2013-09-27 01:57   --------   d-----w-   c:\program files\Common Files\Java
2013-09-27 01:57 . 2013-09-27 01:57   --------   d-----w-   c:\programdata\Oracle
2013-09-27 01:54 . 2013-09-27 01:54   94632   ----a-w-   c:\windows\system32\WindowsAccessBridge.dll
2013-09-27 01:54 . 2013-09-27 01:54   --------   d-----w-   c:\program files\Java
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-10-10 09:45 . 2013-02-03 13:27   692616   ----a-w-   c:\windows\system32\FlashPlayerApp.exe
2013-10-10 09:45 . 2013-02-03 13:27   71048   ----a-w-   c:\windows\system32\FlashPlayerCPLApp.cpl
2013-09-27 01:54 . 2012-09-20 22:10   868264   ----a-w-   c:\windows\system32\npdeployJava1.dll
2013-09-27 01:54 . 2011-06-15 12:27   790440   ----a-w-   c:\windows\system32\deployJava1.dll
2013-09-11 09:42 . 2003-03-18 11:14   499712   ----a-w-   c:\windows\system32\msvcp71.dll
2013-09-11 09:42 . 2003-02-20 19:42   348160   ----a-w-   c:\windows\system32\msvcr71.dll
2013-08-30 07:48 . 2013-03-26 22:51   177864   ----a-w-   c:\windows\system32\drivers\aswVmm.sys
2013-08-30 07:48 . 2011-10-29 20:53   369584   ----a-w-   c:\windows\system32\drivers\aswSP.sys
2013-08-30 07:48 . 2011-10-29 20:53   56080   ----a-w-   c:\windows\system32\drivers\aswTdi.sys
2013-08-30 07:48 . 2013-03-26 22:51   49376   ----a-w-   c:\windows\system32\drivers\aswRvrt.sys
2013-08-30 07:48 . 2011-10-29 20:53   49760   ----a-w-   c:\windows\system32\drivers\aswRdr.sys
2013-08-30 07:48 . 2011-10-29 20:53   770344   ----a-w-   c:\windows\system32\drivers\aswSnx.sys
2013-08-30 07:48 . 2011-10-29 20:53   29816   ----a-w-   c:\windows\system32\drivers\aswFsBlk.sys
2013-08-30 07:48 . 2011-10-29 20:53   66336   ----a-w-   c:\windows\system32\drivers\aswMonFlt.sys
2013-08-30 07:47 . 2011-10-29 20:53   41664   ----a-w-   c:\windows\avastSS.scr
2013-08-30 07:47 . 2011-10-29 20:53   229648   ----a-w-   c:\windows\system32\aswBoot.exe
2013-08-07 09:22 . 2009-12-29 20:05   238872   ------w-   c:\windows\system32\MpSigStub.exe
2013-08-02 04:09 . 2013-08-28 03:55   1548288   ----a-w-   c:\windows\system32\WMVDECOD.DLL
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-08-30 07:47   121968   ----a-w-   c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\Karli\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\Karli\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\Karli\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\Karli\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Weather"="c:\program files\AWS\WeatherBug\Weather.exe" [2010-10-29 1652736]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-08-30 4858968]
"ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2013-06-20 73832]
"TvOutSwitch"="c:\program files\Fujitsu\DispSwitch\DispSwitchLauncher.exe" [2007-10-01 106496]
"RtHDVCpl"="RtHDVCpl.exe" [2007-09-19 4702208]
"LoadFujitsuQuickTouch"="c:\program files\Fujitsu\Application Panel\QuickTouch.exe" [2006-11-26 260912]
"LoadFUJ02E3"="c:\program files\Fujitsu\FUJ02E3\FUJ02E3.exe" [2007-06-13 84784]
"LoadBtnHnd"="c:\program files\Fujitsu\BtnHnd\BtnHnd.exe" [2006-11-13 68400]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-09 52256]
"IndicatorUtility"="c:\program files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2007-02-10 97072]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 49152]
"FJUPDNV_Chitose"="c:\program files\Fujitsu\fjdvrupd\updatenv.exe" [2007-02-05 167936]
"331BigDog"="c:\windows\VM331_STI.EXE" [2007-07-02 192512]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"TkBellExe"="c:\program files\real\realplayer\Update\realsched.exe" [2013-09-11 295512]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2013-05-07 115440]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2013-05-07 22:36   552176   ----a-w-   c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute   REG_MULTI_SZ     autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\01897211.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\17882742.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\63933402.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mbamchameleon]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMSwissArmy]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Users^Karli^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\Karli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2013-04-04 21:06   958576   ----a-w-   c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Registry Cleaner Scheduler]
2013-03-03 02:20   1403680   ----a-w-   c:\program files\CleanMyPC\Registry Cleaner\RCHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2007-03-15 05:01   71216   ------w-   c:\program files\CyberLink\PowerDVD\PDVDServ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2013-05-15 01:08   4760816   ----a-w-   c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiSpywareOverride"=dword:00000001
.
R3 ADVNTDRV;ADVNTDRV;c:\windows\System32\drivers\ADVNTDRV.SYS [1999-11-18 3872]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2013-05-23 119056]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation   REG_MULTI_SZ     FontCache
HPZ12   REG_MULTI_SZ     Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt   REG_MULTI_SZ     hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2013-10-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-02-03 09:45]
.
2013-10-14 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1554741564-3749478033-3638076803-1000Core.job
- c:\users\Karli\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-02-23 06:20]
.
2013-10-16 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1554741564-3749478033-3638076803-1000UA.job
- c:\users\Karli\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-02-23 06:20]
.
2012-01-01 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1554741564-3749478033-3638076803-1000.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2013-08-14 22:13]
.
.
------- Supplementary Scan -------
.

uInternet Settings,ProxyOverride = 192.168.*.*

TCP: DhcpNameServer = 209.18.47.61 209.18.47.62
FF - ProfilePath - c:\users\Karli\AppData\Roaming\Mozilla\Firefox\Profiles\2fsnzhkb.default-1372970557911\

FF - prefs.js: keyword.URL -
FF - ExtSQL: 2013-09-11 04:46; {DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}; c:\programdata\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-Google Desktop Search - c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
HKLM_ActiveSetup-ccc-core-static - msiexec
AddRemove-{D6B25B8D-0566-42B1-A23D-7576138435D6} - c:\progra~2\TARMAI~1\{D6B25~1\Setup.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-10-16 21:47
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}]
@DACL=(02 0000)
@="Folder Redirection"
"ProcessGroupPolicyEx"="ProcessGroupPolicyEx"
"DllName"=expand:"fdeploy.dll"
"NoMachinePolicy"=dword:00000001
"NoSlowLink"=dword:00000001
"PerUserLocalSettings"=dword:00000001
"NoGPOListChanges"=dword:00000000
"NoBackgroundPolicy"=dword:00000000
"GenerateGroupPolicy"="GenerateGroupPolicy"
"EventSources"=multi:"(Folder Redirection,Application)\00\00"
"DisplayName"=expand:"@fdeploy.dll,-261"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}]
@DACL=(02 0000)
@="Microsoft Disk Quota"
"DisplayName"=expand:"@%SystemRoot%\\System32\\dskquota.dll,-100"
"NoMachinePolicy"=dword:00000000
"NoUserPolicy"=dword:00000001
"NoSlowLink"=dword:00000001
"NoBackgroundPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000001
"PerUserLocalSettings"=dword:00000000
"RequiresSuccessfulRegistry"=dword:00000001
"EnableAsynchronousProcessing"=dword:00000000
"DllName"=expand:"%SystemRoot%\\System32\\dskquota.dll"
"ProcessGroupPolicy"="ProcessGroupPolicy"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}]
@DACL=(02 0000)
@="QoS Packet Scheduler"
"DisplayName"=expand:"@gptext.dll,-201"
"ProcessGroupPolicy"="ProcessPSCHEDPolicy"
"DllName"=expand:"gptext.dll"
"NoUserPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7933F41E-56F8-41d6-A31C-4148A711EE93}]
@DACL=(02 0000)
@="Windows Search Group Policy Extension"
"DllName"=expand:"%SystemRoot%\\System32\\srchadmin.dll"
"EnableAsynchronousProcessing"=dword:00000001
"NoBackgroundPolicy"=dword:00000000
"NoGPOListChanges"=dword:00000001
"NoMachinePolicy"=dword:00000000
"NoSlowLink"=dword:00000000
"NoUserPolicy"=dword:00000000
"PerUserLocalSettings"=dword:00000000
"ProcessGroupPolicy"="ProcessGroupPolicy"
"RequiresSuccessfulRegistry"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}]
@DACL=(02 0000)
@="IP Security"
"ProcessGroupPolicyEx"="ProcessIPSECPolicyEx"
"GenerateGroupPolicy"="GenerateIPSECPolicy"
"DllName"=expand:"%SystemRoot%\\System32\\polstore.dll"
"NoUserPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000000
"DisplayName"=expand:"@c:\\Windows\\system32\\polstore.dll,-5012"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{FB2CA36D-0B40-4307-821B-A13B252DE56C}]
@DACL=(02 0000)
@="Enterprise QoS"
"DisplayName"=expand:"@gptext.dll,-203"
"ProcessGroupPolicy"="ProcessEQoSPolicy"
"DllName"=expand:"gptext.dll"
"RequiresSuccessfulRegistry"=dword:00000001
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.exe'(7340)
c:\users\Karli\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
Completion time: 2013-10-16 21:51:41
ComboFix-quarantined-files.txt 2013-10-17 02:51
.
Pre-Run: 112,661,000,192 bytes free
Post-Run: 112,485,310,464 bytes free
.
- - End Of File - - 310A2F79F83A01AB60A92BC5C6C11525
5C616939100B85E558DA92B899A0FC36

gringo_pr · October 17, 2013

Hello janedoe1776

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Please start by opening Notepad and copy/paste the text in the box into the window:

ClearJavaCache::

Save it to your desktop as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.

Restart if you have to.

Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
- report from Combofix
- let me know of any problems you may have had
- How is the computer doing now after running the script?

Gringo

janedoe1776 · October 18, 2013

Evening Mr. Gringo,

Here is the ComboFix log. I did get the "Illegal operation attempted on a registry key that has been marked for deletion." error and restarted. Then I was unable to get online or even open a browser. I ran rkill again, then ran the "fixdamage" part of MBAR to get it back up and running again. My Avast program is not working properly at this point, so I figure I will probably have to uninstall it and do a clean install. There are also 3 icons that appeared on my desktop that I have no idea where they came from. 2 of them are named "desktop.ini" and the other is "~$Checkbook.xlsx" and all 3 of them look almost like they are greyed out. (yes very weird I know).

ComboFix 13-10-16.02 - Karli 10/17/2013 20:29:16.4.2 - x86
Running from: c:\users\Karli\Desktop\ComboFix.exe
Command switches used :: c:\users\Karli\Desktop\CFScript.txt
.
.
(((((((((((((((((((((((((   Files Created from 2013-09-18 to 2013-10-18 )))))))))))))))))))))))))))))))
.
.
2013-10-18 01:39 . 2013-10-18 01:39   --------   d-----w-   c:\windows\system32\config\systemprofile\AppData\Local\temp
2013-10-18 01:39 . 2013-10-18 01:39   --------   d-----w-   c:\users\Default\AppData\Local\temp
2013-10-17 23:01 . 2013-10-17 23:01   --------   d-----w-   c:\users\Karli\AppData\Roaming\AVAST Software
2013-10-17 01:29 . 2013-10-17 01:29   --------   d-----w-   c:\users\Karli\AppData\Roaming\CleanMyPC Software
2013-10-16 02:24 . 2013-10-16 02:25   75992   ----a-w-   c:\windows\system32\drivers\mbamchameleon.sys
2013-10-15 07:30 . 2013-09-16 05:50   7328304   ----a-w-   c:\programdata\Microsoft\Windows Defender\Definition Updates\{AA957FF3-5D86-469E-BC1A-EFF0705EB987}\mpengine.dll
2013-10-14 04:25 . 2013-10-14 04:30   --------   d-----w-   c:\programdata\Spybot - Search & Destroy
2013-10-13 17:06 . 2013-10-17 03:50   --------   d-----w-   C:\AdwCleaner
2013-10-13 13:00 . 2013-10-18 00:21   --------   d-----w-   c:\programdata\Malwarebytes' Anti-Malware (portable)
2013-10-13 12:29 . 2013-10-13 12:29   --------   d-----w-   c:\users\Karli\AppData\Local\ElevatedDiagnostics
2013-10-13 02:38 . 2013-10-13 02:38   --------   d-----w-   C:\FRST
2013-10-09 08:25 . 2013-08-27 01:28   1069056   ----a-w-   c:\windows\system32\DWrite.dll
2013-10-09 08:25 . 2013-08-27 01:50   486400   ----a-w-   c:\windows\system32\d3d10level9.dll
2013-10-09 08:25 . 2013-08-27 01:28   798208   ----a-w-   c:\windows\system32\FntCache.dll
2013-10-09 08:25 . 2013-08-27 02:47   219648   ----a-w-   c:\windows\system32\d3d10_1core.dll
2013-10-09 08:25 . 2013-08-27 02:47   189952   ----a-w-   c:\windows\system32\d3d10core.dll
2013-10-09 08:25 . 2013-08-27 02:47   160768   ----a-w-   c:\windows\system32\d3d10_1.dll
2013-10-09 08:25 . 2013-08-27 02:47   1029120   ----a-w-   c:\windows\system32\d3d10.dll
2013-10-09 08:25 . 2013-08-27 01:52   1172480   ----a-w-   c:\windows\system32\d3d10warp.dll
2013-10-09 08:25 . 2013-08-27 01:32   683008   ----a-w-   c:\windows\system32\d2d1.dll
2013-10-05 14:18 . 2013-10-17 22:07   247192   ----a-w-   c:\windows\system32\drivers\aswNdis2.sys
2013-10-05 14:18 . 2013-10-14 17:41   104752   ----a-w-   c:\windows\system32\drivers\aswFW.sys
2013-10-05 14:18 . 2013-10-17 22:08   26136   ----a-w-   c:\windows\system32\drivers\aswKbd.sys
2013-10-05 14:18 . 2013-07-17 09:17   12112   ----a-w-   c:\windows\system32\drivers\aswNdis.sys
2013-09-27 01:57 . 2013-09-27 01:57   --------   d-----w-   c:\program files\Common Files\Java
2013-09-27 01:57 . 2013-09-27 01:57   --------   d-----w-   c:\programdata\Oracle
2013-09-27 01:54 . 2013-09-27 01:54   94632   ----a-w-   c:\windows\system32\WindowsAccessBridge.dll
2013-09-27 01:54 . 2013-09-27 01:54   --------   d-----w-   c:\program files\Java
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-10-17 22:08 . 2013-03-26 22:51   178304   ----a-w-   c:\windows\system32\drivers\aswVmm.sys
2013-10-17 22:08 . 2013-03-26 22:51   49944   ----a-w-   c:\windows\system32\drivers\aswRvrt.sys
2013-10-17 22:08 . 2011-10-29 20:53   35656   ----a-w-   c:\windows\system32\drivers\aswFsBlk.sys
2013-10-17 22:08 . 2011-10-29 20:53   403440   ----a-w-   c:\windows\system32\drivers\aswSP.sys
2013-10-17 22:08 . 2011-10-29 20:53   54832   ----a-w-   c:\windows\system32\drivers\aswRdr.sys
2013-10-17 22:08 . 2011-10-29 20:53   57672   ----a-w-   c:\windows\system32\drivers\aswTdi.sys
2013-10-17 22:08 . 2011-10-29 20:53   774392   ----a-w-   c:\windows\system32\drivers\aswSnx.sys
2013-10-17 22:08 . 2011-10-29 20:53   70384   ----a-w-   c:\windows\system32\drivers\aswMonFlt.sys
2013-10-17 22:08 . 2011-10-29 20:53   43152   ----a-w-   c:\windows\avastSS.scr
2013-10-17 22:08 . 2011-10-29 20:53   269216   ----a-w-   c:\windows\system32\aswBoot.exe
2013-10-10 09:45 . 2013-02-03 13:27   692616   ----a-w-   c:\windows\system32\FlashPlayerApp.exe
2013-10-10 09:45 . 2013-02-03 13:27   71048   ----a-w-   c:\windows\system32\FlashPlayerCPLApp.cpl
2013-09-27 01:54 . 2012-09-20 22:10   868264   ----a-w-   c:\windows\system32\npdeployJava1.dll
2013-09-27 01:54 . 2011-06-15 12:27   790440   ----a-w-   c:\windows\system32\deployJava1.dll
2013-09-11 09:42 . 2003-03-18 11:14   499712   ----a-w-   c:\windows\system32\msvcp71.dll
2013-09-11 09:42 . 2003-02-20 19:42   348160   ----a-w-   c:\windows\system32\msvcr71.dll
2013-08-07 09:22 . 2009-12-29 20:05   238872   ------w-   c:\windows\system32\MpSigStub.exe
2013-08-02 04:09 . 2013-08-28 03:55   1548288   ----a-w-   c:\windows\system32\WMVDECOD.DLL
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-10-17 22:08   321752   ----a-w-   c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\Karli\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\Karli\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\Karli\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36   130736   ----a-w-   c:\users\Karli\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Weather"="c:\program files\AWS\WeatherBug\Weather.exe" [2010-10-29 1652736]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZoneAlarm"="c:\program files\CheckPoint\ZoneAlarm\zatray.exe" [2013-06-20 73832]
"TvOutSwitch"="c:\program files\Fujitsu\DispSwitch\DispSwitchLauncher.exe" [2007-10-01 106496]
"RtHDVCpl"="RtHDVCpl.exe" [2007-09-19 4702208]
"LoadFujitsuQuickTouch"="c:\program files\Fujitsu\Application Panel\QuickTouch.exe" [2006-11-26 260912]
"LoadFUJ02E3"="c:\program files\Fujitsu\FUJ02E3\FUJ02E3.exe" [2007-06-13 84784]
"LoadBtnHnd"="c:\program files\Fujitsu\BtnHnd\BtnHnd.exe" [2006-11-13 68400]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-09 52256]
"IndicatorUtility"="c:\program files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2007-02-10 97072]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-11 49152]
"FJUPDNV_Chitose"="c:\program files\Fujitsu\fjdvrupd\updatenv.exe" [2007-02-05 167936]
"331BigDog"="c:\windows\VM331_STI.EXE" [2007-07-02 192512]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"TkBellExe"="c:\program files\real\realplayer\Update\realsched.exe" [2013-09-11 295512]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2013-10-17 3568312]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2013-05-07 115440]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2013-05-07 22:36   552176   ----a-w-   c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute   REG_MULTI_SZ     autocheck autochk *\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\01897211.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\17882742.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\63933402.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mbamchameleon]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Users^Karli^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\Karli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2013-04-04 21:06   958576   ----a-w-   c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Registry Cleaner Scheduler]
2013-03-03 02:20   1403680   ----a-w-   c:\program files\CleanMyPC\Registry Cleaner\RCHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2007-03-15 05:01   71216   ------w-   c:\program files\CyberLink\PowerDVD\PDVDServ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2013-05-15 01:08   4760816   ----a-w-   c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiSpywareOverride"=dword:00000001
.
R3 ADVNTDRV;ADVNTDRV;c:\windows\System32\drivers\ADVNTDRV.SYS [1999-11-18 3872]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2013-05-23 119056]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation   REG_MULTI_SZ     FontCache
HPZ12   REG_MULTI_SZ     Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt   REG_MULTI_SZ     hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2013-10-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-02-03 09:45]
.
2013-10-14 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1554741564-3749478033-3638076803-1000Core.job
- c:\users\Karli\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-02-23 06:20]
.
2013-10-17 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1554741564-3749478033-3638076803-1000UA.job
- c:\users\Karli\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-02-23 06:20]
.
2012-01-01 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1554741564-3749478033-3638076803-1000.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2013-08-14 22:13]
.
.
------- Supplementary Scan -------
.

uInternet Settings,ProxyOverride = 192.168.*.*

TCP: DhcpNameServer = 209.18.47.61 209.18.47.62
FF - ProfilePath - c:\users\Karli\AppData\Roaming\Mozilla\Firefox\Profiles\2fsnzhkb.default-1372970557911\

FF - prefs.js: keyword.URL -
FF - ExtSQL: 2013-09-11 04:46; {DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}; c:\programdata\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-10-17 20:39
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}]
@DACL=(02 0000)
@="Folder Redirection"
"ProcessGroupPolicyEx"="ProcessGroupPolicyEx"
"DllName"=expand:"fdeploy.dll"
"NoMachinePolicy"=dword:00000001
"NoSlowLink"=dword:00000001
"PerUserLocalSettings"=dword:00000001
"NoGPOListChanges"=dword:00000000
"NoBackgroundPolicy"=dword:00000000
"GenerateGroupPolicy"="GenerateGroupPolicy"
"EventSources"=multi:"(Folder Redirection,Application)\00\00"
"DisplayName"=expand:"@fdeploy.dll,-261"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}]
@DACL=(02 0000)
@="Microsoft Disk Quota"
"DisplayName"=expand:"@%SystemRoot%\\System32\\dskquota.dll,-100"
"NoMachinePolicy"=dword:00000000
"NoUserPolicy"=dword:00000001
"NoSlowLink"=dword:00000001
"NoBackgroundPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000001
"PerUserLocalSettings"=dword:00000000
"RequiresSuccessfulRegistry"=dword:00000001
"EnableAsynchronousProcessing"=dword:00000000
"DllName"=expand:"%SystemRoot%\\System32\\dskquota.dll"
"ProcessGroupPolicy"="ProcessGroupPolicy"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}]
@DACL=(02 0000)
@="QoS Packet Scheduler"
"DisplayName"=expand:"@gptext.dll,-201"
"ProcessGroupPolicy"="ProcessPSCHEDPolicy"
"DllName"=expand:"gptext.dll"
"NoUserPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7933F41E-56F8-41d6-A31C-4148A711EE93}]
@DACL=(02 0000)
@="Windows Search Group Policy Extension"
"DllName"=expand:"%SystemRoot%\\System32\\srchadmin.dll"
"EnableAsynchronousProcessing"=dword:00000001
"NoBackgroundPolicy"=dword:00000000
"NoGPOListChanges"=dword:00000001
"NoMachinePolicy"=dword:00000000
"NoSlowLink"=dword:00000000
"NoUserPolicy"=dword:00000000
"PerUserLocalSettings"=dword:00000000
"ProcessGroupPolicy"="ProcessGroupPolicy"
"RequiresSuccessfulRegistry"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}]
@DACL=(02 0000)
@="IP Security"
"ProcessGroupPolicyEx"="ProcessIPSECPolicyEx"
"GenerateGroupPolicy"="GenerateIPSECPolicy"
"DllName"=expand:"%SystemRoot%\\System32\\polstore.dll"
"NoUserPolicy"=dword:00000001
"NoGPOListChanges"=dword:00000000
"DisplayName"=expand:"@c:\\Windows\\system32\\polstore.dll,-5012"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{FB2CA36D-0B40-4307-821B-A13B252DE56C}]
@DACL=(02 0000)
@="Enterprise QoS"
"DisplayName"=expand:"@gptext.dll,-203"
"ProcessGroupPolicy"="ProcessEQoSPolicy"
"DllName"=expand:"gptext.dll"
"RequiresSuccessfulRegistry"=dword:00000001
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.exe'(8088)
c:\users\Karli\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
Completion time: 2013-10-17 20:43:36
ComboFix-quarantined-files.txt 2013-10-18 01:43
ComboFix2.txt 2013-10-17 02:51
.
Pre-Run: 111,032,983,552 bytes free
Post-Run: 110,981,976,064 bytes free
.
- - End Of File - - C57899F8DDDE97040B6E3078B4F7599F
5C616939100B85E558DA92B899A0FC36

gringo_pr · October 18, 2013

Hello

These logs are looking allot better. But we still have some work to do.

Please print out these instructions, or copy them to a Notepad file. It will make it easier for you to follow the instructions and complete all of the necessary steps..

uninstall some programs

NOTE** Because of the cleanup process some of the programs I have listed may not be in add/remove anymore this is fine just move to the next item on the list.

You can remove these programs using add/remove or you can use the free uninstaller from Revo (Revo does allot better of a job)

Programs to remove
- Adobe Reader X (10.1.8)
  WeatherBug

Please download and install Revo Uninstaller Free
Double click Revo Uninstaller to run it.
From the list of programs double click on The Program to remove
When prompted if you want to uninstall click Yes.
Be sure the Moderate option is selected then click Next.
The program will run, If prompted again click Yes
when the built-in uninstaller is finished click on Next.
Once the program has searched for leftovers click Next.
Check/tick the bolded items only on the list then click Delete
when prompted click on Yes and then on next.
put a check on any folders that are found and select delete
when prompted select yes then on next
Once done click Finish.

.

Update Adobe reader

Recently there have been vulnerabilities detected in older versions of Adobe Reader. It is strongly suggested that you update to the current version.
You can download it from http://www.adobe.com/products/acrobat/readstep2.html
After installing the latest Adobe Reader, uninstall all previous versions.
If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.
- If you don't like Adobe Reader (53 MB), you can download Foxit PDF Reader(7 MB) from here. It's a much smaller file to download and uses a lot less resources than Adobe Reader.
  Note: When installing FoxitReader, be careful not to install anything to do with AskBar.

Clean Out Temp Files

This small application you may want to keep and use once a week to keep the computer clean.
Download CCleaner from here CCleaner
- Run the installer to install the application.
- When it gives you the option to install Yahoo toolbar uncheck the box next to it.
- Run CCleaner. (make sure under Windows tab all the boxes of Internet Explorer and Windows explorer are checked. Under System check Empty Recycle Bin and Temporary Files. Under Application tab all the boxes should be checked).
- Click Run Cleaner.
- Close CCleaner.

: Malwarebytes' Anti-Malware :

I see You have MBAM installed on the computer - that is great!! it is a very good program! I would like you to run a quick scan for me now

Double-click mbam icon
go to the update tab at the top
click on check for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.
When completed, a log will open in Notepad. please copy and paste the log into your next reply
- If you accidentally close it, the log file is saved here and will be named like this:
- C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.

Click OK to either and let MBAM proceed with the disinfection process.

If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Download HijackThis

Go Here to download HijackThis program
Save HijackThis to your desktop.
Right Click on Hijackthis and select "Run as Admin" (XP users just need to double click to run)
Click on "Do A system scan and save a logfile" (if you do not see "Do A system scan and save a logfile" then click on main menu)
copy and paste hijackthis report into the topic

"information and logs"

In your next post I need the following
- Log From MBAM
- report from Hijackthis
- let me know of any problems you may have had
- How is the computer doing now?

Gringo

janedoe1776 · October 18, 2013

Why am I removing Weatherbug?

gringo_pr · October 18, 2013

Hello

it is ad support and can be a conduit for malware

gringo

janedoe1776 · October 19, 2013

ok Mr. Gringo,

I did all that you asked. Now I can't get that computer online and/or open any programs on it. I dug my desktop out so I could get back to you on what was going on with it.

At this point is the laptop even redeemable? or am I going to need to reformat and reinstall the OS?

gringo_pr · October 20, 2013

What is happening when you try to open a program?

gringo

janedoe1776 · October 20, 2013

the mouse pointer turns into a spinning circle like it's trying to do something, but then nothing.

gringo_pr · October 21, 2013

Download Windows Repair (all in one) from here.

Install the program then run

Go to step 3 and allow it to run SFC

waio%20step3.JPG

On the start repairs tab click start

waiostart%20rep.JPG

Select the following items and tick restart system when finished

Reset Registry Permissions

Reset File Permissions

Register System Files

Repair WMI

Repair Windows Firewall

Repair Internet Explorer

Repair Hosts File

Remove Policies Set By Infections

Repair Missing Start menu Icons

Repair Icons

Repair Winsock & DNS Cache

Remove Temp Files

Repair Proxy Settings

Unhide Non System Files

Repair Windows Updates

Set windows Services To Default

Repair MSI (windows Installer)

Repair File Associations

Repair windows Safe mode

After that come back and tell me if that has made a difference.

Gringo

Malwarebytes freezes when I try to remove threats

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information