Redirects that aren't detected

barthtl3 · November 6, 2013

I was looking up restaurant reviews on Google, my computer suddenly restarted, and since then I’ve been getting redirects. I ran Malwarebytes and it has removed:

C:\Users\Admin\AppData\Local\Mwlsoft\VaultClientRes.dll (VirTool.Vbcrypt)

C:\Users\Admin\AppData\Local\Temp\hiiiuuu.exe (Trojan.Downloader.ED)

C:\Users\Admin\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30\5d4fcf5e-2ded9ab7 (Trojan.Agent)

C:\Users\Admin\Desktop\Files\Documents and Settings\Administrator\Local Settings\temp\is1598539481\zgInstaller.exe (PUP.Optional.SweetPacks.A)

I also ran Microsoft Security Essentials (including the Offline defender), and it has removed the following: Win64/Alureon.gen!A, TrojanDropper:32/Rovinx.I, and VirTool:Win32/SeeInject.gen!KK.

I am still getting redirects. Any help would be sincerely appreciated. Below are my logs.

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 10.0.9200.16720

Run by Admin at 21:50:47 on 2013-11-05

Microsoft Windows 7 Enterprise 6.1.7601.1.1252.1.1033.18.7648.5170 [GMT -5:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Program Files\IDT\WDM\STacSV64.exe

C:\Windows\system32\Hpservice.exe

C:\Windows\system32\vcsFPService.exe

C:\Windows\system32\atieclxx.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\Broadcom\Broadcom 802.11\WLTRYSVC.EXE

C:\Program Files\Broadcom\Broadcom 802.11\bcmwltry.exe

C:\Windows\system32\WLANExt.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\IDT\WDM\AESTSr64.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe

C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe

C:\Windows\system32\svchost.exe -k imgsvc

c:\Program Files\Microsoft Security Client\NisSrv.exe

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.EXE

C:\Program Files\IDT\WDM\sttray64.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe

C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Citrix\ICA Client\concentr.exe

C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Windows\SysWOW64\RunDll32.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

mWinlogon: Userinit = userinit.exe,

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

uRun: [Google Update] "C:\Users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe" /c

uRun: [Google] rundll32 "C:\Users\Admin\AppData\Local\Apps\Google\knecgkmdhe.dll",DllRegisterServer

uRun: [Mwlsoft Update] regsvr32.exe C:\Users\Admin\AppData\Local\Mwlsoft\VaultClientRes.dll

mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun: [QLBController] C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe /start

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"

mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [ConnectionCenter] "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

uPolicies-Explorer: HideSCAHealth = dword:1

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

barthtl3 · November 6, 2013

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000

IE: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

TCP: NameServer = 192.168.2.1

TCP: Interfaces\{82C4ACD6-1EF7-4619-A5E4-D711D157828D} : DHCPNameServer = 192.168.2.1

Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll

SSODL: WebCheck - <orphaned>

x64-Run: [broadcom Wireless Manager UI] C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.exe

x64-Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe

x64-Run: [synTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe

x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

x64-IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

x64-Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>

x64-Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - <orphaned>

x64-SSODL: WebCheck - <orphaned>

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39uqgr1d.default\

FF - plugin: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrlui.dll

FF - plugin: C:\Users\Admin\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll

.

============= SERVICES / DRIVERS ===============

.

R0 amd_sata;amd_sata;C:\Windows\System32\drivers\amd_sata.sys [2012-5-22 79488]

R0 amd_xata;amd_xata;C:\Windows\System32\drivers\amd_xata.sys [2012-5-22 40064]

R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2013-6-18 247216]

R1 ctxusbm;Citrix USB Monitor Driver;C:\Windows\System32\drivers\ctxusbm.sys [2010-4-16 87600]

R1 NEOFLTR_650_16339;Juniper Networks TDI Filter Driver (NEOFLTR_650_16339);C:\Windows\System32\drivers\NEOFLTR_650_16339.SYS [2012-9-30 100472]

R2 AESTFilters;Andrea ST Filters Service;C:\Program Files\IDT\WDM\AESTSr64.exe [2012-5-22 89600]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2012-5-22 204288]

R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-3-28 94264]

R2 hpHotkeyMonitor;hpHotkeyMonitor;C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\hpHotkeyMonitor.exe [2011-5-13 317496]

R2 hpsrv;HP Service;C:\Windows\System32\hpservice.exe [2011-5-13 30520]

R2 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2012-3-20 139616]

R2 vcsFPService;Validity VCS Fingerprint Service;C:\Windows\System32\vcsFPService.exe [2011-3-24 3161904]

R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2012-5-22 231440]

R3 btwampfl;Bluetooth AMP USB Filter;C:\Windows\System32\drivers\btwampfl.sys [2012-5-22 344616]

R3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\System32\drivers\btwl2cap.sys [2012-5-22 39464]

R3 InputFilter_Hid_FlexDef2b;Siliten HID Devices(FlexDef2b) Driver Service;C:\Windows\System32\drivers\InputFilter_FlexDef2b.sys [2010-6-18 17920]

R3 JMCR;JMCR;C:\Windows\System32\drivers\jmcr.sys [2012-5-22 174680]

R3 johci;JMicron 1394 Filter Driver;C:\Windows\System32\drivers\johci.sys [2012-5-22 26712]

R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2013-8-12 366600]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-6-10 539240]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S3 dmvsc;dmvsc;C:\Windows\System32\drivers\dmvsc.sys [2010-11-21 71168]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2010-11-20 20992]

S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]

S3 Synth3dVsc;Synth3dVsc;C:\Windows\System32\drivers\Synth3dVsc.sys [2010-11-21 88960]

S3 terminpt;Microsoft Remote Desktop Input Driver;C:\Windows\System32\drivers\terminpt.sys [2010-11-21 34816]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-20 59392]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-20 31232]

S3 tsusbhub;tsusbhub;C:\Windows\System32\drivers\tsusbhub.sys [2010-11-21 117248]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-12-13 54784]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-5-23 1255736]

.

=============== Created Last 30 ================

.

2013-11-05 02:48:07 10280728 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{89A9F57D-FEAF-43CF-93A6-164C4BDD4EC2}\mpengine.dll

2013-11-04 06:37:40 -------- d-----w- C:\Windows\Microsoft Antimalware

2013-11-03 22:57:16 37888 ----a-w- C:\ProgramData\Microsoft\Windows\DRM\DEFD.tmp

2013-11-03 22:57:16 37888 ----a-w- C:\ProgramData\Microsoft\Windows\DRM\DEFC.tmp

2013-11-03 19:54:29 -------- d-----w- C:\Users\Admin\AppData\Local\Mwlsoft

2013-11-03 05:30:13 10280728 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2013-10-27 17:01:14 -------- d-----w- C:\Windows\System32\MRT

2013-10-18 03:35:14 965000 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{72199750-52EA-4862-8102-521D0B3465F8}\gapaengine.dll

2013-10-09 03:28:20 633856 ----a-w- C:\Windows\System32\comctl32.dll

2013-10-09 03:28:20 530432 ----a-w- C:\Windows\SysWow64\comctl32.dll

2013-10-09 03:28:12 70656 ----a-w- C:\Windows\SysWow64\fontsub.dll

2013-10-09 03:28:12 46080 ----a-w- C:\Windows\System32\atmlib.dll

2013-10-09 03:28:12 41472 ----a-w- C:\Windows\System32\lpk.dll

2013-10-09 03:28:12 368128 ----a-w- C:\Windows\System32\atmfd.dll

2013-10-09 03:28:12 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll

2013-10-09 03:28:12 295424 ----a-w- C:\Windows\SysWow64\atmfd.dll

2013-10-09 03:28:12 25600 ----a-w- C:\Windows\SysWow64\lpk.dll

2013-10-09 03:28:12 14336 ----a-w- C:\Windows\System32\dciman32.dll

2013-10-09 03:28:12 10240 ----a-w- C:\Windows\SysWow64\dciman32.dll

2013-10-09 03:28:12 100864 ----a-w- C:\Windows\System32\fontsub.dll

2013-10-09 03:28:07 785624 ----a-w- C:\Windows\System32\drivers\Wdf01000.sys

2013-10-09 03:26:59 7680 ----a-w- C:\Windows\SysWow64\instnm.exe

.

==================== Find3M ====================

.

2013-10-09 05:03:31 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2013-10-09 05:03:31 692616 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2013-09-22 23:28:06 1767936 ----a-w- C:\Windows\SysWow64\wininet.dll

2013-09-22 23:27:49 2876928 ----a-w- C:\Windows\SysWow64\jscript9.dll

2013-09-22 23:27:48 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll

2013-09-22 23:27:48 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll

2013-09-22 22:55:10 2241024 ----a-w- C:\Windows\System32\wininet.dll

2013-09-22 22:54:51 3959296 ----a-w- C:\Windows\System32\jscript9.dll

2013-09-22 22:54:50 67072 ----a-w- C:\Windows\System32\iesetup.dll

2013-09-22 22:54:50 136704 ----a-w- C:\Windows\System32\iesysprep.dll

2013-09-21 03:38:39 2706432 ----a-w- C:\Windows\System32\mshtml.tlb

2013-09-21 03:30:24 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2013-09-21 02:48:36 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe

2013-09-21 02:39:47 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe

2013-09-14 01:10:19 497152 ----a-w- C:\Windows\System32\drivers\afd.sys

2013-09-08 02:30:37 1903552 ----a-w- C:\Windows\System32\drivers\tcpip.sys

2013-09-08 02:27:14 327168 ----a-w- C:\Windows\System32\mswsock.dll

2013-09-08 02:03:58 231424 ----a-w- C:\Windows\SysWow64\mswsock.dll

2013-09-04 12:12:11 343040 ----a-w- C:\Windows\System32\drivers\usbhub.sys

2013-09-04 12:11:51 325120 ----a-w- C:\Windows\System32\drivers\usbport.sys

2013-09-04 12:11:49 99840 ----a-w- C:\Windows\System32\drivers\usbccgp.sys

2013-09-04 12:11:43 52736 ----a-w- C:\Windows\System32\drivers\usbehci.sys

2013-09-04 12:11:43 30720 ----a-w- C:\Windows\System32\drivers\usbuhci.sys

2013-09-04 12:11:42 25600 ----a-w- C:\Windows\System32\drivers\usbohci.sys

2013-09-04 12:11:40 7808 ----a-w- C:\Windows\System32\drivers\usbd.sys

2013-08-29 02:17:48 5549504 ----a-w- C:\Windows\System32\ntoskrnl.exe

2013-08-29 02:16:35 1732032 ----a-w- C:\Windows\System32\ntdll.dll

2013-08-29 02:16:28 243712 ----a-w- C:\Windows\System32\wow64.dll

2013-08-29 02:16:14 859648 ----a-w- C:\Windows\System32\tdh.dll

2013-08-29 02:13:28 878080 ----a-w- C:\Windows\System32\advapi32.dll

2013-08-29 01:51:45 3969472 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

2013-08-29 01:51:45 3914176 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

2013-08-29 01:50:31 5120 ----a-w- C:\Windows\SysWow64\wow32.dll

2013-08-29 01:50:30 1292192 ----a-w- C:\Windows\SysWow64\ntdll.dll

2013-08-29 01:50:16 619520 ----a-w- C:\Windows\SysWow64\tdh.dll

2013-08-29 01:48:17 640512 ----a-w- C:\Windows\SysWow64\advapi32.dll

2013-08-29 01:48:15 44032 ----a-w- C:\Windows\apppatch\acwow64.dll

2013-08-29 00:49:53 25600 ----a-w- C:\Windows\SysWow64\setup16.exe

2013-08-29 00:49:52 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll

2013-08-29 00:49:49 2048 ----a-w- C:\Windows\SysWow64\user.exe

2013-08-28 01:21:06 3155968 ----a-w- C:\Windows\System32\win32k.sys

2013-08-28 01:12:33 461312 ----a-w- C:\Windows\System32\scavengeui.dll

.

============= FINISH: 21:51:11.83 ===============

MrCharlie · November 6, 2013

Welcome to the forum.

Please download and run RogueKiller 32 Bit to your desktop.

RogueKiller 64 Bit <---use this one for 64 bit systems

Which system am I using?

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes and use the default font)

General P2P/Piracy Warning:

1. If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
2. If you have illegal/cracked software, cracks, keygens, custom (Adobe) host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy.
Failure to remove such software will result in your topic being closed and no further assistance being provided.

MrC

Note:

Please read all of my instructions completely including these.

Make sure system restore is turned on and running

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>When we are done, I'll give to instructions on how to cleanup all the tools and logs

<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

barthtl3 · November 6, 2013

RogueKiller V8.7.6 _x64_ [Oct 28 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.adlice.com/forum/

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Admin [Admin rights]

Mode : Scan -- Date : 11/06/2013 13:38:52

| ARK || FAK || MBR |

¤¤¤ Bad processes : 2 ¤¤¤

[sUSP PATH][DLL] rundll32.exe -- C:\Users\Admin\AppData\Local\Apps\Google\knecgkmdhe.dll [-] -> rundll32.exe KILLED [TermProc]

¤¤¤ Registry Entries : 7 ¤¤¤

[RUN][sUSP PATH] HKCU\[...]\Run : Google (rundll32 "C:\Users\Admin\AppData\Local\Apps\Google\knecgkmdhe.dll",DllRegisterServer [x][-][x]) -> FOUND

[RUN][sUSP PATH] HKCU\[...]\Run : Mwlsoft Update (regsvr32.exe C:\Users\Admin\AppData\Local\Mwlsoft\VaultClientRes.dll [x][x]) -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-1254563572-101497606-771037836-1000\[...]\Run : Google (rundll32 "C:\Users\Admin\AppData\Local\Apps\Google\knecgkmdhe.dll",DllRegisterServer [x][-][x]) -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-1254563572-101497606-771037836-1000\[...]\Run : Mwlsoft Update (regsvr32.exe C:\Users\Admin\AppData\Local\Mwlsoft\VaultClientRes.dll [x][x]) -> FOUND

[HJ SMENU][PUM] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) Hitachi HTS723232A7A364 SATA Disk Device +++++

--- User ---

[MBR] 4879ff808a5d05981df039d4da04cc15

[bSP] f0783db912012f6879938ff5f7d9b89e : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 305143 Mo

User = LL1 ... OK!

User != LL2 ... KO!

--- LL2 ---

[MBR] f12c1a3b7041ba3b816fac954e1794cb

[bSP] f1f9297e89fac822a87bd663825d825e : Windows 7/8 MBR Code

Partition table:

0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 300 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 616448 | Size: 61440 Mo

2 - [ACTIVE] FAT16 (0x06) [VISIBLE] Offset (sectors): 128000000 | Size: 1000 Mo

3 - [XXXXXX] FAT16 (0x06) [VISIBLE] Offset (sectors): 131999744 | Size: 1000 Mo

Finished : << RKreport[0]_S_11062013_133852.txt >>

MrCharlie · November 6, 2013

Run RogueKiller again and click Scan
When the scan completes > click on the Registry tab
Put a check next to all of these and uncheck the rest: (if found)

[RUN][sUSP PATH] HKCU\[...]\Run : Google (rundll32 "C:\Users\Admin\AppData\Local\Apps\Google\knecgkmdhe.dll",DllRegisterServer [x][-][x]) -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-1254563572-101497606-771037836-1000\[...]\Run : Google (rundll32 "C:\Users\Admin\AppData\Local\Apps\Google\knecgkmdhe.dll",DllRegisterServer [x][-][x]) -> FOUND

Now click Delete on the right hand column under Options

-------------

Next click on the Processes tab and put a check next to these and uncheck the rest. (if found)

[sUSP PATH][DLL] rundll32.exe -- C:\Users\Admin\AppData\Local\Apps\Google\knecgkmdhe.dll [-] -> rundll32.exe KILLED [TermProc]

[sUSP PATH][DLL] rundll32.exe -- C:\Users\Admin\AppData\Local\Apps\Google\knecgkmdhe.dll [-] -> rundll32.exe KILLED [TermProc]

Now click Delete on the right hand column under Options

-------------

Lets clean out any adware now: (this will require a reboot so save all your work)

Please download AdwCleaner by Xplode and save to your Desktop.

Make sure you click on download buttons that look like this, not "sponsored ad links":

Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator
Click on the Scan button.
AdwCleaner will begin...be patient as the scan may take some time to complete.
When it's done you'll see: Pending: Please uncheck elements you don't want removed.
Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
Look over the log especially under Files/Folders for any program you want to save.
If there's a program you may want to save, just uncheck it from AdwCleaner.
If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
If you're ready to clean it all up.....click the Clean button.
After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder.
Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
To restore an item that has been deleted:
Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

Then..................

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

Please let me know how computer is running now, MrC

barthtl3 · November 6, 2013

I am really sorry, microsoft security essentials automatically cleared a threat while the program was running, now it those options are not available to delete but I am still having problems. I scanned again and this is the new log.

RogueKiller V8.7.6 _x64_ [Oct 28 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.adlice.com/forum/

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Admin [Admin rights]

Mode : Scan -- Date : 11/06/2013 14:02:31

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 5 ¤¤¤

[RUN][sUSP PATH] HKCU\[...]\Run : Mwlsoft Update (regsvr32.exe C:\Users\Admin\AppData\Local\Mwlsoft\VaultClientRes.dll [x][x]) -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-1254563572-101497606-771037836-1000\[...]\Run : Mwlsoft Update (regsvr32.exe C:\Users\Admin\AppData\Local\Mwlsoft\VaultClientRes.dll [x][x]) -> FOUND

[HJ SMENU][PUM] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) Hitachi HTS723232A7A364 SATA Disk Device +++++

--- User ---

[MBR] 4879ff808a5d05981df039d4da04cc15

[bSP] f0783db912012f6879938ff5f7d9b89e : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 305143 Mo

User = LL1 ... OK!

User != LL2 ... KO!

--- LL2 ---

[MBR] f12c1a3b7041ba3b816fac954e1794cb

[bSP] f1f9297e89fac822a87bd663825d825e : Windows 7/8 MBR Code

Partition table:

0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 300 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 616448 | Size: 61440 Mo

2 - [ACTIVE] FAT16 (0x06) [VISIBLE] Offset (sectors): 128000000 | Size: 1000 Mo

3 - [XXXXXX] FAT16 (0x06) [VISIBLE] Offset (sectors): 131999744 | Size: 1000 Mo

Finished : << RKreport[0]_S_11062013_140231.txt >>

RKreport[0]_S_11062013_133852.txt;RKreport[0]_S_11062013_135327.txt;RKreport[0]_S_11062013_135452.txt

MrCharlie · November 6, 2013

Please run AdwCleaner and MB as asked in my post.

MrC

barthtl3 · November 6, 2013

Neither found anything. I am still getting redirects and microsoft security essentials keeps auto cleaning threats. Here are the logs. Also, I now get a Regsvr32 window that says a VaultClientRes.dll module couldn't be found.

Malwarebytes log:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org

Database version: v2013.11.06.09

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 10.0.9200.16721

Admin :: ADMIN-PC [administrator]

11/6/2013 2:44:26 PM

mbam-log-2013-11-06 (14-44-26).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 205058

Time elapsed: 5 minute(s), 36 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

Adwcleaner log:

# AdwCleaner v3.011 - Report created 06/11/2013 at 14:38:06

# Updated 03/11/2013 by Xplode

# Operating System : Windows 7 Enterprise Service Pack 1 (64 bits)

# Username : Admin - ADMIN-PC

# Running from : C:\Users\Admin\Desktop\AdwCleaner.exe

# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16720

-\\ Mozilla Firefox v23.0.1 (en-US)

[ File : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39uqgr1d.default\prefs.js ]

-\\ Google Chrome v

[ File : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [745 octets] - [06/11/2013 14:38:06]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [804 octets] ##########

MrCharlie · November 6, 2013

Run RogueKiller again and click Scan
When the scan completes > click on the Registry tab
Put a check next to all of these and uncheck the rest: (if found)

[RUN][sUSP PATH] HKCU\[...]\Run : Mwlsoft Update (regsvr32.exe C:\Users\Admin\AppData\Local\Mwlsoft\VaultClientRes.dll [x][x]) -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-1254563572-101497606-771037836-1000\[...]\Run : Mwlsoft Update (regsvr32.exe C:\Users\Admin\AppData\Local\Mwlsoft\VaultClientRes.dll [x][x]) -> FOUND

Now click Delete on the right hand column under Options

-------------

Next:

Download Malwarebytes Anti-Rootkit from HERE

Unzip the contents to a folder in a convenient location.
Open the folder where the contents were unzipped and run mbar.exe
Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
Click on the Cleanup button to remove any threats and reboot if prompted to do so.
Wait while the system shuts down and the cleanup process is performed.
Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

To attach a log if needed:

Bottom right corner of this page.

New window that comes up.

------------------------------------------

Last:

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please make sure you click download buttons that look like this, not "sponsored ad links":

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

barthtl3 · November 6, 2013

ComboFix 13-11-04.01 - Admin 11/06/2013 17:52:50.1.2 - x64

Microsoft Windows 7 Enterprise 6.1.7601.1.1252.1.1033.18.7648.5926 [GMT -5:00]

Running from: c:\users\Admin\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}

SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\programdata\Microsoft\Windows\DRM\6D40.tmp

c:\windows\SysWow64\agent.exe

.

((((((((((((((((((((((((( Files Created from 2013-10-06 to 2013-11-06 )))))))))))))))))))))))))))))))

.

2013-11-06 23:03 . 2013-11-06 23:03 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-11-06 21:58 . 2013-11-06 22:45 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)

2013-11-06 21:58 . 2013-11-06 22:30 116440 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys

2013-11-06 21:56 . 2013-11-06 22:30 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys

2013-11-06 19:37 . 2013-11-06 19:57 -------- d-----w- C:\AdwCleaner

2013-11-06 18:44 . 2013-10-18 03:33 965000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B59021C9-3F31-4CFC-BEE1-9293B49C220A}\gapaengine.dll

2013-11-06 18:43 . 2013-10-14 07:12 10280728 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{68E57DC8-D131-46F9-B6A9-9A7178DBE937}\mpengine.dll

2013-11-05 02:48 . 2013-10-14 07:12 10280728 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2013-11-04 06:37 . 2013-11-04 06:37 -------- d-----w- c:\windows\Microsoft Antimalware

2013-11-03 19:54 . 2013-11-04 00:12 -------- d-----w- c:\users\Admin\AppData\Local\Mwlsoft

2013-10-27 17:01 . 2013-10-27 17:03 -------- d-----w- c:\windows\system32\MRT

2013-10-09 03:28 . 2013-07-04 12:50 633856 ----a-w- c:\windows\system32\comctl32.dll

2013-10-09 03:28 . 2013-07-04 11:50 530432 ----a-w- c:\windows\SysWow64\comctl32.dll

2013-10-09 03:28 . 2013-06-06 05:50 41472 ----a-w- c:\windows\system32\lpk.dll

2013-10-09 03:28 . 2013-06-06 05:49 100864 ----a-w- c:\windows\system32\fontsub.dll

2013-10-09 03:28 . 2013-06-06 05:49 14336 ----a-w- c:\windows\system32\dciman32.dll

2013-10-09 03:28 . 2013-06-06 05:47 46080 ----a-w- c:\windows\system32\atmlib.dll

2013-10-09 03:28 . 2013-06-06 04:57 25600 ----a-w- c:\windows\SysWow64\lpk.dll

2013-10-09 03:28 . 2013-06-06 04:51 70656 ----a-w- c:\windows\SysWow64\fontsub.dll

2013-10-09 03:28 . 2013-06-06 04:50 10240 ----a-w- c:\windows\SysWow64\dciman32.dll

2013-10-09 03:28 . 2013-06-06 03:30 368128 ----a-w- c:\windows\system32\atmfd.dll

2013-10-09 03:28 . 2013-06-06 03:01 295424 ----a-w- c:\windows\SysWow64\atmfd.dll

2013-10-09 03:28 . 2013-06-06 03:01 34304 ----a-w- c:\windows\SysWow64\atmlib.dll

2013-10-09 03:28 . 2013-06-25 22:55 785624 ----a-w- c:\windows\system32\drivers\Wdf01000.sys

2013-10-09 03:26 . 2013-08-29 01:50 5120 ----a-w- c:\windows\SysWow64\wow32.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-10-18 03:33 . 2012-07-03 01:47 965000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

2013-10-09 05:03 . 2012-07-03 22:11 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-10-09 05:03 . 2012-07-03 22:11 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2013-09-26 05:46 . 2012-05-23 13:34 80541720 ----a-w- c:\windows\system32\MRT.exe

2013-08-29 01:48 . 2013-10-09 03:26 44032 ----a-w- c:\windows\apppatch\acwow64.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-10-26 343168]

"QLBController"="c:\program files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe" [2011-05-14 318520]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]

"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2013-09-03 41336]

"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2013-09-03 840568]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

"ConnectionCenter"="c:\program files (x86)\Citrix\ICA Client\concentr.exe" [2010-05-12 300472]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-31 152392]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2011-4-24 1132320]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]

R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]

R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]

R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]

R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]

S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_sata.sys [x]

S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_xata.sys [x]

S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys;c:\windows\SYSNATIVE\DRIVERS\ctxusbm.sys [x]

S1 NEOFLTR_650_16339;Juniper Networks TDI Filter Driver (NEOFLTR_650_16339);c:\windows\system32\Drivers\NEOFLTR_650_16339.SYS;c:\windows\SYSNATIVE\Drivers\NEOFLTR_650_16339.SYS [x]

S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]

S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [x]

S2 hpHotkeyMonitor;hpHotkeyMonitor;c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe;c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe [x]

S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]

S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe;c:\windows\SYSNATIVE\vcsFPService.exe [x]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]

S3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys;c:\windows\SYSNATIVE\drivers\btwampfl.sys [x]

S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]

S3 InputFilter_Hid_FlexDef2b;Siliten HID Devices(FlexDef2b) Driver Service;c:\windows\system32\DRIVERS\InputFilter_FlexDef2b.sys;c:\windows\SYSNATIVE\DRIVERS\InputFilter_FlexDef2b.sys [x]

S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys;c:\windows\SYSNATIVE\DRIVERS\jmcr.sys [x]

S3 johci;JMicron 1394 Filter Driver;c:\windows\system32\DRIVERS\johci.sys;c:\windows\SYSNATIVE\DRIVERS\johci.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

.

Contents of the 'Scheduled Tasks' folder

.

2013-11-06 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-03 05:03]

.

2013-11-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1254563572-101497606-771037836-1000Core.job

- c:\users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-25 14:23]

.

2013-11-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1254563572-101497606-771037836-1000UA.job

- c:\users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-25 14:23]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Broadcom Wireless Manager UI"="c:\program files\Broadcom\Broadcom 802.11\WLTRAY.exe" [2012-05-22 7168000]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-05-11 1128448]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-08-12 1356240]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000

IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39uqgr1d.default\

.

- - - - ORPHANS REMOVED - - - -

.

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

AddRemove-Usmleworld QBank - c:\windows\system32\javaws.exe

AddRemove-Usmleworld Step3 CCS - c:\windows\system32\javaws.exe

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2013-11-06 18:19:50

ComboFix-quarantined-files.txt 2013-11-06 23:19

.

Pre-Run: 230,027,038,720 bytes free

Post-Run: 230,080,749,568 bytes free

.

- - End Of File - - 02F9CC7E2A12DA6823F64966B52CECFA

A36C5E4F47E84449FF07ED3517B43A31

mbar-log-2013-11-06 (16-58-33).txt

mbar-log-2013-11-06 (17-30-46).txt

system-log.txt

MrCharlie · November 7, 2013

How is it??? MrC

barthtl3 · November 7, 2013

I did a bunch of searches to safe websites and got redirected to answergrab once since the last update. It only happened the one time and not since. I did run Microsoft security essentials and malwarebytes but they found nothing. Everything else seems to be fine though.

MrCharlie · November 7, 2013

What browser were you using?? MrC

barthtl3 · November 8, 2013

I was using Chrome at the time it happened but I also have IE and firefox. I tested each browser.

MrCharlie · November 8, 2013

It happens in all 3 browsers???

Please download Farbar Recovery Scan Tool and save it to a folder. (use correct version for your system.....Which system am I using?)

Please make sure you click download buttons that look like this, not "sponsored ad links":

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

MrC

barthtl3 · November 8, 2013

Both Chrome and Firefox and having the redirects. So far, IE hasn't.

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-10-2013

Ran by Admin (administrator) on ADMIN-PC on 07-11-2013 21:42:08

Running from C:\Users\Admin\Desktop\FRST

Windows 7 Enterprise Service Pack 1 (X64) OS Language: English(US)

Internet Explorer Version 10

Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe

(Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe

(AMD) C:\Windows\system32\atieclxx.exe

(Validity Sensors, Inc.) C:\Windows\system32\vcsFPService.exe

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe

(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\WLTRYSVC.EXE

(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\bcmwltry.exe

(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

(Juniper Networks) C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe

(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.EXE

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe

(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe

(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe

(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

(Google Inc.) C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE

(Microsoft Corporation) C:\Windows\splwow64.exe

(Google Inc.) C:\Users\Admin\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [broadcom Wireless Manager UI] - C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.EXE [7168000 2012-05-22] (Broadcom Corporation)

HKLM\...\Run: [sysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-05-11] (IDT, Inc.)

HKLM\...\Run: [synTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2828072 2011-09-16] (Synaptics Incorporated)

HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-08-12] (Microsoft Corporation)

HKLM-x32\...\Run: [startCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-10-25] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [QLBController] - C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe [318520 2011-05-13] (Hewlett-Packard Company)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [] - [x]

HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.)

HKLM-x32\...\Run: [sunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [ConnectionCenter] - C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [300472 2010-05-12] (Citrix Systems, Inc.)

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x43C5D77E6038CD01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab

Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File

Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File

Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:

========

FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39uqgr1d.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Admin\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Admin\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)

FF Extension: dniruiwhyu - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39uqgr1d.default\Extensions\dniruiwhyu@dniruiwhyu.org.xpi

Chrome:

=======

CHR Plugin: (Remoting Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Users\Admin\AppData\Local\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Users\Admin\AppData\Local\Google\Chrome\Application\30.0.1599.101\pdf.dll ()

CHR Plugin: (Shockwave Flash) - C:\Users\Admin\AppData\Local\Google\Chrome\Application\30.0.1599.101\gcswf32.dll No File

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Java Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

CHR Plugin: (Google Update) - C:\Users\Admin\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File

CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File

CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Google Search) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (Google Wallet) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0

CHR Extension: (Hover Zoom) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nonjdcjchghhkdoolnlbekcfllmednbl\4.22_0

CHR Extension: (Gmail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

==================== Services (Whitelisted) =================

R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe [317496 2011-05-13] (Hewlett-Packard Company)

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-08-12] (Microsoft Corporation)

R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-08-12] (Microsoft Corporation)

R2 wltrysvc; C:\Program Files\Broadcom\Broadcom 802.11\WLTRYSVC.EXE [48128 2012-05-22] (Broadcom Corporation)

==================== Drivers (Whitelisted) ====================

R3 InputFilter_Hid_FlexDef2b; C:\Windows\System32\DRIVERS\InputFilter_FlexDef2b.sys [17920 2010-06-18] (Siliten)

S3 johci; C:\Windows\System32\DRIVERS\johci.sys [26712 2011-02-09] (JMicron Technology Corp.)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)

R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation)

R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1863680 2012-03-30] (Sonix Co. Ltd.)

S3 catchme; \??\C:\ComboFix\catchme.sys [x]

S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-11-07 21:41 - 2013-11-07 21:41 - 00000000 ____D C:\Users\Admin\Desktop\FRST

2013-11-07 21:41 - 2013-11-07 21:41 - 00000000 ____D C:\FRST

2013-11-07 21:40 - 2013-11-07 21:40 - 01957098 _____ (Farbar) C:\Users\Admin\Downloads\FRST64 (3).exe

2013-11-07 21:39 - 2013-11-07 21:39 - 01957098 _____ (Farbar) C:\Users\Admin\Downloads\FRST64 (2).exe

2013-11-07 21:38 - 2013-11-07 21:38 - 01957098 _____ (Farbar) C:\Users\Admin\Downloads\FRST64 (1).exe

2013-11-07 21:37 - 2013-11-07 21:38 - 01957098 _____ (Farbar) C:\Users\Admin\Downloads\FRST64.exe

2013-11-06 18:20 - 2013-11-06 18:20 - 00016924 _____ C:\ComboFix.txt

2013-11-06 17:50 - 2013-11-06 18:21 - 00000000 ____D C:\Qoobox

2013-11-06 17:50 - 2011-06-26 01:45 - 00256000 _____ C:\Windows\PEV.exe

2013-11-06 17:50 - 2010-11-07 12:20 - 00208896 _____ C:\Windows\MBR.exe

2013-11-06 17:50 - 2009-04-19 23:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-11-06 17:50 - 2000-08-30 19:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-11-06 17:50 - 2000-08-30 19:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-11-06 17:50 - 2000-08-30 19:00 - 00098816 _____ C:\Windows\sed.exe

2013-11-06 17:50 - 2000-08-30 19:00 - 00080412 _____ C:\Windows\grep.exe

2013-11-06 17:50 - 2000-08-30 19:00 - 00068096 _____ C:\Windows\zip.exe

2013-11-06 17:49 - 2013-11-06 18:15 - 00000000 ____D C:\Windows\erdnt

2013-11-06 17:47 - 2013-11-06 17:47 - 05144303 ____R (Swearware) C:\Users\Admin\Desktop\ComboFix.exe

2013-11-06 17:46 - 2013-11-06 17:47 - 05144303 _____ (Swearware) C:\Users\Admin\Downloads\ComboFix.exe

2013-11-06 16:58 - 2013-11-06 17:45 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2013-11-06 16:56 - 2013-11-06 17:45 - 00000000 ____D C:\Users\Admin\Desktop\mbar

2013-11-06 16:56 - 2013-11-06 17:30 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2013-11-06 16:56 - 2013-11-06 16:56 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Admin\Downloads\mbar-1.07.0.1007.exe

2013-11-06 16:54 - 2013-11-06 16:54 - 00002646 _____ C:\Users\Admin\Desktop\RKreport[0]_D_11062013_165445.txt

2013-11-06 16:51 - 2013-11-06 16:51 - 00002541 _____ C:\Users\Admin\Desktop\RKreport[0]_S_11062013_165134.txt

2013-11-06 16:49 - 2013-11-06 16:49 - 04012032 _____ C:\Users\Admin\Downloads\RogueKillerX64 (4).exe

2013-11-06 16:44 - 2013-11-06 16:44 - 00002507 _____ C:\Users\Admin\Desktop\RKreport[0]_S_11062013_164439.txt

2013-11-06 16:37 - 2013-11-06 16:37 - 04012032 _____ C:\Users\Admin\Downloads\RogueKillerX64 (3).exe

2013-11-06 14:41 - 2013-11-06 14:41 - 00000883 _____ C:\Users\Admin\Documents\AdwCleaner[R0].txt

2013-11-06 14:37 - 2013-11-06 14:57 - 00000000 ____D C:\AdwCleaner

2013-11-06 14:36 - 2013-11-06 14:36 - 01073262 _____ C:\Users\Admin\Desktop\AdwCleaner.exe

2013-11-06 14:02 - 2013-11-06 14:02 - 00002474 _____ C:\Users\Admin\Desktop\RKreport[0]_S_11062013_140231.txt

2013-11-06 14:00 - 2013-11-06 14:00 - 04012032 _____ C:\Users\Admin\Downloads\RogueKillerX64 (2).exe

2013-11-06 13:54 - 2013-11-06 13:54 - 00002438 _____ C:\Users\Admin\Desktop\RKreport[0]_S_11062013_135452.txt

2013-11-06 13:53 - 2013-11-06 13:53 - 00001619 _____ C:\Users\Admin\Desktop\RKreport[0]_S_11062013_135327.txt

2013-11-06 13:52 - 2013-11-06 13:52 - 04012032 _____ C:\Users\Admin\Downloads\RogueKillerX64 (1).exe

2013-11-06 13:38 - 2013-11-06 13:38 - 00002968 _____ C:\Users\Admin\Desktop\RKreport[0]_S_11062013_133852.txt

2013-11-06 13:35 - 2013-11-06 16:54 - 00000000 ____D C:\Users\Admin\Desktop\RK_Quarantine

2013-11-06 13:35 - 2013-11-06 13:35 - 04012032 _____ C:\Users\Admin\Downloads\RogueKillerX64.exe

2013-11-05 22:27 - 2013-11-05 22:27 - 00022919 ____H C:\Users\Admin\Desktop\~WRL0005.tmp

2013-11-05 21:50 - 2013-11-05 21:50 - 00688992 ____R (Swearware) C:\Users\Admin\Downloads\dds (2).scr

2013-11-05 21:46 - 2013-11-05 21:46 - 00688992 _____ (Swearware) C:\Users\Admin\Downloads\dds.com

2013-11-05 21:44 - 2013-11-05 21:44 - 00688992 _____ (Swearware) C:\Users\Admin\Downloads\dds (1).scr

2013-11-05 21:15 - 2013-11-05 21:51 - 00017566 _____ C:\Users\Admin\Desktop\dds.txt

2013-11-05 21:15 - 2013-11-05 21:51 - 00010780 _____ C:\Users\Admin\Desktop\attach.txt

2013-11-05 21:14 - 2013-11-05 21:14 - 00688992 ____R (Swearware) C:\Users\Admin\Downloads\dds.scr

2013-11-05 14:01 - 2013-11-05 20:52 - 00000000 ____D C:\Users\Admin\Desktop\Stuff

2013-11-04 01:37 - 2013-11-04 01:37 - 00000000 ____D C:\Windows\Microsoft Antimalware

2013-11-03 22:09 - 2013-11-03 22:09 - 00000000 ____D C:\Users\Admin\Desktop\PP

2013-11-03 22:05 - 2013-11-05 20:51 - 00000000 ____D C:\Users\Admin\Desktop\Files

2013-11-03 14:54 - 2013-11-06 13:53 - 00000000 ____D C:\Users\Admin\AppData\Local\Apps\Google

2013-11-03 14:54 - 2013-11-03 19:12 - 00000000 ____D C:\Users\Admin\AppData\Local\Mwlsoft

2013-10-27 12:01 - 2013-10-27 12:03 - 00000000 ____D C:\Windows\system32\MRT

2013-10-25 19:57 - 2013-10-25 19:57 - 00088230 _____ C:\Users\Admin\Downloads\Table 1 Comparison of SCIT versus SLIT DPS 10 24 13. (1).pptx

2013-10-25 19:17 - 2013-10-25 19:17 - 00088230 _____ C:\Users\Admin\Downloads\Table 1 Comparison of SCIT versus SLIT DPS 10 24 13..pptx

2013-10-23 11:57 - 2013-10-25 19:38 - 00087778 _____ C:\Users\Admin\Documents\ARC Grass Slit.enl

2013-10-23 11:57 - 2013-10-23 11:57 - 00000000 ____D C:\Users\Admin\Documents\ARC Grass Slit.Data

2013-10-23 02:57 - 2013-10-23 02:57 - 00075239 _____ C:\Users\Admin\Downloads\MCAD Cases at Children’s.pptx

2013-10-09 23:45 - 2013-09-22 18:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-10-09 23:45 - 2013-09-22 18:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-10-09 23:45 - 2013-09-22 18:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-10-09 23:45 - 2013-09-22 18:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-10-09 23:45 - 2013-09-22 18:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-10-09 23:45 - 2013-09-22 18:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-10-09 23:45 - 2013-09-22 18:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-10-09 23:45 - 2013-09-22 18:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-10-09 23:45 - 2013-09-22 18:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-10-09 23:45 - 2013-09-22 18:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-10-09 23:45 - 2013-09-22 18:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-10-09 23:45 - 2013-09-22 18:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-10-09 23:45 - 2013-09-22 18:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-10-09 23:45 - 2013-09-22 17:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-10-09 23:45 - 2013-09-22 17:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-10-09 23:45 - 2013-09-22 17:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-10-09 23:45 - 2013-09-22 17:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-10-09 23:45 - 2013-09-22 17:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-10-09 23:45 - 2013-09-22 17:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-10-09 23:45 - 2013-09-22 17:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-10-09 23:45 - 2013-09-22 17:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-10-09 23:45 - 2013-09-22 17:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-10-09 23:45 - 2013-09-22 17:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-10-09 23:45 - 2013-09-22 17:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-10-09 23:45 - 2013-09-22 17:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-10-09 23:45 - 2013-09-22 17:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-10-09 23:45 - 2013-09-22 17:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-10-09 23:45 - 2013-09-20 22:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-10-09 23:45 - 2013-09-20 22:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-10-09 23:45 - 2013-09-20 21:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-10-09 23:45 - 2013-09-20 21:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-10-08 22:28 - 2013-07-04 07:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll

2013-10-08 22:28 - 2013-07-04 06:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll

2013-10-08 22:28 - 2013-06-25 17:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys

2013-10-08 22:28 - 2013-06-06 00:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll

2013-10-08 22:28 - 2013-06-06 00:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll

2013-10-08 22:28 - 2013-06-06 00:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll

2013-10-08 22:28 - 2013-06-06 00:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll

2013-10-08 22:28 - 2013-06-05 23:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll

2013-10-08 22:28 - 2013-06-05 23:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll

2013-10-08 22:28 - 2013-06-05 23:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll

2013-10-08 22:28 - 2013-06-05 22:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll

2013-10-08 22:28 - 2013-06-05 22:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll

2013-10-08 22:28 - 2013-06-05 22:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll

2013-10-08 22:27 - 2013-09-13 20:10 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys

2013-10-08 22:27 - 2013-09-07 21:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys

2013-10-08 22:27 - 2013-09-07 21:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll

2013-10-08 22:27 - 2013-09-07 21:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll

2013-10-08 22:27 - 2013-08-28 21:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2013-10-08 22:27 - 2013-08-28 21:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2013-10-08 22:27 - 2013-08-28 21:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll

2013-10-08 22:27 - 2013-08-28 21:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll

2013-10-08 22:27 - 2013-08-28 21:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll

2013-10-08 22:27 - 2013-08-28 20:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2013-10-08 22:27 - 2013-08-28 20:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2013-10-08 22:27 - 2013-08-28 20:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2013-10-08 22:27 - 2013-08-28 20:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll

2013-10-08 22:27 - 2013-08-28 20:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll

2013-10-08 22:27 - 2013-08-27 20:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-10-08 22:27 - 2013-07-12 05:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys

2013-10-08 22:27 - 2013-07-12 05:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys

2013-10-08 22:27 - 2013-07-04 07:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll

2013-10-08 22:27 - 2013-07-04 07:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll

2013-10-08 22:27 - 2013-07-04 06:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll

2013-10-08 22:27 - 2013-07-04 06:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll

2013-10-08 22:27 - 2013-07-04 05:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys

2013-10-08 22:27 - 2013-07-02 23:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys

2013-10-08 22:27 - 2013-07-02 23:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys

2013-10-08 22:26 - 2013-09-04 07:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys

2013-10-08 22:26 - 2013-09-04 07:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys

2013-10-08 22:26 - 2013-09-04 07:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys

2013-10-08 22:26 - 2013-09-04 07:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys

2013-10-08 22:26 - 2013-09-04 07:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys

2013-10-08 22:26 - 2013-09-04 07:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys

2013-10-08 22:26 - 2013-09-04 07:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys

2013-10-08 22:26 - 2013-08-28 20:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll

2013-10-08 22:26 - 2013-08-28 19:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe

2013-10-08 22:26 - 2013-08-28 19:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll

2013-10-08 22:26 - 2013-08-28 19:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe

2013-10-08 22:26 - 2013-08-28 19:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe

2013-10-08 22:26 - 2013-08-27 20:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll

2013-10-08 22:26 - 2013-08-01 07:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys

2013-10-08 22:26 - 2013-07-20 05:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll

2013-10-08 22:26 - 2013-07-20 05:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll

==================== One Month Modified Files and Folders =======

2013-11-07 21:41 - 2013-11-07 21:41 - 00000000 ____D C:\Users\Admin\Desktop\FRST

2013-11-07 21:41 - 2013-11-07 21:41 - 00000000 ____D C:\FRST

2013-11-07 21:40 - 2013-11-07 21:40 - 01957098 _____ (Farbar) C:\Users\Admin\Downloads\FRST64 (3).exe

2013-11-07 21:39 - 2013-11-07 21:39 - 01957098 _____ (Farbar) C:\Users\Admin\Downloads\FRST64 (2).exe

2013-11-07 21:38 - 2013-11-07 21:38 - 01957098 _____ (Farbar) C:\Users\Admin\Downloads\FRST64 (1).exe

2013-11-07 21:38 - 2013-11-07 21:37 - 01957098 _____ (Farbar) C:\Users\Admin\Downloads\FRST64.exe

2013-11-07 21:32 - 2012-07-03 17:11 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-11-07 21:32 - 2012-05-25 09:23 - 00000908 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1254563572-101497606-771037836-1000UA.job

2013-11-07 21:32 - 2012-05-22 23:39 - 01408276 _____ C:\Windows\WindowsUpdate.log

2013-11-07 12:41 - 2009-07-13 23:45 - 00022208 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-11-07 12:41 - 2009-07-13 23:45 - 00022208 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-11-07 12:40 - 2012-05-23 09:00 - 00370172 _____ C:\Windows\system32\prfh0804.dat

2013-11-07 12:40 - 2012-05-23 09:00 - 00104616 _____ C:\Windows\system32\prfc0804.dat

2013-11-07 12:40 - 2009-07-14 00:13 - 01191384 _____ C:\Windows\system32\PerfStringBackup.INI

2013-11-07 12:33 - 2009-07-14 00:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-11-07 12:33 - 2009-07-13 23:51 - 00040389 _____ C:\Windows\setupact.log

2013-11-07 12:24 - 2010-11-20 22:47 - 00012258 _____ C:\Windows\PFRO.log

2013-11-07 12:23 - 2012-05-25 09:23 - 00000856 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1254563572-101497606-771037836-1000Core.job

2013-11-06 18:21 - 2013-11-06 17:50 - 00000000 ____D C:\Qoobox

2013-11-06 18:20 - 2013-11-06 18:20 - 00016924 _____ C:\ComboFix.txt

2013-11-06 18:20 - 2009-07-13 22:20 - 00000000 __RHD C:\Users\Default

2013-11-06 18:15 - 2013-11-06 17:49 - 00000000 ____D C:\Windows\erdnt

2013-11-06 18:04 - 2009-07-13 21:34 - 00000215 _____ C:\Windows\system.ini

2013-11-06 17:47 - 2013-11-06 17:47 - 05144303 ____R (Swearware) C:\Users\Admin\Desktop\ComboFix.exe

2013-11-06 17:47 - 2013-11-06 17:46 - 05144303 _____ (Swearware) C:\Users\Admin\Downloads\ComboFix.exe

2013-11-06 17:45 - 2013-11-06 16:58 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2013-11-06 17:45 - 2013-11-06 16:56 - 00000000 ____D C:\Users\Admin\Desktop\mbar

2013-11-06 17:30 - 2013-11-06 16:56 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2013-11-06 16:56 - 2013-11-06 16:56 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Admin\Downloads\mbar-1.07.0.1007.exe

2013-11-06 16:54 - 2013-11-06 16:54 - 00002646 _____ C:\Users\Admin\Desktop\RKreport[0]_D_11062013_165445.txt

2013-11-06 16:54 - 2013-11-06 13:35 - 00000000 ____D C:\Users\Admin\Desktop\RK_Quarantine

2013-11-06 16:51 - 2013-11-06 16:51 - 00002541 _____ C:\Users\Admin\Desktop\RKreport[0]_S_11062013_165134.txt

2013-11-06 16:49 - 2013-11-06 16:49 - 04012032 _____ C:\Users\Admin\Downloads\RogueKillerX64 (4).exe

2013-11-06 16:44 - 2013-11-06 16:44 - 00002507 _____ C:\Users\Admin\Desktop\RKreport[0]_S_11062013_164439.txt

2013-11-06 16:37 - 2013-11-06 16:37 - 04012032 _____ C:\Users\Admin\Downloads\RogueKillerX64 (3).exe

2013-11-06 14:57 - 2013-11-06 14:37 - 00000000 ____D C:\AdwCleaner

2013-11-06 14:41 - 2013-11-06 14:41 - 00000883 _____ C:\Users\Admin\Documents\AdwCleaner[R0].txt

2013-11-06 14:36 - 2013-11-06 14:36 - 01073262 _____ C:\Users\Admin\Desktop\AdwCleaner.exe

2013-11-06 14:02 - 2013-11-06 14:02 - 00002474 _____ C:\Users\Admin\Desktop\RKreport[0]_S_11062013_140231.txt

2013-11-06 14:00 - 2013-11-06 14:00 - 04012032 _____ C:\Users\Admin\Downloads\RogueKillerX64 (2).exe

2013-11-06 13:54 - 2013-11-06 13:54 - 00002438 _____ C:\Users\Admin\Desktop\RKreport[0]_S_11062013_135452.txt

2013-11-06 13:53 - 2013-11-06 13:53 - 00001619 _____ C:\Users\Admin\Desktop\RKreport[0]_S_11062013_135327.txt

2013-11-06 13:53 - 2013-11-03 14:54 - 00000000 ____D C:\Users\Admin\AppData\Local\Apps\Google

2013-11-06 13:52 - 2013-11-06 13:52 - 04012032 _____ C:\Users\Admin\Downloads\RogueKillerX64 (1).exe

2013-11-06 13:38 - 2013-11-06 13:38 - 00002968 _____ C:\Users\Admin\Desktop\RKreport[0]_S_11062013_133852.txt

2013-11-06 13:35 - 2013-11-06 13:35 - 04012032 _____ C:\Users\Admin\Downloads\RogueKillerX64.exe

2013-11-05 22:27 - 2013-11-05 22:27 - 00022919 ____H C:\Users\Admin\Desktop\~WRL0005.tmp

2013-11-05 21:51 - 2013-11-05 21:15 - 00017566 _____ C:\Users\Admin\Desktop\dds.txt

2013-11-05 21:51 - 2013-11-05 21:15 - 00010780 _____ C:\Users\Admin\Desktop\attach.txt

2013-11-05 21:50 - 2013-11-05 21:50 - 00688992 ____R (Swearware) C:\Users\Admin\Downloads\dds (2).scr

2013-11-05 21:46 - 2013-11-05 21:46 - 00688992 _____ (Swearware) C:\Users\Admin\Downloads\dds.com

2013-11-05 21:44 - 2013-11-05 21:44 - 00688992 _____ (Swearware) C:\Users\Admin\Downloads\dds (1).scr

2013-11-05 21:14 - 2013-11-05 21:14 - 00688992 ____R (Swearware) C:\Users\Admin\Downloads\dds.scr

2013-11-05 20:52 - 2013-11-05 14:01 - 00000000 ____D C:\Users\Admin\Desktop\Stuff

2013-11-05 20:51 - 2013-11-03 22:05 - 00000000 ____D C:\Users\Admin\Desktop\Files

2013-11-05 20:51 - 2013-05-01 13:16 - 00000000 ____D C:\Users\Admin\Desktop\Common

2013-11-04 01:37 - 2013-11-04 01:37 - 00000000 ____D C:\Windows\Microsoft Antimalware

2013-11-03 22:09 - 2013-11-03 22:09 - 00000000 ____D C:\Users\Admin\Desktop\PP

2013-11-03 19:12 - 2013-11-03 14:54 - 00000000 ____D C:\Users\Admin\AppData\Local\Mwlsoft

2013-11-03 17:57 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\system32\sysprep

2013-10-27 12:05 - 2013-04-21 21:01 - 00002026 _____ C:\Users\Public\Desktop\Adobe Acrobat X Pro.lnk

2013-10-27 12:03 - 2013-10-27 12:01 - 00000000 ____D C:\Windows\system32\MRT

2013-10-27 11:56 - 2013-09-17 01:43 - 602948484 _____ C:\Windows\MEMORY.DMP

2013-10-27 11:56 - 2013-09-17 01:43 - 00000000 ____D C:\Windows\Minidump

2013-10-27 11:54 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\LiveKernelReports

2013-10-25 19:57 - 2013-10-25 19:57 - 00088230 _____ C:\Users\Admin\Downloads\Table 1 Comparison of SCIT versus SLIT DPS 10 24 13. (1).pptx

2013-10-25 19:38 - 2013-10-23 11:57 - 00087778 _____ C:\Users\Admin\Documents\ARC Grass Slit.enl

2013-10-25 19:17 - 2013-10-25 19:17 - 00088230 _____ C:\Users\Admin\Downloads\Table 1 Comparison of SCIT versus SLIT DPS 10 24 13..pptx

2013-10-23 11:57 - 2013-10-23 11:57 - 00000000 ____D C:\Users\Admin\Documents\ARC Grass Slit.Data

2013-10-23 02:57 - 2013-10-23 02:57 - 00075239 _____ C:\Users\Admin\Downloads\MCAD Cases at Children’s.pptx

2013-10-16 06:15 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\rescache

2013-10-14 19:27 - 2012-10-01 00:30 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Apple Computer

2013-10-13 06:51 - 2012-05-25 09:23 - 00003878 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1254563572-101497606-771037836-1000UA

2013-10-13 06:51 - 2012-05-25 09:23 - 00003482 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1254563572-101497606-771037836-1000Core

2013-10-12 19:51 - 2009-07-13 23:45 - 00349192 _____ C:\Windows\system32\FNTCACHE.DAT

2013-10-11 03:09 - 2012-05-23 09:45 - 00001945 _____ C:\Windows\epplauncher.mif

2013-10-11 03:08 - 2012-05-23 09:36 - 00000000 ____D C:\Program Files\Microsoft Security Client

2013-10-11 03:08 - 2012-05-23 09:36 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client

2013-10-10 08:18 - 2013-03-13 10:12 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-10-10 08:18 - 2013-03-13 10:12 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-10-09 23:47 - 2012-05-23 09:48 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-10-09 00:03 - 2012-07-03 17:11 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-10-09 00:03 - 2012-07-03 17:11 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-10-09 00:03 - 2012-07-03 17:11 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2013-11-02 15:13

==================== End Of Log ============================

Addition.txt

MrCharlie · November 8, 2013

Download the attached fixlist.txt to the same folder as FRST.
Run FRST.exe and click Fix only once and wait
The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

Then......

Please go to your add/remove programs and uninstall these and any other Java listed:
Java Auto Updater (x32 Version: 2.0.7.1)
Java 6 Update 31 (x32 Version: 6.0.310)

Now.....Download and install the latest version (Java™ 7 Update 45) from Here. Uncheck the box to install the Ask toolbar!!! and any other free "stuff".

Go here and follow the instructions to clear your Java Cache
[url=http://www.java.com/en/download/help/plugin_cache.xml

Let me know....MrC

barthtl3 · November 8, 2013

I didn't find Java auto updater in the add/remove programs. Everything else went fine, but I still am having redirect issues.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 31-10-2013

Ran by Admin at 2013-11-08 13:05:19 Run:1

Running from C:\Users\Admin\Desktop\FRST

Boot Mode: Normal

==============================================

Content of fixlist:

*****************

Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File

Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File

FF Extension: dniruiwhyu - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39uqgr1d.default\Extensions\dniruiwhyu@dniruiwhyu.org.xpi

*****************

HKCR\PROTOCOLS\Filter\application/x-ica => Key deleted successfully.

HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found.

HKCR\PROTOCOLS\Filter\ica => Key deleted successfully.

HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found.

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39uqgr1d.default\Extensions\dniruiwhyu@dniruiwhyu.org.xpi => Moved successfully.

==== End of Fixlog ====

MrCharlie · November 8, 2013

What browser is affected?? MrC

barthtl3 · November 8, 2013

I tried several searches in each browser and only chrome had a redirect so far.

MrCharlie · November 8, 2013

Disable all of the extensions in Chrome and see how it is.

MrC

barthtl3 · November 8, 2013

The extensions listed are "Hoverzoom" and "Extension 1.0". I disabled both and did about 30 searches with no issue.

MrCharlie · November 8, 2013

Enable one and see how it is and then the other until the redirects come back.

Then you'll see which one is responsible for them.

MrC

barthtl3 · November 9, 2013

Extension 1.0 seems to be responsible. The other one did not give redirects in all my attempts, but Extension 1.0 did on the 3rd attempt.

MrCharlie · November 9, 2013

OK, so delete that one and problem solved.

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
If you get Unsupported operating system. Aborting now, just reboot and try again.
A Notepad document should open automatically called checkup.txt.
Please Post the contents of that document.
Do Not Attach It!!!

MrC

Redirects that aren't detected

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information