Ads randomly playing through Window's Host Process

Sorbooze · January 2, 2014

Hello all =)

I have recently gotten a very nasty virus from what I can tell... It will randomly start playing adds through Window's Host Process svchost.exe. I have tried to run MBAM and MBAM anti-rootkit program and it just keeps coming back. Any help you could offer would be appreciated.

Sorbooze · January 2, 2014

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 8.0.7600.17267 BrowserJavaVersion: 1.6.0_26

Run by user at 19:45:14 on 2014-01-01

Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.8183.5008 [GMT -5:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\atieclxx.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE

C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE

C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe

C:\Windows\SysWOW64\PnkBstrA.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe

C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe

C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SndVol.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

C:\Windows\system32\SndVol.exe

C:\Windows\system32\taskmgr.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Windows\system32\wuauclt.exe

C:\Users\user\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\SndVol.exe

C:\Users\user\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\RunDll32.exe

c:\Program Files\Microsoft Security Client\NisSrv.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uProxyOverride = 127.0.0.1:9421;<local>

uURLSearchHooks: {cd90bf73-20f6-44ef-993d-bb920303bd2e} - <orphaned>

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

mRun: [Razer Synapse] "C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe"

mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun

mRun: [blueStacks Agent] C:\Program Files (x86)\BlueStacks\HD-Agent.exe

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:0

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableLUA = dword:0

mPolicies-System: EnableUIADesktopToggle = dword:0

mPolicies-System: PromptOnSecureDesktop = dword:0

IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

TCP: NameServer = 192.168.1.1

TCP: Interfaces\{0AA364C6-55A2-4FBC-AB0A-211F4B504E6B} : DHCPNameServer = 65.32.5.111 65.32.5.112

TCP: Interfaces\{43D6AC1F-B787-49B9-86C7-5B0FD6C4C1A2} : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{43D6AC1F-B787-49B9-86C7-5B0FD6C4C1A2}\2456C6B696E6F5E4F575962756C6563737F5532366366623 : DHCPNameServer = 192.168.2.1

TCP: Interfaces\{43D6AC1F-B787-49B9-86C7-5B0FD6C4C1A2}\2484E42323 : DHCPNameServer = 65.32.5.111 65.32.5.112

TCP: Interfaces\{43D6AC1F-B787-49B9-86C7-5B0FD6C4C1A2}\45865602C4F66647370275962756C6563737 : DHCPNameServer = 68.234.128.88 68.234.128.70 50.30.208.88

TCP: Interfaces\{43D6AC1F-B787-49B9-86C7-5B0FD6C4C1A2}\A425D20534F5E4564777F627B6 : DHCPNameServer = 10.0.0.1

TCP: Interfaces\{43D6AC1F-B787-49B9-86C7-5B0FD6C4C1A2}\C696E6B6379737 : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{8630E97A-E5E0-412F-8FB1-99C68334277A} : DHCPNameServer = 66.193.237.2 66.158.224.2 64.132.155.130 64.132.155.131

TCP: Interfaces\{D74EC7A8-B839-4DF6-87C6-8DBD825BDF64} : DHCPNameServer = 7.254.254.254

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

SSODL: WebCheck - <orphaned>

SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

x64-BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

x64-Run: [intelliType Pro] "c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe"

x64-Run: [intelliPoint] "c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe"

x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

x64-Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - <orphaned>

x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - <orphaned>

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

x64-SSODL: WebCheck - <orphaned>

.

============= SERVICES / DRIVERS ===============

.

R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2013-6-18 247216]

R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2009-12-22 55856]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2013-9-5 239616]

R2 BstHdDrv;BlueStacks Hypervisor;C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [2013-9-19 70984]

R2 NIHardwareService;NIHardwareService;C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [2011-12-16 5827072]

R2 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2010-10-24 139616]

R2 TeamViewer8;TeamViewer 8;C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [2013-11-5 5087584]

R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2013-7-5 96256]

R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2013-6-20 366600]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2009-6-10 187392]

R3 rzendpt;rzendpt;C:\Windows\System32\drivers\rzendpt.sys [2013-5-16 31232]

R3 rzudd;Razer Keyboard Driver;C:\Windows\System32\drivers\rzudd.sys [2013-5-16 126464]

R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);C:\Windows\System32\drivers\tap0901t.sys [2012-12-13 31232]

S2 BstHdAndroidSvc;BlueStacks Android Service;C:\Program Files (x86)\BlueStacks\HD-Service.exe [2013-9-19 393032]

S2 BstHdLogRotatorSvc;BlueStacks Log Rotator Service;C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [2013-9-19 384840]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2012-7-8 104912]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2012-7-8 123856]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-2-28 161384]

S3 DAdderFltr;DeathAdder Mouse;C:\Windows\System32\drivers\dadder.sys [2007-8-2 12672]

S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;C:\Windows\System32\drivers\LEqdUsb.sys [2009-6-17 74256]

S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;C:\Windows\System32\drivers\LHidEqd.sys [2009-6-17 13328]

S3 LP;LP;C:\Program Files\LP.exe [2010-2-10 2375680]

S3 MADFUCONECTIV;Service for M-Audio Conectiv DFU;C:\Windows\System32\drivers\MAudioConectiv_DFU.sys [2010-3-16 46088]

S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;C:\Windows\System32\drivers\ManyCam_x64.sys [2008-3-13 27136]

S3 MAUSBCONECTIV;Service for M-Audio Conectiv;C:\Windows\System32\drivers\MAudioConectiv.sys [2010-3-16 187912]

S3 RTCore64;RTCore64;C:\Program Files (x86)\MSI Afterburner\RTCore64.sys [2013-1-23 13368]

S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]

S3 TunngleService;TunngleService;C:\Program Files (x86)\Tunngle\TnglCtrl.exe [2012-12-13 745368]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2011-5-10 51712]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-3-29 1255736]

.

=============== File Associations ===============

.

.txt: <filetype is not registered>

FileExt: .js: jsfile=C:\Windows\System32\Notepad.exe %1 [default=Edit - 'Open' doesn't exist]

.

=============== Created Last 30 ================

.

2014-01-02 00:44:32 10315576 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C3BF0815-EB74-4409-B8BD-E38A915D4F57}\mpengine.dll

2014-01-02 00:21:37 -------- d-----w- C:\TDSSKiller_Quarantine

2014-01-01 23:54:15 89304 ----a-w- C:\Windows\System32\drivers\3B0527C9.sys

2014-01-01 23:54:08 89304 ----a-w- C:\Windows\System32\drivers\528B01E2.sys

2014-01-01 07:56:49 -------- d-----w- C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-01-01 07:56:24 89304 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys

2014-01-01 04:14:04 -------- d-----w- C:\Users\user\AppData\Local\DayZ

2014-01-01 04:14:00 239960 ----a-w- C:\Windows\SysWow64\xactengine3_7.dll

2014-01-01 04:14:00 176984 ----a-w- C:\Windows\System32\xactengine3_7.dll

2014-01-01 04:13:59 1907552 ----a-w- C:\Windows\System32\d3dcsx_43.dll

2014-01-01 04:13:59 1868128 ----a-w- C:\Windows\SysWow64\d3dcsx_43.dll

2014-01-01 04:13:57 511328 ----a-w- C:\Windows\System32\d3dx10_43.dll

2014-01-01 04:13:57 470880 ----a-w- C:\Windows\SysWow64\d3dx10_43.dll

2014-01-01 04:13:56 2401112 ----a-w- C:\Windows\System32\D3DX9_43.dll

2013-12-31 04:02:32 10315576 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2013-12-06 20:19:49 965000 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{8325136F-423D-412D-B008-D2C3327A8AF2}\gapaengine.dll

.

==================== Find3M ====================

.

2013-11-19 10:21:41 267936 ------w- C:\Windows\System32\MpSigStub.exe

2013-10-11 13:35:23 108968 ----a-w- C:\Windows\System32\WindowsAccessBridge-64.dll

2013-10-11 13:35:18 973736 ----a-w- C:\Windows\System32\deployJava1.dll

2013-10-11 13:35:18 1095080 ----a-w- C:\Windows\System32\npDeployJava1.dll

2010-03-16 00:55:14 576000 ----a-w- C:\Program Files\ISSetup.dll

2010-03-16 00:48:55 473 ----a-w- C:\Program Files\layout.bin

2010-02-10 08:57:56 8704 ----a-w- C:\Program Files\SpOrder.dll

2010-02-04 02:52:14 319488 ----a-w- C:\Program Files\LowerPing.exe

2010-02-04 02:52:14 26624 ----a-w- C:\Program Files\none.exe

2010-02-04 02:52:14 20480 ----a-w- C:\Program Files\LP_Install.exe

2010-02-04 02:52:12 28672 ----a-w- C:\Program Files\Interop.PCProxyLib.dll

2009-11-26 10:31:06 2375680 ----a-w- C:\Program Files\LP.exe

2009-11-26 10:28:00 471040 ----a-w- C:\Program Files\RegisterLSP.exe

2009-06-03 16:07:16 454656 ----a-w- C:\Program Files\putty.exe

.

============= FINISH: 19:45:42.89 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 12/18/2009 3:03:20 PM

System Uptime: 1/1/2014 7:23:03 PM (0 hours ago)

.

Motherboard: Gigabyte Technology Co., Ltd. | | P55-UD3L

Processor: Intel® Core i5 CPU 750 @ 2.67GHz | Socket 1156 | 2661/133mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 466 GiB total, 32.151 GiB free.

D: is CDROM ()

E: is CDROM (CDFS)

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP1139: 12/31/2013 11:12:21 PM - Installed DirectX

.

==== Installed Programs ======================

.

Update for Microsoft Office 2007 (KB2508958)

7-Zip 9.20 (x64 edition)

Adobe Acrobat 9 Pro - English, Français, Deutsch

Adobe Acrobat 9.2.0 - CPSID_50026

Adobe AIR

Adobe Creative Suite 4 Master Collection

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Media Player

Adobe Shockwave Player 12.0

AMD Accelerated Video Transcoding

AMD Catalyst Control Center

AMD Catalyst Install Manager

AMD Drag and Drop Transcoding

AMD Media Foundation Decoders

AMD Wireless Display v3.0

ASIO4ALL

Battle.net

BlueStacks App Player

BlueStacks Notification Center

BovadaPoker

Broadcom Driver Installation Program

Catalyst Control Center - Branding

Catalyst Control Center Graphics Previews Common

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

ccc-utility64

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

CCleaner

D3DX10

DayZ

Diablo III

DivX Setup

Dota 2

Dungeon Defenders

EPSON NX410 Series Printer Uninstall

FINAL FANTASY XIV - A Realm Reborn

Glary Utilities 3.9.1

Google Chrome

Google Update Helper

Hearthstone

Holdem Indicator 2.4.1

Java 7 Update 40 (64-bit)

Java Auto Updater

Java 6 Update 26

League of Legends

M-Audio Conectiv Driver 6.0.3 (x64)

Malwarebytes Anti-Malware version 1.75.0.1300

Microsoft .NET Framework 4.5

Microsoft Application Error Reporting

Microsoft Mouse and Keyboard Center

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office File Validation Add-In

Microsoft Office Groove MUI (English) 2007

Microsoft Office Groove Setup Metadata MUI (English) 2007

Microsoft Office InfoPath MUI (English) 2007

Microsoft Office Office 64-bit Components 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared 64-bit MUI (English) 2007

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Security Client

Microsoft Security Essentials

Microsoft Silverlight

Microsoft SkyDrive

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2005 Redistributable (x64)

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727

Microsoft XNA Framework Redistributable 3.1

Movie Maker

MS Access 97 SP2

MSI Afterburner 2.3.1

MSVCRT

MSVCRT110

MSVCRT110_amd64

Music Manager

MyDefrag v4.3.1

Native Instruments Controller Editor

Native Instruments Service Center

Native Instruments Traktor 2

NVIDIA Install Application

Open Broadcaster Software

Origin

Path of Exile

Photo Common

Photo Gallery

RaidCall

Razer Synapse 2.0

Realtek High Definition Audio Driver

Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596825) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597973) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687309) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2760411) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2760588) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2760823) 32-Bit Edition

Security Update for Microsoft Office Excel 2007 (KB2760583) 32-Bit Edition

Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition

Security Update for Microsoft Office Outlook 2007 (KB2825999) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition

Security Update for Microsoft Office Publisher 2007 (KB2597971) 32-Bit Edition

Security Update for Microsoft Office Word 2007 (KB2767773) 32-Bit Edition

SimCity™

Skype Click to Call

Skype™ 6.3

SMPlayer 0.8.5 (x64)

StarCraft II

Steam

Suite Shared Configuration CS4

swMSM

System Requirements Lab for Intel

TeamSpeak 3 Client

TeamViewer 8

Tixati

Torq 2.0

Trillian

Tunngle beta

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition

Update for Microsoft Office Access 2007 Help (KB963663)

Update for Microsoft Office Excel 2007 Help (KB963678)

Update for Microsoft Office Infopath 2007 Help (KB963662)

Update for Microsoft Office OneNote 2007 Help (KB963670)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition

Update for Microsoft Office Outlook 2007 Help (KB963677)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2825641) 32-Bit Edition

Update for Microsoft Office Powerpoint 2007 Help (KB963669)

Update for Microsoft Office Publisher 2007 Help (KB963667)

Update for Microsoft Office Script Editor Help (KB963671)

Update for Microsoft Office Word 2007 Help (KB963665)

Ventrilo Client for Windows x64

VirtualDJ Home FREE

VLC media player 2.1.0-pre1-20130528-0403

VLC Setup Helper

Warcraft III

Windows Live Communications Platform

Windows Live Essentials

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Photo Common

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

World of Warcraft

.

==== Event Viewer Messages From Past Week ========

.

12/31/2013 10:45:40 PM, Error: volsnap [35] - The shadow copies of volume C: were aborted because the shadow copy storage failed to grow.

1/1/2014 7:31:31 PM, Error: Service Control Manager [7034] - The BlueStacks Log Rotator Service service terminated unexpectedly. It has done this 1 time(s).

1/1/2014 7:25:27 PM, Error: Service Control Manager [7023] - The Peer Name Resolution Protocol service terminated with the following error: %%-2140993535

1/1/2014 7:25:27 PM, Error: Service Control Manager [7001] - The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error: %%-2140993535

1/1/2014 7:25:27 PM, Error: Microsoft-Windows-PNRPSvc [102] - The Peer Name Resolution Protocol cloud did not start because the creation of the default identity failed with error code: 0x80630801.

1/1/2014 7:23:31 PM, Error: Service Control Manager [7023] - The BlueStacks Android Service service terminated with the following error: An exception occurred in the service when handling the control request.

1/1/2014 7:23:28 PM, Error: Service Control Manager [7023] - The Power service terminated with the following error: The WMI request could not be completed and should be retried.

1/1/2014 12:55:57 AM, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.

1/1/2014 12:50:51 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Reboot the machine) after the unexpected termination of the Plug and Play service, but this action failed with the following error: A system shutdown has already been scheduled.

1/1/2014 12:50:51 AM, Error: Service Control Manager [7031] - The Plug and Play service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.

1/1/2014 12:50:51 AM, Error: Service Control Manager [7031] - The DCOM Server Process Launcher service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.

1/1/2014 12:50:25 AM, Error: Service Control Manager [7034] - The NIHardwareService service terminated unexpectedly. It has done this 1 time(s).

1/1/2014 12:39:30 AM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.

1/1/2014 12:06:51 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x0000003b (0x00000000c0000005, 0xfffff96000176483, 0xfffff88006671070, 0x0000000000000000). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 010114-30248-01.

.

==== End Of File ===========================

Sorbooze · January 2, 2014

ComboFix 14-01-01.01 - user 01/01/2014 22:48:20.1.4 - x64

Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.8183.4139 [GMT -5:00]

Running from: c:\users\user\Downloads\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}

SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\LHT58AC.tmp

c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\a1ode5zc.default\searchplugins\bing-zugo.xml

c:\windows\SysWow64\frapsvid.dll

.

((((((((((((((((((((((((( Files Created from 2013-12-02 to 2014-01-02 )))))))))))))))))))))))))))))))

.

2014-01-02 03:54 . 2014-01-02 03:54 -------- d-----w- c:\users\Default\AppData\Local\temp

2014-01-02 00:44 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C3BF0815-EB74-4409-B8BD-E38A915D4F57}\mpengine.dll

2014-01-02 00:21 . 2014-01-02 00:21 -------- d-----w- C:\TDSSKiller_Quarantine

2014-01-01 23:54 . 2014-01-01 23:54 89304 ----a-w- c:\windows\system32\drivers\3B0527C9.sys

2014-01-01 23:54 . 2014-01-01 23:54 89304 ----a-w- c:\windows\system32\drivers\528B01E2.sys

2014-01-01 07:56 . 2014-01-02 00:18 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)

2014-01-01 07:56 . 2014-01-01 23:53 89304 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys

2014-01-01 04:14 . 2014-01-01 04:16 -------- d-----w- c:\users\user\AppData\Local\DayZ

2014-01-01 04:14 . 2010-06-02 09:55 239960 ----a-w- c:\windows\SysWow64\xactengine3_7.dll

2014-01-01 04:14 . 2010-06-02 09:55 176984 ----a-w- c:\windows\system32\xactengine3_7.dll

2014-01-01 04:13 . 2010-05-26 16:41 1907552 ----a-w- c:\windows\system32\d3dcsx_43.dll

2014-01-01 04:13 . 2010-05-26 16:41 1868128 ----a-w- c:\windows\SysWow64\d3dcsx_43.dll

2014-01-01 04:13 . 2010-05-26 16:41 511328 ----a-w- c:\windows\system32\d3dx10_43.dll

2014-01-01 04:13 . 2010-05-26 16:41 470880 ----a-w- c:\windows\SysWow64\d3dx10_43.dll

2014-01-01 04:13 . 2010-05-26 16:41 2401112 ----a-w- c:\windows\system32\D3DX9_43.dll

2013-12-31 04:02 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2013-12-06 20:19 . 2013-10-18 05:39 965000 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8325136F-423D-412D-B008-D2C3327A8AF2}\gapaengine.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-11-19 10:21 . 2009-12-25 01:44 267936 ------w- c:\windows\system32\MpSigStub.exe

2013-10-18 05:39 . 2011-03-25 12:54 965000 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

2013-10-11 13:35 . 2013-10-11 13:35 108968 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll

2013-10-11 13:35 . 2013-10-11 13:35 312744 ----a-w- c:\windows\system32\javaws.exe

2013-10-11 13:35 . 2013-10-11 13:35 189352 ----a-w- c:\windows\system32\javaw.exe

2013-10-11 13:35 . 2013-10-11 13:35 189352 ----a-w- c:\windows\system32\java.exe

2013-10-11 13:35 . 2013-10-11 13:35 973736 ----a-w- c:\windows\system32\deployJava1.dll

2013-10-11 13:35 . 2013-10-11 13:35 1095080 ----a-w- c:\windows\system32\npDeployJava1.dll

2010-03-16 00:55 . 2010-03-16 00:19 576000 ----a-w- c:\program files\ISSetup.dll

2010-03-16 00:48 . 2010-03-16 00:19 473 ----a-w- c:\program files\layout.bin

2010-02-10 08:57 . 2010-02-10 08:57 8704 ----a-w- c:\program files\SpOrder.dll

2010-02-04 02:52 . 2010-02-10 08:57 319488 ----a-w- c:\program files\LowerPing.exe

2010-02-04 02:52 . 2010-02-10 08:57 26624 ----a-w- c:\program files\none.exe

2010-02-04 02:52 . 2010-02-10 08:57 20480 ----a-w- c:\program files\LP_Install.exe

2010-02-04 02:52 . 2010-02-10 08:57 28672 ----a-w- c:\program files\Interop.PCProxyLib.dll

2009-11-26 10:31 . 2010-02-10 08:57 2375680 ----a-w- c:\program files\LP.exe

2009-11-26 10:28 . 2010-02-10 08:57 471040 ----a-w- c:\program files\RegisterLSP.exe

2009-06-03 16:07 . 2010-02-10 08:57 454656 ----a-w- c:\program files\putty.exe

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[7] 2009-07-14 . 7266972E86890E2B30C0C322E906B027 . 509440 . . [6.1.7600.16385] .. c:\windows\winsxs\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7600.16385_none_c5bfcda3579104e3\rpcss.dll

[-] 2009-07-14 . D99D113118E69AB3ECFFFFECCE036282 . 509952 . . [6.1.7600.16385] .. c:\windows\system32\rpcss.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]

@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"

[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]

2012-11-07 00:03 220632 ----a-w- c:\users\user\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]

@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"

[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]

2012-11-07 00:03 220632 ----a-w- c:\users\user\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]

@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"

[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]

2012-11-07 00:03 220632 ----a-w- c:\users\user\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Razer Synapse"="c:\program files (x86)\Razer\Synapse\RzSynapse.exe" [2013-05-21 609640]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2013-09-05 766208]

"BlueStacks Agent"="c:\program files (x86)\BlueStacks\HD-Agent.exe" [2013-09-19 606024]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk * \0BootDefrag.exe

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R0 BootDefragDriver;BootDefragDriver;c:\windows\System32\drivers\BootDefragDriver.sys;c:\windows\SYSNATIVE\drivers\BootDefragDriver.sys [x]

R2 BstHdAndroidSvc;BlueStacks Android Service;c:\program files (x86)\BlueStacks\HD-Service.exe BstHdAndroidSvc Android;c:\program files (x86)\BlueStacks\HD-Service.exe BstHdAndroidSvc Android [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 DAdderFltr;DeathAdder Mouse;c:\windows\system32\drivers\dadder.sys;c:\windows\SYSNATIVE\drivers\dadder.sys [x]

R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys;c:\windows\SYSNATIVE\DRIVERS\LEqdUsb.Sys [x]

R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys;c:\windows\SYSNATIVE\DRIVERS\LHidEqd.Sys [x]

R3 LP;LP;c:\program files\LP.exe;c:\program files\LP.exe [x]

R3 MADFUCONECTIV;Service for M-Audio Conectiv DFU;c:\windows\system32\DRIVERS\MAudioConectiv_DFU.sys;c:\windows\SYSNATIVE\DRIVERS\MAudioConectiv_DFU.sys [x]

R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam_x64.sys;c:\windows\SYSNATIVE\DRIVERS\ManyCam_x64.sys [x]

R3 MAUSBCONECTIV;Service for M-Audio Conectiv;c:\windows\system32\DRIVERS\MAudioConectiv.sys;c:\windows\SYSNATIVE\DRIVERS\MAudioConectiv.sys [x]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]

R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]

R3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]

R3 RTCore64;RTCore64;c:\program files (x86)\MSI Afterburner\RTCore64.sys;c:\program files (x86)\MSI Afterburner\RTCore64.sys [x]

R3 TunngleService;TunngleService;c:\program files (x86)\Tunngle\TnglCtrl.exe;c:\program files (x86)\Tunngle\TnglCtrl.exe [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]

S2 BstHdDrv;BlueStacks Hypervisor;c:\program files (x86)\BlueStacks\HD-Hypervisor-amd64.sys;c:\program files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [x]

S2 BstHdLogRotatorSvc;BlueStacks Log Rotator Service;c:\program files (x86)\BlueStacks\HD-LogRotatorService.exe;c:\program files (x86)\BlueStacks\HD-LogRotatorService.exe [x]

S2 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [x]

S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

S3 rzendpt;rzendpt;c:\windows\system32\DRIVERS\rzendpt.sys;c:\windows\SYSNATIVE\DRIVERS\rzendpt.sys [x]

S3 rzudd;Razer Keyboard Driver;c:\windows\system32\DRIVERS\rzudd.sys;c:\windows\SYSNATIVE\DRIVERS\rzudd.sys [x]

S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys;c:\windows\SYSNATIVE\DRIVERS\tap0901t.sys [x]

.

Contents of the 'Scheduled Tasks' folder

.

2014-01-02 c:\windows\Tasks\GlaryInitialize 3.job

- c:\program files (x86)\Glary Utilities 3\Initialize.exe [2013-09-02 09:06]

.

2013-12-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-13 01:06]

.

2013-12-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-13 01:06]

.

2013-09-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1316219031-892445748-1288858348-1000Core.job

- c:\users\user\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-08 08:19]

.

2013-09-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1316219031-892445748-1288858348-1000UA.job

- c:\users\user\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-08 08:19]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]

@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"

[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]

2012-11-07 00:03 244696 ----a-w- c:\users\user\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]

@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"

[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]

2012-11-07 00:03 244696 ----a-w- c:\users\user\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]

@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"

[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]

2012-11-07 00:03 244696 ----a-w- c:\users\user\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-06-21 1356240]

"IntelliType Pro"="c:\program files\Microsoft Mouse and Keyboard Center\itype.exe" [2012-10-12 1464984]

"IntelliPoint"="c:\program files\Microsoft Mouse and Keyboard Center\ipoint.exe" [2012-10-12 2075288]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-08-30 13192848]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = 127.0.0.1:9421;<local>

IE: Append Link Target to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Append to Existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert Link Target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

TCP: DhcpNameServer = 192.168.1.1

.

------- File Associations -------

.

.txt=

.

- - - - ORPHANS REMOVED - - - -

.

URLSearchHooks-{cd90bf73-20f6-44ef-993d-bb920303bd2e} - (no file)

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

ShellIconOverlayIdentifiers-{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} - (no file)

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\BlueStacks]

"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2014-01-01 22:55:50

ComboFix-quarantined-files.txt 2014-01-02 03:55

.

Pre-Run: 33,346,859,008 bytes free

Post-Run: 35,693,551,616 bytes free

.

- - End Of File - - 7FB69AFFAA181999345255C0CFE0A280

A36C5E4F47E84449FF07ED3517B43A31

Sorbooze · January 2, 2014

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 10:59:43 PM, on 1/1/2014

Platform: Windows 7 (WinNT 6.00.3504)

MSIE: Internet Explorer v8.00 (8.00.7600.17267)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe

C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe

C:\Program Files (x86)\BlueStacks\HD-Agent.exe

C:\Users\user\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1:9421;<local>

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O4 - HKLM\..\Run: [Razer Synapse] "C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe"

O4 - HKLM\..\Run: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [blueStacks Agent] C:\Program Files (x86)\BlueStacks\HD-Agent.exe

O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)

O9 - Extra button: Absolute Poker - {1FBA04EE-3024-11d2-8F1F-0000F87ABD16} - C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (file missing) (HKCU)

O9 - Extra 'Tools' menuitem: Absolute Poker - {1FBA04EE-3024-11d2-8F1F-0000F87ABD16} - C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (file missing) (HKCU)

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O15 - Trusted Zone: *.clonewarsadventures.com

O15 - Trusted Zone: *.freerealms.com

O15 - Trusted Zone: *.soe.com

O15 - Trusted Zone: *.sony.com

O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} (UnoCtrl Class) - http://zone.msn.com/bingame/zpagames/GAME_UNO1.cab60096.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZPAFramework.cab102118.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)

O23 - Service: BlueStacks Android Service (BstHdAndroidSvc) - BlueStack Systems, Inc. - C:\Program Files (x86)\BlueStacks\HD-Service.exe

O23 - Service: BlueStacks Log Rotator Service (BstHdLogRotatorSvc) - BlueStack Systems, Inc. - C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: EPSON V5 Service4(01) (EPSON_EB_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE

O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: LP - Unknown owner - C:\Program Files\LP.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: NIHardwareService - Native Instruments GmbH - C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe

O23 - Service: TeamViewer 8 (TeamViewer8) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe

O23 - Service: TunngleService - Tunngle.net GmbH - C:\Program Files (x86)\Tunngle\TnglCtrl.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 11933 bytes

Sorbooze · January 2, 2014

RogueKiller V8.8.0 _x64_ [Dec 27 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.adlice.com/forum/

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7600 ) 64 bits version

Started in : Normal mode

User : user [Admin rights]

Mode : Scan -- Date : 01/01/2014 23:07:55

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

[Tst.HjT] HiJackThis.exe -- C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe[-] -> KILLED [TermProc]

¤¤¤ Registry Entries : 9 ¤¤¤

[HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ POL][PUM] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ POL][PUM] HKLM\[...]\System : EnableLUA (0) -> FOUND

[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : EnableLUA (0) -> FOUND

[HJ SMENU][PUM] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : Tst.HjT ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD5000AAKS-00V1A0 ATA Device +++++

--- User ---

[MBR] b87f2e4a34b198b2e8a50d79781f717a

[bSP] a250c9c5538b642ea31ec4ee00a04b8b : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 476838 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[0]_S_01012014_230755.txt >>

Sorbooze · January 2, 2014

In addition it appears the adds start whenever I load media in my browser... youtube etc.

Sorbooze · January 2, 2014

In addition it appears the adds start whenever I load media in my browser... youtube etc.

or just load chrome

# AdwCleaner v3.016 - Report created 01/01/2014 at 23:25:02

# Updated 23/12/2013 by Xplode

# Operating System : Windows 7 Professional (64 bits)

# Username : user - USER-PC

# Running from : C:\Users\user\Downloads\AdwCleaner.exe

# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\AVG Security Toolbar

Folder Deleted : C:\ProgramData\NCH Software

Folder Deleted : C:\Program Files (x86)\Conduit

Folder Deleted : C:\users\user\AppData\Local\Conduit

Folder Deleted : C:\users\user\AppData\LocalLow\boost_interprocess

Folder Deleted : C:\users\user\AppData\LocalLow\Conduit

Folder Deleted : C:\users\user\AppData\Roaming\NCH Software

Folder Deleted : C:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\a1ode5zc.default\ConduitCommon

Folder Deleted : C:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\a1ode5zc.default\FoxTab

Folder Deleted : C:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\a1ode5zc.default\CT2653012

Folder Deleted : C:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\a1ode5zc.default\Extensions\{cd90bf73-20f6-44ef-993d-bb920303bd2e}

File Deleted : C:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\a1ode5zc.default\searchplugins\Askcom.xml

File Deleted : C:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\a1ode5zc.default\searchplugins\Conduit.xml

File Deleted : C:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\a1ode5zc.default\user.js

File Deleted : C:\Windows\System32\Tasks\NCH Software

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_veoh_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_veoh_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9DC8FA51-B596-4F77-802C-5B295919C205}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3E28F712-0D6C-4EE3-AC8C-8F060F5D7C33}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6EEBC7FF-67DA-4B90-9251-C2C5696E4B48}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{74137531-80F7-406F-9543-7D11385FA8C8}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{832599B2-55BF-4437-8F3E-030CF5AEB262}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9B7B034B-944A-4261-B487-862F642F7615}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B1A429DB-FB06-4645-B7C0-0CC405EAD3CD}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DD67706E-819E-4EBD-BF8D-6D6147CC7A49}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\NCH Software

Key Deleted : HKCU\Software\YahooPartnerToolbar

Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes

Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar

Key Deleted : HKLM\Software\AVG Secure Search

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\Software\NCH Software

Key Deleted : [x64] HKLM\SOFTWARE\DivX\Install\Setup\WizardLayout\ConduitToolbar

Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - 127.0.0.1:9421;<local>

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.7600.17267

-\\ Mozilla Firefox v

[ File : C:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\a1ode5zc.default\prefs.js ]

Line Deleted : user_pref("CT2653012..clientLogIsEnabled", false);

Line Deleted : user_pref("CT2653012.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);

Line Deleted : user_pref("CT2653012.BrowserCompStateIsOpen_129780839977253423", true);

Line Deleted : user_pref("CT2653012.BrowserCompStateIsOpen_129780841964128425", true);

Line Deleted : user_pref("CT2653012.BrowserCompStateIsOpen_129780842340847176", true);

Line Deleted : user_pref("CT2653012.CTID", "CT2653012");

Line Deleted : user_pref("CT2653012.CurrentServerDate", "8-7-2012");

Line Deleted : user_pref("CT2653012.DSInstall", true);

Line Deleted : user_pref("CT2653012.DialogsAlignMode", "LTR");

Line Deleted : user_pref("CT2653012.DialogsGetterLastCheckTime", "Sat Jul 07 2012 19:58:29 GMT-0400 (Eastern Daylight Time)");

Line Deleted : user_pref("CT2653012.DownloadReferralCookieData", "");

Line Deleted : user_pref("CT2653012.FirstServerDate", "8-7-2012");

Line Deleted : user_pref("CT2653012.FirstTime", true);

Line Deleted : user_pref("CT2653012.FirstTimeFF3", true);

Line Deleted : user_pref("CT2653012.FirstTimeHiddenVer", true);

Line Deleted : user_pref("CT2653012.FixPageNotFoundErrors", false);

Line Deleted : user_pref("CT2653012.GroupingServerCheckInterval", 1440);

Line Deleted : user_pref("CT2653012.HPInstall", true);

Line Deleted : user_pref("CT2653012.HasUserGlobalKeys", true);

Line Deleted : user_pref("CT2653012.HomePageProtectorEnabled", true);

Line Deleted : user_pref("CT2653012.Initialize", true);

Line Deleted : user_pref("CT2653012.InitializeCommonPrefs", true);

Line Deleted : user_pref("CT2653012.InstallationAndCookieDataSentCount", 2);

Line Deleted : user_pref("CT2653012.InstallationId", "ct2653012_veoh.exe");

Line Deleted : user_pref("CT2653012.InstallationType", "ConduitNSISIntegration");

Line Deleted : user_pref("CT2653012.InstalledDate", "Sat Jul 07 2012 19:58:21 GMT-0400 (Eastern Daylight Time)");

Line Deleted : user_pref("CT2653012.InvalidateCache", false);

Line Deleted : user_pref("CT2653012.IsAlertDBUpdated", true);

Line Deleted : user_pref("CT2653012.IsGrouping", false);

Line Deleted : user_pref("CT2653012.IsInitSetupIni", true);

Line Deleted : user_pref("CT2653012.IsMulticommunity", false);

Line Deleted : user_pref("CT2653012.IsOpenThankYouPage", false);

Line Deleted : user_pref("CT2653012.IsOpenUninstallPage", true);

Line Deleted : user_pref("CT2653012.IsProtectorsInit", true);

Line Deleted : user_pref("CT2653012.LanguagePackLastCheckTime", "Sat Jul 07 2012 19:58:30 GMT-0400 (Eastern Daylight Time)");

Line Deleted : user_pref("CT2653012.LanguagePackReloadIntervalMM", 1440);

Line Deleted : user_pref("CT2653012.LastLogin_3.13.0.200", "Sat Jul 07 2012 20:33:18 GMT-0400 (Eastern Daylight Time)");

Line Deleted : user_pref("CT2653012.LatestVersion", "3.13.0.6");

Line Deleted : user_pref("CT2653012.Locale", "en");

Line Deleted : user_pref("CT2653012.MCDetectTooltipHeight", "83");

Line Deleted : user_pref("CT2653012.MCDetectTooltipWidth", "295");

Line Deleted : user_pref("CT2653012.MyStuffEnabledAtInstallation", true);

Line Deleted : user_pref("CT2653012.OriginalFirstVersion", "3.13.0.200");

Line Deleted : user_pref("CT2653012.RadioIsPodcast", false);

Line Deleted : user_pref("CT2653012.RadioLastCheckTime", "Sat Jul 07 2012 19:58:24 GMT-0400 (Eastern Daylight Time)");

Line Deleted : user_pref("CT2653012.RadioLastUpdateIPServer", "3");

Line Deleted : user_pref("CT2653012.RadioLastUpdateServer", "129780946393030000");

Line Deleted : user_pref("CT2653012.RadioMediaID", "22060368");

Line Deleted : user_pref("CT2653012.RadioMediaType", "Media Player");

Line Deleted : user_pref("CT2653012.RadioMenuSelectedID", "EBRadioMenu_CT265301222060368");

Line Deleted : user_pref("CT2653012.RadioShrinkedFromSetup", false);

Line Deleted : user_pref("CT2653012.RadioStationName", "California%20Rock%20-%20Rock");

Line Deleted : user_pref("CT2653012.SearchCaption", "Veoh Web Player Customized Web Search");

Line Deleted : user_pref("CT2653012.SearchEngineBeforeUnload", "Veoh Web Player Customized Web Search");

Line Deleted : user_pref("CT2653012.SearchFromAddressBarIsInit", true);

Line Deleted : user_pref("CT2653012.SearchInNewTabEnabled", true);

Line Deleted : user_pref("CT2653012.SearchInNewTabIntervalMM", 1440);

Line Deleted : user_pref("CT2653012.SearchInNewTabLastCheckTime", "Sat Jul 07 2012 19:58:24 GMT-0400 (Eastern Daylight Time)");

Line Deleted : user_pref("CT2653012.SearchProtectorEnabled", true);

Line Deleted : user_pref("CT2653012.SearchProtectorToolbarDisabled", false);

Line Deleted : user_pref("CT2653012.SendProtectorDataViaLogin", true);

Line Deleted : user_pref("CT2653012.ServiceMapLastCheckTime", "Sat Jul 07 2012 19:58:21 GMT-0400 (Eastern Daylight Time)");

Line Deleted : user_pref("CT2653012.SettingsLastCheckTime", "Sat Jul 07 2012 19:58:21 GMT-0400 (Eastern Daylight Time)");

Line Deleted : user_pref("CT2653012.SettingsLastUpdate", "1340630811");

Line Deleted : user_pref("CT2653012.ThirdPartyComponentsInterval", 504);

Line Deleted : user_pref("CT2653012.ThirdPartyComponentsLastCheck", "Sat Jul 07 2012 19:58:21 GMT-0400 (Eastern Daylight Time)");

Line Deleted : user_pref("CT2653012.ThirdPartyComponentsLastUpdate", "1331805997");

Line Deleted : user_pref("CT2653012.ToolbarShrinkedFromSetup", false);

Line Deleted : user_pref("CT2653012.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,client.conduit-storage.com,OurToolbar.com,CommunityToolbars.com,ForumToolbar.com,MyBlogToolbar.com,MyCity[...]

Line Deleted : user_pref("CT2653012.UserID", "UN11444423878288392");

Line Deleted : user_pref("CT2653012.alertChannelId", "1045667");

Line Deleted : user_pref("CT2653012.autoDisableScopes", -1);

Line Deleted : user_pref("CT2653012.backendstorage.2653012a129780834468347070000000paramsgk0", "7B2275706461746552657154696D65223A313334313730353531333236322C227570646174655265737054696D65223A31333431373035353133343[...]

Line Deleted : user_pref("CT2653012.backendstorage.cbcountry_001", "5553");

Line Deleted : user_pref("CT2653012.backendstorage.cbfirsttime", "536174204A756C20303720323031322031393A35383A333420474D542D3034303020284561737465726E204461796C696768742054696D6529");

Line Deleted : user_pref("CT2653012.backendstorage.shoppingapp.gk.exipres", "546875204A756C20313220323031322031393A35383A333320474D542D3034303020284561737465726E204461796C696768742054696D6529");

Line Deleted : user_pref("CT2653012.backendstorage.shoppingapp.gk.geolocation", "756E6974656420737461746573");

Line Deleted : user_pref("CT2653012.backendstorage.twitter_v1.8.0_twitter_app_open_t_f", "66616C7365");

Line Deleted : user_pref("CT2653012.backendstorage.url_history0001", "68747470733A2F2F7777772E676F6F676C652E636F6D3A3A3A636C69636B68616E646C65723A3A3A313334313730373535363031382C2C2C68747470733A2F2F7777772E676F6F676[...]

Line Deleted : user_pref("CT2653012.globalFirstTimeInfoLastCheckTime", "Sat Jul 07 2012 19:58:30 GMT-0400 (Eastern Daylight Time)");

Line Deleted : user_pref("CT2653012.homepageProtectorEnableByLogin", true);

Line Deleted : user_pref("CT2653012.initDone", true);

Line Deleted : user_pref("CT2653012.isAppTrackingManagerOn", true);

Line Deleted : user_pref("CT2653012.isFirstRadioInstallation", false);

Line Deleted : user_pref("CT2653012.myStuffEnabled", true);

Line Deleted : user_pref("CT2653012.myStuffPublihserMinWidth", 400);

Line Deleted : user_pref("CT2653012.myStuffServiceIntervalMM", 1440);

Line Deleted : user_pref("CT2653012.navigateToUrlOnSearch", false);

Line Deleted : user_pref("CT2653012.revertSettingsEnabled", false);

Line Deleted : user_pref("CT2653012.searchProtectorDialogDelayInSec", 10);

Line Deleted : user_pref("CT2653012.searchProtectorEnableByLogin", true);

Line Deleted : user_pref("CT2653012.testingCtid", "");

Line Deleted : user_pref("CT2653012.toolbarAppMetaDataLastCheckTime", "Sat Jul 07 2012 19:58:29 GMT-0400 (Eastern Daylight Time)");

Line Deleted : user_pref("CT2653012.toolbarContextMenuLastCheckTime", "Sat Jul 07 2012 19:58:30 GMT-0400 (Eastern Daylight Time)");

Line Deleted : user_pref("CT2653012.usagesFlag", 2);

Line Deleted : user_pref("CommunityToolbar.ConduitSearchList", "Veoh Web Player Customized Web Search");

Line Deleted : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.13.0.200");

Line Deleted : user_pref("CommunityToolbar.ToolbarsList", "CT2653012");

Line Deleted : user_pref("CommunityToolbar.ToolbarsList2", "CT2653012");

Line Deleted : user_pref("CommunityToolbar.ToolbarsList4", "CT2653012");

Line Deleted : user_pref("CommunityToolbar.globalUserId", "1f6754fd-f14f-4c16-8f41-5875bfd6e7bf");

Line Deleted : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);

Line Deleted : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);

Line Deleted : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2653012");

Line Deleted : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Sat Jul 07 2012 19:58:32 GMT-0400 (Eastern Daylight Time)");

Line Deleted : user_pref("CommunityToolbar.notifications.alertInfoInterval", 60);

Line Deleted : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Sat Jul 07 2012 19:58:40 GMT-0400 (Eastern Daylight Time)");

Line Deleted : user_pref("CommunityToolbar.notifications.locale", "en");

Line Deleted : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);

Line Deleted : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Sat Jul 07 2012 19:58:30 GMT-0400 (Eastern Daylight Time)");

Line Deleted : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");

Line Deleted : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);

Line Deleted : user_pref("CommunityToolbar.notifications.showTrayIcon", false);

Line Deleted : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);

Line Deleted : user_pref("CommunityToolbar.notifications.userId", "9ad184b8-f776-4656-ade5-9ba4a4eb7981");

Line Deleted : user_pref("CommunityToolbar.originalSearchEngine", "Ask.com");

Line Deleted : user_pref("aol_toolbar.surf.date", "45");

Line Deleted : user_pref("aol_toolbar.surf.lastDate", "30");

Line Deleted : user_pref("aol_toolbar.surf.lastMonth", "11");

Line Deleted : user_pref("aol_toolbar.surf.lastYear", "2009");

Line Deleted : user_pref("aol_toolbar.surf.month", "143");

Line Deleted : user_pref("aol_toolbar.surf.prevMonth", "0");

Line Deleted : user_pref("aol_toolbar.surf.total", "145");

Line Deleted : user_pref("aol_toolbar.surf.week", "143");

Line Deleted : user_pref("aol_toolbar.surf.year", "143");

Line Deleted : user_pref("browser.search.defaultengine", "Ask.com");

Line Deleted : user_pref("browser.search.defaultenginename", "Veoh Web Player Customized Web Search");

Line Deleted : user_pref("browser.search.defaultthis.engineName", "Veoh Web Player Customized Web Search");

Line Deleted : user_pref("browser.search.order.1", "Ask.com");

Line Deleted : user_pref("browser.search.selectedEngine", "Veoh Web Player Customized Web Search");

Line Deleted : user_pref("extensions.toolbar@ask.com.install-event-fired", true);

Line Deleted : user_pref("integratedgmail-expanded-inbox", true);

Line Deleted : user_pref("tfp.CT2653012", true);

-\\ Google Chrome v

[ File : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [22437 octets] - [01/01/2014 23:23:11]

AdwCleaner[s0].txt - [22587 octets] - [01/01/2014 23:25:02]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [22648 octets] ##########

Sorbooze · January 2, 2014

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.0.9 (01.01.2014:1)

OS: Windows 7 Professional x64

Ran by user on Wed 01/01/2014 at 23:34:15.95

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{f3fafa6b-118d-4ade-bd37-0bb95bc1e552}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0B4A10D1-FBD6-451d-BFDA-F03252B05984}

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\Users\user\appdata\local\cre"

Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Wed 01/01/2014 at 23:40:00.54

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

AdvancedSetup · January 2, 2014

Well now that you've run all sorts of scans without being asked (not exactly in the correct order either) how is the computer running now?

Do you still need help with this?

Sorbooze · January 2, 2014

><! Sorry. The problem still persists when I reboot the computer. Adds playing from the windows host process

Sorbooze · January 2, 2014

Sometimes it plays from "Name not available". I will stop acting on my own and follow directions!!

AdvancedSetup · January 2, 2014

Please uninstall ALL versions of Java from your Control Panel, Add/Remove and then reboot the computer.

Then run the following

Please download JavaRa-1.16 and save it to your computer.

Double click to open the zip file and then select all and choose Copy.
Create a new folder on your Desktop named RemoveJava and paste the files into this new folder.
Quit all browsers and other running applications.
Right-click on JavaRa.exe in RemoveJava folder and choose Run as administrator to start the program.
From the drop-down menu, choose English and click on Select.
JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
A logfile will pop up. Please save it to a convenient location and post it in your next reply.

Then run the following

Please Run TFC by OldTimer to clear temporary files:

Download TFC from here and save it to your desktop.
http://oldtimer.geekstogo.com/TFC.exe
Close any open programs and Internet browsers.
Double click TFC.exe to run it on XP (for Vista and Windows 7 right click and choose "Run as administrator") and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.
Please be patient as clearing out temp files may take a while.
Once it completes you may be prompted to restart your computer, please do so.
Once it's finished you may delete TFC.exe from your desktop or save it for later use for the cleaning of temporary files.

Reboot the computer again and delete your FRST logs and run it again and post back both new logs.

Sorbooze · January 2, 2014

JavaRa 1.16 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Thu Jan 02 03:09:11 2014

------------------------------------

Finished reporting.

I'm not sure where to find the TFC log, but it deleted 3,100 of temp files.

The ads are still playing through service host.

AdvancedSetup · January 2, 2014

Reboot the computer again and delete your FRST logs and run it again and post back both new logs

Sorbooze · January 2, 2014

FRST = First JavaRa logs? I rebooted but forgot to delete and ran it again so I can reboot again.

Sorbooze · January 2, 2014

Sorry not really familiar with the acronym FRST.

Sorbooze · January 2, 2014

Ah! You must be Farbar Recovery Scan Tool. Here you go. This was run after rebooting after running java removal and TFC program.

Addition.txt

FRST.txt

AdvancedSetup · January 2, 2014

Please download the attached fixlist.txt file and save it to the Desktop.

NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.

If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Sorbooze · January 2, 2014

The ads are still playing unfortunately, but here is the log.

Fixlog.txt

AdvancedSetup · January 2, 2014

Please go ahead and delete your current copy of Combofix.exe and download a new fresh copy.

Once ready to use the program you can download it directly from the link below.
Important! - Please make sure you save combofix to your desktop and do not run it from your browser
Direct download link for: ComboFix.exe
Please make sure you disable your security applications before running ComboFix.
Once Combofix has completed it will produce and open a log file. Please be patient as it can take some time to load.
Please attach that log file to your next reply.
If needed the file can be located here: C:\combofix.txt
NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.

Sorbooze · January 2, 2014

ComboFix 14-01-01.01 - user 01/02/2014 16:21:16.3.4 - x64

Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.8183.2736 [GMT -5:00]

Running from: c:\users\user\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}

SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((( Files Created from 2013-12-02 to 2014-01-02 )))))))))))))))))))))))))))))))

.

2014-01-02 21:27 . 2014-01-02 21:27 -------- d-----w- c:\users\Default\AppData\Local\temp

2014-01-02 08:16 . 2014-01-02 08:16 -------- d-----w- C:\FRST

2014-01-02 06:07 . 2014-01-02 06:07 117464 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys

2014-01-02 06:06 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{08582BD2-A38D-4AEF-9F24-8A318E171FCF}\mpengine.dll

2014-01-02 04:34 . 2014-01-02 04:34 -------- d-----w- c:\windows\ERUNT

2014-01-02 04:23 . 2014-01-02 04:25 -------- d-----w- C:\AdwCleaner

2014-01-02 03:59 . 2014-01-02 03:59 388096 ----a-r- c:\users\user\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2014-01-02 03:59 . 2014-01-02 03:59 -------- d-----w- c:\program files (x86)\Trend Micro

2014-01-02 00:44 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2014-01-02 00:21 . 2014-01-02 00:21 -------- d-----w- C:\TDSSKiller_Quarantine

2014-01-01 23:54 . 2014-01-01 23:54 89304 ----a-w- c:\windows\system32\drivers\3B0527C9.sys

2014-01-01 23:54 . 2014-01-01 23:54 89304 ----a-w- c:\windows\system32\drivers\528B01E2.sys

2014-01-01 07:56 . 2014-01-02 06:09 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)

2014-01-01 07:56 . 2014-01-02 06:06 89304 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys