mikhail23 Posted January 4, 2014 ID:773179 Share Posted January 4, 2014 Folks, my computer is infected - the speaker plays random commercials, Malwarebytes periodically prevents outgoing connections to malicious websites. Malwarebytes scanner however occasionally comes up clean and occasionally finds something. So I need help. Here is the contents of the two fiels attach.txt------------------.UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.IF REQUESTED, ZIP IT UP & ATTACH IT.DDS (Ver_2012-11-20.01).Microsoft Windows 7 Enterprise Boot Device: \Device\HarddiskVolume1Install Date: 4/6/2010 11:13:09 AMSystem Uptime: 1/3/2014 10:51:11 PM (1 hours ago).Motherboard: Dell Inc. | | 0D441TProcessor: Intel® Core i5 CPU 650 @ 3.20GHz | CPU | 3193/133mhz.==== Disk Partitions =========================.C: is FIXED (NTFS) - 466 GiB total, 332.239 GiB free.D: is CDROM (CDFS)F: is FIXED (NTFS) - 466 GiB total, 457.636 GiB free..==== Disabled Device Manager Items =============.Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}Description: Cisco Systems VPN AdapterDevice ID: ROOT\NET\0001Manufacturer: Cisco SystemsName: Cisco Systems VPN AdapterPNP Device ID: ROOT\NET\0001Service: CVirtA.Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for WindowsDevice ID: ROOT\NET\0002Manufacturer: Cisco SystemsName: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for WindowsPNP Device ID: ROOT\NET\0002Service: vpnva.Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}Description: DW1520 Wireless-N Half-Mini CardDevice ID: PCI\VEN_14E4&DEV_4353&SUBSYS_000E1028&REV_01\4&383D974A&0&00E4Manufacturer: BroadcomName: DW1520 Wireless-N Half-Mini CardPNP Device ID: PCI\VEN_14E4&DEV_4353&SUBSYS_000E1028&REV_01\4&383D974A&0&00E4Service: BCM43XX.==== System Restore Points ===================.No restore point in system..==== Installed Programs ======================. Update for Microsoft Office 2007 (KB2508958)4Media YouTube to iPod Converter7-Zip 4.65Adobe Flash Player 11 ActiveXAdobe Flash Player 11 PluginAdobe Reader X (10.0.1)Apple Mobile Device SupportAspell English Dictionary-0.50-2Blend for Visual Studio Add-in for Adobe FXG ImportBlend for Visual Studio SDK for .NET 4.5Blend for Visual Studio SDK for Silverlight 5BonjourBusiness-in-a-BoxCisco AnyConnect Secure Mobility ClientCisco AnyConnect Secure Mobility Client Cisco Systems VPN Client 5.0.06.0160Cisco WebEx MeetingsCrystal Reports Basic for Visual Studio 2008CutePDF Writer 3.0D3DX10Definition Update for Microsoft Office 2010 (KB982726) 32-Bit EditionDropboxDVDVideoSoftTB ToolbarEntity Framework Designer for Visual Studio 2012 - enuFinist EnergyFree YouTube to iPod Converter version 3.9.32.324Garmin ANT AgentGarmin Communicator PluginGarmin USB DriversGNU Aspell 0.50-3Google ChromeGoogle Update HelperGPL Ghostscript 8.63GSview 4.9Hotfix for Microsoft Visual C++ 2010 Express - ENU (KB2542054)IrfanView (remove only)Java 7 Update 45Java Auto UpdaterJava 6 Update 30Malwarebytes Anti-Malware version 1.75.0.1300MATLAB R2009bMicrosoft .NET Compact Framework 2.0 SP2Microsoft .NET Compact Framework 3.5Microsoft .NET Framework 1.1Microsoft .NET Framework 4 Multi-Targeting PackMicrosoft .NET Framework 4.5Microsoft .NET Framework 4.5 Multi-Targeting PackMicrosoft .NET Framework 4.5 SDKMicrosoft Application Error ReportingMicrosoft Device Emulator version 3.0 - ENUMicrosoft Document Explorer 2008Microsoft Expression Blend SDK for .NET 4Microsoft Expression Blend SDK for Silverlight 4Microsoft Help Viewer 1.0Microsoft Help Viewer 2.0Microsoft NuGet - Visual Studio Express 2012 for Windows DesktopMicrosoft Office 2007 Primary Interop AssembliesMicrosoft Office 2007 Service Pack 3 (SP3)Microsoft Office 2010 Service Pack 1 (SP1)Microsoft Office Access MUI (English) 2007Microsoft Office Access Setup Metadata MUI (English) 2007Microsoft Office Enterprise 2007Microsoft Office Excel MUI (English) 2007Microsoft Office File Validation Add-InMicrosoft Office Groove MUI (English) 2007Microsoft Office Groove Setup Metadata MUI (English) 2007Microsoft Office InfoPath MUI (English) 2007Microsoft Office OneNote MUI (English) 2007Microsoft Office Outlook MUI (English) 2007Microsoft Office PowerPoint MUI (English) 2007Microsoft Office Project MUI (English) 2010Microsoft Office Project Professional 2010Microsoft Office Proof (English) 2007Microsoft Office Proof (English) 2010Microsoft Office Proof (French) 2007Microsoft Office Proof (French) 2010Microsoft Office Proof (Spanish) 2007Microsoft Office Proof (Spanish) 2010Microsoft Office Proofing (English) 2007Microsoft Office Proofing (English) 2010Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)Microsoft Office Publisher MUI (English) 2007Microsoft Office Shared MUI (English) 2007Microsoft Office Shared MUI (English) 2010Microsoft Office Shared Setup Metadata MUI (English) 2007Microsoft Office Shared Setup Metadata MUI (English) 2010Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3)Microsoft Office Visual Web Developer 2007Microsoft Office Visual Web Developer MUI (English) 2007Microsoft Office Word MUI (English) 2007Microsoft Portable Library Multi-Targeting PackMicrosoft Project 2010 Service Pack 1 (SP1)Microsoft Project Professional 2010Microsoft Security ClientMicrosoft Security EssentialsMicrosoft SilverlightMicrosoft SQL Server 2005 Compact Edition [ENU]Microsoft SQL Server 2008Microsoft SQL Server 2008 BrowserMicrosoft SQL Server 2008 Common FilesMicrosoft SQL Server 2008 Database Engine ServicesMicrosoft SQL Server 2008 Database Engine SharedMicrosoft SQL Server 2008 Native ClientMicrosoft SQL Server 2008 RsFx DriverMicrosoft SQL Server 2008 Setup Support Files Microsoft SQL Server 2012 Command Line Utilities Microsoft SQL Server 2012 Data-Tier App Framework Microsoft SQL Server 2012 Express LocalDB Microsoft SQL Server 2012 Management Objects Microsoft SQL Server 2012 Native Client Microsoft SQL Server 2012 T-SQL Language Service Microsoft SQL Server 2012 Transact-SQL Compiler Service Microsoft SQL Server 2012 Transact-SQL ScriptDom Microsoft SQL Server Compact 3.5 Design Tools ENUMicrosoft SQL Server Compact 3.5 for Devices ENUMicrosoft SQL Server Compact 3.5 SP2 ENUMicrosoft SQL Server Compact 4.0 SP1 ENUMicrosoft SQL Server Data Tools - enu (11.1.20828.01)Microsoft SQL Server Data Tools Build Utilities - enu (11.1.20828.01)Microsoft SQL Server Database Publishing Wizard 1.2Microsoft SQL Server Management Studio ExpressMicrosoft SQL Server Native ClientMicrosoft SQL Server VSS WriterMicrosoft System CLR Types for SQL Server 2012Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219Microsoft Visual C++ 2010 Express - ENUMicrosoft Visual C++ 2012 32bit Compilers - ENU ResourcesMicrosoft Visual C++ 2012 Core LibrariesMicrosoft Visual C++ 2012 x86-x64 CompilersMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610Microsoft Visual C++ 2012 x86 Debug Runtime - 11.0.60610Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610Microsoft Visual Studio 2005 Tools for Office RuntimeMicrosoft Visual Studio 2012 PreparationMicrosoft Visual Studio 2012 Shell (Minimum)Microsoft Visual Studio 2012 Shell (Minimum) Interop AssembliesMicrosoft Visual Studio 2012 Shell (Minimum) ResourcesMicrosoft Visual Studio 2012 Tools for SQL Server Compact 4.0 SP1 ENUMicrosoft Visual Studio Express 2012 for Windows DesktopMicrosoft Visual Studio Express 2012 for Windows Desktop - ENUMicrosoft Visual Studio Team Foundation Server 2012 Object ModelMicrosoft Visual Studio Team Foundation Server 2012 Object Model Language Pack - ENUMicrosoft Visual Studio Team Foundation Server 2012 Team ExplorerMicrosoft Visual Studio Team Foundation Server 2012 Team Explorer Language Pack - ENUMicrosoft Visual Studio Ultimate 2012 XAML UI Designer CoreMicrosoft Visual Studio Ultimate 2012 XAML UI Designer enu ResourcesMicrosoft Visual Studio Web Authoring ComponentMicrosoft Windows SDK for Visual Studio 2008 Headers and LibrariesMicrosoft Windows SDK for Visual Studio 2008 SDK Reference Assemblies and IntelliSenseMicrosoft Windows SDK for Visual Studio 2008 ToolsMicrosoft Windows SDK for Visual Studio 2008 Win32 ToolsMiKTeX 2.7Misha_s Custom Keyboard LayoutMovie MakerMozilla Firefox 12.0 (x86 en-US)Mozilla Maintenance ServiceMSVCRTMSVCRT110MSXML 4.0 SP2 (KB954430)MSXML 4.0 SP2 (KB973688)MSXML 4.0 SP2 Parser and SDKOGA Notifier 2.0.0048.0Oracle VM VirtualBox 3.2.12OTS Finist client applicationsOTS Finist serverOverDrive Media ConsolePalm webOS SDKPhoto CommonPhoto GalleryPowerDVD DXPrerequisites for SSDT PuTTY version 0.60QuickBooksQuickBooks Simple Start 2010QuickTimeRoxio Creator AudioRoxio Creator CopyRoxio Creator DataRoxio Creator DE 10.3Roxio Creator ToolsRoxio Express Labeler 3Roxio Update ManagerSAMSUNG USB Driver for Mobile PhonesSecurity Update for 2007 Microsoft Office System (KB2288621)Security Update for CAPICOM (KB931906)Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2596792) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2596871) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2597969) 32-Bit EditionSecurity Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2553091)Security Update for Microsoft Office 2010 (KB2553447) 32-Bit EditionSecurity Update for Microsoft Office 2010 (KB2589320) 32-Bit EditionSecurity Update for Microsoft Office 2010 (KB2597986) 32-Bit EditionSecurity Update for Microsoft Office 2010 (KB2598243) 32-Bit EditionSecurity Update for Microsoft Office 2010 (KB2687501) 32-Bit EditionSecurity Update for Microsoft Office 2010 (KB2687510) 32-Bit EditionSecurity Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit EditionSecurity Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit EditionSecurity Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit EditionSecurity Update for Microsoft Office system 2007 (KB974234)Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition Security Update for Microsoft Visual C++ 2010 Express - ENU (KB2251489)Service Pack 1 for SQL Server 2008 (KB968369)Skype™ 6.11Sql Server Customer Experience Improvement ProgramSSH Secure ShellTeamViewer 5TeamViewer 6TeamViewer 7TOPAZ Graphics 5.3.2TortoiseSVN 1.7.4.22459 (32 bit)UltraVncUninstall 1.0.0.1Update for 2007 Microsoft Office System (KB967642)Update for Microsoft Office 2007 suites (KB2596620) 32-Bit EditionUpdate for Microsoft Office 2007 suites (KB2596660) 32-Bit EditionUpdate for Microsoft Office 2007 suites (KB2596802) 32-Bit EditionUpdate for Microsoft Office 2007 suites (KB2596848) 32-Bit EditionUpdate for Microsoft Office 2007 suites (KB2767916) 32-Bit EditionUpdate for Microsoft Office 2007 System (KB2539530)Update for Microsoft Office 2010 (KB2494150)Update for Microsoft Office 2010 (KB2553181) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2553310) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2553378) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2566458)Update for Microsoft Office 2010 (KB2596964) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2598242) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2687509) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2760631) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2767886) 32-Bit EditionUpdate for Microsoft Office Outlook 2007 (KB2687404) 32-Bit EditionUpdate for Microsoft Office Outlook 2007 Junk Email Filter (KB2768021) 32-Bit EditionVim 7.2 (self-installing)Visual Studio 2012 Update 3 (KB2707250)Visual Studio Tools for the Office system 3.0 RuntimeVLC media player 1.0.5WinDjView 1.0.3Windows Driver Package - Dynastream Innovations (libusb0) LibUsbDevices (07/07/2009 1.12.2)Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)Windows Driver Package - Palm (WinUSB) Palm Devices (10/09/2009 1.0.1)Windows Driver Package - Palm (WinUSB) Palm Devices (11/30/2008 1.0.0)Windows Live Communications PlatformWindows Live EssentialsWindows Live ID Sign-in AssistantWindows Live InstallerWindows Live Photo CommonWindows Live PIMT PlatformWindows Live SOXEWindows Live SOXE DefinitionsWindows Live SyncWindows Live UX PlatformWindows Live UX Platform Language PackWindows Mobile 5.0 SDK R2 for Pocket PCWindows Mobile 5.0 SDK R2 for SmartphoneWindows Software Development KitWindows Software Development Kit DirectX x86 RemoteWindows Software Development Kit for Windows Store AppsWindows Software Development Kit for Windows Store Apps DirectX x86 RemoteWindows XP Targeting with C++WinSCP 5.1Xming 6.9.0.31.==== Event Viewer Messages From Past Week ========.1/3/2014 10:51:41 PM, Error: Service Control Manager [7023] - The Power service terminated with the following error: The WMI request could not be completed and should be retried.1/3/2014 10:51:33 PM, Error: Service Control Manager [7000] - The Palm Novacom service failed to start due to the following error: The system cannot find the file specified.1/3/2014 10:51:31 PM, Error: Service Control Manager [7000] - The Apple Mobile Device service failed to start due to the following error: The application has failed to start because its side-by-side configuration is incorrect. Please see the application event log or use the command-line sxstrace.exe tool for more detail.1/3/2014 10:51:28 PM, Error: atikmdag [52236] - CPLIB :: General - Invalid Parameter1/3/2014 10:51:28 PM, Error: atikmdag [43029] - Display is not active.==== End Of File =========================== DDS.txt----------------------------------------------------------------------------------------------------------------------------------------DDS (Ver_2012-11-20.01) - NTFS_x86 Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 10.45.2Run by Administrator at 23:31:23 on 2014-01-03Microsoft Windows 7 Enterprise 6.1.7601.1.1252.1.1033.18.3574.738 [GMT -5:00].AV: Microsoft Security Essentials *Enabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}SP: Microsoft Security Essentials *Enabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}.============== Running Processes ================.C:\Windows\system32\psxss.exeC:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exec:\Program Files\Microsoft Security Client\MsMpEng.exeC:\Windows\system32\atiesrxx.exeC:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exeC:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exeC:\Windows\system32\atieclxx.exeC:\Windows\System32\spoolsv.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Cisco Systems\VPN Client\cvpnd.exeC:\Program Files\Monitel\FinistServer\AgentService.exeC:\Program Files\Monitel\FinistServer\FinistServer.exeC:\Program Files\Monitel\FinistServer\Monitel.Finist.GenericDataAccess.Service.exeC:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exeC:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exec:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exeC:\Program Files\Palm\PDK\tcprelay.exeC:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exec:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exec:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exeC:\Program Files\Monitel\FinistServer\FinModLoader.exeC:\Windows\system32\conhost.exeC:\Program Files\TeamViewer\Version5\TeamViewer_Service.exeC:\Program Files\TeamViewer\Version6\TeamViewer_Service.exeC:\Program Files\TeamViewer\Version7\TeamViewer_Service.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exec:\Program Files\Microsoft Security Client\NisSrv.exeC:\Windows\system32\taskhost.exeC:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exeC:\Windows\system32\Dwm.exeC:\Windows\Explorer.EXEC:\Program Files\Microsoft Office\Office12\GrooveMonitor.exeC:\Program Files\Microsoft Security Client\msseces.exeC:\Program Files\Skype\Phone\Skype.exeC:\Program Files\TortoiseSVN\bin\TSVNCache.exeC:\Program Files\Business-in-a-Box\BIBLauncher.exeC:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exeC:\Users\Administrator\AppData\Roaming\Dropbox\bin\Dropbox.exeC:\Windows\system32\SearchIndexer.exeC:\Program Files\Google\Chrome\Application\chrome.exeC:\Program Files\Google\Chrome\Application\chrome.exeC:\Program Files\Google\Chrome\Application\chrome.exeC:\Program Files\Malwarebytes' Anti-Malware\mbam.exeC:\Program Files\Google\Chrome\Application\chrome.exeC:\Program Files\Google\Chrome\Application\chrome.exeC:\Windows\system32\wuauclt.exeC:\Program Files\PuTTY\putty.exeC:\Program Files\Google\Chrome\Application\chrome.exeC:\Windows\system32\SearchProtocolHost.exeC:\Windows\system32\SearchFilterHost.exec:\Program Files\Microsoft Security Client\MpCmdRun.exeC:\Program Files\Google\Chrome\Application\chrome.exeC:\Windows\system32\conhost.exeC:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\svchost.exe -k RPCSSC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonationC:\Windows\System32\svchost.exe -k LPDServiceC:\Windows\System32\svchost.exe -k HPZ12C:\Windows\system32\svchost.exe -k imgsvcC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted.============== Pseudo HJT Report ===============.mURLSearchHooks: DVDVideoSoftTB Toolbar: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - c:\program files\dvdvideosofttb\prxtbDVD2.dllBHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dllBHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office12\GrooveShellExtensions.dllBHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dllBHO: DVDVideoSoftTB Toolbar: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - c:\program files\dvdvideosofttb\prxtbDVD2.dllBHO: {8984B388-A5BB-4DF7-B274-77B879E179DB} - <orphaned>BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dllBHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office\office14\URLREDIR.DLLBHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dllTB: DVDVideoSoftTB Toolbar: {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - c:\program files\dvdvideosofttb\prxtbDVD2.dllTB: DVDVideoSoftTB Toolbar: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - c:\program files\dvdvideosofttb\prxtbDVD2.dlluRun: [skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrunuRun: [bIBLauncher] c:\program files\business-in-a-box\BIBLauncher.exemRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"mRun: [PDVDDXSrv] rem "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"mRun: [intuit SyncManager] c:\program files\common files\intuit\sync\IntuitSyncManager.exe startupmRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottimemRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkeymRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"StartupFolder: c:\users\admini~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\administrator\appdata\roaming\dropbox\bin\Dropbox.exeStartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exeStartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\vpncli~1.lnk - c:\windows\installer\{21e247d4-5e27-4bea-aa4d-19a81203fe2a}\Icon3E5562ED7.icouPolicies-Explorer: NoDriveTypeAutoRun = dword:145uPolicies-Explorer: NoAutoTrayNotify = dword:1mPolicies-Explorer: UseDefaultTile = dword:1mPolicies-System: ConsentPromptBehaviorAdmin = dword:0mPolicies-System: ConsentPromptBehaviorUser = dword:3mPolicies-System: EnableLUA = dword:0mPolicies-System: EnableUIADesktopToggle = dword:0mPolicies-System: PromptOnSecureDesktop = dword:0mPolicies-System: dontdisplaylastusername = dword:1mPolicies-System: DisableCAD = dword:1mPolicies-Windows\System: LocalProfile = dword:1mPolicies-Windows\System: ReadOnlyProfile = dword:1IE: Download with 4Media YouTube to iPod Converter - c:\program files\4media\youtube to ipod converter\upod_link.HTMIE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000IE: Free YouTube to iPod Converter - c:\users\administrator\appdata\roaming\dvdvideosoftiehelpers\freeyoutubetoipodconverter.htmIE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dllIE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}Trusted Zone: kent.eduDPF: {CC679CB8-DC4B-458B-B817-D447B3B6AC31} - vpnweb.cabTCP: NameServer = 192.168.1.1TCP: Interfaces\{10104CC5-73E5-4D56-B38A-C34CED98414E} : NameServer = 131.123.47.62,131.123.35.62TCP: Interfaces\{10104CC5-73E5-4D56-B38A-C34CED98414E} : DHCPNameServer = 131.123.47.62 131.123.35.62TCP: Interfaces\{4BCAFAEF-FE3D-4B87-9F9D-E8FD8BA90EED} : DHCPNameServer = 192.168.1.1Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLLHandler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dllHandler: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - c:\program files\intuit\quickbooks 2010\HelpAsyncPluggableProtocol.dllHandler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dllHandler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dllSSODL: WebCheck - <orphaned>SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dllmASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\32.0.1700.41\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome.================= FIREFOX ===================.FF - ProfilePath - c:\users\administrator\appdata\roaming\mozilla\firefox\profiles\8wu3qn3j.default\FF - prefs.js: browser.search.selectedEngine - mail.ru: Поиск в ИнтернетеFF - component: c:\users\administrator\appdata\roaming\mozilla\firefox\profiles\8wu3qn3j.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCoreGecko19.dllFF - component: c:\users\administrator\appdata\roaming\mozilla\firefox\profiles\8wu3qn3j.default\extensions\engine@conduit.com\components\RadioWMPCoreGecko19.dllFF - plugin: c:\progra~1\micros~3\office14\NPAUTHZ.DLLFF - plugin: c:\progra~1\micros~3\office14\NPSPWRAP.DLLFF - plugin: c:\program files\google\update\1.3.22.3\npGoogleUpdate3.dllFF - plugin: c:\program files\java\jre7\bin\dtplugin\npdeployJava1.dllFF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dllFF - plugin: c:\program files\microsoft silverlight\5.1.20513.0\npctrlui.dllFF - plugin: c:\program files\mozilla firefox\plugins\npatgpc.dllFF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dllFF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_9_900_170.dllFF - ExtSQL: 2013-11-11 18:57; ynpyqfjjnuhyzc@hjtvvpagbmyud.com; c:\users\administrator\appdata\roaming\mozilla\firefox\profiles\8wu3qn3j.default\extensions\ynpyqfjjnuhyzc@hjtvvpagbmyud.comFF - ExtSQL: 2013-12-20 23:39; ext@WebexpEnhancedV1alpha413.net; c:\program files\webexpenhancedv1\webexpenhancedv1alpha413\ffFF - ExtSQL: !HIDDEN! 2013-11-11 18:57; ynpyqfjjnuhyzc@hjtvvpagbmyud.com; c:\program files\mozilla firefox\extensions\ynpyqfjjnuhyzc@hjtvvpagbmyud.com.============= SERVICES / DRIVERS ===============.R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2013-1-20 195296]R1 MpKslfd651bfa;MpKslfd651bfa;c:\programdata\microsoft\microsoft antimalware\definition updates\{008a9175-fc56-4cc1-a274-3cbf4fac3f13}\MpKslfd651bfa.sys [2014-1-3 40392]R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-8-18 176128]R2 FinistAgent;FinistAgent;c:\program files\monitel\finistserver\AgentService.exe [2013-4-23 54784]R2 FinistServer;FinistServer;c:\program files\monitel\finistserver\FinistServer.exe [2012-9-26 8192]R2 GdaServer;GdaServer;c:\program files\monitel\finistserver\Monitel.Finist.GenericDataAccess.Service.exe [2012-9-26 10752]R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2014-1-3 418376]R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2014-1-3 701512]R2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2012-3-20 100328]R2 Palm_TCP_Relay;Palm TCP Relay;c:\program files\palm\pdk\tcprelay.exe [2010-6-16 11776]R2 TeamViewer5;TeamViewer 5;c:\program files\teamviewer\version5\TeamViewer_Service.exe [2010-7-6 173352]R2 TeamViewer6;TeamViewer 6;c:\program files\teamviewer\version6\TeamViewer_Service.exe [2011-1-27 2253688]R2 TeamViewer7;TeamViewer 7;c:\program files\teamviewer\version7\TeamViewer_Service.exe [2012-8-24 2735528]R2 UMVPFSrv;UMVPFSrv;c:\program files\common files\logishrd\lvmvfm\UMVPFSrv.exe [2012-1-18 450848]R2 vpnagent;Cisco AnyConnect Secure Mobility Agent;c:\program files\cisco\cisco anyconnect secure mobility client\vpnagent.exe [2011-9-9 475088]R3 acsock;acsock;c:\windows\system32\drivers\acsock.sys [2011-9-9 87976]R3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k6232.sys [2010-7-28 214696]R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2014-1-3 22856]R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2014-1-3 40776]R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\NisSrv.exe [2013-1-27 295232]R3 PsxDrv;PsxDrv;c:\windows\system32\drivers\psxdrv.sys [2009-7-13 9216]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2012-7-8 104912]S2 NovacomD;Palm Novacom;c:\program files\palm, inc\novacomd\x86\novacomd.exe --> c:\program files\palm, inc\novacomd\x86\novacomd.exe [?]S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-9-5 171680]S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\drivers\ssudbus.sys [2013-8-20 84248]S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2011-7-1 15872]S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [2012-9-12 121064]S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\drivers\ssadmdfl.sys [2012-9-12 12776]S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\drivers\ssadmdm.sys [2012-9-12 136808]S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\drivers\ssudmdm.sys [2013-8-20 182680]S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-7-1 52224]S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-4-6 1343400]S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2009-7-22 47128]S4 RsFx0103;RsFx0103 Driver;c:\windows\system32\drivers\RsFx0103.sys [2009-3-30 239336]S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\microsoft sql server\mssql10.sqlexpress\mssql\binn\SQLAGENT.EXE [2009-3-30 366936].=============== Created Last 30 ================.2014-01-04 03:52:54 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2014-01-04 03:51:35 40392 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{008a9175-fc56-4cc1-a274-3cbf4fac3f13}\MpKslfd651bfa.sys2014-01-03 16:37:05 -------- d-----w- c:\users\administrator\appdata\roaming\Malwarebytes2014-01-03 16:36:52 -------- d-----w- c:\programdata\Malwarebytes2014-01-03 16:36:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys2014-01-03 16:36:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2014-01-03 16:20:02 62576 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{008a9175-fc56-4cc1-a274-3cbf4fac3f13}\offreg.dll2014-01-03 04:39:56 7760024 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{008a9175-fc56-4cc1-a274-3cbf4fac3f13}\mpengine.dll2014-01-01 17:40:10 7760024 ------w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll2013-12-16 01:19:55 25088 ----a-w- c:\windows\system32\msxml3a.dll2013-12-16 01:12:15 -------- d-----w- c:\program files\Business-in-a-Box2013-12-10 16:17:20 -------- d-----w- c:\program files\Mozilla Maintenance Service2013-12-07 03:35:32 719224 ------w- c:\programdata\microsoft\microsoft antimalware\definition updates\{2d1c2e46-cc7a-4cb0-85ac-f5bee778d4d3}\gapaengine.dll.==================== Find3M ====================.2013-12-12 02:16:12 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl2013-12-12 02:16:12 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe2013-11-19 10:21:30 230048 ------w- c:\windows\system32\MpSigStub.exe2013-10-08 12:50:41 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll.============= FINISH: 23:33:42.22 =============== Link to post Share on other sites More sharing options...
MrCharlie Posted January 4, 2014 ID:773257 Share Posted January 4, 2014 Welcome to the forum. Please download and run RogueKiller 32 Bit to your desktop. RogueKiller 64 Bit <---use this one for 64 bit systems Which system am I using? Quit all running programs. For Windows XP, double-click to start. For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run. Click Scan to scan the system. When the scan completes > Close out the program > Don't Fix anything! Don't run any other options, they're not all bad!!!!!!! Post back the report which should be located on your desktop. (please don't put logs in code or quotes and use the default font) General P2P/Piracy Warning: 1. If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here. Failure to remove or disable such software will result in your topic being closed and no further assistance being provided. 2. If you have illegal/cracked software, cracks, keygens, custom (Adobe) host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy. Failure to remove such software will result in your topic being closed and no further assistance being provided. MrC Note: Please read all of my instructions completely including these. Make sure system restore is turned on and running Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive <+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you. <+>The removal of malware isn't instantaneous, please be patient. <+>When we are done, I'll give to instructions on how to cleanup all the tools and logs <+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that. ------->Your topic will be closed if you haven't replied within 3 days!<-------- (If I don't respond within 24 hours, please send me a PM) Link to post Share on other sites More sharing options...
mikhail23 Posted January 4, 2014 Author ID:773302 Share Posted January 4, 2014 RogueKiller V8.8.0 [Dec 27 2013] by Tigzymail : tigzyRK<at>gmail<dot>comFeedback : http://www.adlice.com/forum/Website : http://www.adlice.com/softwares/roguekiller/Blog : http://www.adlice.com Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits versionStarted in : Normal modeUser : Administrator [Admin rights]Mode : Scan -- Date : 01/04/2014 09:31:36| ARK || FAK || MBR | ¤¤¤ Bad processes : 0 ¤¤¤ ¤¤¤ Registry Entries : 15 ¤¤¤[DNS][PUM] HKLM\[...]\CCSet\[...]\{10104CC5-73E5-4D56-B38A-C34CED98414E} : NameServer (131.123.47.62,131.123.35.62 [uNITED STATES (US) - UNITED STATES (US)]) -> FOUND[DNS][PUM] HKLM\[...]\CS001\[...]\{10104CC5-73E5-4D56-B38A-C34CED98414E} : NameServer (131.123.47.62,131.123.35.62 [uNITED STATES (US) - UNITED STATES (US)]) -> FOUND[DNS][PUM] HKLM\[...]\CS002\[...]\{10104CC5-73E5-4D56-B38A-C34CED98414E} : NameServer (131.123.47.62,131.123.35.62 [uNITED STATES (US) - UNITED STATES (US)]) -> FOUND[HJ POL][PUM] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND[HJ POL][PUM] HKLM\[...]\System : EnableLUA (0) -> FOUND[HJ SMENU][PUM] HKCU\[...]\Advanced : Start_ShowMyDocs (0) -> FOUND[HJ SMENU][PUM] HKCU\[...]\Advanced : Start_ShowMyPics (0) -> FOUND[HJ SMENU][PUM] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND[HJ SMENU][PUM] HKCU\[...]\Advanced : Start_ShowMyMusic (0) -> FOUND[HJ SMENU][PUM] HKCU\[...]\Advanced : Start_ShowSetProgramAccessAndDefaults (0) -> FOUND[HJ SMENU][PUM] HKCU\[...]\Advanced : Start_TrackProgs (0) -> FOUND[HJ DESK][PUM] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND[HJ DESK][PUM] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Scheduled tasks : 0 ¤¤¤ ¤¤¤ Startup Entries : 0 ¤¤¤ ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ Browser Addons : 0 ¤¤¤ ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver : [NOT LOADED 0xc0000033] ¤¤¤ ¤¤¤ External Hives: ¤¤¤ ¤¤¤ Infection : ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤--> %SystemRoot%\System32\drivers\etc\hosts ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD5000AAKS-75V0A0 ATA Device +++++--- User ---[MBR] f4b6bb4d5ad43ca7a9d2aff2a0b4f3cc[bSP] 7d37a240489bd83a1a7a3f1eb887b6d2 : Windows 7/8 MBR CodePartition table:0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 476838 MoUser = LL1 ... OK!User = LL2 ... OK! +++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ USB) Seagate FreeAgent GoFlex USB Device +++++--- User ---[MBR] b5c7a9145516e2ee136fae473801e463[bSP] fe3ad9ed68c0e0f0fc7106524756e68b : Empty MBR CodePartition table:0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 476937 MoUser = LL1 ... OK!Error reading LL2 MBR! ([0x32] The request is not supported. ) Finished : << RKreport[0]_S_01042014_093136.txt >> Link to post Share on other sites More sharing options...
MrCharlie Posted January 4, 2014 ID:773306 Share Posted January 4, 2014 Please download and run ComboFix. The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop. Please visit this webpage for download links, and instructions for running ComboFix http://www.bleepingcomputer.com/combofix/how-to-use-combofix Please make sure you click download buttons that look similar to this, not "sponsored ad links": Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Information on disabling your malware programs can be found Here. Make sure you run ComboFix from your desktop. Give it at least 30-45 minutes to finish if needed. Please include the C:\ComboFix.txt in your next reply for further review. ---------->NOTE<----------If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed. MrC Link to post Share on other sites More sharing options...
mikhail23 Posted January 4, 2014 Author ID:773329 Share Posted January 4, 2014 below is ComboFox the log. The virus is still there-----------------------ComboFix 14-01-04.03 - Administrator 01/04/2014 9:59.1.2 - x86Microsoft Windows 7 Enterprise 6.1.7601.1.1252.1.1033.18.3574.1211 [GMT -5:00]Running from: c:\users\Administrator\Desktop\ComboFix.exeAV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..c:\windows\system32\htmlc:\windows\system32\html\calendar.htmlc:\windows\system32\html\calendarbottom.htmlc:\windows\system32\html\calendartop.htmlc:\windows\system32\html\crystalexportdialog.htmc:\windows\system32\html\crystalprinthost.htmlc:\windows\system32\imagesc:\windows\system32\images\toolbar\calendar.gifc:\windows\system32\images\toolbar\crlogo.gifc:\windows\system32\images\toolbar\export.gifc:\windows\system32\images\toolbar\export_over.gifc:\windows\system32\images\toolbar\exportd.gifc:\windows\system32\images\toolbar\First.gifc:\windows\system32\images\toolbar\first_over.gifc:\windows\system32\images\toolbar\Firstd.gifc:\windows\system32\images\toolbar\gotopage.gifc:\windows\system32\images\toolbar\gotopage_over.gifc:\windows\system32\images\toolbar\gotopaged.gifc:\windows\system32\images\toolbar\grouptree.gifc:\windows\system32\images\toolbar\grouptree_over.gifc:\windows\system32\images\toolbar\grouptreed.gifc:\windows\system32\images\toolbar\grouptreepressed.gifc:\windows\system32\images\toolbar\Last.gifc:\windows\system32\images\toolbar\last_over.gifc:\windows\system32\images\toolbar\Lastd.gifc:\windows\system32\images\toolbar\Next.gifc:\windows\system32\images\toolbar\next_over.gifc:\windows\system32\images\toolbar\Nextd.gifc:\windows\system32\images\toolbar\Prev.gifc:\windows\system32\images\toolbar\prev_over.gifc:\windows\system32\images\toolbar\Prevd.gifc:\windows\system32\images\toolbar\print.gifc:\windows\system32\images\toolbar\print_over.gifc:\windows\system32\images\toolbar\printd.gifc:\windows\system32\images\toolbar\Refresh.gifc:\windows\system32\images\toolbar\refresh_over.gifc:\windows\system32\images\toolbar\refreshd.gifc:\windows\system32\images\toolbar\Search.gifc:\windows\system32\images\toolbar\search_over.gifc:\windows\system32\images\toolbar\searchd.gifc:\windows\system32\images\toolbar\up.gifc:\windows\system32\images\toolbar\up_over.gifc:\windows\system32\images\toolbar\upd.gifc:\windows\system32\images\tree\begindots.gifc:\windows\system32\images\tree\beginminus.gifc:\windows\system32\images\tree\beginplus.gifc:\windows\system32\images\tree\blank.gifc:\windows\system32\images\tree\blankdots.gifc:\windows\system32\images\tree\dots.gifc:\windows\system32\images\tree\lastdots.gifc:\windows\system32\images\tree\lastminus.gifc:\windows\system32\images\tree\lastplus.gifc:\windows\system32\images\tree\Magnify.gifc:\windows\system32\images\tree\minus.gifc:\windows\system32\images\tree\minusbox.gifc:\windows\system32\images\tree\plus.gifc:\windows\system32\images\tree\plusbox.gifc:\windows\system32\images\tree\singleminus.gifc:\windows\system32\images\tree\singleplus.gifc:\windows\XSxS..((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))..-------\Service_vpnagent..((((((((((((((((((((((((( Files Created from 2013-12-04 to 2014-01-04 )))))))))))))))))))))))))))))))..2014-01-04 15:06 . 2014-01-04 15:06 -------- d-----w- c:\users\PowerPoint\AppData\Local\temp2014-01-04 14:28 . 2013-12-04 02:57 7760024 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0FF414B8-1613-45E5-92A2-A142B4B70A68}\mpengine.dll2014-01-03 16:37 . 2014-01-03 16:37 -------- d-----w- c:\users\Administrator\AppData\Roaming\Malwarebytes2014-01-03 16:36 . 2014-01-03 16:36 -------- d-----w- c:\programdata\Malwarebytes2014-01-03 16:36 . 2014-01-03 16:36 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2014-01-03 16:36 . 2013-04-04 19:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys2014-01-03 04:39 . 2013-12-04 02:57 7760024 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll2013-12-16 01:19 . 2000-10-19 20:05 25088 ----a-w- c:\windows\system32\msxml3a.dll2013-12-16 01:12 . 2013-12-16 01:19 -------- d-----w- c:\program files\Business-in-a-Box2013-12-10 16:17 . 2013-12-10 16:17 -------- d-----w- c:\program files\Mozilla Maintenance Service2013-12-07 03:35 . 2013-10-18 02:12 719224 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2D1C2E46-CC7A-4CB0-85AC-F5BEE778D4D3}\gapaengine.dll...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2014-01-04 14:31 . 2014-01-04 14:31 92672 ----a-w- c:\windows\system32\drivers\WUDFPf.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 35968 ----a-w- c:\windows\system32\drivers\winusb.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 16384 ----a-w- c:\windows\system32\drivers\ws2ifsl.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 14912 ----a-w- c:\windows\system32\drivers\wmilib.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 132224 ----a-w- c:\windows\system32\drivers\WUDFRd.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 11264 ----a-w- c:\windows\system32\drivers\wmiacpi.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 43392 ----a-w- c:\windows\system32\drivers\winhv.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 9728 ----a-w- c:\windows\system32\drivers\wfplwf.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 63488 ----a-w- c:\windows\system32\drivers\wanarp.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 445008 ----a-w- c:\windows\system32\drivers\Wdf01000.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 38480 ----a-w- c:\windows\system32\drivers\WdfLdr.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 35328 ----a-w- c:\windows\system32\drivers\watchdog.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 21632 ----a-w- c:\windows\system32\drivers\wacompen.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 19024 ----a-w- c:\windows\system32\drivers\wd.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 19008 ----a-w- c:\windows\system32\drivers\wimmount.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 14336 ----a-w- c:\windows\system32\drivers\vwifimp.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 53120 ----a-w- c:\windows\system32\drivers\volmgr.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 48128 ----a-w- c:\windows\system32\drivers\vwififlt.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 297040 ----a-w- c:\windows\system32\drivers\volmgrx.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 245632 ----a-w- c:\windows\system32\drivers\volsnap.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 23464 ----a-w- c:\windows\system32\drivers\vpnva.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 19968 ----a-w- c:\windows\system32\drivers\vwifibus.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 141904 ----a-w- c:\windows\system32\drivers\vsmraid.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 40704 ----a-w- c:\windows\system32\drivers\vmstorfl.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 5632 ----a-w- c:\windows\system32\drivers\vms3cap.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 52736 ----a-w- c:\windows\system32\drivers\viac7.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 17920 ----a-w- c:\windows\system32\drivers\VMBusHID.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 175360 ----a-w- c:\windows\system32\drivers\vmbus.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 16976 ----a-w- c:\windows\system32\drivers\viaide.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 111616 ----a-w- c:\windows\system32\drivers\videoprt.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 53328 ----a-w- c:\windows\system32\drivers\VIAAGP.SYS.bak2014-01-04 14:31 . 2014-01-04 14:31 41936 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 32832 ----a-w- c:\windows\system32\drivers\vdrvroot.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 26112 ----a-w- c:\windows\system32\drivers\vgapnp.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 25088 ----a-w- c:\windows\system32\drivers\vga.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 160128 ----a-w- c:\windows\system32\drivers\vhdmp.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 111504 ----a-w- c:\windows\system32\drivers\VBoxNetFlt.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 100560 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 143248 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 76288 ----a-w- c:\windows\system32\drivers\USBSTOR.SYS.bak2014-01-04 14:31 . 2014-01-04 14:31 24064 ----a-w- c:\windows\system32\drivers\usbuhci.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 146432 ----a-w- c:\windows\system32\drivers\usbvideo.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 86016 ----a-w- c:\windows\system32\drivers\usbcir.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 75776 ----a-w- c:\windows\system32\drivers\usbccgp.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 5888 ----a-w- c:\windows\system32\drivers\usbd.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 42496 ----a-w- c:\windows\system32\drivers\usbehci.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 284672 ----a-w- c:\windows\system32\drivers\usbport.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 26112 ----a-w- c:\windows\system32\drivers\usbrpm.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 258560 ----a-w- c:\windows\system32\drivers\usbhub.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 20480 ----a-w- c:\windows\system32\drivers\usbohci.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 19968 ----a-w- c:\windows\system32\drivers\usbprint.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 80768 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 45056 ----a-w- c:\windows\system32\drivers\usbaapl.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 25856 ----a-w- c:\windows\system32\drivers\USBCAMD2.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 25856 ----a-w- c:\windows\system32\drivers\USBCAMD.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 8192 ----a-w- c:\windows\system32\drivers\umpass.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 39936 ----a-w- c:\windows\system32\drivers\umbus.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 57424 ----a-w- c:\windows\system32\drivers\ULIAGPKX.SYS.bak2014-01-04 14:31 . 2014-01-04 14:31 55888 ----a-w- c:\windows\system32\drivers\UAGP35.SYS.bak2014-01-04 14:31 . 2014-01-04 14:31 53120 ----a-w- c:\windows\system32\drivers\termdd.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 52224 ----a-w- c:\windows\system32\drivers\TsUsbFlt.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 31232 ----a-w- c:\windows\system32\drivers\tssecsrv.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 246784 ----a-w- c:\windows\system32\drivers\udfs.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 108544 ----a-w- c:\windows\system32\drivers\tunnel.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 74752 ----a-w- c:\windows\system32\drivers\tdx.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 35328 ----a-w- c:\windows\system32\drivers\tcpipreg.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 24576 ----a-w- c:\windows\system32\drivers\tdtcp.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 24576 ----a-w- c:\windows\system32\drivers\tape.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 21504 ----a-w- c:\windows\system32\drivers\tdi.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 18432 ----a-w- c:\windows\system32\drivers\tdpipe.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 1293672 ----a-w- c:\windows\system32\drivers\tcpip.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 12240 ----a-w- c:\windows\system32\drivers\swenum.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 53632 ----a-w- c:\windows\system32\drivers\stream.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 28032 ----a-w- c:\windows\system32\drivers\storvsc.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 21072 ----a-w- c:\windows\system32\drivers\stexstor.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 182680 ----a-w- c:\windows\system32\drivers\ssudmdm.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 148864 ----a-w- c:\windows\system32\drivers\storport.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 84248 ----a-w- c:\windows\system32\drivers\ssudbus.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 136808 ----a-w- c:\windows\system32\drivers\ssadmdm.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 12776 ----a-w- c:\windows\system32\drivers\ssadmdfl.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 10472 ----a-w- c:\windows\system32\drivers\ssadcmnt.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 10472 ----a-w- c:\windows\system32\drivers\ssadcm.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 10344 ----a-w- c:\windows\system32\drivers\ssadwhnt.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 10344 ----a-w- c:\windows\system32\drivers\ssadwh.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 121064 ----a-w- c:\windows\system32\drivers\ssadbus.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 77888 ----a-w- c:\windows\system32\drivers\sisraid4.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 71168 ----a-w- c:\windows\system32\drivers\smb.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 405504 ----a-w- c:\windows\system32\drivers\spsys.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 311808 ----a-w- c:\windows\system32\drivers\srv.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 310272 ----a-w- c:\windows\system32\drivers\srv2.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 17472 ----a-w- c:\windows\system32\drivers\spldr.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 17408 ----a-w- c:\windows\system32\drivers\smclib.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 114688 ----a-w- c:\windows\system32\drivers\srvnet.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 40016 ----a-w- c:\windows\system32\drivers\sisraid2.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 52304 ----a-w- c:\windows\system32\drivers\SISAGP.SYS.bak2014-01-04 14:31 . 2014-01-04 14:31 18944 ----a-w- c:\windows\system32\drivers\SiLib.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 13824 ----a-w- c:\windows\system32\drivers\sfloppy.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 83456 ----a-w- c:\windows\system32\drivers\serial.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 19968 ----a-w- c:\windows\system32\drivers\sermouse.sys.bak2013-12-10 16:16 . 2013-12-10 16:16 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll..------- Sigcheck -------Note: Unsigned files aren't necessarily malware..[-] 2010-11-20 . 9EAFFC703B62910D8929813617568FB0 . 377344 . . [6.1.7601.17514] . . c:\windows\System32\rpcss.dll[7] 2010-11-20 . 7660F01D3B38ACA1747E397D21D790AF . 376832 . . [6.1.7601.17514] . . c:\windows\winsxs\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_6bd245e79c221747\rpcss.dll[7] 2009-07-14 . B82CD39E336973359D7C9BF911E8E84F . 376320 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7600.16385_none_69a1321f9f3393ad\rpcss.dll.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4.[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]2011-05-09 09:49 176936 ----a-w- c:\program files\DVDVideoSoftTB\prxtbDVD2.dll.[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\prxtbDVD2.dll" [2011-05-09 176936].[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}].[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]"{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\program files\DVDVideoSoftTB\prxtbDVD2.dll" [2011-05-09 176936].[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]@="{C5994560-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]2011-06-13 15:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]@="{C5994561-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]2011-06-13 15:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]@="{C5994562-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]2011-06-13 15:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]@="{C5994563-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]2011-06-13 15:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]@="{C5994564-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]2011-06-13 15:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]@="{C5994565-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]2011-06-13 15:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]@="{C5994566-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]2011-06-13 15:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]@="{C5994567-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]2011-06-13 15:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]@="{C5994568-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]2011-06-13 15:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]2013-05-25 00:36 130736 ----a-w- c:\users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]2013-05-25 00:36 130736 ----a-w- c:\users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]2013-05-25 00:36 130736 ----a-w- c:\users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]2013-05-25 00:36 130736 ----a-w- c:\users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-11-14 20584608]"BIBLauncher"="c:\program files\Business-in-a-Box\BIBLauncher.exe" [2013-10-22 3925296].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"PDVDDXSrv"="rem" [X]"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2010-10-19 1439496]"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 947152]"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336].c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk - c:\users\Administrator\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-24 27776968].c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2011-11-11 1155432]VPN Client.lnk - c:\windows\Installer\{21E247D4-5E27-4BEA-AA4D-19A81203FE2A}\Icon3E5562ED7.ico -user_logon [2012-1-22 6144].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"= 0 (0x0)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableLUA"= 0 (0x0)"EnableUIADesktopToggle"= 0 (0x0)"PromptOnSecureDesktop"= 0 (0x0)"DisableCAD"= 1 (0x1).[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]"UseDefaultTile"= 1 (0x1).[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]"aux9"=wdmaud.drv.[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]@="Service".R1 MpKslfd651bfa;MpKslfd651bfa;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{008A9175-FC56-4CC1-A274-3CBF4FAC3F13}\MpKslfd651bfa.sys [x]R2 NovacomD;Palm Novacom;c:\program files\Palm, Inc\novacomd\x86\novacomd.exe [x]R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-09-05 171680]R3 acsock;acsock;c:\windows\system32\DRIVERS\acsock.sys [2011-09-09 87976]R3 AtiDCM;AtiDCM;c:\drivers\video\Bin\atidcmxx.sys [x]R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2013-08-20 84248]R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 100328]R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 295232]R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-06-02 121064]R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-06-02 12776]R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-06-02 136808]R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2013-08-20 182680]R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-04-06 1343400]R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-07-23 47128]R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [2009-03-30 239336]R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-03-30 366936]S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2010-12-01 143248]S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2010-12-01 41936]S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-18 176128]S2 FinistAgent;FinistAgent;c:\program files\Monitel\FinistServer\AgentService.exe [2013-04-23 54784]S2 FinistServer;FinistServer;c:\program files\Monitel\FinistServer\FinistServer.exe [2012-09-26 8192]S2 GdaServer;GdaServer;c:\program files\Monitel\FinistServer\Monitel.Finist.GenericDataAccess.Service.exe [2012-09-26 10752]S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]S2 Palm_TCP_Relay;Palm TCP Relay;c:\program files\Palm\PDK\tcprelay.exe [2010-06-16 11776]S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-07-06 173352]S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2011-01-27 2253688]S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2012-08-24 2735528]S2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2012-01-18 450848]S3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k6232.sys [2010-02-26 214696]S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 22856]S3 PsxDrv;PsxDrv;c:\windows\system32\drivers\psxdrv.sys [2009-07-13 9216]S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2010-12-01 100560]S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2010-12-01 111504]..--- Other Services/Drivers In Memory ---.*NewlyCreated* - WS2IFSL.[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]LPDService REG_MULTI_SZ LPDSVCHPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12.[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]2013-12-05 00:12 1211344 ----a-w- c:\program files\Google\Chrome\Application\32.0.1700.41\Installer\chrmstp.exe.Contents of the 'Scheduled Tasks' folder.2014-01-04 c:\windows\Tasks\Adobe Flash Player Updater.job- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-28 02:16].2014-01-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-03 01:23].2014-01-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-03 01:23]..------- Supplementary Scan -------.uInternet Settings,ProxyOverride = *.localIE: Download with 4Media YouTube to iPod Converter - c:\program files\4Media\YouTube to iPod Converter\upod_link.HTMIE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000IE: Free YouTube to iPod Converter - c:\users\Administrator\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htmTrusted Zone: kent.eduTCP: DhcpNameServer = 192.168.1.1TCP: Interfaces\{10104CC5-73E5-4D56-B38A-C34CED98414E}: NameServer = 131.123.47.62,131.123.35.62DPF: {CC679CB8-DC4B-458B-B817-D447B3B6AC31} - vpnweb.cabFF - ProfilePath - c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\8wu3qn3j.default\FF - prefs.js: browser.search.selectedEngine - mail.ru: Поиск в ИнтернетеFF - ExtSQL: 2013-11-11 18:57; ynpyqfjjnuhyzc@hjtvvpagbmyud.com; c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\8wu3qn3j.default\extensions\ynpyqfjjnuhyzc@hjtvvpagbmyud.comFF - ExtSQL: 2013-12-20 23:39; ext@WebexpEnhancedV1alpha413.net; c:\program files\WebexpEnhancedV1\WebexpEnhancedV1alpha413\ffFF - ExtSQL: !HIDDEN! 2013-11-11 18:57; ynpyqfjjnuhyzc@hjtvvpagbmyud.com; c:\program files\Mozilla Firefox\extensions\ynpyqfjjnuhyzc@hjtvvpagbmyud.com.- - - - ORPHANS REMOVED - - - -.Toolbar-ITBar7Position - (no file)AddRemove-01_Simmental - c:\program files\SAMSUNG\USB Drivers\01_Simmental\Uninstall.exeAddRemove-02_Siberian - c:\program files\SAMSUNG\USB Drivers\02_Siberian\Uninstall.exeAddRemove-03_Swallowtail - c:\program files\SAMSUNG\USB Drivers\03_Swallowtail\Uninstall.exeAddRemove-04_semseyite - c:\program files\SAMSUNG\USB Drivers\04_semseyite\Uninstall.exeAddRemove-05_Sloan - c:\program files\SAMSUNG\USB Drivers\05_Sloan\Uninstall.exeAddRemove-06_Spencer - c:\program files\SAMSUNG\USB Drivers\06_Spencer\Uninstall.exeAddRemove-07_Schorl - c:\program files\SAMSUNG\USB Drivers\07_Schorl\Uninstall.exeAddRemove-08_EMPChipset - c:\program files\SAMSUNG\USB Drivers\08_EMPChipset\Uninstall.exeAddRemove-09_Hsp - c:\program files\SAMSUNG\USB Drivers\09_Hsp\Uninstall.exeAddRemove-11_HSP_Plus_Default - c:\program files\SAMSUNG\USB Drivers\11_HSP_Plus_Default\Uninstall.exeAddRemove-12_Symbian_USB_Download_Driver - c:\program files\SAMSUNG\USB Drivers\12_Symbian_USB_Download_Driver\Uninstall.exeAddRemove-15_Symbian_Samsung_PC_DLC_Driver - c:\program files\SAMSUNG\USB Drivers\15_Symbian_Samsung_PC_DLC_Driver\Uninstall.exeAddRemove-16_Shrewsbury - c:\program files\SAMSUNG\USB Drivers\16_Shrewsbury\Uninstall.exeAddRemove-17_EMP_Chipset2 - c:\program files\SAMSUNG\USB Drivers\17_EMP_Chipset2\Uninstall.exeAddRemove-18_Zinia_Serial_Driver - c:\program files\SAMSUNG\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exeAddRemove-19_VIA_driver - c:\program files\SAMSUNG\USB Drivers\19_VIA_driver\Uninstall.exeAddRemove-20_NXP_Driver - c:\program files\SAMSUNG\USB Drivers\20_NXP_Driver\Uninstall.exeAddRemove-21_Searsburg - c:\program files\SAMSUNG\USB Drivers\21_Searsburg\Uninstall.exeAddRemove-22_WiBro_WiMAX - c:\program files\SAMSUNG\USB Drivers\22_WiBro_WiMAX\Uninstall.exeAddRemove-24_flashusbdriver - c:\program files\SAMSUNG\USB Drivers\24_flashusbdriver\Uninstall.exeAddRemove-25_escape - c:\program files\SAMSUNG\USB Drivers\25_escape\Uninstall.exe...[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TrueSight]"ImagePath"="\??\".--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Internet Explorer\User Preferences]@Denied: (2) (Administrator)"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,74,fe,7b,88,f9,66,dc,4d,95,7c,53,\"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,74,fe,7b,88,f9,66,dc,4d,95,7c,53,\.[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.3G2".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.3GP".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.3G2".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.3GP".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.ADTS".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.ADTS".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.ADTS".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.AIFF".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.AIFF".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.AIFF".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.ASF".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.ASX".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.AU".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.AVI".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cda\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.CDA".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.finproj\UserChoice]@Denied: (2) (Administrator)"Progid"="finproj_auto_file".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]@Denied: (2) (Administrator)"Progid"="PBrush".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]@Denied: (2) (Administrator)"Progid"="ChromeHTML".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]@Denied: (2) (Administrator)"Progid"="ChromeHTML".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]@Denied: (2) (Administrator)"Progid"="jpegfile".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MPEG".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2t\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.M2TS".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2ts\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.M2TS".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2v\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MPEG".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.m3u".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.M4A".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MP4".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MIDI".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MIDI".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mod\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MPEG".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MOV".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MP3".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MPEG".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MP3".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MP4".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MP4".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MPEG".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MPEG".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MPEG".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MPEG".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MPEG".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mts\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.M2TS".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoice]@Denied: (2) (Administrator)"Progid"="AcroExch.Document".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]@Denied: (2) (Administrator)"Progid"="Applications\\AcroRd32.exe".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.resx\UserChoice]@Denied: (2) (Administrator)"Progid"="Applications\\VSLauncher.exe".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MIDI".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]@Denied: (2) (Administrator)"Progid"="ChromeHTML".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.AU".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tex\UserChoice]@Denied: (2) (Administrator)"Progid"="Applications\\pdflatex.exe".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ts\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.TTS".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tts\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.TTS".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.WAV".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wax\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.WAX".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.ASF".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.WMA".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmd\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.WMD".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wms\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.WMS".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.WMV".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmx\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.ASX".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmz\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.WMZ".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.WPL".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.WVX".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]@Denied: (2) (Administrator)"Progid"="ChromeHTML".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]@Denied: (2) (Administrator)"Progid"="ChromeHTML".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="IFlashBroker5".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]@Denied: (Full) (Everyone).--------------------- DLLs Loaded Under Running Processes ---------------------.- - - - - - - > 'Explorer.exe'(3100)c:\users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll.------------------------ Other Running Processes ------------------------.c:\windows\system32\psxss.exec:\program files\Microsoft Security Client\MsMpEng.exec:\windows\system32\atieclxx.exec:\program files\Bonjour\mDNSResponder.exec:\program files\Cisco Systems\VPN Client\cvpnd.exec:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exec:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exec:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exec:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exec:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEc:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exec:\program files\Monitel\FinistServer\FinModLoader.exec:\windows\system32\conhost.exec:\windows\system32\taskhost.exec:\program files\Malwarebytes' Anti-Malware\mbamgui.exec:\windows\system32\conhost.exec:\program files\TortoiseSVN\bin\TSVNCache.exec:\users\Administrator\AppData\Roaming\Dropbox\bin\Dropbox.exec:\windows\system32\sppsvc.exec:\\?\c:\windows\system32\wbem\WMIADAP.EXE.**************************************************************************.Completion time: 2014-01-04 10:13:27 - machine was rebootedComboFix-quarantined-files.txt 2014-01-04 15:13.Pre-Run: 356,180,111,360 bytes freePost-Run: 356,488,511,488 bytes free.- - End Of File - - 150BBCA2B1D5EDC88F2440FC69730951A36C5E4F47E84449FF07ED3517B43A31 Link to post Share on other sites More sharing options...
MrCharlie Posted January 4, 2014 ID:773336 Share Posted January 4, 2014 Using ComboFix...... 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Download the attached CFScript.txt, place it next to ComboFix.exe Refering to the picture above, drag CFScript into ComboFix.exe CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall. After reboot, (in case it asks to reboot)...... Please provide the contents of the ComboFix log (C:\ComboFix.txt) in your next reply. ------------------------------- Next..reset Google Chrome: https://support.google.com/chrome/answer/3296214?hl=en If you still have a problem, please re-install Google Chrome. MrC Link to post Share on other sites More sharing options...
mikhail23 Posted January 4, 2014 Author ID:773343 Share Posted January 4, 2014 ComboFix 14-01-04.03 - Administrator 01/04/2014 10:39:43.2.2 - x86Microsoft Windows 7 Enterprise 6.1.7601.1.1252.1.1033.18.3574.1693 [GMT -5:00]Running from: c:\users\Administrator\Desktop\ComboFix.exeCommand switches used :: c:\users\Administrator\Desktop\CFScript.txtAV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))...--------------- FCopy ---------------.c:\windows\winsxs\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_6bd245e79c221747\rpcss.dll --> c:\windows\System32\rpcss.dll.((((((((((((((((((((((((( Files Created from 2013-12-04 to 2014-01-04 )))))))))))))))))))))))))))))))..2014-01-04 15:46 . 2014-01-04 15:46 -------- d-----w- c:\users\template\AppData\Local\temp2014-01-04 15:46 . 2014-01-04 15:46 -------- d-----w- c:\users\PowerPoint\AppData\Local\temp2014-01-04 15:46 . 2014-01-04 15:46 -------- d-----w- c:\users\Default\AppData\Local\temp2014-01-04 15:46 . 2014-01-04 15:46 -------- d-----w- c:\users\Default.old\AppData\Local\temp2014-01-04 14:28 . 2013-12-04 02:57 7760024 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0FF414B8-1613-45E5-92A2-A142B4B70A68}\mpengine.dll2014-01-03 16:37 . 2014-01-03 16:37 -------- d-----w- c:\users\Administrator\AppData\Roaming\Malwarebytes2014-01-03 16:36 . 2014-01-03 16:36 -------- d-----w- c:\programdata\Malwarebytes2014-01-03 16:36 . 2014-01-03 16:36 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2014-01-03 16:36 . 2013-04-04 19:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys2014-01-03 04:39 . 2013-12-04 02:57 7760024 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll2013-12-16 01:19 . 2000-10-19 20:05 25088 ----a-w- c:\windows\system32\msxml3a.dll2013-12-16 01:12 . 2013-12-16 01:19 -------- d-----w- c:\program files\Business-in-a-Box2013-12-10 16:17 . 2013-12-10 16:17 -------- d-----w- c:\program files\Mozilla Maintenance Service2013-12-07 03:35 . 2013-10-18 02:12 719224 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2D1C2E46-CC7A-4CB0-85AC-F5BEE778D4D3}\gapaengine.dll...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2014-01-04 14:31 . 2014-01-04 14:31 92672 ----a-w- c:\windows\system32\drivers\WUDFPf.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 35968 ----a-w- c:\windows\system32\drivers\winusb.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 16384 ----a-w- c:\windows\system32\drivers\ws2ifsl.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 14912 ----a-w- c:\windows\system32\drivers\wmilib.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 132224 ----a-w- c:\windows\system32\drivers\WUDFRd.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 11264 ----a-w- c:\windows\system32\drivers\wmiacpi.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 43392 ----a-w- c:\windows\system32\drivers\winhv.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 9728 ----a-w- c:\windows\system32\drivers\wfplwf.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 63488 ----a-w- c:\windows\system32\drivers\wanarp.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 445008 ----a-w- c:\windows\system32\drivers\Wdf01000.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 38480 ----a-w- c:\windows\system32\drivers\WdfLdr.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 35328 ----a-w- c:\windows\system32\drivers\watchdog.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 21632 ----a-w- c:\windows\system32\drivers\wacompen.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 19024 ----a-w- c:\windows\system32\drivers\wd.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 19008 ----a-w- c:\windows\system32\drivers\wimmount.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 14336 ----a-w- c:\windows\system32\drivers\vwifimp.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 53120 ----a-w- c:\windows\system32\drivers\volmgr.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 48128 ----a-w- c:\windows\system32\drivers\vwififlt.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 297040 ----a-w- c:\windows\system32\drivers\volmgrx.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 245632 ----a-w- c:\windows\system32\drivers\volsnap.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 23464 ----a-w- c:\windows\system32\drivers\vpnva.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 19968 ----a-w- c:\windows\system32\drivers\vwifibus.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 141904 ----a-w- c:\windows\system32\drivers\vsmraid.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 40704 ----a-w- c:\windows\system32\drivers\vmstorfl.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 5632 ----a-w- c:\windows\system32\drivers\vms3cap.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 52736 ----a-w- c:\windows\system32\drivers\viac7.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 17920 ----a-w- c:\windows\system32\drivers\VMBusHID.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 175360 ----a-w- c:\windows\system32\drivers\vmbus.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 16976 ----a-w- c:\windows\system32\drivers\viaide.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 111616 ----a-w- c:\windows\system32\drivers\videoprt.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 53328 ----a-w- c:\windows\system32\drivers\VIAAGP.SYS.bak2014-01-04 14:31 . 2014-01-04 14:31 41936 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 32832 ----a-w- c:\windows\system32\drivers\vdrvroot.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 26112 ----a-w- c:\windows\system32\drivers\vgapnp.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 25088 ----a-w- c:\windows\system32\drivers\vga.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 160128 ----a-w- c:\windows\system32\drivers\vhdmp.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 111504 ----a-w- c:\windows\system32\drivers\VBoxNetFlt.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 100560 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 143248 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 76288 ----a-w- c:\windows\system32\drivers\USBSTOR.SYS.bak2014-01-04 14:31 . 2014-01-04 14:31 24064 ----a-w- c:\windows\system32\drivers\usbuhci.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 146432 ----a-w- c:\windows\system32\drivers\usbvideo.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 86016 ----a-w- c:\windows\system32\drivers\usbcir.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 75776 ----a-w- c:\windows\system32\drivers\usbccgp.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 5888 ----a-w- c:\windows\system32\drivers\usbd.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 42496 ----a-w- c:\windows\system32\drivers\usbehci.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 284672 ----a-w- c:\windows\system32\drivers\usbport.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 26112 ----a-w- c:\windows\system32\drivers\usbrpm.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 258560 ----a-w- c:\windows\system32\drivers\usbhub.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 20480 ----a-w- c:\windows\system32\drivers\usbohci.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 19968 ----a-w- c:\windows\system32\drivers\usbprint.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 80768 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 45056 ----a-w- c:\windows\system32\drivers\usbaapl.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 25856 ----a-w- c:\windows\system32\drivers\USBCAMD2.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 25856 ----a-w- c:\windows\system32\drivers\USBCAMD.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 15872 ----a-w- c:\windows\system32\drivers\usb8023.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 8192 ----a-w- c:\windows\system32\drivers\umpass.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 39936 ----a-w- c:\windows\system32\drivers\umbus.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 57424 ----a-w- c:\windows\system32\drivers\ULIAGPKX.SYS.bak2014-01-04 14:31 . 2014-01-04 14:31 55888 ----a-w- c:\windows\system32\drivers\UAGP35.SYS.bak2014-01-04 14:31 . 2014-01-04 14:31 53120 ----a-w- c:\windows\system32\drivers\termdd.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 52224 ----a-w- c:\windows\system32\drivers\TsUsbFlt.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 31232 ----a-w- c:\windows\system32\drivers\tssecsrv.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 246784 ----a-w- c:\windows\system32\drivers\udfs.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 108544 ----a-w- c:\windows\system32\drivers\tunnel.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 74752 ----a-w- c:\windows\system32\drivers\tdx.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 35328 ----a-w- c:\windows\system32\drivers\tcpipreg.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 24576 ----a-w- c:\windows\system32\drivers\tdtcp.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 24576 ----a-w- c:\windows\system32\drivers\tape.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 21504 ----a-w- c:\windows\system32\drivers\tdi.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 18432 ----a-w- c:\windows\system32\drivers\tdpipe.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 1293672 ----a-w- c:\windows\system32\drivers\tcpip.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 12240 ----a-w- c:\windows\system32\drivers\swenum.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 53632 ----a-w- c:\windows\system32\drivers\stream.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 28032 ----a-w- c:\windows\system32\drivers\storvsc.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 21072 ----a-w- c:\windows\system32\drivers\stexstor.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 182680 ----a-w- c:\windows\system32\drivers\ssudmdm.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 148864 ----a-w- c:\windows\system32\drivers\storport.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 84248 ----a-w- c:\windows\system32\drivers\ssudbus.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 136808 ----a-w- c:\windows\system32\drivers\ssadmdm.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 12776 ----a-w- c:\windows\system32\drivers\ssadmdfl.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 10472 ----a-w- c:\windows\system32\drivers\ssadcmnt.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 10472 ----a-w- c:\windows\system32\drivers\ssadcm.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 10344 ----a-w- c:\windows\system32\drivers\ssadwhnt.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 10344 ----a-w- c:\windows\system32\drivers\ssadwh.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 121064 ----a-w- c:\windows\system32\drivers\ssadbus.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 77888 ----a-w- c:\windows\system32\drivers\sisraid4.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 71168 ----a-w- c:\windows\system32\drivers\smb.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 405504 ----a-w- c:\windows\system32\drivers\spsys.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 311808 ----a-w- c:\windows\system32\drivers\srv.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 310272 ----a-w- c:\windows\system32\drivers\srv2.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 17472 ----a-w- c:\windows\system32\drivers\spldr.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 17408 ----a-w- c:\windows\system32\drivers\smclib.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 114688 ----a-w- c:\windows\system32\drivers\srvnet.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 40016 ----a-w- c:\windows\system32\drivers\sisraid2.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 52304 ----a-w- c:\windows\system32\drivers\SISAGP.SYS.bak2014-01-04 14:31 . 2014-01-04 14:31 18944 ----a-w- c:\windows\system32\drivers\SiLib.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 13824 ----a-w- c:\windows\system32\drivers\sfloppy.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 83456 ----a-w- c:\windows\system32\drivers\serial.sys.bak2014-01-04 14:31 . 2014-01-04 14:31 19968 ----a-w- c:\windows\system32\drivers\sermouse.sys.bak2013-12-10 16:16 . 2013-12-10 16:16 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4.[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]2011-05-09 09:49 176936 ----a-w- c:\program files\DVDVideoSoftTB\prxtbDVD2.dll.[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\prxtbDVD2.dll" [2011-05-09 176936].[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}].[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]"{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\program files\DVDVideoSoftTB\prxtbDVD2.dll" [2011-05-09 176936].[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]@="{C5994560-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]2011-06-13 15:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]@="{C5994561-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]2011-06-13 15:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]@="{C5994562-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]2011-06-13 15:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]@="{C5994563-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]2011-06-13 15:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]@="{C5994564-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]2011-06-13 15:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]@="{C5994565-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]2011-06-13 15:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]@="{C5994566-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]2011-06-13 15:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]@="{C5994567-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]2011-06-13 15:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]@="{C5994568-53D9-4125-87C9-F193FC689CB2}"[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]2011-06-13 15:20 64792 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]2013-05-25 00:36 130736 ----a-w- c:\users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]2013-05-25 00:36 130736 ----a-w- c:\users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]2013-05-25 00:36 130736 ----a-w- c:\users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]2013-05-25 00:36 130736 ----a-w- c:\users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-11-14 20584608]"BIBLauncher"="c:\program files\Business-in-a-Box\BIBLauncher.exe" [2013-10-22 3925296].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"PDVDDXSrv"="rem" [X]"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2010-10-19 1439496]"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 947152]"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336].c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk - c:\users\Administrator\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-24 27776968].c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2011-11-11 1155432]VPN Client.lnk - c:\windows\Installer\{21E247D4-5E27-4BEA-AA4D-19A81203FE2A}\Icon3E5562ED7.ico -user_logon [2012-1-22 6144].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"= 0 (0x0)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableLUA"= 0 (0x0)"EnableUIADesktopToggle"= 0 (0x0)"PromptOnSecureDesktop"= 0 (0x0)"DisableCAD"= 1 (0x1).[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]"UseDefaultTile"= 1 (0x1).[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]"aux9"=wdmaud.drv.[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]@="Service".R1 MpKslfd651bfa;MpKslfd651bfa;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{008A9175-FC56-4CC1-A274-3CBF4FAC3F13}\MpKslfd651bfa.sys [x]R2 NovacomD;Palm Novacom;c:\program files\Palm, Inc\novacomd\x86\novacomd.exe [x]R2 Palm_TCP_Relay;Palm TCP Relay;c:\program files\Palm\PDK\tcprelay.exe [2010-06-16 11776]R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-09-05 171680]R3 acsock;acsock;c:\windows\system32\DRIVERS\acsock.sys [2011-09-09 87976]R3 AtiDCM;AtiDCM;c:\drivers\video\Bin\atidcmxx.sys [x]R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2013-08-20 84248]R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 100328]R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 295232]R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-06-02 121064]R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-06-02 12776]R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-06-02 136808]R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2013-08-20 182680]R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-04-06 1343400]R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-07-23 47128]R4 RsFx0103;RsFx0103 Driver;c:\windows\system32\DRIVERS\RsFx0103.sys [2009-03-30 239336]R4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-03-30 366936]S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2010-12-01 143248]S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2010-12-01 41936]S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-18 176128]S2 FinistAgent;FinistAgent;c:\program files\Monitel\FinistServer\AgentService.exe [2013-04-23 54784]S2 FinistServer;FinistServer;c:\program files\Monitel\FinistServer\FinistServer.exe [2012-09-26 8192]S2 GdaServer;GdaServer;c:\program files\Monitel\FinistServer\Monitel.Finist.GenericDataAccess.Service.exe [2012-09-26 10752]S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-07-06 173352]S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2011-01-27 2253688]S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2012-08-24 2735528]S2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2012-01-18 450848]S3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k6232.sys [2010-02-26 214696]S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 22856]S3 PsxDrv;PsxDrv;c:\windows\system32\drivers\psxdrv.sys [2009-07-13 9216]S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2010-12-01 100560]S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2010-12-01 111504]..--- Other Services/Drivers In Memory ---.*NewlyCreated* - WS2IFSL.[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]LPDService REG_MULTI_SZ LPDSVCHPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12.[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]2013-12-05 00:12 1211344 ----a-w- c:\program files\Google\Chrome\Application\32.0.1700.41\Installer\chrmstp.exe.Contents of the 'Scheduled Tasks' folder.2014-01-04 c:\windows\Tasks\Adobe Flash Player Updater.job- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-28 02:16].2014-01-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-03 01:23].2014-01-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-03 01:23]..------- Supplementary Scan -------.uInternet Settings,ProxyOverride = *.localIE: Download with 4Media YouTube to iPod Converter - c:\program files\4Media\YouTube to iPod Converter\upod_link.HTMIE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000IE: Free YouTube to iPod Converter - c:\users\Administrator\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htmTrusted Zone: kent.eduTCP: DhcpNameServer = 192.168.1.1TCP: Interfaces\{10104CC5-73E5-4D56-B38A-C34CED98414E}: NameServer = 131.123.47.62,131.123.35.62DPF: {CC679CB8-DC4B-458B-B817-D447B3B6AC31} - vpnweb.cabFF - ProfilePath - c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\8wu3qn3j.default\FF - prefs.js: browser.search.selectedEngine - mail.ru: Поиск в ИнтернетеFF - ExtSQL: 2013-11-11 18:57; ynpyqfjjnuhyzc@hjtvvpagbmyud.com; c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\8wu3qn3j.default\extensions\ynpyqfjjnuhyzc@hjtvvpagbmyud.comFF - ExtSQL: 2013-12-20 23:39; ext@WebexpEnhancedV1alpha413.net; c:\program files\WebexpEnhancedV1\WebexpEnhancedV1alpha413\ffFF - ExtSQL: !HIDDEN! 2013-11-11 18:57; ynpyqfjjnuhyzc@hjtvvpagbmyud.com; c:\program files\Mozilla Firefox\extensions\ynpyqfjjnuhyzc@hjtvvpagbmyud.com.- - - - ORPHANS REMOVED - - - -.Toolbar-ITBar7Position - (no file)...[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\TrueSight]"ImagePath"="\??\".--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Internet Explorer\User Preferences]@Denied: (2) (Administrator)"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,74,fe,7b,88,f9,66,dc,4d,95,7c,53,\"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,74,fe,7b,88,f9,66,dc,4d,95,7c,53,\.[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.3G2".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.3GP".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.3G2".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.3GP".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.ADTS".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.ADTS".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.ADTS".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.AIFF".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.AIFF".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.AIFF".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.ASF".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.ASX".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.AU".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.AVI".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cda\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.CDA".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.finproj\UserChoice]@Denied: (2) (Administrator)"Progid"="finproj_auto_file".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]@Denied: (2) (Administrator)"Progid"="PBrush".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]@Denied: (2) (Administrator)"Progid"="ChromeHTML".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]@Denied: (2) (Administrator)"Progid"="ChromeHTML".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]@Denied: (2) (Administrator)"Progid"="jpegfile".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MPEG".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2t\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.M2TS".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2ts\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.M2TS".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2v\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MPEG".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.m3u".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.M4A".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MP4".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MIDI".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MIDI".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mod\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MPEG".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MOV".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MP3".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MPEG".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MP3".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MP4".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MP4".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MPEG".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MPEG".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MPEG".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MPEG".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MPEG".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mts\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.M2TS".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoice]@Denied: (2) (Administrator)"Progid"="AcroExch.Document".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]@Denied: (2) (Administrator)"Progid"="Applications\\AcroRd32.exe".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.resx\UserChoice]@Denied: (2) (Administrator)"Progid"="Applications\\VSLauncher.exe".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.MIDI".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]@Denied: (2) (Administrator)"Progid"="ChromeHTML".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.AU".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tex\UserChoice]@Denied: (2) (Administrator)"Progid"="Applications\\pdflatex.exe".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ts\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.TTS".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tts\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.TTS".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.WAV".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wax\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.WAX".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.ASF".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.WMA".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmd\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.WMD".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wms\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.WMS".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.WMV".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmx\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.ASX".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmz\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.WMZ".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.WPL".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\UserChoice]@Denied: (2) (Administrator)"Progid"="WMP11.AssocFile.WVX".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]@Denied: (2) (Administrator)"Progid"="ChromeHTML".[HKEY_USERS\S-1-5-21-2976120555-305352736-41816922-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]@Denied: (2) (Administrator)"Progid"="ChromeHTML".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="IFlashBroker5".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]@Denied: (Full) (Everyone).--------------------- DLLs Loaded Under Running Processes ---------------------.- - - - - - - > 'Explorer.exe'(5032)c:\users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll.Completion time: 2014-01-04 10:47:32ComboFix-quarantined-files.txt 2014-01-04 15:47ComboFix2.txt 2014-01-04 15:13.Pre-Run: 356,493,766,656 bytes freePost-Run: 356,444,008,448 bytes free.- - End Of File - - A99D4F6E6609C51E38BAC0ADE8C7072AA36C5E4F47E84449FF07ED3517B43A31 Link to post Share on other sites More sharing options...
MrCharlie Posted January 4, 2014 ID:773345 Share Posted January 4, 2014 Lets clean out any adware/spyware now: (this will require a reboot so save all your work) Please download AdwCleaner by Xplode and save to your Desktop. Make sure you click on download buttons that look similar to this, not "sponsored ad links": Double click on AdwCleaner.exe to run the tool. Vista/Windows 7/8 users right-click and select Run As AdministratorClick on the Scan button.AdwCleaner will begin...be patient as the scan may take some time to complete.When it's done you'll see: Pending: Please uncheck elements you don't want removed.Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.Look over the log especially under Files/Folders for any program you want to save.If there's a program you may want to save, just uncheck it from AdwCleaner.If you're not sure, post the log for review. (all items found are adware/spyware/foistware)If you're ready to clean it all up.....click the Clean button.After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.Copy and paste the contents of that logfile in your next reply.A copy of that logfile will also be saved in the C:\AdwCleaner folder.Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\QuarantineTo restore an item that has been deleted:Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.Then.................. Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal. Please Update and run a FULL Scan with Malwarebytes Anti-Malware, post the report. Make sure that everything is checked, and click Remove Selected. Please let me know how computer is running now, MrC Link to post Share on other sites More sharing options...
mikhail23 Posted January 4, 2014 Author ID:773363 Share Posted January 4, 2014 # AdwCleaner v3.016 - Report created 04/01/2014 at 10:58:32# Updated 23/12/2013 by Xplode# Operating System : Windows 7 Enterprise Service Pack 1 (32 bits)# Username : Administrator - DESK# Running from : C:\Users\Administrator\Desktop\AdwCleaner.exe# Option : Clean ***** [ Services ] ***** ***** [ Files / Folders ] ***** Folder Deleted : C:\Program Files\ConduitFolder Deleted : C:\Program Files\DVDVideoSoftTBFolder Deleted : C:\Program Files\Mail.RuFolder Deleted : C:\Program Files\Common Files\DVDVideoSoft\TBFolder Deleted : C:\Users\Administrator\AppData\Local\ConduitFolder Deleted : C:\Users\Administrator\AppData\Local\SwvUpdaterFolder Deleted : C:\Users\Administrator\AppData\LocalLow\ConduitFolder Deleted : C:\Users\Administrator\AppData\LocalLow\DVDVideoSoftTBFolder Deleted : C:\Users\Administrator\AppData\LocalLow\Mail.RuFolder Deleted : C:\Users\Administrator\AppData\LocalLow\PriceGongFolder Deleted : C:\Users\Administrator\AppData\Roaming\dvdvideosoftiehelpersFolder Deleted : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\8wu3qn3j.default\ConduitFolder Deleted : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\8wu3qn3j.default\ConduitEngineFolder Deleted : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\8wu3qn3j.default\CT2269050Folder Deleted : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\8wu3qn3j.default\Extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}Folder Deleted : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\8wu3qn3j.default\Extensions\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}Folder Deleted : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\8wu3qn3j.default\Extensions\engine@conduit.comFile Deleted : C:\Windows\system32\conduitEngine.tmpFile Deleted : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\8wu3qn3j.default\user.js ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\poheodfamflhhhdcmjfeggbgigeefacoKey Deleted : HKLM\SOFTWARE\Classes\Conduit.EngineKey Deleted : HKLM\SOFTWARE\Microsoft\Tracing\DVDVideoSoftTBAutoUpdateHelper_RASAPI32Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\DVDVideoSoftTBAutoUpdateHelper_RASMANCSKey Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2269050Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C40CCB73-5DA3-44DE-AC25-5D5836E7F26A}Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C40CCB73-5DA3-44DE-AC25-5D5836E7F26A}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C40CCB73-5DA3-44DE-AC25-5D5836E7F26A}Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C40CCB73-5DA3-44DE-AC25-5D5836E7F26A}Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3A552C9C-B980-4BCA-A232-34F9855D8138}Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{030C17B3-B3E0-4AD1-A350-195147EE0951}Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{FFEBBF0A-C22C-4172-89FF-45215A135AC7}Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]Key Deleted : HKCU\Software\APN PIPKey Deleted : HKCU\Software\InstallCoreKey Deleted : HKCU\Software\YahooPartnerToolbarKey Deleted : HKCU\Software\AppDataLow\ToolbarKey Deleted : HKCU\Software\AppDataLow\Software\ConduitKey Deleted : HKCU\Software\AppDataLow\Software\DVDVideoSoftTBKey Deleted : HKCU\Software\AppDataLow\Software\PriceGongKey Deleted : HKLM\Software\BetterSurfKey Deleted : HKLM\Software\ConduitKey Deleted : HKLM\Software\DVDVideoSoftTBKey Deleted : HKLM\Software\PIPKey Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DVDVideoSoftTB ToolbarKey Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536 ***** [ Browsers ] ***** -\\ Internet Explorer v8.0.7601.17514 -\\ Mozilla Firefox v12.0 (en-US) [ File : C:\Users\PowerPoint\AppData\Roaming\Mozilla\Firefox\Profiles\8wu3qn3j.default\prefs.js ] [ File : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\8wu3qn3j.default\prefs.js ] Line Deleted : user_pref("extensions.enabledItems", "{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3,{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:2.9.2,{ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1,{CAFEEFAC-0016-0000-0024-AB[...] -\\ Google Chrome v32.0.1700.41 [ File : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [7232 octets] - [04/01/2014 10:54:49]AdwCleaner[s0].txt - [6165 octets] - [04/01/2014 10:58:32] ########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [6225 octets] ########## Link to post Share on other sites More sharing options...
mikhail23 Posted January 4, 2014 Author ID:773409 Share Posted January 4, 2014 Malwarebytes Anti-Malware (Trial) 1.75.0.1300www.malwarebytes.org Database version: v2014.01.04.04 Windows 7 Service Pack 1 x86 NTFSInternet Explorer 8.0.7601.17514Administrator :: DESK [administrator] Protection: Enabled 1/4/2014 11:28:03 AMmbam-log-2014-01-04 (11-28-03).txt Scan type: Full scan (C:\|F:\|)Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 664621Time elapsed: 57 minute(s), 31 second(s) Memory Processes Detected: 0(No malicious items detected) Memory Modules Detected: 0(No malicious items detected) Registry Keys Detected: 0(No malicious items detected) Registry Values Detected: 0(No malicious items detected) Registry Data Items Detected: 0(No malicious items detected) Folders Detected: 0(No malicious items detected) Files Detected: 12C:\AdwCleaner\Quarantine\C\Program Files\Conduit\Community Alerts\Alert0.dll.vir (PUP.Optional.Conduit) -> Quarantined and deleted successfully.C:\Tmp\Downloads\Chrome_Setup (1).exe (PUP.Optional.iBryte) -> Quarantined and deleted successfully.C:\Tmp\Downloads\Chrome_Setup (2).exe (PUP.Optional.iBryte) -> Quarantined and deleted successfully.C:\Tmp\Downloads\Chrome_Setup (3).exe (PUP.Optional.iBryte) -> Quarantined and deleted successfully.C:\Tmp\Downloads\Chrome_Setup (4).exe (PUP.Optional.iBryte) -> Quarantined and deleted successfully.C:\Tmp\Downloads\Chrome_Setup (5).exe (PUP.Optional.iBryte) -> Quarantined and deleted successfully.C:\Tmp\Downloads\Chrome_Setup (6).exe (PUP.Optional.iBryte) -> Quarantined and deleted successfully.C:\Tmp\Downloads\Chrome_Setup (7).exe (PUP.Optional.iBryte) -> Quarantined and deleted successfully.C:\Tmp\Downloads\Chrome_Setup (8).exe (PUP.Optional.iBryte) -> Quarantined and deleted successfully.C:\Tmp\Downloads\Chrome_Setup (9).exe (PUP.Optional.iBryte) -> Quarantined and deleted successfully.C:\Tmp\Downloads\Chrome_Setup.exe (PUP.Optional.iBryte) -> Quarantined and deleted successfully.C:\Tmp\Downloads\ZipExtractorSetup.exe (PUP.Optional.InstallCore) -> Quarantined and deleted successfully. (end) Link to post Share on other sites More sharing options...
mikhail23 Posted January 4, 2014 Author ID:773410 Share Posted January 4, 2014 The computer seems happy. The "hidden radio" commercials after running AdwCleaner.Am I cured now? Link to post Share on other sites More sharing options...
mikhail23 Posted January 4, 2014 Author ID:773413 Share Posted January 4, 2014 The computer seems happy. The "hidden radio" commercials after running AdwCleaner.Am I cured now?I mean the "commercials" stopped after running AdwCleaner. So the virus seems gone. Link to post Share on other sites More sharing options...
MrCharlie Posted January 4, 2014 ID:773445 Share Posted January 4, 2014 Yes..... Lets check your computers security before you go and we have a little cleanup to do also: Download Security Check by screen317 from HERE or HERE.Save it to your Desktop.Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.If you get Unsupported operating system. Aborting now, just reboot and try again.A Notepad document should open automatically called checkup.txt.Please Post the contents of that document.Do Not Attach It!!!MrC Link to post Share on other sites More sharing options...
mikhail23 Posted January 4, 2014 Author ID:773459 Share Posted January 4, 2014 Results of screen317's Security Check version 0.99.78 Windows 7 Service Pack 1 x86 (UAC is disabled!) ``````````````Antivirus/Firewall Check:`````````````` Windows Security Center service is not running! This report may not be accurate! Windows Firewall Enabled! Windows Firewall Disabled! Microsoft Security Essentials (On Access scanning disabled!) Error obtaining update status for antivirus! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware version 1.75.0.1300 Java 6 Update 30 Java 7 Update 45 Adobe Flash Player 11.9.900.170 Adobe Reader 10.0.1 Adobe Reader out of Date! Mozilla Firefox 12.0 Firefox out of Date! Google Chrome 31.0.1650.57 Google Chrome 32.0.1700.41 Google Chrome plugins... ````````Process Check: objlist.exe by Laurent```````` Microsoft Security Essentials MSMpEng.exe Microsoft Security Essentials msseces.exe Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 1% ````````````````````End of Log`````````````````````` Link to post Share on other sites More sharing options...
MrCharlie Posted January 4, 2014 ID:773476 Share Posted January 4, 2014 Out dated programs on the system are vulnerable to malware.Please update or uninstall them:----------------------------Adobe Reader 10.0.1 Adobe Reader out of Date! <---please check for an update if available or uninstall and download and install Foxit Reader which is less vulnerable to malware and much better than Adobe. Don't install any toolbars that may come with it (ASK Toolbar).-------------------------------Mozilla Firefox 12.0 Firefox out of Date! <----please check for an update if available.-----------------------------A little clean up to do....Please Uninstall ComboFix: (if you used it)Press the Windows logo key + R to bring up the "run box"Copy and paste next command in the field:ComboFix /uninstallMake sure there's a space between Combofix and /Then hit enter.This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller)---------------------------------Please download OTC to your desktop. (This will clean up most of the tools and logs)http://oldtimer.geekstogo.com/OTC.exeDouble-click OTC to run it. (Vista and up users, please right click on OTC and select "Run as an Administrator")Click on the CleanUp! button and follow the prompts.(If you get a warning from your firewall or other security programs regarding OTC attempting to contact the Internet, please allow the connection.)You will be asked to reboot the machine to finish the Cleanup process, choose Yes.After the reboot all the tools we used should be gone.Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.Any other programs or logs you can manually delete. (right click.....Delete)IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST folder, FRST-OlderVersion folder, MBAR folder, etc....AdwCleaner > just run the program and click uninstall.Note:If you used FRST and can't delete the quarantine folder:Download the fixlist.txt to the same folder as FRST.exe.Run FRST.exe and click Fix only once and waitThat will delete the quarantine folder created by FRST.The rest you can manually delete.-------------------------------Any questions...please post back.If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.Take a look at My Preventive Maintenance to avoid being infected again.Good Luck and Thanks for using the forum, MrC Link to post Share on other sites More sharing options...
mikhail23 Posted January 4, 2014 Author ID:773522 Share Posted January 4, 2014 excellent! thank you so much! Link to post Share on other sites More sharing options...
MrCharlie Posted January 4, 2014 ID:773525 Share Posted January 4, 2014 OK.....Take Care MrC Link to post Share on other sites More sharing options...
LDTate Posted January 6, 2014 ID:774359 Share Posted January 6, 2014 Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you. Link to post Share on other sites More sharing options...
Recommended Posts