Infected Registry. Can't seem to remove

aeg565 · January 10, 2014

Hey all,

Recently I noticed that my computer was running significantly slower. I ran AVG and got rid of 24 security threats, thinking that this would remedy the problem... unfortunately I was wrong. I then used adwcleaner to try locate and destroy the threat. While it does detect what I'm assuming is the problem (in registry... HKLM\Software\DeviceVM) and says it can delete it, the problem always returns after I restart my computer.

I've ran malwarebytes, security check, adwcleaner, combofix, and a host of other programs to get rid of the problem... no luck.

Right now I deleted chrome, where I believe the file was using an extension to gain access to my information, and am currently running TDSSkiller as a last resort. If this doesn't work what should I do?

Thanks in advance!

Alex

aeg565 · January 10, 2014

Tried TDSSKiller, FRST64, and zoek.exe. Still showing up in the registry section when I run adwcleaner...

kevinf80 · January 10, 2014

Hello and

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Please download SystemLook from the following link below and save it to your Desktop. Use the correct version 32bit or 64bit.

http://jpshortstuff.247fixes.com/SystemLook_x64.exe <<- 64 bit….

http://images.malwareremoval.com/jpshortstuff/SystemLook.exe <<- 32 bit

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:

:regfindDeviceVM

Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Next,

Run Malwarebytes, Open > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Full scan

Make sure that everything is checked, and click Remove Selected on any found items.

Post the produced logs.

Thanks,

Kevin

aeg565 · January 10, 2014

Thanks for your help Kevin.

I'm not the most tech savvy but I'm pretty sure I removed all P2P software from my computer. If I didn't just let me know and I will.

Here's my system look:

SystemLook 30.07.11 by jpshortstuff

Log created at 13:01 on 10/01/2014 by Alex

Administrator - Elevation successful

========== regfind ==========

Searching for "DeviceVM"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\D6D9DA99654AEE9438062FE27EAA2127\InstallProperties]

"Publisher"="DeviceVM, Inc."

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\D6D9DA99654AEE9438062FE27EAA2127\InstallProperties]

"URLInfoAbout"="http://www.devicevm.com"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\DeviceVM]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DvmMDES]

"DisplayName"="DeviceVM Meta Data Export Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\DvmMDES]

"DisplayName"="DeviceVM Meta Data Export Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DvmMDES]

"DisplayName"="DeviceVM Meta Data Export Service"

-= EOF =-

Here's my Malwarebytes:

Malwarebytes Anti-Malware (Trial) 1.75.0.1300

www.malwarebytes.org

Database version: v2014.01.10.07

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.16428

Alex :: ALEX-PC [administrator]

Protection: Enabled

1/10/2014 1:02:42 PM

mbam-log-2014-01-10 (13-02-42).txt

Scan type: Full scan (C:\|D:\|)

Scan options disabled: File System

Objects scanned: 209872

Time elapsed: 31 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

kevinf80 · January 10, 2014

What makes you believe DeviceVM is malicious, I get no bad feedback to any research on the registry entries we see....

http://devicevm-inc.software.informer.com/

If you want those registry entries removed, let me know. I see no reason to mess with anything that is not broke!!

Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Kevin

aeg565 · January 11, 2014

About to run Farbar. I am suspicious because Adwcleaner classifies it as a registry infection.

Thanks again for your help.

aeg565 · January 11, 2014

Addition.txt:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-01-2014

Ran by Alex at 2014-01-10 17:25:42

Running from C:\Users\Alex\Desktop

Boot Mode: Normal

==========================================================

==================== Security Center ========================

AV: AVG AntiVirus 2013 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: AVG AntiVirus 2013 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}

==================== Installed Programs ======================

Update for Microsoft Office 2007 (KB2508958) (x32 Version: - Microsoft)

2007 Microsoft Office system (x32 Version: 12.0.6612.1000 - Microsoft Corporation)

3ivx MPEG-4 5.0.2 (remove only) (x32 Version: 5.0.2 - 3ivx Technologies, Pty. Ltd.)

64 Bit HP CIO Components Installer (Version: 1.2.0 - Hewlett-Packard) Hidden

64 Bit HP CIO Components Installer (Version: 3.2.1 - Hewlett-Packard) Hidden

6500_E709_eDocs (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden

6500_E709_Help (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden

6500_E709n (x32 Version: 50.0.165.000 - Hewlett-Packard) Hidden

7-Zip 9.22beta (x32 Version: - )

Activation Assistant for the 2007 Microsoft Office suites (x32 Version: - Microsoft Corporation)

Activation Assistant for the 2007 Microsoft Office suites (x32 Version: 1.0 - Microsoft Corporation) Hidden

Adobe AIR (x32 Version: 1.5.3.9120 - Adobe Systems Inc.)

Adobe AIR (x32 Version: 1.5.3.9120 - Adobe Systems Inc.) Hidden

Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)

Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.03) (x32 Version: 11.0.03 - Adobe Systems Incorporated)

AIDA64 Extreme v4.00 (x32 Version: 4.00 - FinalWire Ltd.)

Apple Application Support (x32 Version: 1.5.1 - Apple Inc.)

Apple Mobile Device Support (Version: 3.4.0.25 - Apple Inc.)

Apple Software Update (x32 Version: 2.1.1.116 - Apple Inc.)

Assassin's Creed II (x32 Version: 1.01 - Ubisoft)

ASUSUpdate (x32 Version: 7.18.03 - ASUSTeK Computer Inc.)

AutoHotkey 1.0.48.05 (x32 Version: 1.0.48.05 - Chris Mallett)

AVG 2013 (Version: 13.0.3462 - AVG Technologies) Hidden

AVG 2013 (Version: 13.0.3658 - AVG Technologies) Hidden

AVG 2013 (Version: 2013.0.3462 - AVG Technologies)

Batman: Arkham Asylum Demo (x32 Version: 1.0.0.0 - Eidos Inc/Warner Brothers)

Battlefield 4™ (x32 Version: 1.0.0.1 - Electronic Arts)

Bonjour (Version: 2.0.5.0 - Apple Inc.)

bpd_scan (x32 Version: 3.00.0000 - Hewlett-Packard) Hidden

BPDSoftware (x32 Version: 50.0.165.000 - Hewlett-Packard) Hidden

BPDSoftware_Ini (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden

BufferChm (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

Call of Duty: Black Ops (x32 Version: - Treyarch)

Company of Heroes (x32 Version: - Relic)

Core Temp version 0.99.8 (Version: 0.99.8 - Arthur Liberman)

Counter-Strike: Source (x32 Version: - Valve)

CPUID CPU-Z 1.67.1 (Version: - )

Crysis 2 (x32 Version: - Electronic Arts)

Crysis Warhead (x32 Version: - Crytek)

Darksiders II (x32 Version: - )

Dead Rising 2 (x32 Version: 1.0.0000.130 - Capcom)

Dead Rising 2 (x32 Version: 1.0.0000.130 - Capcom) Hidden

Dead Rising 2 (x32 Version: 1.0.0001.130 - Capcom) Hidden

Dead Space 2 (x32 Version: - Electronic Arts)

Destination Component (x32 Version: 110.0.0.0 - Hewlett-Packard) Hidden

DeviceDiscovery (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

Diablo III (x32 Version: 1.0.5.12811 - Blizzard Entertainment)

DocMgr (x32 Version: 120.0.000.000 - Hewlett-Packard) Hidden

DocProc (x32 Version: 12.0.0.0 - Hewlett-Packard) Hidden

Dota 2 (x32 Version: - Valve)

Download Manager 2.3.10 (x32 Version: 2.3.10 - IGN Entertainment, Inc.)

ESN Sonar (x32 Version: 0.70.4 - ESN Social Software AB)

EVGA Precision 1.7.1 (x32 Version: 1.7.1 - EVGA Corporation)

EVGA Precision X 4.2.1 (x32 Version: 4.2.1 - EVGA Corporation)

Facebook Plug-In (HKCU Version: - Facebook, Inc.)

Fallout 3 (x32 Version: 1.00.0000 - Bethesda Softworks)

Fax (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

FileZilla Client 3.3.2 (x32 Version: 3.3.2 - )

Folk Tale (x32 Version: - Games Foundry)

Fraps (x32 Version: - )

Game Booster 3 (x32 Version: 3.4 - IObit)

GameSpy Comrade (x32 Version: 1.5.0.156 - GameSpy)

GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden

Google Chrome (x32 Version: 31.0.1650.63 - Google Inc.)

Google Earth (x32 Version: 7.1.2.2041 - Google)

Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden

HP Customer Participation Program 12.0 (Version: 12.0 - HP)

HP Document Manager 2.0 (Version: 2.0 - HP)

HP Imaging Device Functions 12.0 (Version: 12.0 - HP)

HP Officejet 6500 E709 Series (Version: 12.0 - HP)

HP Smart Web Printing (Version: 4.05 - HP)

HP Update (x32 Version: 4.000.011.006 - Hewlett-Packard)

HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden

iTunes (Version: 10.2.2.12 - Apple Inc.)

Java Auto Updater (x32 Version: 2.0.3.1 - Sun Microsystems, Inc.) Hidden

Java 6 Update 24 (x32 Version: 6.0.240 - Sun Microsystems, Inc.)

League of Legends (x32 Version: 1.3 - Riot Games) Hidden

Left 4 Dead 2 (x32 Version: - Valve)

Malwarebytes Anti-Malware version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)

MarketResearch (x32 Version: 120.0.226.000 - Hewlett-Packard) Hidden

Medieval II: Total War (x32 Version: - The Creative Assembly)

Medieval II: Total War Kingdoms (x32 Version: - The Creative Assembly)

Metro Last Light (x32 Version: - )

Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322 - Microsoft)

Microsoft .NET Framework 4.5 (Version: 4.5.50709 - Microsoft Corporation) Hidden

Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.88.0 - Microsoft Corporation)

Microsoft Games for Windows Marketplace (x32 Version: 3.5.50.0 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden

Microsoft Office Access MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Access Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Outlook MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Professional Hybrid 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden

Microsoft Office Publisher MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)

Microsoft VC9 runtime libraries (x32 Version: 2.0.0 - AOL Inc.) Hidden

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (Version: 8.0.51011 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden

Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0 - Microsoft Corp.)

Microsoft Xbox 360 Accessories 1.2 (Version: 1.20.146.0 - Microsoft)

MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)

Napoleon: Total War (x32 Version: - The Creative Assembly)

Network64 (Version: 120.0.194.000 - Hewlett-Packard) Hidden

Nexus Mod Manager (Version: 0.46.0 - Black Tree Gaming)

NVIDIA 3D Vision Controller Driver 332.21 (Version: 332.21 - NVIDIA Corporation)

NVIDIA 3D Vision Driver 332.21 (Version: 332.21 - NVIDIA Corporation)

NVIDIA Control Panel 332.21 (Version: 332.21 - NVIDIA Corporation) Hidden

NVIDIA GeForce Experience 1.8.1 (Version: 1.8.1 - NVIDIA Corporation)

NVIDIA Graphics Driver 332.21 (Version: 332.21 - NVIDIA Corporation)

NVIDIA HD Audio Driver 1.3.30.1 (Version: 1.3.30.1 - NVIDIA Corporation)

NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden

NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden

NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden

NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden

NVIDIA PhysX System Software 9.13.0725 (Version: 9.13.0725 - NVIDIA Corporation)

NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden

NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3221 - NVIDIA Corporation) Hidden

NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden

NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden

NVIDIA Virtual Audio 1.2.19 (Version: 1.2.19 - NVIDIA Corporation)

OCR Software by I.R.I.S. 12.0 (Version: 12.0 - HP)

Origin (x32 Version: 9.3.11.2762 - Electronic Arts, Inc.)

PC Wizard 2012.2.11 (x32 Version: - CPUID)

PowerISO (x32 Version: 5.7 - Power Software Ltd)

ProductContext (x32 Version: 50.0.165.000 - Hewlett-Packard) Hidden

PunkBuster Services (x32 Version: 0.993 - Even Balance, Inc.)

QuickTime (x32 Version: 7.69.80.9 - Apple Inc.)

Ralink RT2870 Wireless LAN Card (x32 Version: 1.5.26.0 - Ralink)

RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden

RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden

RivaTuner v2.24 (x32 Version: v2.24 - Alexey Nicolaychuk)

Safari (x32 Version: 5.33.18.5 - Apple Inc.)

Saints Row IV (x32 Version: 1 - )

Scan (x32 Version: 12.0.0.0 - Hewlett-Packard) Hidden

SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden

SmartWebPrinting (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

Source SDK Base 2007 (x32 Version: - Valve)

SpeedFan (remove only) (x32 Version: - )

Spelling Dictionaries Support For Adobe Reader 9 (x32 Version: 9.0.0 - Adobe Systems Incorporated)

Spotify (HKCU Version: 0.9.6.81.gd359a796 - Spotify AB)

StarCraft II (x32 Version: 1.3.4.18701 - Blizzard Entertainment)

Status (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

Steam (x32 Version: 1.0.0.0 - Valve Corporation)

System Requirements Lab CYRI (x32 Version: 4.4.21.0 - Husdawg, LLC)

The Elder Scrolls V: Skyrim (x32 Version: - Bethesda Game Studios)

The Sims™ 3 (x32 Version: 1.4.6 - Electronic Arts)

The Walking Dead (x32 Version: - )

Third Age - Total War 3.0 (Part 1of2) (HKCU Version: - )

Third Age - Total War 3.0 (Part 2of2) (HKCU Version: - )

Toolbox (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

Torchlight II (x32 Version: - )

Total War: ROME II (x32 Version: - Creative Assembly)

Total War: SHOGUN 2 (x32 Version: - The Creative Assembly)

TrayApp (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

Tropico 4 (x32 Version: - )

TurboV (x32 Version: 1.00.17 - )

Ubisoft Game Launcher (x32 Version: 1.0.0.0 - UBISOFT)

UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden

Update for 2007 Microsoft Office System (KB967642) (x32 Version: - Microsoft)

Update for Microsoft .NET Framework 4.5 (KB2750147) (x32 Version: 1 - Microsoft Corporation)

Update for Microsoft .NET Framework 4.5 (KB2805221) (x32 Version: 1 - Microsoft Corporation)

Update for Microsoft Office 2007 Help for Common Features (KB963673) (x32 Version: - Microsoft)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32 Version: - Microsoft)

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32 Version: - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32 Version: - Microsoft)

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32 Version: - Microsoft)

Update for Microsoft Office Access 2007 Help (KB963663) (x32 Version: - Microsoft)

Update for Microsoft Office Excel 2007 Help (KB963678) (x32 Version: - Microsoft)

Update for Microsoft Office OneNote 2007 Help (KB963670) (x32 Version: - Microsoft)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32 Version: - Microsoft)

Update for Microsoft Office Outlook 2007 Help (KB963677) (x32 Version: - Microsoft)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2850085) 32-Bit Edition (x32 Version: - Microsoft)

Update for Microsoft Office Powerpoint 2007 Help (KB963669) (x32 Version: - Microsoft)

Update for Microsoft Office Publisher 2007 Help (KB963667) (x32 Version: - Microsoft)

Update for Microsoft Office Script Editor Help (KB963671) (x32 Version: - Microsoft)

Update for Microsoft Office Word 2007 Help (KB963665) (x32 Version: - Microsoft)

Ventrilo Client for Windows x64 (Version: 3.0.5.0 - Flagship Industries, Inc.)

Visual Studio 2010 x64 Redistributables (Version: 13.0.0.1 - AVG Technologies)

VLC media player 2.0.8 (x32 Version: 2.0.8 - VideoLAN)

Warhammer® 40,000®: Dawn of War® II – Retribution™ (x32 Version: - Relic)

WarhammerÂ® 40,000Â®: Dawn of WarÂ® II â€“ Retributionâ„¢ Beta (x32 Version: - )

WebReg (x32 Version: 120.0.194.000 - Hewlett-Packard) Hidden

Windows Live ID Sign-in Assistant (Version: 6.500.3165.0 - Microsoft Corporation)

Windows Live installer (x32 Version: 12.0.1471.1025 - Microsoft Corporation)

Windows Live Mail (x32 Version: 12.0.1606.1023 - Microsoft Corporation)

Windows Live Photo Gallery (x32 Version: 12.0.1329.0201 - Microsoft Corporation)

Windows Live Toolbar (x32 Version: 03.01.0146 - Microsoft Corporation)

Windows Live Toolbar (x32 Version: 03.01.0146 - Microsoft Corporation) Hidden

Windows Live Writer (x32 Version: 12.0.1370.0325 - Microsoft Corporation)

XCOM: Enemy Unknown (x32 Version: - Firaxis Games)

==================== Restore Points =========================

09-01-2014 06:29:15 Scheduled Checkpoint

10-01-2014 01:34:36 Installed DirectX

10-01-2014 06:16:17 Installed Microsoft Fix it 50535

10-01-2014 06:34:51 zoek.exe restore point

10-01-2014 09:30:46 Removed Realtek 8169 8168 8101E 8102E Ethernet Driver

10-01-2014 09:35:12 Windows Update

==================== Hosts content: ==========================

2010-11-14 22:51 - 2014-01-09 22:07 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMM

Task: {1BB2838D-53E4-4422-B165-B754BF7269B5} - System32\Tasks\{E376AFF9-6889-4497-9A7A-65D8162861F1} => C:\Program Files (x86)\Skype\\Phone\Skype.exe

Task: {39D016F8-9867-4748-BEC6-7B712F61A266} - System32\Tasks\ASUS\ASUS Update Checker => C:\Program Files (x86)\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe [2009-12-28] (ASUSTeK Computer Inc.)

Task: {4F083A2F-BF8C-493F-91FC-AE7F05408A13} - System32\Tasks\RealCreateProcessScheduledTask22286474S-1-5-21-3530666769-31344507-419582560-1000 => C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [2012-07-18] (RealNetworks, Inc.)

Task: {6D8F888C-A260-46FA-98BA-54222A7B163C} - System32\Tasks\RealCreateProcessScheduledTask13284608S-1-5-21-3530666769-31344507-419582560-1000 => C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [2012-07-18] (RealNetworks, Inc.)

Task: {712C6861-2B14-4E72-92BA-22B6921FE2B7} - System32\Tasks\Microsoft\Windows\Wired\GatherWiredInfo => C:\Windows\system32\gatherWiredInfo.vbs

Task: {72FDB32F-F4EC-442F-BAB4-A9FD3F8DCE30} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-3530666769-31344507-419582560-1000 => C:\Program Files (x86)\Real\RealUpgrade\realupgrade.exe [2012-06-21] (RealNetworks, Inc.)

Task: {798FB25E-6B32-4D35-B724-6D74983401B4} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-10] (Adobe Systems Incorporated)

Task: {8C47C0E8-EC95-47A6-B25F-7ADE5BB5CF07} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-02-18] (Google Inc.)

Task: {97981417-592E-4FA5-9F81-1D65D5C214B5} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-02-18] (Google Inc.)

Task: {ADBFEB18-DB64-408F-8156-58ABB1E3CCD8} - \BackgroundContainer Startup Task No Task File

Task: {AE576ACD-6035-4B88-9463-AB0F15C10B2E} - System32\Tasks\RealCreateProcessScheduledTask24086991S-1-5-21-3530666769-31344507-419582560-1000 => C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [2012-07-18] (RealNetworks, Inc.)

Task: {CD423F9F-2608-45A0-A69B-6E81EACDC651} - System32\Tasks\Game_Booster_AutoUpdate => C:\Program Files (x86)\IObit\Game Booster\Autoupdate.exe [2013-07-30] ()

Task: {D00C4662-E092-45E7-96A6-0374F76F7F16} - System32\Tasks\Check Updates for Windows Live Toolbar => C:\Program Files (x86)\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19] (Microsoft Corporation)

Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs

Task: {F881D13C-F14C-4D7A-B96F-3C80BC955C2C} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3530666769-31344507-419582560-1000 => C:\Program Files (x86)\Real\RealUpgrade\realupgrade.exe [2012-06-21] (RealNetworks, Inc.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\Check Updates for Windows Live Toolbar.job => C:\Program Files (x86)\Windows Live Toolbar\MSNTBUP.EXE

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2010-01-02 06:42 - 2010-01-02 06:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll

2009-04-17 10:15 - 2005-05-11 15:39 - 00565248 _____ () C:\Program Files\ASUS\TurboV\pngio.dll

2009-04-17 10:15 - 2008-09-04 16:42 - 01126912 _____ () C:\Program Files\ASUS\TurboV\OcProfile.dll

2009-04-17 10:15 - 2008-08-21 14:19 - 00126976 _____ () C:\Program Files\ASUS\TurboV\TVOCLIB.DLL

2009-10-23 16:01 - 2009-10-23 16:01 - 00067872 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2010-02-21 08:33 - 2010-02-21 08:33 - 00094208 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll

2014-01-09 23:02 - 2013-12-03 18:47 - 00702416 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\libglesv2.dll

2014-01-09 23:02 - 2013-12-03 18:47 - 00099792 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\libegl.dll

2014-01-09 23:02 - 2013-12-03 18:48 - 04055504 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll

2014-01-09 23:02 - 2013-12-03 18:48 - 00399312 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll

2014-01-09 23:02 - 2013-12-03 18:47 - 01619408 _____ () C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:05EE1EEF

AlternateDataStreams: C:\ProgramData\TEMP:D1B5B4F1

AlternateDataStreams: C:\ProgramData\TEMP:DFC5A2B2

==================== Safe Mode (whitelisted) ===================

==================== Faulty Device Manager Devices =============

Name: Officejet J6400 series

Description: Officejet J6400 series

Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}

Manufacturer: HP

Service:

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Officejet Pro 8600

Description: Officejet Pro 8600

Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}

Manufacturer: HP

Service:

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Officejet 6700

Description: Officejet 6700

Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}

Manufacturer: HP

Service:

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

==================== Event log errors: =========================

Application errors:

==================

Error: (01/10/2014 01:43:16 PM) (Source: SideBySide) (User: )

Description: Activation context generation failed for "assemblyIdentity1".Error in manifest or policy file "assemblyIdentity2" on line assemblyIdentity3.

The value "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" of attribute "version" in element "assemblyIdentity" is invalid.

Error: (01/10/2014 01:00:29 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/09/2014 10:47:46 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/09/2014 10:24:01 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/09/2014 09:38:29 PM) (Source: Application Hang) (User: )

Description: The program mbam.exe version 1.75.0.1 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: b50

Start Time: 01cf0dc542e92c57

Termination Time: 0

Application Path: C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

Report Id: 6cb266e9-79b9-11e3-9087-00248c85808f

Error: (01/09/2014 09:28:06 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/09/2014 09:21:12 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/09/2014 07:45:43 PM) (Source: SideBySide) (User: )

Description: Activation context generation failed for "assemblyIdentity1".Error in manifest or policy file "assemblyIdentity2" on line assemblyIdentity3.

The value "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" of attribute "version" in element "assemblyIdentity" is invalid.

System errors:

=============

Error: (01/10/2014 00:59:02 PM) (Source: Service Control Manager) (User: )

Description: The HOSTS Anti-PUPs service failed to start due to the following error:

%%2

Error: (01/10/2014 01:39:25 AM) (Source: Service Control Manager) (User: )

Description: The ScRegSetValueExW call failed for FailureActions with the following error:

%%5

Error: (01/10/2014 01:39:25 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT AUTHORITY)

Description: Installation Failure: Windows failed to install the following update with error 0x80070002: Security Update for Microsoft .NET Framework 4.5 on Windows 7, Vista, Windows Server 2008, Windows Server 2008 R2 for x64 (KB2861208).

Error: (01/10/2014 01:39:25 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT AUTHORITY)

Description: Installation Failure: Windows failed to install the following update with error 0x80070002: Security Update for Microsoft .NET Framework 4.5 on Windows 7, Vista, Windows Server 2008, Windows Server 2008 R2 for x64 (KB2742613).

Error: (01/10/2014 01:39:25 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT AUTHORITY)

Description: Installation Failure: Windows failed to install the following update with error 0x80246007: Security Update for Windows 7 for x64-based Systems (KB2893984).

Error: (01/10/2014 01:39:25 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT AUTHORITY)

Description: Installation Failure: Windows failed to install the following update with error 0x80246007: Update for Windows 7 for x64-based Systems (KB2913152).

Error: (01/10/2014 01:39:25 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT AUTHORITY)

Description: Installation Failure: Windows failed to install the following update with error 0x80246007: Security Update for Windows 7 for x64-based Systems (KB2893294).

Error: (01/10/2014 01:39:25 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT AUTHORITY)

Description: Installation Failure: Windows failed to install the following update with error 0x80242fff: Cumulative Security Update for Internet Explorer 11 for Windows 7 for x64-based Systems (KB2898785).

Error: (01/10/2014 01:39:25 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT AUTHORITY)

Description: Installation Failure: Windows failed to install the following update with error 0x80246007: Update for Windows 7 for x64-based Systems (KB2904266).

Error: (01/10/2014 01:38:34 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT AUTHORITY)

Description: Installation Failure: Windows failed to install the following update with error 0x80070002: Security Update for Microsoft .NET Framework 4.5 on Windows 7, Vista, Windows Server 2008, Windows Server 2008 R2 for x64 (KB2833957).

Microsoft Office Sessions:

=========================

CodeIntegrity Errors:

===================================

Date: 2014-01-09 22:05:42.085

Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-01-09 22:05:41.976

Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2009-12-25 13:05:35.448