Malwarebytes freezs

kanga85 · January 18, 2014

When I run malwarebytes it seems to find one infection, carries on through C:\windows\system32, but then freezes, "not responding" (and is impossible to close; even using Task Manager; and at times I have needed to turn off the computer to remove the frozen Malwarebytes). It seems to freeze at a different spot each time I run it, about 31000 objects scanned, and stops at places like C:\Users\Linda\Links\Desktop.ini, or C:\Users\Administrater\Computer3\Links\Desktop.lnk, or C:\Users\Ray\Desktop\Epsom\scan.lnk or C:\Users\Ray\Contacts\Ray.contact. Because the Malware detection process never finishes, I am unable to remove my 1 infection.

SuperAntiSpyware runs correctly, and finds nothing wrong.

I have now downloaded and run your latest Chameleon, clicking on the first box. It opens in Dos, and downloads the latest definitions, abd tells me that it is 'Killing known malicious processes. Please wait."

I wait 24 hrs while the computer seems to be running, and the Dos box continues to flash its cursor, and then I give up.

I know I should be patient, but should I wait longer than 24hrs?

dds.txt

attach.txt

Maniac · January 18, 2014

Hello kanga85! My name is Borislav and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.
Do not perform any kind of scanning and fixing without my instructions. If you want to proceed on your own, please let me know.

Step 1

Please uninstall ZoneAlarm LTD Toolbar .

Step 2

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Step 3

Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Scan button. Wait until is finished.
Click on Clean.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner\AdwCleaner[s0].txt as well.

Step 4

Please follow the instructions here:

https://forums.malwarebytes.org/index.php?showtopic=10138&page=1entry417944

Step 5

Launch Malwarebytes' Anti-Malware
Go to Update tab and select Check for Updates. If an update is found, it will download and install the latest version.
Go to Scanner tab and select Perform Quick Scan, then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer,please do so immediately.

In your next reply, post the following log files:

Junkware Removal Tool log
AdwCleaner log
Malwarebytes' Anti-Malware log

kanga85 · January 19, 2014

Thanks for your advice Borislav, which I greatly appreciate. However, I still have troubles.

1. I could not find ZoneAlarm Toolbar anywhere, and could not find out how to remove it. Therefore I proceded to steps 2 and 3 above without removing it.

2. AdwCleaner found some ZoneAlarm and removed it, and wrote a text file. (Attached)

3. I then ran Malwarebytes and it stopped (froze) at C:\users\Ray\Desktop\AdwCleaner[sO].txt. I therefore decided that this file would naturally contain a reference to ZoneAlarm, which seemed to be part of the problem, so I deleted this text file, and ran Malwarebytes again. It froze at Users\Public\Music\Desktop.ini (which folder has never been used by me and which contains no files).

4. I ran AdwCleaner again, and the txt file is attached. It seemed to now find nothing.

5. I booted into Safe Mode (as Administrater) and ran Mbam. It found one problem, and the text file is now attached.

6. I then realised that Internet Explorer (which I never use, being a Firefox man) contined ZoneAlarm as its home page (How?). I removed it.

7. I have then run Mbam a number of times, it freezes every time, always in C:\Users; eg. C:\Users\Ray\desktop\desktop.ini .

Thanks for any further help.

Kanga85 (Ray)

AdwCleanerS1.txt

JRT.txt

mbam-log-2014-01-19 (12-58-28).txt

kanga85 · January 19, 2014

Sorry, the first AdwCleanerS0.txt file was not attached, as I deleted it as described earlier.

Kanga85

Maniac · January 19, 2014

Please read my notes and further instructions:

Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.

kanga85 · January 21, 2014

Borislav,

Sorry for the delay - I thought I had posted a reply two days ago, but it has got lost somewhere.

I followed through all your advice which seemed relevant, but MBam still freezes.

I am now fairly certain that I have cleaned my computer of Malware, having run SuperAntiSpyware, M.S. Security Essentials, Kaspersky TDSS Killer, RKill, Hitman Pro, AdwCleaner, JRT and Eset Online scanner. Malwarebytes now runs without freezing when Win7 is booted into Safe Mode, but still freezes at about the same spots as before (while scanning Users folders).

Since it runs in Safe Mode, I consider that I must have some conflict with some other process that is also running. I am not entirely sure how best to find where this conflict is, but I will play around. I currently have NO antivirus running, so the conflict is not there.

Thanks

Maniac · January 22, 2014

So you decide to work alone?

kanga85 · January 23, 2014

I am sorry.

I did not understand your previous post (#5); "Please read my notes and further instructions:".

I had printed out and followed all your previous instructions (#2) carefully, and found no 'further instructions" in #5.

MBam still freezes when running in Normal mode, but runs well, and finds no problems, in 'Safe' mode.

Maniac · January 23, 2014

Sorry I couldn't help you on this way. If you would like to help you we should start from the beginning and you should follow only my instructions.

kanga85 · January 23, 2014

OK Borislav, go ahead.

Maniac · January 24, 2014

Please generate a new fresh DDS log files.

kanga85 · January 24, 2014

Files pasted:

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.16428 BrowserJavaVersion: 10.51.2
Run by Ray at 9:49:26 on 2014-01-25
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.61.1033.18.4065.1677 [GMT 10:00]
.
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Intel\iCLS Client\HeciServer.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\IProsetMonitor.exe
c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe
C:\Windows\SysWOW64\vmnat.exe
C:\Windows\system32\EscSvc64.exe
C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
C:\Windows\SysWOW64\vmnetdhcp.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\WUDFHost.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\System32\spool\drivers\x64\3\E_YATIIVE.EXE
C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Program Files (x86)\epson\Creativity Suite\Event Manager\EEventManager.exe
C:\Program Files (x86)\FinePixViewer\QuickDCF2.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Users\Ray\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe
C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\Program Files (x86)\VMware\VMware Player\vmplayer.exe
C:\Program Files (x86)\VMware\VMware Player\vmware-unity-helper.exe
C:\Program Files (x86)\VMware\VMware Player\x64\vmware-vmx.exe
C:\Program Files (x86)\VMware\VMware Player\vprintproxy.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.

mWinlogon: Userinit = userinit.exe,
BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll
BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
uRun: [internodeUsage] C:\PROGRA~2\INTERN~2\mum.exe
uRun: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
uRun: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [EPLTarget\P0000000000000001] C:\Windows\System32\spool\DRIVERS\x64\3\E_YATIIVE.EXE /EPT "EPLTarget\P0000000000000001" /M "WF-2530 Series"
mRun: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
mRun: [EEventManager] C:\Program Files (x86)\EPSON\Creativity Suite\Event Manager\EEventManager.exe
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [FUFAXRCV] "C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe"
mRun: [FUFAXSTM] "C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
StartupFolder: C:\Users\Ray\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\Ray\AppData\Roaming\Dropbox\bin\Dropbox.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\EXIFLA~1.LNK - C:\Program Files (x86)\FinePixViewer\QuickDCF2.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MICROS~1.LNK - C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE
uPolicies-Explorer: NoDriveTypeAutoRun = dword:221
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office10\EXCEL.EXE/3000
LSP: %SystemRoot%\system32\vsocklib.dll
DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} -

TCP: NameServer = 192.168.0.1
TCP: Interfaces\{30C85AED-6CA0-4732-AFB8-2A7CC01F7E12} : DHCPNameServer = 192.168.0.1
TCP: Interfaces\{6784E75C-92B9-4232-9EAF-DB4816CF79FC} : DHCPNameServer = 192.168.0.1
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
SSODL: WebCheck - <orphaned>
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
x64-BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-Run: [Nvtmru] "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
x64-Run: [shadowPlay] C:\Windows\System32\rundll32.exe C:\Windows\System32\nvspcap64.dll,ShadowPlayOnSystemStart
x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
x64-Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - <orphaned>
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Ray\AppData\Roaming\Mozilla\Firefox\Profiles\vgp03jla.default\

FF - prefs.js: browser.search.selectedEngine - Search By ZoneAlarm
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2013-9-27 248240]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-23 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-13 12368]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [2014-1-20 144152]
R2 EPSON_PM_RPCV4_05;EPSON V3 Service4(05);C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE [2013-5-21 151648]
R2 EpsonScanSvc;Epson Scanner Service;C:\Windows\System32\escsvc64.exe [2013-5-21 135824]
R2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-4-20 635104]
R2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;C:\Windows\System32\IPROSetMonitor.exe [2012-9-6 170824]
R2 jhi_service;Intel® Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe [2013-5-16 165760]
R2 NvStreamSvc;NVIDIA Streamer Service;C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2013-12-22 15125280]
R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [2013-3-6 39056]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-11-11 414496]
R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2013-5-16 364416]
R2 VMUSBArbService;VMware USB Arbitration Service;C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [2011-8-29 846448]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2010-4-27 83080]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2010-4-27 184968]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);C:\Windows\System32\drivers\nvvad64v.sys [2013-12-22 39200]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2014-1-23 418376]
S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2014-1-23 701512]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;C:\Windows\System32\drivers\ssadadb.sys [2011-5-13 36328]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-1-5 111616]
S3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2014-1-23 25928]
S3 netr7364;RT73 USB Extensible Wireless LAN Card Driver;C:\Windows\System32\drivers\netr7364.sys [2011-10-5 729152]
S3 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2013-9-27 134944]
S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2013-10-23 348376]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);C:\Windows\System32\drivers\ssadbus.sys [2011-5-13 157672]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);C:\Windows\System32\drivers\ssadmdfl.sys [2011-5-13 16872]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;C:\Windows\System32\drivers\ssadmdm.sys [2011-5-13 177640]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);C:\Windows\System32\drivers\ssadserd.sys [2011-5-13 146920]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-5-18 1255736]
.
=============== Created Last 30 ================
.
2014-01-24 07:36:16   965000   ----a-w-   C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2014-01-24 07:36:16   965000   ----a-w-   C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{AE5FE9A6-55BD-4180-AB54-37DED4849DEE}\gapaengine.dll
2014-01-24 07:34:48   10315576   ----a-w-   C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{F2AFD41A-E23A-47AC-AD82-6C75D47AAF53}\mpengine.dll
2014-01-23 07:08:18   39984   ----a-w-   C:\Windows\SysWow64\drivers\mbamswissarmy.sys
2014-01-23 07:08:14   25928   ----a-w-   C:\Windows\System32\drivers\mbam.sys
2014-01-23 07:08:14   --------   d-----w-   C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-22 10:03:15   10315576   ------w-   C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-01-22 00:31:10   31384   ----a-w-   C:\Windows\System32\drivers\VMparport.sys
2014-01-22 00:31:09   63128   ----a-w-   C:\Windows\System32\drivers\vmx86.sys
2014-01-22 00:30:39   354456   ----a-w-   C:\Windows\SysWow64\vmnetdhcp.exe
2014-01-22 00:30:33   433816   ----a-w-   C:\Windows\SysWow64\vmnat.exe
2014-01-22 00:30:31   30360   ----a-w-   C:\Windows\System32\drivers\vmnetuserif.sys
2014-01-22 00:30:20   942744   ----a-w-   C:\Windows\System32\vnetlib64.dll
2014-01-22 00:30:18   32920   ----a-w-   C:\Windows\System32\drivers\VMkbd.sys
2014-01-22 00:30:14   39024   ----a-w-   C:\Windows\System32\drivers\hcmon.sys
2014-01-22 00:29:30   --------   d-----w-   C:\Program Files (x86)\VMware
2014-01-22 00:29:30   --------   d-----w-   C:\Program Files (x86)\Common Files\VMware
2014-01-22 00:29:03   --------   d-----w-   C:\Program Files\Common Files\VMware
2014-01-21 05:43:44   --------   d-----w-   C:\Malware
2014-01-20 11:47:56   --------   d-----w-   C:\Program Files (x86)\ESET
2014-01-20 09:18:45   --------   d-----w-   C:\ProgramData\HitmanPro
2014-01-20 06:59:42   --------   d-----w-   C:\TDSSKiller_Quarantine
2014-01-20 00:32:27   965000   ------w-   C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{6C73E089-A456-4B7B-820D-B4DB2995F547}\gapaengine.dll
2014-01-20 00:19:57   --------   d-----w-   C:\Program Files (x86)\Microsoft Security Client
2014-01-20 00:19:54   --------   d-----w-   C:\Program Files\Microsoft Security Client
2014-01-19 03:54:01   --------   d-----w-   C:\Users\Ray\AppData\Roaming\Wise Disk Cleaner
2014-01-19 02:10:38   --------   d-----w-   C:\AdwCleaner
2014-01-19 01:54:41   --------   d-----w-   C:\Windows\ERUNT
2014-01-17 10:22:02   10315576   ----a-w-   C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{468AE781-6671-42D9-990D-7666F4CE7B2A}\mpengine.dll
2014-01-16 12:08:21   --------   d-----w-   C:\Users\Ray\AppData\Roaming\Wise Registry Cleaner
2014-01-16 12:07:54   --------   d-----w-   C:\Program Files (x86)\Wise
2014-01-16 10:29:24   96168   ----a-w-   C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2014-01-15 03:22:52   99840   ----a-w-   C:\Windows\System32\drivers\usbccgp.sys
2014-01-15 03:22:52   7808   ----a-w-   C:\Windows\System32\drivers\usbd.sys
2014-01-15 03:22:52   53248   ----a-w-   C:\Windows\System32\drivers\usbehci.sys
2014-01-15 03:22:52   343040   ----a-w-   C:\Windows\System32\drivers\usbhub.sys
2014-01-15 03:22:52   325120   ----a-w-   C:\Windows\System32\drivers\usbport.sys
2014-01-15 03:22:52   30720   ----a-w-   C:\Windows\System32\drivers\usbuhci.sys
2014-01-15 03:22:52   25600   ----a-w-   C:\Windows\System32\drivers\usbohci.sys
2014-01-15 03:22:34   3156480   ----a-w-   C:\Windows\System32\win32k.sys
2014-01-15 03:21:32   376768   ----a-w-   C:\Windows\System32\drivers\netio.sys
2014-01-10 06:24:45   --------   d-----w-   C:\Users\Ray\AppData\Local\Calendar
2014-01-04 04:43:47   --------   d-----w-   C:\Program Files\Microsoft Mouse and Keyboard Center
.
==================== Find3M ====================
.
2014-01-19 07:33:29   270496   ------w-   C:\Windows\System32\MpSigStub.exe
2013-12-22 07:48:18   71048   ----a-w-   C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-12-22 07:48:18   692616   ----a-w-   C:\Windows\SysWow64\FlashPlayerApp.exe
2013-11-26 10:19:07   2724864   ----a-w-   C:\Windows\System32\mshtml.tlb
2013-11-26 10:18:23   4096   ----a-w-   C:\Windows\System32\ieetwcollectorres.dll
2013-11-26 09:48:07   66048   ----a-w-   C:\Windows\System32\iesetup.dll
2013-11-26 09:46:25   48640   ----a-w-   C:\Windows\System32\ieetwproxystub.dll
2013-11-26 09:23:02   2724864   ----a-w-   C:\Windows\SysWow64\mshtml.tlb
2013-11-26 09:18:39   139264   ----a-w-   C:\Windows\System32\ieUnatt.exe
2013-11-26 09:18:09   111616   ----a-w-   C:\Windows\System32\ieetwcollector.exe
2013-11-26 09:16:57   708608   ----a-w-   C:\Windows\System32\jscript9diag.dll
2013-11-26 08:35:02   5769216   ----a-w-   C:\Windows\System32\jscript9.dll
2013-11-26 08:28:16   553472   ----a-w-   C:\Windows\SysWow64\jscript9diag.dll
2013-11-26 08:16:12   4243968   ----a-w-   C:\Windows\SysWow64\jscript9.dll
2013-11-26 08:02:16   1995264   ----a-w-   C:\Windows\System32\inetcpl.cpl
2013-11-26 07:32:06   1928192   ----a-w-   C:\Windows\SysWow64\inetcpl.cpl
2013-11-26 07:07:57   2334208   ----a-w-   C:\Windows\System32\wininet.dll
2013-11-26 06:33:33   1820160   ----a-w-   C:\Windows\SysWow64\wininet.dll
2013-11-23 18:26:20   417792   ----a-w-   C:\Windows\SysWow64\WMPhoto.dll
2013-11-23 17:47:34   465920   ----a-w-   C:\Windows\System32\WMPhoto.dll
2013-11-12 02:23:09   2048   ----a-w-   C:\Windows\System32\tzres.dll
2013-11-12 02:07:29   2048   ----a-w-   C:\Windows\SysWow64\tzres.dll
2013-11-11 15:02:02   6674208   ----a-w-   C:\Windows\System32\nvcpl.dll
2013-11-11 15:02:02   3490080   ----a-w-   C:\Windows\System32\nvsvc64.dll
2013-11-11 15:01:59   922912   ----a-w-   C:\Windows\System32\nvvsvc.exe
2013-11-11 15:01:59   63776   ----a-w-   C:\Windows\System32\nvshext.dll
2013-11-11 15:01:59   219424   ----a-w-   C:\Windows\System32\nvmctray.dll
2013-11-10 22:59:28   590112   ----a-w-   C:\Windows\SysWow64\nvStreaming.exe
2013-10-30 02:32:01   335360   ----a-w-   C:\Windows\System32\msieftp.dll
2013-10-30 02:19:52   301568   ----a-w-   C:\Windows\SysWow64\msieftp.dll
.
============= FINISH: 9:49:49.90 ===============

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 17/05/2012 7:01:12 PM
System Uptime: 23/01/2014 5:21:37 PM (40 hours ago)
.
Motherboard: Intel Corporation | | DH67BL
Processor: Intel® Core i3-2120 CPU @ 3.30GHz | CPU 1 | 3300/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 233 GiB total, 113.173 GiB free.
D: is CDROM ()
E: is Removable
F: is Removable
G: is Removable
H: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP215: 20/01/2014 10:31:44 AM - Windows Update
RP216: 21/01/2014 3:00:10 AM - Windows Update
RP217: 24/01/2014 5:34:06 PM - Windows Update
.
==== Installed Programs ======================
.
12Ghosts FileDate
ABBYY FineReader 6.0 Sprint
ACDSee
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader XI (11.0.06)
Adobe Shockwave Player 12.0
American Greetings CreataCard
Apple Application Support
Apple Software Update
ArcSoft PhotoImpression 5
BeCyIconGrabber
CCleaner
Dropbox
EPSON Attach To Email
Epson Connect Guide
EPSON Copy Utility 3
EPSON Event Manager
Epson FAX Utility
EPSON File Manager
Epson Network Guide WF-2530 Series
EPSON Scan
EPSON Scan Assistant
Epson User's Guide WF-2530 Series
EPSON WF-2530 Series Printer Uninstall
EpsonNet Print
ESET Online Scanner v3
Family Tree Maker
FinePixViewer Ver.5.3
FTMVistaUpdater
GeForce Experience NvStream Client Components
Glary Utilities 2.55.0.1790
Google Chrome
Google Update Helper
Greenfish Icon Editor Pro 3.0
Hewlett-Packard ACLM.NET v1.1.0.0
HP Product Detection
IcoFX 1.6.4
Intel® Desktop Utilities
Intel® Integrator Assistant
Intel® Management Engine Components
Intel® Network Connections 17.4.95.0
Intel® Trusted Connect Service Client
Internode Monthly Usage Meter 8.2a
IrfanView (remove only)
Java 7 Update 51
Java 7 Update 7 (64-bit)
Java Auto Updater
K-Lite Codec Pack 9.7.5 (Full)
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Application Error Reporting
Microsoft Mouse and Keyboard Center
Microsoft Office XP Professional with FrontPage
Microsoft Security Client
Microsoft Security Essentials
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Web Publishing Wizard 1.52
Mozilla Firefox 27.0 (x86 en-GB)
Mozilla Maintenance Service
Mozilla Thunderbird 24.2.0 (x86 en-US)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
NVIDIA 3D Vision Controller Driver 331.82
NVIDIA 3D Vision Driver 331.82
NVIDIA Control Panel 331.82
NVIDIA GeForce Experience 1.7.1
NVIDIA Graphics Driver 331.82
NVIDIA HD Audio Driver 1.3.26.4
NVIDIA Install Application
NVIDIA LED Visualizer 1.0
NVIDIA PhysX
NVIDIA PhysX System Software 9.13.0725
NVIDIA ShadowPlay 9.3.21
NVIDIA Stereoscopic 3D Driver
NVIDIA Update 9.3.21
NVIDIA Update Components
NVIDIA Virtual Audio 1.2.9
NXPowerLite
PCmover OEM Express
PDFCreator
PerfV350 User's Guide
PhotoScape
QuickTime
RealDownloader
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealNetworks - Microsoft Visual C++ 2010 Runtime
RealPlayer
Realtek High Definition Audio Driver
RealUpgrade 1.1
Renesas Electronics USB 3.0 Host Controller Driver
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2858302v2)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2736428)
Security Update for Microsoft .NET Framework 4 Extended (KB2742595)
Security Update for Microsoft .NET Framework 4 Extended (KB2858302v2)
SHIELD Streaming
Shockwave
Simple Sudoku 4.2
SUPERAntiSpyware
swMSM
System Requirements Lab for Intel
tools-windows
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3)
VmciSockets
VMware Player
Wise Disk Cleaner 8.03
Wise Registry Cleaner 7.92
.
==== Event Viewer Messages From Past Week ========
.
23/01/2014 5:24:23 PM, Error: Service Control Manager [7023] - The HP Network Devices Support service terminated with the following error: The specified module could not be found.
23/01/2014 5:19:32 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
23/01/2014 5:06:00 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service NVSvc with arguments "" in order to run the server: {DCAB0989-1301-4319-BE5F-ADE89F88581C}
23/01/2014 4:56:33 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F}
23/01/2014 4:56:33 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
23/01/2014 4:56:25 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
23/01/2014 4:56:25 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
23/01/2014 4:56:25 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
23/01/2014 4:56:22 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
23/01/2014 4:56:15 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
23/01/2014 4:56:07 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache MpFilter SASDIFSV SASKUTIL spldr Wanarpv6
23/01/2014 4:56:06 PM, Error: Service Control Manager [7001] - The Microsoft Network Inspection System service depends on the Microsoft Malware Protection Driver service which failed to start because of the following error: A device attached to the system is not functioning.
23/01/2014 4:56:06 PM, Error: Service Control Manager [7001] - The Epson Scanner Service service depends on the Windows Image Acquisition (WIA) service which failed to start because of the following error: The dependency service or group failed to start.
22/01/2014 12:56:19 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk5\DR9.
22/01/2014 1:21:44 PM, Error: Disk [11] - The driver detected a controller error on \...\DR10.
21/01/2014 4:06:48 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.165.2243.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: Default URL Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.10201.0 Error code: 0x8007043c Error description: This service cannot be started in Safe Mode
21/01/2014 4:06:48 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
.
==== End Of File ===========================

Maniac · January 25, 2014

Please follow the instructions here:

https://forums.malwarebytes.org/index.php?showtopic=10138&page=1entry181018

When you are done, reboot your system and let me know.

kanga85 · January 25, 2014

Done all of item I above and rebooted

Maniac · January 26, 2014

Please update Malwarebytes and perform a full system scan.

kanga85 · January 27, 2014

Malwarebytes updated and Full Scan Run,

Program froze "Not Responding" at C:\Users\Ray\Desktop\Scanner\Perfv350 Users Guide.lnk

after 40 min and 13 sec, 174398 objects scanned, 6 objects detected.

No log file written.

This is a different spot to where it has frozen previously, although in the past it is always in C:\Users\...

The six objects detected all popped up in an area not scanned a few days ago by a quick scan done in Safe Mode.

I note your period of reduced activity, and now advise that I will be totally away from the computer, and all internet connectivity, from tomorrow 28th January until 11th February, when I would be very grateful if we could further tackle this problem together.

Maniac · January 27, 2014

Of course, we will.

Note: Please do not run this tool without special supervision and instructions of someone authorized to do so. Otherwise, you could end up with serious problems. For more details, read this article: ComboFix usage, Questions, Help? - Look here

Please visit this webpage and read the ComboFix User's Guide:

Once you've read the article and are ready to use the program you can download it directly from the link below.
Important! - Please make sure you save combofix to your desktop and do not run it from your browser
Direct download link for: ComboFix.exe
Please make sure you disable your security applications before running ComboFix.
Once Combofix has completed it will produce and open a log file. Please be patient as it can take some time to load.
Please copy/paste the contents or attach that log file to your next reply.
If needed the file can be located here: C:\combofix.txt
NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.

AdvancedSetup · January 30, 2014

We will close this topic for now. When you're back and ready to work on the issue again please just send a private message to a Moderator or Administrator and we will reopen your topic at that time.

Thanks

gringo_pr · February 14, 2014

Topic has been reopened by request

gringo

kanga85 · February 14, 2014

Hello Borislav, I am now back on deck. I have now run Malwarebytes and it still freezes in C:\Users\

Do you want me to now run ComboFix?

Maniac · February 15, 2014

Before that, please generate a new fresh DDS log file.

kanga85 · February 17, 2014

sorry for the delay. I was looking at page 1 and didn't notice page 2 of this entry,

DDS log files pasted below

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.16518 BrowserJavaVersion: 10.51.2
Run by Ray at 13:36:34 on 2014-02-17
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.61.1033.18.4065.1531 [GMT 10:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Intel\iCLS Client\HeciServer.exe
C:\Windows\system32\IProsetMonitor.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe
C:\Windows\SysWOW64\vmnat.exe
C:\Windows\SysWOW64\vmnetdhcp.exe
C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
C:\Windows\System32\WUDFHost.exe
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
c:\Program Files\Microsoft Security Client\NisSrv.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files (x86)\Internode\mum.exe
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\System32\spool\drivers\x64\3\E_YATIIVE.EXE
C:\Program Files (x86)\FinePixViewer\QuickDCF2.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Users\Ray\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Program Files (x86)\epson\Creativity Suite\Event Manager\EEventManager.exe
C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe
C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\Program Files (x86)\VMware\VMware Player\vmplayer.exe
C:\Program Files (x86)\VMware\VMware Player\vmware-unity-helper.exe
C:\Program Files (x86)\VMware\VMware Player\x64\vmware-vmx.exe
C:\Program Files (x86)\VMware\VMware Player\vprintproxy.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.

mWinlogon: Userinit = userinit.exe,
BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll
BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
uRun: [internodeUsage] C:\PROGRA~2\INTERN~2\mum.exe
uRun: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
uRun: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [EPLTarget\P0000000000000001] C:\Windows\System32\spool\DRIVERS\x64\3\E_YATIIVE.EXE /EPT "EPLTarget\P0000000000000001" /M "WF-2530 Series"
mRun: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
mRun: [EEventManager] C:\Program Files (x86)\EPSON\Creativity Suite\Event Manager\EEventManager.exe
mRun: [FUFAXRCV] "C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe"
mRun: [FUFAXSTM] "C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe"
StartupFolder: C:\Users\Ray\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\Ray\AppData\Roaming\Dropbox\bin\Dropbox.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\EXIFLA~1.LNK - C:\Program Files (x86)\FinePixViewer\QuickDCF2.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MICROS~1.LNK - C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE
uPolicies-Explorer: NoDriveTypeAutoRun = dword:221
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office10\EXCEL.EXE/3000
LSP: %SystemRoot%\system32\vsocklib.dll
DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} -

TCP: NameServer = 192.168.0.1
TCP: Interfaces\{30C85AED-6CA0-4732-AFB8-2A7CC01F7E12} : DHCPNameServer = 192.168.0.1
TCP: Interfaces\{6784E75C-92B9-4232-9EAF-DB4816CF79FC} : DHCPNameServer = 192.168.0.1
SSODL: WebCheck - <orphaned>
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
x64-BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-Run: [Nvtmru] "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
x64-Run: [shadowPlay] C:\Windows\System32\rundll32.exe C:\Windows\System32\nvspcap64.dll,ShadowPlayOnSystemStart
x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Ray\AppData\Roaming\Mozilla\Firefox\Profiles\vgp03jla.default\

FF - prefs.js: browser.search.selectedEngine - Search By ZoneAlarm
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2013-9-27 248240]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-23 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-13 12368]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [2014-1-20 144152]
R2 EPSON_PM_RPCV4_05;EPSON V3 Service4(05);C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE [2013-5-21 151648]
R2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-4-20 635104]
R2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;C:\Windows\System32\IPROSetMonitor.exe [2012-9-6 170824]
R2 jhi_service;Intel® Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe [2013-5-16 165760]
R2 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2013-9-27 134944]
R2 NvStreamSvc;NVIDIA Streamer Service;C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2013-12-22 15125280]
R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [2013-3-6 39056]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-11-11 414496]
R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2013-5-16 364416]
R2 VMUSBArbService;VMware USB Arbitration Service;C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [2011-8-29 846448]
R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2013-10-23 348376]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2010-4-27 83080]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2010-4-27 184968]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);C:\Windows\System32\drivers\nvvad64v.sys [2013-12-22 39200]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]
S2 EpsonScanSvc;Epson Scanner Service;C:\Windows\System32\escsvc64.exe [2013-5-21 135824]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;C:\Windows\System32\drivers\ssadadb.sys [2011-5-13 36328]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-2-14 111616]
S3 netr7364;RT73 USB Extensible Wireless LAN Card Driver;C:\Windows\System32\drivers\netr7364.sys [2011-10-5 729152]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);C:\Windows\System32\drivers\ssadbus.sys [2011-5-13 157672]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);C:\Windows\System32\drivers\ssadmdfl.sys [2011-5-13 16872]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;C:\Windows\System32\drivers\ssadmdm.sys [2011-5-13 177640]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);C:\Windows\System32\drivers\ssadserd.sys [2011-5-13 146920]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-5-18 1255736]
.
=============== Created Last 30 ================
.
2014-02-16 17:33:04   10315576   ----a-w-   C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{49DCC238-F296-454C-A3BB-45FAD566723F}\mpengine.dll
2014-02-16 15:47:05   10315576   ------w-   C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-02-12 17:46:22   3928064   ----a-w-   C:\Windows\System32\d2d1.dll
2014-02-12 17:46:22   3419136   ----a-w-   C:\Windows\SysWow64\d2d1.dll
2014-02-12 17:46:22   2565120   ----a-w-   C:\Windows\System32\d3d10warp.dll
2014-02-12 17:46:22   1987584   ----a-w-   C:\Windows\SysWow64\d3d10warp.dll
2014-02-12 17:00:50   548864   ----a-w-   C:\Windows\System32\vbscript.dll
2014-02-12 17:00:50   454656   ----a-w-   C:\Windows\SysWow64\vbscript.dll
2014-02-12 07:23:40   2048   ----a-w-   C:\Windows\SysWow64\msxml3r.dll
2014-02-12 07:23:40   2048   ----a-w-   C:\Windows\System32\msxml3r.dll
2014-02-12 07:23:40   1882112   ----a-w-   C:\Windows\System32\msxml3.dll
2014-02-12 07:23:40   1237504   ----a-w-   C:\Windows\SysWow64\msxml3.dll
2014-01-27 08:22:19   --------   d-----w-   C:\Users\Ray\AppData\Roaming\Dweather
2014-01-27 08:05:59   --------   d-----w-   C:\Driver
2014-01-25 20:45:19   25928   ----a-w-   C:\Windows\System32\drivers\mbam.sys
2014-01-25 20:45:19   --------   d-----w-   C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-25 04:15:40   --------   d-----w-   C:\Windows\Migration
2014-01-24 07:36:16   965000   ------w-   C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2014-01-24 07:36:16   965000   ------w-   C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{AE5FE9A6-55BD-4180-AB54-37DED4849DEE}\gapaengine.dll
2014-01-22 00:31:10   31384   ----a-w-   C:\Windows\System32\drivers\VMparport.sys
2014-01-22 00:31:09   63128   ----a-w-   C:\Windows\System32\drivers\vmx86.sys
2014-01-22 00:30:39   354456   ----a-w-   C:\Windows\SysWow64\vmnetdhcp.exe
2014-01-22 00:30:33   433816   ----a-w-   C:\Windows\SysWow64\vmnat.exe
2014-01-22 00:30:31   30360   ----a-w-   C:\Windows\System32\drivers\vmnetuserif.sys
2014-01-22 00:30:20   942744   ----a-w-   C:\Windows\System32\vnetlib64.dll
2014-01-22 00:30:18   32920   ----a-w-   C:\Windows\System32\drivers\VMkbd.sys
2014-01-22 00:30:14   39024   ----a-w-   C:\Windows\System32\drivers\hcmon.sys
2014-01-22 00:29:30   --------   d-----w-   C:\Program Files (x86)\VMware
2014-01-22 00:29:30   --------   d-----w-   C:\Program Files (x86)\Common Files\VMware
2014-01-22 00:29:03   --------   d-----w-   C:\Program Files\Common Files\VMware
2014-01-21 05:43:44   --------   d-----w-   C:\Malware
2014-01-20 11:47:56   --------   d-----w-   C:\Program Files (x86)\ESET
2014-01-20 09:18:45   --------   d-----w-   C:\ProgramData\HitmanPro
2014-01-20 06:59:42   --------   d-----w-   C:\TDSSKiller_Quarantine
2014-01-20 00:19:57   --------   d-----w-   C:\Program Files (x86)\Microsoft Security Client
2014-01-20 00:19:54   --------   d-----w-   C:\Program Files\Microsoft Security Client
2014-01-19 03:54:01   --------   d-----w-   C:\Users\Ray\AppData\Roaming\Wise Disk Cleaner
2014-01-19 02:10:38   --------   d-----w-   C:\AdwCleaner
2014-01-19 01:54:41   --------   d-----w-   C:\Windows\ERUNT
.
==================== Find3M ====================
.
2014-02-11 02:48:23   71048   ----a-w-   C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-11 02:48:23   692616   ----a-w-   C:\Windows\SysWow64\FlashPlayerApp.exe
2014-02-06 11:30:46   2724864   ----a-w-   C:\Windows\System32\mshtml.tlb
2014-02-06 11:30:12   4096   ----a-w-   C:\Windows\System32\ieetwcollectorres.dll
2014-02-06 11:07:39   66048   ----a-w-   C:\Windows\System32\iesetup.dll
2014-02-06 11:06:47   48640   ----a-w-   C:\Windows\System32\ieetwproxystub.dll
2014-02-06 10:49:03   139264   ----a-w-   C:\Windows\System32\ieUnatt.exe
2014-02-06 10:48:45   111616   ----a-w-   C:\Windows\System32\ieetwcollector.exe
2014-02-06 10:48:11   708608   ----a-w-   C:\Windows\System32\jscript9diag.dll
2014-02-06 10:20:26   2724864   ----a-w-   C:\Windows\SysWow64\mshtml.tlb
2014-02-06 10:11:37   5768704   ----a-w-   C:\Windows\System32\jscript9.dll
2014-02-06 10:01:36   61952   ----a-w-   C:\Windows\SysWow64\iesetup.dll
2014-02-06 10:00:46   51200   ----a-w-   C:\Windows\SysWow64\ieetwproxystub.dll
2014-02-06 09:50:32   2041856   ----a-w-   C:\Windows\System32\inetcpl.cpl
2014-02-06 09:47:22   112128   ----a-w-   C:\Windows\SysWow64\ieUnatt.exe
2014-02-06 09:46:27   553472   ----a-w-   C:\Windows\SysWow64\jscript9diag.dll
2014-02-06 09:25:36   4244480   ----a-w-   C:\Windows\SysWow64\jscript9.dll
2014-02-06 09:24:52   2334208   ----a-w-   C:\Windows\System32\wininet.dll
2014-02-06 09:09:30   1964032   ----a-w-   C:\Windows\SysWow64\inetcpl.cpl
2014-02-06 08:41:35   1820160   ----a-w-   C:\Windows\SysWow64\wininet.dll
2014-01-19 07:33:29   270496   ------w-   C:\Windows\System32\MpSigStub.exe
2013-12-18 11:09:39   96168   ----a-w-   C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2013-12-04 02:27:33   485888   ----a-w-   C:\Windows\System32\secproc_isv.dll
2013-12-04 02:27:33   123392   ----a-w-   C:\Windows\System32\secproc_ssp_isv.dll
2013-12-04 02:27:33   123392   ----a-w-   C:\Windows\System32\secproc_ssp.dll
2013-12-04 02:27:16   488448   ----a-w-   C:\Windows\System32\secproc.dll
2013-12-04 02:26:32   528384   ----a-w-   C:\Windows\System32\msdrm.dll
2013-12-04 02:16:51   658432   ----a-w-   C:\Windows\System32\RMActivate_isv.exe
2013-12-04 02:16:51   626176   ----a-w-   C:\Windows\System32\RMActivate.exe
2013-12-04 02:16:50   552960   ----a-w-   C:\Windows\System32\RMActivate_ssp_isv.exe
2013-12-04 02:16:48   553984   ----a-w-   C:\Windows\System32\RMActivate_ssp.exe
2013-12-04 02:03:20   87040   ----a-w-   C:\Windows\SysWow64\secproc_ssp_isv.dll
2013-12-04 02:03:20   87040   ----a-w-   C:\Windows\SysWow64\secproc_ssp.dll
2013-12-04 02:03:20   423936   ----a-w-   C:\Windows\SysWow64\secproc_isv.dll
2013-12-04 02:03:08   428032   ----a-w-   C:\Windows\SysWow64\secproc.dll
2013-12-04 02:02:06   390144   ----a-w-   C:\Windows\SysWow64\msdrm.dll
2013-12-04 01:54:14   510976   ----a-w-   C:\Windows\SysWow64\RMActivate_ssp.exe
2013-12-04 01:54:10   594944   ----a-w-   C:\Windows\SysWow64\RMActivate_isv.exe
2013-12-04 01:54:09   572416   ----a-w-   C:\Windows\SysWow64\RMActivate.exe
2013-12-04 01:54:06   508928   ----a-w-   C:\Windows\SysWow64\RMActivate_ssp_isv.exe
2013-11-27 01:41:37   343040   ----a-w-   C:\Windows\System32\drivers\usbhub.sys
2013-11-27 01:41:15   99840   ----a-w-   C:\Windows\System32\drivers\usbccgp.sys
2013-11-27 01:41:11   53248   ----a-w-   C:\Windows\System32\drivers\usbehci.sys
2013-11-27 01:41:11   325120   ----a-w-   C:\Windows\System32\drivers\usbport.sys
2013-11-27 01:41:09   25600   ----a-w-   C:\Windows\System32\drivers\usbohci.sys
2013-11-27 01:41:06   30720   ----a-w-   C:\Windows\System32\drivers\usbuhci.sys
2013-11-27 01:41:03   7808   ----a-w-   C:\Windows\System32\drivers\usbd.sys
2013-11-26 11:40:00   376768   ----a-w-   C:\Windows\System32\drivers\netio.sys
2013-11-26 10:32:56   3156480   ----a-w-   C:\Windows\System32\win32k.sys
2013-11-23 18:26:20   417792   ----a-w-   C:\Windows\SysWow64\WMPhoto.dll
2013-11-23 17:47:34   465920   ----a-w-   C:\Windows\System32\WMPhoto.dll
.
============= FINISH: 13:37:08.59 ===============

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 17/05/2012 7:01:12 PM
System Uptime: 14/02/2014 3:21:07 AM (82 hours ago)
.
Motherboard: Intel Corporation | | DH67BL
Processor: Intel® Core i3-2120 CPU @ 3.30GHz | CPU 1 | 1584/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 233 GiB total, 142.802 GiB free.
D: is CDROM ()
E: is Removable
F: is Removable
G: is Removable
H: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP223: 13/02/2014 12:00:01 AM - Scheduled Checkpoint
RP224: 13/02/2014 3:00:22 AM - Windows Update
RP225: 14/02/2014 3:00:11 AM - Windows Update
RP226: 17/02/2014 3:32:27 AM - Windows Update
.
==== Installed Programs ======================
.
12Ghosts FileDate
ABBYY FineReader 6.0 Sprint
ACDSee
Adobe Flash Player 12 ActiveX
Adobe Flash Player 12 Plugin
Adobe Reader XI (11.0.06)
Adobe Shockwave Player 12.0
American Greetings CreataCard
Apple Application Support
Apple Software Update
ArcSoft PhotoImpression 5
BeCyIconGrabber
CCleaner
Dropbox
EPSON Attach To Email
Epson Connect Guide
EPSON Copy Utility 3
EPSON Event Manager
Epson FAX Utility
EPSON File Manager
Epson Network Guide WF-2530 Series
EPSON Scan
EPSON Scan Assistant
Epson User's Guide WF-2530 Series
EPSON WF-2530 Series Printer Uninstall
EpsonNet Print
ESET Online Scanner v3
Family Tree Maker
FinePixViewer Ver.5.3
FTMVistaUpdater
GeForce Experience NvStream Client Components
Glary Utilities 2.55.0.1790
Google Chrome
Google Update Helper
Greenfish Icon Editor Pro 3.0
Hewlett-Packard ACLM.NET v1.1.0.0
HP Product Detection
IcoFX 1.6.4
Intel® Desktop Utilities
Intel® Integrator Assistant
Intel® Management Engine Components
Intel® Network Connections 17.4.95.0
Intel® Trusted Connect Service Client
Internode Monthly Usage Meter 8.2a
IrfanView (remove only)
Java 7 Update 51
Java 7 Update 7 (64-bit)
Java Auto Updater
K-Lite Codec Pack 9.7.5 (Full)
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft .NET Framework 4.5.1
Microsoft Application Error Reporting
Microsoft Mouse and Keyboard Center
Microsoft Office XP Professional with FrontPage
Microsoft Security Client
Microsoft Security Essentials
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Web Publishing Wizard 1.52
Mozilla Firefox 27.0 (x86 en-GB)
Mozilla Maintenance Service
Mozilla Thunderbird 24.2.0 (x86 en-US)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
NVIDIA 3D Vision Controller Driver 331.82
NVIDIA 3D Vision Driver 331.82
NVIDIA Control Panel 331.82
NVIDIA GeForce Experience 1.7.1
NVIDIA Graphics Driver 331.82
NVIDIA HD Audio Driver 1.3.26.4
NVIDIA Install Application
NVIDIA LED Visualizer 1.0
NVIDIA PhysX
NVIDIA PhysX System Software 9.13.0725
NVIDIA ShadowPlay 9.3.21
NVIDIA Stereoscopic 3D Driver
NVIDIA Update 9.3.21
NVIDIA Update Components
NVIDIA Virtual Audio 1.2.9
NXPowerLite
PCmover OEM Express
PDFCreator
PerfV350 User's Guide
PhotoScape
QuickTime
RealDownloader
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealNetworks - Microsoft Visual C++ 2010 Runtime
RealPlayer
Realtek High Definition Audio Driver
RealUpgrade 1.1
Renesas Electronics USB 3.0 Host Controller Driver
Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)
Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)
SHIELD Streaming
Shockwave
Simple Sudoku 4.2
SUPERAntiSpyware
swMSM
System Requirements Lab for Intel
tools-windows
VmciSockets
VMware Player
Wise Disk Cleaner 8.03
Wise Registry Cleaner 7.92
.
==== Event Viewer Messages From Past Week ========
.
16/02/2014 1:37:02 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk5\DR6.
16/02/2014 1:23:08 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
16/02/2014 1:22:38 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the LanmanServer service.
16/02/2014 1:22:09 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk5\DR5.
14/02/2014 3:24:00 AM, Error: Service Control Manager [7023] - The HP Network Devices Support service terminated with the following error: The specified module could not be found.
12/02/2014 3:55:20 AM, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
12/02/2014 10:11:02 AM, Error: NetBT [4321] - The name "MSHOME :1d" could not be registered on the interface with IP address 192.168.0.100. The computer with the IP address 192.168.0.102 did not allow the name to be claimed by this computer.
11/02/2014 12:44:51 PM, Error: NetBT [4321] - The name "MSHOME :1d" could not be registered on the interface with IP address 192.168.0.100. The computer with the IP address 192.168.0.101 did not allow the name to be claimed by this computer.
.
==== End Of File ===========================

Maniac · February 17, 2014

Please follow the instructions for ComboFix.

kanga85 · February 18, 2014

Combofix run, apparently without problems.

Text file pasted below

ComboFix 14-02-14.01 - Ray 19/02/2014   8:50.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.61.1033.18.4065.2726 [GMT 10:00]
Running from: c:\users\Ray\Desktop\Malwarebytes Problem\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\users\Ray\AppData\Roaming\ACD Systems\ACDSee\ImageDB.ddf
c:\windows\SysWow64\ReadMe.txt
c:\windows\wininit.ini
.
.
(((((((((((((((((((((((((   Files Created from 2014-01-18 to 2014-02-18 )))))))))))))))))))))))))))))))
.
.
2014-02-18 22:56 . 2014-02-18 22:56   --------   d-----w-   c:\users\UpdatusUser\AppData\Local\temp
2014-02-18 22:56 . 2014-02-18 22:56   --------   d-----w-   c:\users\Linda\AppData\Local\temp
2014-02-17 17:33 . 2013-12-03 09:28   10315576   ----a-w-   c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E049C9D-F466-4062-9406-E703FE15F40E}\mpengine.dll
2014-02-16 17:33 . 2013-12-03 09:28   10315576   ----a-w-   c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-02-12 17:46 . 2013-12-24 23:09   1987584   ----a-w-   c:\windows\SysWow64\d3d10warp.dll
2014-02-12 17:46 . 2013-12-24 22:48   2565120   ----a-w-   c:\windows\system32\d3d10warp.dll
2014-02-12 17:46 . 2013-11-26 08:16   3419136   ----a-w-   c:\windows\SysWow64\d2d1.dll
2014-02-12 17:46 . 2013-11-22 22:48   3928064   ----a-w-   c:\windows\system32\d2d1.dll
2014-02-12 17:00 . 2013-12-21 09:53   548864   ----a-w-   c:\windows\system32\vbscript.dll
2014-02-12 17:00 . 2013-12-21 08:56   454656   ----a-w-   c:\windows\SysWow64\vbscript.dll
2014-02-12 07:23 . 2013-12-06 02:30   2048   ----a-w-   c:\windows\system32\msxml3r.dll
2014-02-12 07:23 . 2013-12-06 02:30   1882112   ----a-w-   c:\windows\system32\msxml3.dll
2014-02-12 07:23 . 2013-12-06 02:02   2048   ----a-w-   c:\windows\SysWow64\msxml3r.dll
2014-02-12 07:23 . 2013-12-06 02:02   1237504   ----a-w-   c:\windows\SysWow64\msxml3.dll
2014-01-27 08:22 . 2014-01-27 08:22   --------   d-----w-   c:\users\Ray\AppData\Roaming\Dweather
2014-01-27 08:05 . 2014-01-27 08:25   --------   d-----w-   C:\Driver
2014-01-25 20:45 . 2014-01-25 20:45   --------   d-----w-   c:\program files (x86)\Malwarebytes' Anti-Malware
2014-01-25 20:45 . 2013-04-04 04:50   25928   ----a-w-   c:\windows\system32\drivers\mbam.sys
2014-01-25 04:15 . 2014-01-25 04:15   --------   d-----w-   c:\windows\Migration
2014-01-24 07:36 . 2014-01-20 00:32   965000   ------w-   c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2014-01-24 07:36 . 2014-01-20 00:32   965000   ------w-   c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{AE5FE9A6-55BD-4180-AB54-37DED4849DEE}\gapaengine.dll
2014-01-22 00:31 . 2012-06-08 16:37   31384   ----a-w-   c:\windows\system32\drivers\VMparport.sys
2014-01-22 00:31 . 2012-06-08 16:37   63128   ----a-w-   c:\windows\system32\drivers\vmx86.sys
2014-01-22 00:30 . 2012-06-08 16:36   354456   ----a-w-   c:\windows\SysWow64\vmnetdhcp.exe
2014-01-22 00:30 . 2012-06-08 16:37   433816   ----a-w-   c:\windows\SysWow64\vmnat.exe
2014-01-22 00:30 . 2012-06-08 16:35   30360   ----a-w-   c:\windows\system32\drivers\vmnetuserif.sys
2014-01-22 00:30 . 2012-06-08 16:37   942744   ----a-w-   c:\windows\system32\vnetlib64.dll
2014-01-22 00:30 . 2012-06-08 16:36   32920   ----a-w-   c:\windows\system32\drivers\VMkbd.sys
2014-01-22 00:30 . 2011-08-29 13:11   39024   ----a-w-   c:\windows\system32\drivers\hcmon.sys
2014-01-22 00:29 . 2014-01-22 00:29   --------   d-----w-   c:\program files (x86)\VMware
2014-01-22 00:29 . 2014-01-22 00:29   --------   d-----w-   c:\program files (x86)\Common Files\VMware
2014-01-22 00:29 . 2014-01-22 00:29   --------   d-----w-   c:\program files\Common Files\VMware
2014-01-21 05:43 . 2014-01-21 07:04   --------   d-----w-   C:\Malware
2014-01-20 11:47 . 2014-01-20 11:47   --------   d-----w-   c:\program files (x86)\ESET
2014-01-20 11:44 . 2014-01-20 11:44   --------   d-----w-   c:\users\Linda\AppData\Roaming\VMware
2014-01-20 11:38 . 2014-01-20 11:38   --------   d-----w-   c:\users\Linda\AppData\Roaming\RealNetworks
2014-01-20 09:18 . 2014-01-20 09:24   --------   d-----w-   c:\programdata\HitmanPro
2014-01-20 06:59 . 2014-01-20 06:59   --------   d-----w-   C:\TDSSKiller_Quarantine
2014-01-20 00:19 . 2014-01-20 00:19   --------   d-----w-   c:\program files (x86)\Microsoft Security Client
2014-01-20 00:19 . 2014-01-20 00:20   --------   d-----w-   c:\program files\Microsoft Security Client
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-17 17:00 . 2012-05-17 22:23   88567024   ----a-w-   c:\windows\system32\MRT.exe
2014-02-11 02:48 . 2012-05-19 07:35   71048   ----a-w-   c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-11 02:48 . 2012-05-19 07:35   692616   ----a-w-   c:\windows\SysWow64\FlashPlayerApp.exe
2014-01-19 07:33 . 2010-11-21 03:27   270496   ------w-   c:\windows\system32\MpSigStub.exe
2013-12-22 17:32 . 2013-12-22 17:32   940032   ----a-w-   c:\windows\system32\MsSpellCheckingFacility.exe
2013-12-22 17:32 . 2013-12-22 17:32   194048   ----a-w-   c:\windows\SysWow64\elshyph.dll
2013-12-22 17:32 . 2013-12-22 17:32   71680   ----a-w-   c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-12-22 17:32 . 2013-12-22 17:32   645120   ----a-w-   c:\windows\SysWow64\jsIntl.dll
2013-12-22 17:32 . 2013-12-22 17:32   235008   ----a-w-   c:\windows\system32\elshyph.dll
2013-12-22 17:32 . 2013-12-22 17:32   182272   ----a-w-   c:\windows\SysWow64\msls31.dll
2013-12-22 17:32 . 2013-12-22 17:32   942592   ----a-w-   c:\windows\system32\jsIntl.dll
2013-12-22 17:32 . 2013-12-22 17:32   86016   ----a-w-   c:\windows\SysWow64\iesysprep.dll
2013-12-22 17:32 . 2013-12-22 17:32   86016   ----a-w-   c:\windows\system32\RegisterIEPKEYs.exe
2013-12-22 17:32 . 2013-12-22 17:32   74240   ----a-w-   c:\windows\SysWow64\SetIEInstalledDate.exe
2013-12-22 17:32 . 2013-12-22 17:32   62464   ----a-w-   c:\windows\SysWow64\tdc.ocx
2013-12-22 17:32 . 2013-12-22 17:32   61952   ----a-w-   c:\windows\SysWow64\MshtmlDac.dll
2013-12-22 17:32 . 2013-12-22 17:32   48640   ----a-w-   c:\windows\SysWow64\mshtmler.dll
2013-12-22 17:32 . 2013-12-22 17:32   36352   ----a-w-   c:\windows\SysWow64\imgutil.dll
2013-12-22 17:32 . 2013-12-22 17:32   34816   ----a-w-   c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-12-22 17:32 . 2013-12-22 17:32   337408   ----a-w-   c:\windows\SysWow64\html.iec
2013-12-22 17:32 . 2013-12-22 17:32   247808   ----a-w-   c:\windows\system32\msls31.dll
2013-12-22 17:32 . 2013-12-22 17:32   24576   ----a-w-   c:\windows\SysWow64\licmgr10.dll
2013-12-22 17:32 . 2013-12-22 17:32   151552   ----a-w-   c:\windows\SysWow64\iexpress.exe
2013-12-22 17:32 . 2013-12-22 17:32   139264   ----a-w-   c:\windows\SysWow64\wextract.exe
2013-12-22 17:32 . 2013-12-22 17:32   13312   ----a-w-   c:\windows\SysWow64\mshta.exe
2013-12-22 17:32 . 2013-12-22 17:32   111616   ----a-w-   c:\windows\SysWow64\IEAdvpack.dll
2013-12-22 17:32 . 2013-12-22 17:32   1051136   ----a-w-   c:\windows\SysWow64\mshtmlmedia.dll
2013-12-22 17:32 . 2013-12-22 17:32   90112   ----a-w-   c:\windows\system32\SetIEInstalledDate.exe
2013-12-22 17:32 . 2013-12-22 17:32   77312   ----a-w-   c:\windows\system32\tdc.ocx
2013-12-22 17:32 . 2013-12-22 17:32   52224   ----a-w-   c:\windows\system32\msfeedsbs.dll
2013-12-22 17:32 . 2013-12-22 17:32   48640   ----a-w-   c:\windows\system32\mshtmler.dll
2013-12-22 17:32 . 2013-12-22 17:32   453120   ----a-w-   c:\windows\system32\dxtmsft.dll
2013-12-22 17:32 . 2013-12-22 17:32   413696   ----a-w-   c:\windows\system32\html.iec
2013-12-22 17:32 . 2013-12-22 17:32   40448   ----a-w-   c:\windows\system32\JavaScriptCollectionAgent.dll
2013-12-22 17:32 . 2013-12-22 17:32   296960   ----a-w-   c:\windows\system32\dxtrans.dll
2013-12-22 17:32 . 2013-12-22 17:32   13312   ----a-w-   c:\windows\system32\msfeedssync.exe
2013-12-22 17:32 . 2013-12-22 17:32   131072   ----a-w-   c:\windows\system32\IEAdvpack.dll
2013-12-22 17:32 . 2013-12-22 17:32   105984   ----a-w-   c:\windows\system32\iesysprep.dll
2013-12-22 17:32 . 2013-12-22 17:32   84992   ----a-w-   c:\windows\system32\mshtmled.dll
2013-12-22 17:32 . 2013-12-22 17:32   81408   ----a-w-   c:\windows\system32\icardie.dll
2013-12-22 17:32 . 2013-12-22 17:32   62464   ----a-w-   c:\windows\system32\pngfilt.dll
2013-12-22 17:32 . 2013-12-22 17:32   616104   ----a-w-   c:\windows\system32\ieapfltr.dat
2013-12-22 17:32 . 2013-12-22 17:32   30208   ----a-w-   c:\windows\system32\licmgr10.dll
2013-12-22 17:32 . 2013-12-22 17:32   263376   ----a-w-   c:\windows\system32\iedkcs32.dll
2013-12-22 17:32 . 2013-12-22 17:32   243200   ----a-w-   c:\windows\system32\webcheck.dll
2013-12-22 17:32 . 2013-12-22 17:32   235520   ----a-w-   c:\windows\system32\url.dll
2013-12-22 17:32 . 2013-12-22 17:32   167424   ----a-w-   c:\windows\system32\iexpress.exe
2013-12-22 17:32 . 2013-12-22 17:32   147968   ----a-w-   c:\windows\system32\occache.dll
2013-12-22 17:32 . 2013-12-22 17:32   143872   ----a-w-   c:\windows\system32\wextract.exe
2013-12-22 17:32 . 2013-12-22 17:32   13824   ----a-w-   c:\windows\system32\mshta.exe
2013-12-22 17:32 . 2013-12-22 17:32   1228800   ----a-w-   c:\windows\system32\mshtmlmedia.dll
2013-12-22 17:32 . 2013-12-22 17:32   101376   ----a-w-   c:\windows\system32\inseng.dll
2013-12-22 17:32 . 2013-12-22 17:32   83968   ----a-w-   c:\windows\system32\MshtmlDac.dll
2013-12-22 17:32 . 2013-12-22 17:32   774144   ----a-w-   c:\windows\system32\jscript.dll
2013-12-22 17:32 . 2013-12-22 17:32   48128   ----a-w-   c:\windows\system32\imgutil.dll
2013-12-22 17:32 . 2013-12-22 17:32   135680   ----a-w-   c:\windows\system32\iepeers.dll
2013-12-18 11:09 . 2014-01-16 10:29   96168   ----a-w-   c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-12-04 03:28 . 2014-01-17 10:22   10315576   ----a-w-   c:\programdata\Microsoft\Windows Defender\Definition Updates\{468AE781-6671-42D9-990D-7666F4CE7B2A}\mpengine.dll
2013-11-27 01:41 . 2014-01-15 03:22   343040   ----a-w-   c:\windows\system32\drivers\usbhub.sys
2013-11-27 01:41 . 2014-01-15 03:22   99840   ----a-w-   c:\windows\system32\drivers\usbccgp.sys
2013-11-27 01:41 . 2014-01-15 03:22   53248   ----a-w-   c:\windows\system32\drivers\usbehci.sys
2013-11-27 01:41 . 2014-01-15 03:22   325120   ----a-w-   c:\windows\system32\drivers\usbport.sys
2013-11-27 01:41 . 2014-01-15 03:22   25600   ----a-w-   c:\windows\system32\drivers\usbohci.sys
2013-11-27 01:41 . 2014-01-15 03:22   30720   ----a-w-   c:\windows\system32\drivers\usbuhci.sys
2013-11-27 01:41 . 2014-01-15 03:22   7808   ----a-w-   c:\windows\system32\drivers\usbd.sys
2013-11-26 11:40 . 2014-01-15 03:21   376768   ----a-w-   c:\windows\system32\drivers\netio.sys
2013-11-26 10:32 . 2014-01-15 03:22   3156480   ----a-w-   c:\windows\system32\win32k.sys
2013-11-23 18:26 . 2013-12-22 06:47   417792   ----a-w-   c:\windows\SysWow64\WMPhoto.dll
2013-11-23 17:47 . 2013-12-22 06:47   465920   ----a-w-   c:\windows\system32\WMPhoto.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54   131248   ----a-w-   c:\users\Ray\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54   131248   ----a-w-   c:\users\Ray\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54   131248   ----a-w-   c:\users\Ray\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54   131248   ----a-w-   c:\users\Ray\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"InternodeUsage"="c:\progra~2\INTERN~2\mum.exe" [2011-02-19 1361408]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2014-01-15 6563608]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"EPLTarget\P0000000000000001"="c:\windows\system32\spool\DRIVERS\x64\3\E_YATIIVE.EXE" [2012-02-27 283232]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288]
"EEventManager"="c:\program files (x86)\EPSON\Creativity Suite\Event Manager\EEventManager.exe" [2006-10-12 102400]
"FUFAXRCV"="c:\program files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe" [2012-07-09 502952]
"FUFAXSTM"="c:\program files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe" [2012-07-09 863400]
.
c:\users\Ray\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Ray\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-1-3 30714328]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
ExifLauncher2.lnk - c:\program files (x86)\FinePixViewer\QuickDCF2.exe [2012-5-19 303104]
Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office10\OSA.EXE -b -l [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer6"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-disabled]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 EpsonScanSvc;Epson Scanner Service;c:\windows\system32\EscSvc64.exe;c:\windows\SYSNATIVE\EscSvc64.exe [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys;c:\windows\SYSNATIVE\Drivers\ssadadb.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 netr7364;RT73 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr7364.sys;c:\windows\SYSNATIVE\DRIVERS\netr7364.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys;c:\windows\SYSNATIVE\DRIVERS\ssadserd.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys;c:\windows\SYSNATIVE\DRIVERS\vmci.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [x]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [x]
S2 EPSON_PM_RPCV4_05;EPSON V3 Service4(05);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE [x]
S2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe;c:\windows\SYSNATIVE\IProsetMonitor.exe [x]
S2 jhi_service;Intel® Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [x]
S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-02-11 01:41   1211720   ----a-w-   c:\program files (x86)\Google\Chrome\Application\32.0.1700.107\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2014-02-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-19 02:48]
.
2014-02-13 c:\windows\Tasks\GlaryInitialize.job
- c:\program files (x86)\Glary Utilities\initialize.exe [2013-05-16 05:39]
.
2014-02-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-19 07:29]
.
2014-02-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-19 07:29]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54   164016   ----a-w-   c:\users\Ray\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54   164016   ----a-w-   c:\users\Ray\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54   164016   ----a-w-   c:\users\Ray\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54   164016   ----a-w-   c:\users\Ray\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-10-05 11474024]
"Nvtmru"="c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-11-14 1028384]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2013-11-14 1064224]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 1266912]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office10\EXCEL.EXE/3000
LSP: %SystemRoot%\system32\vsocklib.dll
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Ray\AppData\Roaming\Mozilla\Firefox\Profiles\vgp03jla.default\

FF - prefs.js: browser.search.selectedEngine - Search By ZoneAlarm
.
- - - - ORPHANS REMOVED - - - -
.
SafeBoot-39143565.sys
SafeBoot-CleanHlp
SafeBoot-CleanHlp.sys
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-Shockwave - c:\windows\System32\Macromed\SHOCKW~1\UNWISE.EXE
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2014-02-19 08:58:37
ComboFix-quarantined-files.txt 2014-02-18 22:58
.
Pre-Run: 151,225,524,224 bytes free
Post-Run: 151,220,047,872 bytes free
.
- - End Of File - - F94BAB08E063430A0FAB10F5C325ED19
A36C5E4F47E84449FF07ED3517B43A31

Maniac · February 18, 2014

Please scan your machine with ESET OnlineScan

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer.
  Save it to your Desktop.
- Double click on the to download the ESET Smart Installer. icon on your Desktop.
Check "YES, I accept the Terms of Use."
Click the Start button.
Accept any security warnings from your browser.
Under Scan Settings, check "Scan Archives" and "Remove found threats"
Click Advanced settings and select the following:
- Scan potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth technology
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, click List Threats
Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Click the Back button.
Click the Finish button.

Malwarebytes freezs

Recommended Posts

Link to post

Share on other sites

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information