Network completely taken over by Trojan/rootkit/hijacker NEED HELP ASAP before we toss all 8 computers in the trash

StarKat · January 29, 2014

I am sincerely hoping there is help for me and my husband here... I have NO idea where to start... But i will try to explain to the best of my abilities. We have 8 computers that have been hijacked by outside remote users! I can find logs of these users (maybe user- who knows) showing transfer of files back and forth and can find 3 different versions of my C:/Windows folder depending on how I navigate to it- clicking shortcut links takes me to a different place... I found a shared folder in my D:/Lenovo recovery partition that clearly showed me my Webcam, Audio devices, Boot MBR, Kernel, Registry and system files and more of course, were all being accessed, as well as showing me images of how to make a desktop not your own work as a remote virtual machine... I feel like I'm going crazy but I know what I have seen and I have no idea what to do. We used a completely clean computer that had a hard drive that had not been in it or connected to our network ever and within seconds of it being connected to our modem directly not through our wireless router, the machine was taken over by remote access also. Any discs we try to write or use for booting are corrupted- I no longer have any choices other than boot from windows OS- no USB, no cd/DVD Drive- I CANNOT change anything in BIOS as my BIOS has actually been replaced with a pseudo BIOS interface. It is now Insyde H20, not Lenovo BIOS utility. And I cannot make any changes. I set a password on my hard drive and cd drive as I realized something was going on and cannot remove them now- no option exists, and no option other than boot from windows exists. This is really disturbing and I jane no idea what to do?!? Rebuild BIOS? And MBR??

We are completely hijacked!!

We are redirected when trying to access websites, especially anything to do with anti-virus, and sent to different spots...and also if I find something suspect and look at it, the next time I come back it seems to be gone...

I don't know if anyone here can help me but at this point we have disconnected e dry thing and even pulled out laptop batteries as one especially was downloading and uploading torrents. We are extremely overwhelmed and looking for any help possible please.

Someone please offer me something as a solution beyond just throwing all 8 computers in the trash...

I hope that I have posted correctly here- please let me know what info I could provide that could potentially be helpful.

Thank you.

AdvancedSetup · January 30, 2014

Hello StarKat and :welcome:

Let me start off by asking why you have 8 computers. Is this a business network of computers ?

Are you able to logon and run anything on any of the computers at this point either in Normal Mode or Safe Mode?

StarKat · January 30, 2014

Hi, thank you for your reply.

We do not normally have 8 computers in the house- we have 3-4 base laptops that are used regularly. I have 1, and 1 backup, was put away until a few days ago since receiving my brand new Lenovo ultra book only a bit more than a month ago. My husband has 3 right now he has been using- 1 Work- this one is highly protected (or at least we thought so...) and only for his work purposes- it uses a VPN to connect to a secure company network- (we have yet to determine if that has been affected or not), he has 1 other for creating music with a midi-controller and then 1 that is his old work computer that he uses occasionally. I have my boss's computer right now also as she is out of the country and I need it for invoicing purposes for our business and was tasked with organizing and cleaning it up for her while she is away. So we had 5 that we were using actively, normally 4 at most and we both work from home mostly so yes it could be called a home "work network" I guess...

As we realized what was going on, it was first noticed on our Dell 17R 5720 (brief descriptions of infected systems are listed below)- tons of files were added from nowhere, downloads and installation of non- authorized programs, long identifiers on folders of recent downloads which when found are empty and not able to uninstall... User privileges changed and admin rights taken away on folders/programs/processes, log files of file transfer back and forth through remote access, hijacking of web browsers including redirects/blocked sites/unapproved downloads, etc., I was no longer able to open my own user folder... Obviously we had been hacked... Tons of running processes using CPU resources, no admin rights to stop and programs installed with pseudo icons disguising them as things we are used to- ie: Action center says we need to update Windows, Java, Adobe, Windows Media Player etc. updater services running all the time- inability to change normal Windows functions.

Cmd.exe shows extensive netstat activity and so does our router logs.

At that point, we needed to determine what exactly was getting infected- was it in the network router and/or modem? Wireless or LAN lined distributed or both... Is it in the hardware, the BIOS, RAM, motherboards, optical drives, possibly our Wii, Blu- Ray?? We have no idea really so we went after ruling out what we could and ended up not being able to really rule anything out!

We pulled out old computers- the 2 old laptops and a tower- to try and diagnose, fix and determine the extent of what we were dealing with.

My husband had issues with his motherboard in his music machine so it has been rebuilt and he's been using the third for that in the meantime.

We are able to access our router log and see outgoing sent requests and packets to several different port numbers and IP addresses- Peer to peer networks, foreign- (probably eastern Europe based on 1 IT persons analysis) but no clear evidence of that- definitely seeing remote access- tunneling, ipv4, ipv6, via virtual and actual network adapters installed on all machines.

Each computers lists of installed network adapters is huge! And tons of hidden devices non plug and play- I believe they may be using the Bluetooth to stay connected?? Our webcams and imaging services are incapable of being disabled- I assume keylogging and Remote Desktop viewing is happening.

Some laptops have had their installed adapters turned on and off at different times. Literally have watched the Stop and Disable of a service be changes to Start and Automatic before my eyes. This is unlike anything I've ever seen and spread like wildfire.

Side note- other than the laptops and tower of our network, we believe our iPhones and M-Cell from AT&T are also experiencing odd problems and redirects from websites, weird sounds, trying to connect to foreign browsers and send emails from our email addresses- this is occurring while using anywhere- home or not and we are not using the M-Cell anymore- happening on cellular service too, not just on our wireless network. And neighbor with PC, android, 2 Macs is also infected-so it is across platforms. Not only Windows based, MAC too...

Description of computers involved:

Lenovo Ideapad U510

Can no longer access or use- tried to low level format Hardrive for fresh clean install of Windows 8 and hard disk is no longer visible or accessible so no OS installed right now- sending back to Lenovo most likely for a brand new machine...

Corrupt hard disk possibly now? Or maybe format utility gone bad or corrupted, wrote all zeros to drive- possibly salvageable to get running but bios is pseudo interface I believe.

Music computer

Dell Inspiron 17R 5720- 14 months olds- Win 7 64-bit, clean install after low level format utility, and dos checks just yesterday- appears to be the cleanest computer in the house right now- finished rebuild earlier today- not connected to Internet yet. Now has Phoenix Bios, lots of added devices and network adapters.

Work computer A

Dell Latitude- E6530- Win 7 64 bit pro- no formatting or reinstalls have occurred- 1 IT professional looked at it and dismissed issues as just normal processes and software updates-hijacking rootkit is hidden wisely on this more protected operating system- hard to detect if you don't know what you're looking for.

Toshiba- satellite- L35- S2366 Old old laptop original Vista platform, now Win 7 32-bit. Completely infected and taken over. This would be a great experimental tool as we actually no longer use this one. Only brought it up and out for diagnostic purposes and to search for utilities.

Sony Viao- very old and was in bin for donation... Has a Win XP- 12 year old copy reinstalled once since we have had it, infected immediately after connection to wired LAN with every other computer off, no batteries and not connected to Network- Wireless disabled, only LAN line hardwired into it- we connected it to see if it came from the router (which it did immediately!!) not a direct download or install of some kind of software. Internet hijacks made it useless, so slow and unable to use for the most part.

Dell

Win XP Home- drives written with all zeros, CD rom was accessible intermittently for the last 2 years- now completely unusable. ISO boot from USB only option- no other option. Only up for about 12 hours before wiping disks.

Tower AMD multiplatform Frankenstein home build machine running Windows XP, this one is also a great experimental or diagnostic machine.

This one upon connecting to a clean wireless USB network adapter immediately became hijacked- all kinds of file changes, permission changes, installs of updates. This adapter had not been used on any other machine in weeks. C and D drives both removed. CMOS battery removed and memory cleared with jumper. New Hardrive (ancient relic from garage) installed with new copy of Win XP and not yet connected to network- evidence not clear... Seems in waiting and ready to receive signal, signs of weird things and extra processes/programs/logs...

We attempted another OS rebuild in this tower- with both the original C and D drives- both low level formatted before reinstallation. Connected to Cd and DVD drives for boot to new install and both optical drives became completely corrupted during reinstall- door/part? popped inside during install and no longer opens on one if them, and the other drive is completely non responsive. Has not been connected to network but is totally infected and useless.

Asus- AMD chip- 64-bit Win 7 Home original install- 3/4 years old?...AVG and AD-Aware installed. By far the worst infected machine. Settings allowed auto sync with Dropbox, iCloud, google drive, maybe more... This one belongs to my boss- I use it for work while she is out of the country. Found logs of all kinds of torrent downloads and uploads- movies, music, info about banks/financial sites...

At least 4 machines had Dropbox enabled to auto sync and google drive somehow also... Among other cloud utilities and auto updates. It's a mess.

Sorry for the length of this but I feel the extent of damage needs to be explained and the nastiness of the infection. I don't know if our computers can be saved but if this info can help others be aware then I would feel better about that.

I am happy to run any programs or files on at least 3 of these immediately. I can post logs and whatever else needed to determine what this is... As I said I don't know we can get rid of it completely without all new equipment but I am willing to try anything.

Thank you in advance for reading this and any possible advice/help! We are desperate!

StarKat · January 30, 2014

And didn't meant to post all of that- was going to edit a bit- oops!

In answer to your question 3 maybe 4 that can no longer access the OS- the others limp along behaving fine for a while and then not reacting at all to our commands. Working in safe mode does not stop anything- disabling network adapters in all machines and unplugging wireless router and modem have slowed it but not much.

Seems we cannot stop it and when we try it then disallows access to what you have found.

It's corrupted CD's as they were running as well as USB drives.

So, let me know a place to start and I will do whatever you suggest.

Thank you.

AdvancedSetup · January 30, 2014

Okay well we can only work on one system at a time so you need to pick one and we'll stick with that one until it's clean.

If you've not already done so please start here and post back the 2 log files DDS.txt and Attach.txt

General P2P/Piracy Warning:

If you're using
Peer 2 Peer
software such as
uTorrent, BitTorrent
or similar you must either fully uninstall them or completely disable them from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

If you have
illegal/cracked software, cracks, keygens etc
. on the system, please remove or uninstall them now and read the policy on
Piracy
.

Before we proceed further, please read all of the following instructions carefully.
If there is anything that you do not understand kindly ask before proceeding.
If needed please print out these instructions.

Please do not post logs using CODE, QUOTE, or FONT tags. Just paste them as direct text.
If the log is too large then you can use attachments by clicking on the More Reply Options button.
Please enable your system to show hidden files: How to see hidden files in Windows
Make sure you're subscribed to this topic:
- Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly
[*]Removing malware can be unpredictable...It is unlikely but things can go very wrong! Please make sure you Backup all files that cannot be replaced if something were to happen. You can copy them to a CD/DVD, external drive or a pen drive [*]Please don't run any other scans, download, install or uninstall any programs unless requested by me while I'm working with you. [*]The removal of malware is not instantaneous, please be patient. Often we are also on a different Time Zone. [*]Perform everything in the correct order. Sometimes one step requires the previous one. [*]If you have any problems while following my instructions, Stop there and tell me the exact nature of the issue. [*]You can check here if you're not sure if your computer is 32-bit or 64-bit [*]Please disable your antivirus while running any requested scanners so that they do not interfere with the scanners. [*]When we are done, I'll give you instructions on how to cleanup all the tools and logs [*]Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that. [*]Your topic will be closed if you haven't replied within 3 days [*](If I have not responded within 24 hours, please send me a Private Message as a reminder)

STEP 0
RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes
so that your normal security software can then run and clean your computer of infections.
When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies
that stop us from using certain tools. When finished it will display a log file that shows the processes that were
terminated while the program was running.

As RKill only terminates a program's running process, and does not delete any files, after running it you should not reboot
your computer as any malware processes that are configured to start automatically will just be started again.
Instead, after running RKill you should immediately scan your computer using the requested scans I've included.

Please download Rkill by Grinler from one of the links below and save it to your desktop.

Link 1

Link 2

On Windows XP double-click on the Rkill desktop icon to run the tool.
On Windows Vista/Windows 7 or 8, right-click on the Rkill desktop icon and select Run As Administrator
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
If the tool does not run from any of the links provided, please let me know.
Do not reboot the computer, you will need to run the application again.

STEP 01
Backup the Registry:
Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.

Please download ERUNT from one of the following links: Link1 | Link2 | Link3
ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.
Double click on erunt-setup.exe to Install ERUNT by following the prompts.
NOTE: Do not choose to allow ERUNT to add an Entry to the Startup folder. Click NO.
Start ERUNT either by double clicking on the desktop icon or choosing to start the program at the end of the setup process.
Choose a location for the backup.
- Note: the default location is C:\Windows\ERDNT which is acceptable.
[*]Make sure that at least the first two check boxes are selected. [*]Click on OK [*]Then click on YES to create the folder. [*]Note: if it is necessary to restore the registry, open the backup folder and start ERDNT.exe

STEP 02
Please download RogueKiller and save it to your desktop.

You can check here if you're not sure if your computer is 32-bit or 64-bit

RogueKiller 32-bit | RogueKiller 64-bit
Quit all running programs.
For Windows XP, double-click to start.
For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
Read and accept the EULA (End User Licene Agreement)
Click Scan to scan the system.
When the scan completes Close the program > Don't Fix anything!
Don't run any other options, they're not all bad!!
Post back the report which should be located on your desktop.

StarKat · January 31, 2014

Here are the DDS.txt and Attach.txt logs

DDS.txt

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 11.0.9600.16428 BrowserJavaVersion: 10.51.2

Run by Creator at 21:04:08 on 2014-01-30

Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.1406.539 [GMT -8:00]

.

AV: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}

.

============== Running Processes ================

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\Ati2evxx.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\AVG\AVG2013\avgwdsvc.exe

C:\Windows\system32\TODDSrv.exe

C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Toshiba\Power Saver\TPwrMain.exe

C:\Program Files\Toshiba\SmoothView\SmoothView.exe

C:\Program Files\Toshiba\FlashCards\TCrdMain.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Synaptics\SynTP\SynToshiba.exe

C:\Program Files\AVG\AVG2013\avgui.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe

C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\wuauclt.exe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

C:\Program Files\AVG\AVG2013\avgcfgex.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Windows\notepad.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\svchost.exe -k HPService

.

============== Pseudo HJT Report ===============

.

uProxyOverride = <-loopback>

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll

BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office\office14\URLREDIR.DLL

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll

mRun: [TPwrMain] c:\program files\toshiba\power saver\TPwrMain.EXE

mRun: [smoothView] c:\program files\toshiba\smoothview\SmoothView.exe

mRun: [00TCrdMain] c:\program files\toshiba\flashcards\TCrdMain.exe

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [AVG_UI] "c:\program files\avg\avg2013\avgui.exe" /TRAYONLY

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [WebInternetSecurity] "c:\program files\webinternetsecurity\WebInternetSecurity.exe"

mRunOnce: [Malwarebytes Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~1\micros~1\office14\ONBttnIE.dll/105

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll

TCP: NameServer = 75.75.75.75 75.75.76.76

TCP: Interfaces\{62E556EA-CE34-43AC-9AE8-E7B8A414E8EF} : DHCPNameServer = 75.75.75.75 75.75.76.76

TCP: Interfaces\{6BA886AA-1457-4D38-BD6C-04C09EEE2E2C} : DHCPNameServer = 75.75.75.75 75.75.76.76 192.168.1.1

TCP: Interfaces\{6BA886AA-1457-4D38-BD6C-04C09EEE2E2C}\037364850383035323632383 : DHCPNameServer = 192.168.1.1 192.168.1.1

TCP: Interfaces\{6BA886AA-1457-4D38-BD6C-04C09EEE2E2C}\14454563633353 : DHCPNameServer = 192.168.1.254

TCP: Interfaces\{6BA886AA-1457-4D38-BD6C-04C09EEE2E2C}\4557C69607F523E243 : DHCPNameServer = 192.168.2.1

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -

SSODL: WebCheck - <orphaned>

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\32.0.1700.102\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

.

============= SERVICES / DRIVERS ===============

.

R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [2013-7-20 60216]

R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [2013-7-20 246072]

R0 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2013-7-1 96568]

R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2013-10-23 39224]

R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [2013-11-25 208184]

R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [2013-10-23 22328]

R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2013-7-20 171320]

R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2013-3-21 182072]

R2 avgwd;AVG WatchDog;c:\program files\avg\avg2013\avgwdsvc.exe [2013-11-20 283136]

R2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files\toshiba\configfree\CFIWmxSvcs.exe [2009-8-10 185712]

R2 ConfigFree Service;ConfigFree Service;c:\program files\toshiba\configfree\CFSvcs.exe [2009-3-10 46448]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2014-1-30 40776]

S2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2013\avgidsagent.exe [2013-7-4 4939312]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2011-4-11 62464]

S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\ieetwcollector.exe [2013-12-12 108032]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2013-7-11 14848]

S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]

S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2013-11-12 49152]

S3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2013-7-11 27136]

S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2012-7-4 1343400]

S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-5-6 11520]

.

=============== Created Last 30 ================

.

2014-01-31 05:02:14 54016 ----a-w- c:\windows\system32\drivers\roibbkrj.sys

2014-01-31 04:40:47 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2014-01-31 04:40:46 -------- d-----w- c:\users\creator\appdata\roaming\Malwarebytes

2014-01-31 04:39:44 -------- d-----w- c:\programdata\Malwarebytes

2014-01-31 04:39:42 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2014-01-31 04:39:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2014-01-31 04:39:25 -------- d-----w- c:\users\creator\appdata\local\Programs

2014-01-24 03:43:01 -------- d-----w- c:\windows\system32\appmgmt

2014-01-24 03:29:49 -------- d-----w- c:\users\creator\appdata\local\WebInternetSecurity

2014-01-24 03:14:33 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

2014-01-07 06:38:37 -------- d-----w- c:\windows\system32\%LOCALAPPDATA%

.

==================== Find3M ====================

.

2013-12-18 21:35:19 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-12-18 21:35:19 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-11-26 09:23:02 2724864 ----a-w- c:\windows\system32\mshtml.tlb

2013-11-26 09:22:11 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll

2013-11-26 08:53:56 61952 ----a-w- c:\windows\system32\iesetup.dll

2013-11-26 08:52:26 51200 ----a-w- c:\windows\system32\ieetwproxystub.dll

2013-11-26 08:29:55 112128 ----a-w- c:\windows\system32\ieUnatt.exe

2013-11-26 08:29:52 108032 ----a-w- c:\windows\system32\ieetwcollector.exe

2013-11-26 08:28:16 553472 ----a-w- c:\windows\system32\jscript9diag.dll

2013-11-26 08:16:12 4243968 ----a-w- c:\windows\system32\jscript9.dll

2013-11-26 07:32:06 1928192 ----a-w- c:\windows\system32\inetcpl.cpl

2013-11-26 06:33:33 1820160 ----a-w- c:\windows\system32\wininet.dll

2013-11-25 09:48:36 208184 ----a-w- c:\windows\system32\drivers\avgidsdriverx.sys

2013-11-23 18:26:20 417792 ----a-w- c:\windows\system32\WMPhoto.dll

2013-11-12 20:58:59 61952 ----a-w- c:\windows\system32\MshtmlDac.dll

2013-11-12 20:58:58 36352 ----a-w- c:\windows\system32\imgutil.dll

2013-11-12 20:58:56 111616 ----a-w- c:\windows\system32\IEAdvpack.dll

2013-11-12 20:58:53 74240 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2013-11-12 20:58:52 48640 ----a-w- c:\windows\system32\mshtmler.dll

2013-11-12 20:58:51 86016 ----a-w- c:\windows\system32\iesysprep.dll

2013-11-12 02:07:29 2048 ----a-w- c:\windows\system32\tzres.dll

.

============= FINISH: 21:05:20.76 ===============

And this is the Attach.txt

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 7/4/2012 11:51:14 AM

System Uptime: 1/30/2014 8:06:32 PM (1 hours ago)

.

Motherboard: TOSHIBA | | Satellite L35

Processor: Genuine Intel® CPU T2060 @ 1.60GHz | U23 | 800/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 74 GiB total, 35.351 GiB free.

D: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP102: 1/23/2014 8:10:13 PM - Removed Apple Application Support

RP103: 1/23/2014 8:15:48 PM - Removed Bonjour

RP104: 1/23/2014 8:29:28 PM - Removed Apple Mobile Device Support

RP105: 1/23/2014 8:31:18 PM - Removed Apple Software Update

RP106: 1/23/2014 10:37:10 PM - Removed GimpShop 2.8

RP107: 1/23/2014 10:38:58 PM - Removed GimpShop 2.8

.

==== Installed Programs ======================

.

7-Zip 9.20

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader XI (11.0.05)

AMD APP SDK Runtime

AMD Catalyst Install Manager

AVG 2013

Convert XLS

Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition

Google Chrome

Google Earth

Google Toolbar for Internet Explorer

Google Update Helper

Java 7 Update 51

Java Auto Updater

Malwarebytes Anti-Malware version 1.75.0.1300

Microsoft .NET Framework 4 Client Profile

Microsoft Office Access MUI (English) 2010

Microsoft Office Access Setup Metadata MUI (English) 2010

Microsoft Office Excel MUI (English) 2010

Microsoft Office OneNote MUI (English) 2010

Microsoft Office Outlook MUI (English) 2010

Microsoft Office PowerPoint MUI (English) 2010

Microsoft Office Professional 2010

Microsoft Office Proof (English) 2010

Microsoft Office Proof (French) 2010

Microsoft Office Proof (Spanish) 2010

Microsoft Office Proofing (English) 2010

Microsoft Office Publisher MUI (English) 2010

Microsoft Office Shared MUI (English) 2010

Microsoft Office Shared Setup Metadata MUI (English) 2010

Microsoft Office Single Image 2010

Microsoft Office Word MUI (English) 2010

Microsoft Silverlight

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

MSXML 4.0 SP3 Parser (KB2758694)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2858302v2)

Security Update for Microsoft Excel 2010 (KB2826033) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2553284) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2687423) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2826023) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2826035) 32-Bit Edition

Security Update for Microsoft Office 2010 (KB2850016) 32-Bit Edition

Security Update for Microsoft Outlook 2010 (KB2837597) 32-Bit Edition

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition

Synaptics Pointing Device Driver

TOSHIBA ConfigFree

TOSHIBA Disc Creator

TOSHIBA Hardware Setup

TOSHIBA Value Added Package

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3)

Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition

Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition

Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition

Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition

Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition

Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition

Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition

Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition

Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition

Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition

Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition

Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition

Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition

Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition

Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition

.

==== Event Viewer Messages From Past Week ========

.

1/29/2014 9:21:35 AM, Error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied.

1/27/2014 8:13:01 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service.

1/27/2014 11:45:25 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR9.

1/27/2014 11:31:31 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR6.

1/24/2014 7:59:29 AM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR8.

1/23/2014 9:44:18 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.

1/23/2014 8:14:43 PM, Error: Service Control Manager [7000] - The Apple Mobile Device service failed to start due to the following error: The application has failed to start because its side-by-side configuration is incorrect. Please see the application event log or use the command-line sxstrace.exe tool for more detail.

1/23/2014 10:36:11 PM, Error: Service Control Manager [7031] - The Update LinkiDoo service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

1/23/2014 10:36:04 PM, Error: Service Control Manager [7031] - The Util LinkiDoo service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

1/23/2014 10:31:56 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR2.

.

==== End Of File ===========================

Getting Ready to run Steps 00, 01 and 02 but here is this for now

StarKat · January 31, 2014

Ok- so here is the report from Rogue Killer-

I am now being redirected all over the place on that PC when trying to login here or to the yahoo email I am using for anything related to this- told me my account here was locked but then trying on my phone- now- it is obviously not locked. And yahoo would not load several times.

And FYI this is all being done on the Toshiba laptop. Let me know what to do next.

And also, I have not and do not use P2P anything, nor do I use torrent files or key gens, so if those are on any of these- I did not put them there.

RogueKiller V8.8.4 [Jan 27 2014] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.adlice.com/forum/

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version

Started in : Normal mode

User : Creator [Admin rights]

Mode : Scan -- Date : 01/30/2014 21:57:34

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 3 ¤¤¤

[HJ SMENU][PUM] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 4 ¤¤¤

[V1][sUSP PATH] AVG-Secure-Search-Update_JUNE2013_HP_rmv.job : C:\Windows\TEMP\{0A3BF88E-16A6-4D85-85BB-F76A1D4E89F9}.exe - --uninstall=1 [x] -> FOUND

[V1][sUSP PATH] AVG-Secure-Search-Update_JUNE2013_TB_rmv.job : C:\Windows\TEMP\{89D744A7-8B74-4ABE-90B1-EBBCEFC2A011}.exe - --uninstall=1 [x] -> FOUND

[V2][sUSP PATH] AVG-Secure-Search-Update_JUNE2013_HP_rmv : C:\Windows\TEMP\{0A3BF88E-16A6-4D85-85BB-F76A1D4E89F9}.exe - --uninstall=1 [x] -> FOUND

[V2][sUSP PATH] AVG-Secure-Search-Update_JUNE2013_TB_rmv : C:\Windows\TEMP\{89D744A7-8B74-4ABE-90B1-EBBCEFC2A011}.exe - --uninstall=1 [x] -> FOUND

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) TOSHIBA MK8037GSX ATA Device +++++

--- User ---

[MBR] 1a33e74e59701c03892005121daeedf3

[bSP] fdf73721a5e22882bc0910f238e2fcd9 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 76217 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[0]_S_01302014_215734.txt >>

RKreport[0]_S_01302014_215252.txt

There were several suspect drivers found but I do not see them listed here.

Thanks for your help and I will wait for further instructions.

AdvancedSetup · January 31, 2014

Please read the following and when ready make sure you temporarily disable your antivirus when running this tool.

Please visit this webpage and read the ComboFix User's Guide:

Once you've read the article and are ready to use the program you can download it directly from the link below.
Important! - Please make sure you save combofix to your desktop and do not run it from your browser
Direct download link for: ComboFix.exe
Please make sure you disable your security applications before running ComboFix.
Once Combofix has completed it will produce and open a log file. Please be patient as it can take some time to load.
Please attach that log file to your next reply.
If needed the file can be located here: C:\combofix.txt
NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.

StarKat · February 1, 2014

ComboFix 14-01-29.01 - Creator 01/31/2014   0:08.1.2 - x86
Microsoft Windows 7 Professional   6.1.7601.1.1252.1.1033.18.1406.603 [GMT -8:00]
Running from: c:\users\Creator\Downloads\ComboFix.exe
AV: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
SP: AVG AntiVirus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Creator\AppData\Local\Temp\7zS3EC8\HPSLPSVC32.DLL
.
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_HPSLPSVC
.
.
(((((((((((((((((((((((((   Files Created from 2013-12-28 to 2014-01-31 )))))))))))))))))))))))))))))))
.
.
2014-01-31 05:44 . 2014-01-31 05:45 -------- d-----w- c:\program files\ERUNT
2014-01-31 04:40 . 2014-01-31 04:40 -------- d-----w- c:\users\Creator\AppData\Roaming\Malwarebytes
2014-01-31 04:39 . 2014-01-31 04:39 -------- d-----w- c:\programdata\Malwarebytes
2014-01-31 04:39 . 2014-01-31 04:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2014-01-31 04:39 . 2013-04-04 22:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-01-31 04:39 . 2014-01-31 04:39 -------- d-----w- c:\users\Creator\AppData\Local\Programs
2014-01-24 03:29 . 2014-01-24 03:29 -------- d-----w- c:\users\Creator\AppData\Local\WebInternetSecurity
2014-01-24 03:14 . 2013-12-19 05:10 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2014-01-21 08:31 . 2014-01-21 08:31 -------- d-----w- c:\program files\7-Zip
2014-01-07 06:38 . 2014-01-07 06:38 -------- d-----w- c:\windows\system32\%LOCALAPPDATA%
2014-01-06 21:42 . 2014-01-06 21:44 -------- d-----w- c:\users\TEMP
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-12-18 21:35 . 2012-07-04 23:55 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-12-18 21:35 . 2012-07-04 23:55 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-11-26 09:23 . 2013-12-12 09:30 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2013-11-26 09:22 . 2013-12-12 09:30 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2013-11-26 08:53 . 2013-12-12 09:30 61952 ----a-w- c:\windows\system32\iesetup.dll
2013-11-26 08:52 . 2013-12-12 09:30 51200 ----a-w- c:\windows\system32\ieetwproxystub.dll
2013-11-26 08:29 . 2013-12-12 09:30 112128 ----a-w- c:\windows\system32\ieUnatt.exe
2013-11-26 08:29 . 2013-12-12 09:30 108032 ----a-w- c:\windows\system32\ieetwcollector.exe
2013-11-26 08:28 . 2013-12-12 09:30 553472 ----a-w- c:\windows\system32\jscript9diag.dll
2013-11-26 08:16 . 2013-12-12 09:30 4243968 ----a-w- c:\windows\system32\jscript9.dll
2013-11-26 07:32 . 2013-12-12 09:30 1928192 ----a-w- c:\windows\system32\inetcpl.cpl
2013-11-26 06:33 . 2013-12-12 09:30 1820160 ----a-w- c:\windows\system32\wininet.dll
2013-11-25 09:48 . 2013-11-25 09:48 208184 ----a-w- c:\windows\system32\drivers\avgidsdriverx.sys
2013-11-23 18:26 . 2013-12-11 17:58 417792 ----a-w- c:\windows\system32\WMPhoto.dll
2013-11-12 20:59 . 2013-11-12 20:59 646144 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-12 20:59 . 2013-11-12 20:59 194048 ----a-w- c:\windows\system32\elshyph.dll
2013-11-12 20:59 . 2013-11-12 20:59 645120 ----a-w- c:\windows\system32\jsIntl.dll
2013-11-12 20:59 . 2013-11-12 20:59 71680 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-11-12 20:59 . 2013-11-12 20:59 182272 ----a-w- c:\windows\system32\msls31.dll
2013-11-12 20:59 . 2013-11-12 20:59 62464 ----a-w- c:\windows\system32\tdc.ocx
2013-11-12 20:59 . 2013-11-12 20:59 34816 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-11-12 20:59 . 2013-11-12 20:59 337408 ----a-w- c:\windows\system32\html.iec
2013-11-12 20:59 . 2013-11-12 20:59 1051136 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-11-12 20:59 . 2013-11-12 20:59 24576 ----a-w- c:\windows\system32\licmgr10.dll
2013-11-12 20:59 . 2013-11-12 20:59 151552 ----a-w- c:\windows\system32\iexpress.exe
2013-11-12 20:59 . 2013-11-12 20:59 139264 ----a-w- c:\windows\system32\wextract.exe
2013-11-12 20:59 . 2013-11-12 20:59 454656 ----a-w- c:\windows\system32\vbscript.dll
2013-11-12 20:59 . 2013-11-12 20:59 13312 ----a-w- c:\windows\system32\mshta.exe
2013-11-12 20:58 . 2013-11-12 20:58 61952 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-11-12 20:58 . 2013-11-12 20:58 36352 ----a-w- c:\windows\system32\imgutil.dll
2013-11-12 20:58 . 2013-11-12 20:58 111616 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-11-12 20:58 . 2013-11-12 20:58 74240 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-11-12 20:58 . 2013-11-12 20:58 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-11-12 20:58 . 2013-11-12 20:58 86016 ----a-w- c:\windows\system32\iesysprep.dll
2013-11-12 02:07 . 2013-12-11 17:58 2048 ----a-w- c:\windows\system32\tzres.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2009-08-21 476512]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2009-07-28 460088]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2009-08-05 738616]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-27 815104]
"AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2013-11-20 4411952]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKLM\~\startupfolder\C:^Users^Creator^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\Creator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2013-05-11 10:37 958576 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
R3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2012-06-25 46432]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2013-11-26 108032]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2013-10-02 49152]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 27136]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-07-04 1343400]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-05-06 11520]
S0 AVGIDSHX;AVGIDSHX;c:\windows\system32\DRIVERS\avgidshx.sys [2013-07-20 60216]
S0 Avglogx;AVG Logging Driver;c:\windows\system32\DRIVERS\avglogx.sys [2013-07-20 246072]
S0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx86.sys [2013-10-23 39224]
S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdriverx.sys [2013-11-25 208184]
S1 AVGIDSShim;AVGIDSShim;c:\windows\system32\DRIVERS\avgidsshimx.sys [2013-10-23 22328]
S1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx86.sys [2013-07-20 171320]
S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [2013-03-21 182072]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [2013-07-04 4939312]
S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [2013-11-20 283136]
S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe [2009-08-11 185712]
S2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [2009-03-11 46448]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPService REG_MULTI_SZ   HPSLPSVC
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-01-31 04:20 1211672 ----a-w- c:\program files\Google\Chrome\Application\32.0.1700.102\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2014-01-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-08-28 22:12]
.
2014-01-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-08-28 22:12]
.
.
------- Supplementary Scan -------
.

uInternet Settings,ProxyOverride = <-loopback>
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{C1B93B72-2810-45DE-998F-4F6F8E1DF943} - (no file)
HKLM-Run-WebInternetSecurity - c:\program files\Webinternetsecurity\WebInternetSecurity.exe
MSConfigStartUp-APSDaemon - c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
AddRemove-Convert XLS_is1 - c:\program files\Softinterface
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\progra~1\AVG\AVG2013\avgrsx.exe
c:\program files\AVG\AVG2013\avgcsrvx.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\system32\TODDSrv.exe
c:\program files\Toshiba\Power Saver\TosCoSrv.exe
c:\program files\AVG\AVG2013\avgnsx.exe
c:\program files\AVG\AVG2013\avgemcx.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\Synaptics\SynTP\SynToshiba.exe
c:\program files\TOSHIBA\ConfigFree\NDSTray.exe
c:\program files\AVG\AVG2013\avgcfgex.exe
c:\program files\TOSHIBA\ConfigFree\CFSwMgr.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Completion time: 2014-01-31 00:28:14 - machine was rebooted
ComboFix-quarantined-files.txt 2014-01-31 08:28
.
Pre-Run: 38,458,974,208 bytes free
Post-Run: 39,219,220,480 bytes free
.
- - End Of File - - 1D62488360FA423305B39B688E827BF5
A36C5E4F47E84449FF07ED3517B43A31

I am no longer able to access this site or Yahoo, so am using 2 computers now for this process.

Anything that I am downloading I will be using a USB key to get to the infected computer. Ready for next step. Thank you for the assistance in helping us with this issue. Much appreciated.

AdvancedSetup · February 1, 2014

Okay, please uninstall ALL versions of Java from this computer via Control Panel, Add/Remove and reboot. Then run the following.

Run JavaRa

Please download JavaRa and unzip it in a folder on your desktop.
Double-click on JavaRa.exe to start the program.
Click on Settings and Place a checkmark beside Create a log file. Click on Back.
Click on Update JavaRa Definitions. Click on download. When this is done click on Back.
Choose Remove JRE, since you already uninstalled Java, please click on Next.
Now click on Perform Removal Routine to remove the older versions of Java installed on your computer.
When that's succesfully done, please click OK to close the message.
Click on Next. Since you already downloaded the latest version of Java, please click on Next.
Now click on Close this wizard and click Finish.
From the main menu please choose Additional Tasks
Place a checkmark beside Remove Outdated JRE Firefox Extentions and click Run. Mozilla Firefox should be closed before running this task.
When that's succesfully done you will see a message at the top saying: "Selected tasks completed successfully".
A log file should be created in the same directory as JavaRa.
Please post the log in your next reply.
Close JavaRa by clicking the red cross button.

Next, Please go ahead and run through the following steps and post back the logs when ready.

STEP 03
Please download Malwarebytes Anti-Rootkit from here

Unzip the contents to a folder in a convenient location.
Open the folder where the contents were unzipped and run mbar.exe
Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
Click on the Cleanup button to remove any threats and reboot if prompted to do so.
Wait while the system shuts down and the cleanup process is performed.
Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
When done, please post the two logs produced they will be in the MBAR folder... mbar-log.txt and system-log.txt

STEP 04
Please download Junkware Removal Tool to your desktop.

Shutdown your antivirus to avoid any conflicts.
Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next reply message
When completed make sure to re-enable your antivirus

STEP 05
Lets clean out any adware now: (this will require a reboot so save all your work)

Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator
Click on the Scan button.
AdwCleaner will begin...be patient as the scan may take some time to complete.
When it's done you'll see: Pending: Please uncheck elements you don't want removed.
Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
Look over the log especially under Files/Folders for any program you want to save.
If there's a program you may want to save, just uncheck it from AdwCleaner.
If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
If you're ready to clean it all up.....click the Clean button.
After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder.
Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
To restore an item that has been deleted:
Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

Then..................

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

STEP 06

Please go here to run the online antivirus scannner from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked
Click on Advanced Settings and ensure these options are ticked:
- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
[*]Click Scan [*]Wait for the scan to finish [*]If any threats were found, click the 'List of found threats' , then click Export to text file.... [*]Save it to your desktop, then please copy and paste that log as a reply to this topic.

STEP 07
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

Double-click to run it. When the tool opens click Yes to disclaimer.
Press the Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

StarKat · February 2, 2014

Log from JavaRa

Exception encountered in module [JavaRa]

Message: Object reference not set to an instance of an object.

at JavaRa.routines_registry.get_jre_uninstallers()

User initialised redundant data purge.

......................

Removed registry subkey: {08B0E5C0-4FCB-11CF-AAA5-00401C608501}

Removed registry subkey tree: {5852F5ED-8BF4-11D4-A245-0080C6F74284}

Removed registry subkey: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}

Removed registry subkey: {DBC80044-A445-435b-BC74-9C25C1C588A9}

Removed registry subkey tree: {5852F5EC-8BF4-11D4-A245-0080C6F74284}

Removed registry subkey: application/java-deployment-toolkit

Removed registry subkey tree: {5852F5E0-8BF4-11D4-A245-0080C6F74284}

Removed registry subkey tree: JavaWebStart.isInstalled

Removed registry subkey tree: JavaWebStart.isInstalled.1.7.0.0

Exception encountered in module [JavaRa]

Message: Cannot delete a subkey tree because the subkey does not exist.

at System.ThrowHelper.ThrowArgumentException(ExceptionResource resource)

at Microsoft.Win32.RegistryKey.DeleteSubKeyTreeInternal(String subkey)

at Microsoft.Win32.RegistryKey.DeleteSubKeyTree(String subkey)

at JavaRa.routines_registry.delete_key(String key)

Exception encountered in module [JavaRa]

Message: Cannot delete a subkey tree because the subkey does not exist.

at System.ThrowHelper.ThrowArgumentException(ExceptionResource resource)

at Microsoft.Win32.RegistryKey.DeleteSubKeyTreeInternal(String subkey)

at Microsoft.Win32.RegistryKey.DeleteSubKeyTree(String subkey)

at JavaRa.routines_registry.delete_key(String key)

Removed registry subkey: {5852F5ED-8BF4-11D4-A245-0080C6F74284}

Removed registry subkey tree: Browser Helper Objects

Exception encountered in module [JavaRa]

Message: Cannot delete a subkey tree because the subkey does not exist.

at System.ThrowHelper.ThrowArgumentException(ExceptionResource resource)

at Microsoft.Win32.RegistryKey.DeleteSubKeyTreeInternal(String subkey)

at Microsoft.Win32.RegistryKey.DeleteSubKeyTree(String subkey)

at JavaRa.routines_registry.delete_key(String key)

Removed registry subkey: JavaSoft

Removed registry subkey: JreMetrics

Removed registry subkey tree: JavaPlugin.10512

Removal routine completed successfully. 14 items have been deleted.

Exception encountered in module [JavaRa]

Message: Object reference not set to an instance of an object.

at JavaRa.routines_registry.get_jre_uninstallers()

StarKat · February 2, 2014

Here are all of the other logs

Mbar- system-log.txt

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.07.0.1009

OS version: 6.1.7601 Windows 7 Service Pack 1 x86

Account is Administrative

Internet Explorer version: 11.0.9600.16476

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED

CPU speed: 1.599000 GHz

Memory total: 1474412544, free: 776880128

Host not found

Downloaded database version: v2014.02.02.02

Downloaded database version: v2013.12.18.01

=======================================

Initializing...

------------ Kernel report ------------

02/02/2014 01:04:20

------------ Loaded modules -----------

\SystemRoot\system32\ntoskrnl.exe

\SystemRoot\system32\halmacpi.dll

\SystemRoot\system32\kdcom.dll

\SystemRoot\system32\mcupdate_GenuineIntel.dll

\SystemRoot\system32\PSHED.dll

\SystemRoot\system32\BOOTVID.dll

\SystemRoot\system32\CLFS.SYS

\SystemRoot\system32\CI.dll

\SystemRoot\system32\drivers\Wdf01000.sys

\SystemRoot\system32\drivers\WDFLDR.SYS

\SystemRoot\system32\drivers\ACPI.sys

\SystemRoot\system32\drivers\WMILIB.SYS

\SystemRoot\system32\drivers\msisadrv.sys

\SystemRoot\system32\drivers\pci.sys

\SystemRoot\system32\drivers\vdrvroot.sys

\SystemRoot\System32\drivers\partmgr.sys

\SystemRoot\system32\DRIVERS\compbatt.sys

\SystemRoot\system32\DRIVERS\BATTC.SYS

\SystemRoot\system32\drivers\volmgr.sys

\SystemRoot\System32\drivers\volmgrx.sys

\SystemRoot\system32\drivers\pciide.sys

\SystemRoot\system32\drivers\PCIIDEX.SYS

\SystemRoot\system32\DRIVERS\pcmcia.sys

\SystemRoot\System32\drivers\mountmgr.sys

\SystemRoot\system32\drivers\atapi.sys

\SystemRoot\system32\drivers\ataport.SYS

\SystemRoot\system32\drivers\amdxata.sys

\SystemRoot\system32\drivers\fltmgr.sys

\SystemRoot\system32\drivers\fileinfo.sys

\SystemRoot\System32\Drivers\Ntfs.sys

\SystemRoot\System32\Drivers\msrpc.sys

\SystemRoot\System32\Drivers\ksecdd.sys

\SystemRoot\System32\Drivers\cng.sys

\SystemRoot\System32\drivers\pcw.sys

\SystemRoot\System32\Drivers\Fs_Rec.sys

\SystemRoot\system32\drivers\ndis.sys

\SystemRoot\system32\drivers\NETIO.SYS

\SystemRoot\System32\Drivers\ksecpkg.sys

\SystemRoot\System32\drivers\tcpip.sys

\SystemRoot\System32\drivers\fwpkclnt.sys

\SystemRoot\system32\drivers\vmstorfl.sys

\SystemRoot\system32\drivers\volsnap.sys

\SystemRoot\system32\DRIVERS\TVALZ_O.SYS

\SystemRoot\System32\Drivers\spldr.sys

\SystemRoot\System32\drivers\rdyboost.sys

\SystemRoot\System32\Drivers\mup.sys

\SystemRoot\System32\drivers\hwpolicy.sys

\SystemRoot\System32\DRIVERS\fvevol.sys

\SystemRoot\system32\drivers\disk.sys

\SystemRoot\system32\drivers\CLASSPNP.SYS

\SystemRoot\system32\DRIVERS\avgrkx86.sys

\SystemRoot\system32\DRIVERS\avglogx.sys

\SystemRoot\system32\DRIVERS\avgmfx86.sys

\SystemRoot\system32\DRIVERS\avgidshx.sys

\SystemRoot\system32\DRIVERS\cdrom.sys

\SystemRoot\System32\Drivers\Null.SYS

\SystemRoot\System32\Drivers\Beep.SYS

\SystemRoot\System32\drivers\vga.sys

\SystemRoot\System32\drivers\VIDEOPRT.SYS

\SystemRoot\System32\drivers\watchdog.sys

\SystemRoot\System32\DRIVERS\RDPCDD.sys

\SystemRoot\system32\drivers\rdpencdd.sys

\SystemRoot\system32\drivers\rdprefmp.sys

\SystemRoot\System32\Drivers\Msfs.SYS

\SystemRoot\System32\Drivers\Npfs.SYS

\SystemRoot\system32\DRIVERS\tdx.sys

\SystemRoot\system32\DRIVERS\TDI.SYS

\SystemRoot\system32\DRIVERS\avgtdix.sys

\SystemRoot\System32\DRIVERS\netbt.sys

\SystemRoot\system32\drivers\afd.sys

\SystemRoot\system32\drivers\ws2ifsl.sys

\SystemRoot\system32\DRIVERS\wfplwf.sys

\SystemRoot\system32\DRIVERS\pacer.sys

\SystemRoot\system32\DRIVERS\vwififlt.sys

\SystemRoot\system32\DRIVERS\netbios.sys

\SystemRoot\system32\DRIVERS\wanarp.sys

\SystemRoot\system32\DRIVERS\termdd.sys

\SystemRoot\system32\DRIVERS\rdbss.sys

\SystemRoot\system32\drivers\nsiproxy.sys

\SystemRoot\system32\DRIVERS\mssmbios.sys

\SystemRoot\System32\drivers\discache.sys

\SystemRoot\system32\drivers\csc.sys

\SystemRoot\System32\Drivers\dfsc.sys

\SystemRoot\system32\DRIVERS\blbdrive.sys

\SystemRoot\system32\DRIVERS\avgldx86.sys

\SystemRoot\system32\DRIVERS\avgidsshimx.sys

\SystemRoot\system32\DRIVERS\avgidsdriverx.sys

\SystemRoot\system32\DRIVERS\tunnel.sys

\SystemRoot\system32\DRIVERS\intelppm.sys

\SystemRoot\system32\DRIVERS\atikmdag.sys

\SystemRoot\System32\drivers\dxgkrnl.sys

\SystemRoot\System32\drivers\dxgmms1.sys

\SystemRoot\system32\DRIVERS\usbohci.sys

\SystemRoot\system32\DRIVERS\USBPORT.SYS

\SystemRoot\system32\DRIVERS\usbehci.sys

\SystemRoot\system32\DRIVERS\tdcmdpst.sys

\SystemRoot\system32\DRIVERS\HDAudBus.sys

\SystemRoot\system32\DRIVERS\i8042prt.sys

\SystemRoot\system32\DRIVERS\kbdclass.sys

\SystemRoot\system32\DRIVERS\SynTP.sys

\SystemRoot\system32\DRIVERS\USBD.SYS

\SystemRoot\system32\DRIVERS\mouclass.sys

\SystemRoot\system32\DRIVERS\Rtnicxp.sys

\SystemRoot\system32\DRIVERS\athr.sys

\SystemRoot\system32\DRIVERS\vwifibus.sys

\SystemRoot\system32\DRIVERS\CmBatt.sys

\SystemRoot\system32\DRIVERS\CompositeBus.sys

\SystemRoot\system32\DRIVERS\AgileVpn.sys

\SystemRoot\system32\DRIVERS\rasl2tp.sys

\SystemRoot\system32\DRIVERS\ndistapi.sys

\SystemRoot\system32\DRIVERS\ndiswan.sys

\SystemRoot\system32\DRIVERS\raspppoe.sys

\SystemRoot\system32\DRIVERS\raspptp.sys

\SystemRoot\system32\DRIVERS\rassstp.sys

\SystemRoot\system32\DRIVERS\rdpbus.sys

\SystemRoot\system32\DRIVERS\swenum.sys

\SystemRoot\system32\DRIVERS\ks.sys

\SystemRoot\system32\drivers\BoiHwSetup.sys

\SystemRoot\system32\DRIVERS\umbus.sys

\SystemRoot\system32\DRIVERS\usbhub.sys

\SystemRoot\System32\Drivers\NDProxy.SYS

\SystemRoot\system32\drivers\HdAudio.sys

\SystemRoot\system32\drivers\portcls.sys

\SystemRoot\system32\drivers\drmk.sys

\SystemRoot\system32\DRIVERS\AGRSM.sys

\SystemRoot\system32\drivers\modem.sys

\SystemRoot\System32\win32k.sys

\SystemRoot\System32\drivers\Dxapi.sys

\SystemRoot\system32\DRIVERS\monitor.sys

\SystemRoot\System32\Drivers\crashdmp.sys

\SystemRoot\System32\Drivers\dump_dumpata.sys

\SystemRoot\System32\TSDDD.dll

\SystemRoot\System32\Drivers\dump_atapi.sys

\SystemRoot\System32\Drivers\dump_dumpfve.sys

\SystemRoot\System32\cdd.dll

\SystemRoot\system32\drivers\luafv.sys

\SystemRoot\system32\DRIVERS\lltdio.sys

\SystemRoot\system32\DRIVERS\nwifi.sys

\SystemRoot\system32\DRIVERS\ndisuio.sys

\SystemRoot\system32\DRIVERS\rspndr.sys

\SystemRoot\System32\Drivers\fastfat.SYS

\SystemRoot\system32\drivers\HTTP.sys

\SystemRoot\system32\DRIVERS\bowser.sys

\SystemRoot\System32\drivers\mpsdrv.sys

\SystemRoot\system32\DRIVERS\mrxsmb.sys

\SystemRoot\system32\DRIVERS\mrxsmb10.sys

\SystemRoot\system32\DRIVERS\mrxsmb20.sys

\SystemRoot\system32\DRIVERS\vwifimp.sys

\SystemRoot\system32\drivers\peauth.sys

\SystemRoot\System32\Drivers\secdrv.SYS

\SystemRoot\System32\DRIVERS\srvnet.sys

\SystemRoot\System32\drivers\tcpipreg.sys

\SystemRoot\System32\DRIVERS\srv2.sys

\SystemRoot\System32\DRIVERS\srv.sys

\SystemRoot\system32\drivers\WudfPf.sys

\SystemRoot\system32\DRIVERS\asyncmac.sys

\??\C:\Windows\system32\drivers\mbamchameleon.sys

\SystemRoot\system32\DRIVERS\USBSTOR.SYS

\SystemRoot\system32\DRIVERS\WUDFRd.sys

\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys

\Windows\System32\ntdll.dll

\Windows\System32\smss.exe

\Windows\System32\apisetschema.dll

----------- End -----------

Done!

<<<1>>>

Upper Device Name: \Device\Harddisk1\DR8

Upper Device Object: 0xffffffff86201030

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\00000084\

Lower Device Object: 0xffffffff857c1030

Lower Device Driver Name: \Driver\USBSTOR\

<<<1>>>

Upper Device Name: \Device\Harddisk0\DR0

Upper Device Object: 0xffffffff85673030

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\

Lower Device Object: 0xffffffff848e3908

Lower Device Driver Name: \Driver\atapi\

<<<2>>>

Physical Sector Size: 512

Drive: 0, DevicePointer: 0xffffffff85673030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xffffffff85673d10, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xffffffff85673030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

DevicePointer: 0xffffffff851d8918, DeviceName: Unknown, DriverName: \Driver\ACPI\

DevicePointer: 0xffffffff848e3908, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\

------------ End ----------

Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

Upper DeviceData: 0x0, 0x0, 0x0

Lower DeviceData: 0x0, 0x0, 0x0

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Done!

Drive 0

Scanning MBR on drive 0...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: C7378C2D

Partition information:

Partition 0 type is Primary (0x7)

Partition is ACTIVE.

Partition starts at LBA: 2048 Numsec = 204800

Partition file system is NTFS

Partition is bootable

Partition 1 type is Primary (0x7)

Partition is NOT ACTIVE.

Partition starts at LBA: 206848 Numsec = 156092416

Partition 2 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Disk Size: 80026361856 bytes

Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-156281488-156301488)...

Done!

Read File: File "c:\programdata\avg2013\chjw\3678d7f678d7b33b.dat:21012d25-ac24-4b68-b80c-8261b15a1b19" is sparse (flags = 32768)

Scan finished

=======================================

<<<1>>>

Upper Device Name: \Device\Harddisk0\DR0

Upper Device Object: 0xffffffff85673030

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\

Lower Device Object: 0xffffffff848e3908

Lower Device Driver Name: \Driver\atapi\

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Done!

Drive 0

Scanning MBR on drive 0...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: C7378C2D

Partition information:

Partition 0 type is Primary (0x7)

Partition is ACTIVE.

Partition starts at LBA: 2048 Numsec = 204800

Partition file system is NTFS

Partition is bootable

Partition 1 type is Primary (0x7)

Partition is NOT ACTIVE.

Partition starts at LBA: 206848 Numsec = 156092416

Partition 2 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Disk Size: 80026361856 bytes

Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-156281488-156301488)...

Done!

Read File: File "c:\programdata\avg2013\chjw\3678d7f678d7b33b.dat:21012d25-ac24-4b68-b80c-8261b15a1b19" is sparse (flags = 32768)

Scan finished

=======================================

Removal queue found; removal started

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-i.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...

Removal finished

-----------------------------------------------------------------------------------------------------

Mbar- mbar-log.txt

Malwarebytes Anti-Rootkit BETA 1.07.0.1009

www.malwarebytes.org

Database version: v2014.02.02.02

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 11.0.9600.16476

Creator :: RESURRECTION [administrator]

2/2/2014 1:28:20 AM

mbar-log-2014-02-02 (01-28-20).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 236198

Time elapsed: 13 minute(s), 51 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

Physical Sectors Detected: 0

(No malicious items detected)

(end)

-----------------------------------------------------------------------------------------------------

JRT.txt

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.0 (01.07.2014:1)

OS: Windows 7 Professional x86

Ran by Creator on Sun 02/02/2014 at 1:46:20.69

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\scripthelper.exe

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{13ABD093-D46F-40DF-A608-47E162EC799D}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\igearsettings

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\blekko toolbars"

Successfully deleted: [Folder] "C:\Users\Creator\appdata\local\blekkotb_031"

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Sun 02/02/2014 at 1:51:15.89

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

----------------------------------------------------------------------------------------------------

AdwCleaner[sO].txt

# AdwCleaner v3.018 - Report created 02/02/2014 at 01:56:32

# Updated 28/01/2014 by Xplode

# Operating System : Windows 7 Professional Service Pack 1 (32 bits)

# Username : Creator - RESURRECTION

# Running from : C:\Users\Creator\Desktop\AdwCleaner.exe

# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16428

*************************

AdwCleaner[R0].txt - [834 octets] - [02/02/2014 01:53:24]

AdwCleaner[s0].txt - [760 octets] - [02/02/2014 01:56:32]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [819 octets] ##########

---------------------------------------------------------------------------------------------------

Mbam.txt

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org

Database version: v2014.01.31.02

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 11.0.9600.16476

Creator :: RESURRECTION [administrator]

2/2/2014 2:02:14 AM

mbam-log-2014-02-02 (02-02-14).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 233756

Time elapsed: 11 minute(s), 36 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

-------------------------------------------------------------------------------------------

Eset.txt

C:\Documents and Settings\Public\Music\Abelton Live 9.1 (64bit) all files\Ableton Live 9.1 (64 bit)\Patch\Ableton LivePatch [io].exe a variant of Win32/HackTool.Patcher.AD application

C:\Users\Public\Music\Abelton Live 9.1 (64bit) all files\Ableton Live 9.1 (64 bit)\Patch\Ableton LivePatch [io].exe a variant of Win32/HackTool.Patcher.AD application

----------------------------------------------------------------------------------------------

FRST.txt

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 01-02-2014 03

Ran by Creator (administrator) on RESURRECTION on 02-02-2014 12:29:53

Running from C:\Users\Creator\Desktop

Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: English(US)

Internet Explorer Version 11

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version:

Download link for 64-Bit Version:

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) ===================

(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgwdsvc.exe

(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TPwrMain.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\SmoothView\SmoothView.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\FlashCards\TCrdMain.exe

(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgui.exe

(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynToshiba.exe

(TOSHIBA CORPORATION) C:\Program Files\Toshiba\ConfigFree\NDSTray.exe

(TOSHIBA CORPORATION) C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe

(TOSHIBA CORPORATION) C:\Program Files\Toshiba\ConfigFree\CFIWmxSvcs.exe

(TOSHIBA CORPORATION) C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe

(Microsoft Corporation) C:\Windows\System32\wuauclt.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2013\avgcfgex.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [476512 2009-08-21] (TOSHIBA Corporation)

HKLM\...\Run: [smoothView] - C:\Program Files\Toshiba\SmoothView\SmoothView.exe [460088 2009-07-28] (TOSHIBA Corporation)

HKLM\...\Run: [00TCrdMain] - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [738616 2009-08-05] (TOSHIBA Corporation)

HKLM\...\Run: [synTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [815104 2006-10-27] (Synaptics, Inc.)

HKLM\...\Run: [AVG_UI] - C:\Program Files\AVG\AVG2013\avgui.exe [4411952 2013-11-20] (AVG Technologies CZ, s.r.o.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xDD0782171F5ACD01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =

Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll No File

Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76

========================== Services (Whitelisted) =================

S2 AVGIDSAgent; C:\Program Files\AVG\AVG2013\avgidsagent.exe [4939312 2013-07-04] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program Files\AVG\AVG2013\avgwdsvc.exe [283136 2013-11-20] (AVG Technologies CZ, s.r.o.)

R2 cfWiMAXService; C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe [185712 2009-08-10] (TOSHIBA CORPORATION)

R2 ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [46448 2009-03-10] (TOSHIBA CORPORATION)

==================== Drivers (Whitelisted) ====================

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [208184 2013-11-25] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [60216 2013-07-20] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [22328 2013-10-23] (AVG Technologies CZ, s.r.o.)

R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [171320 2013-07-20] (AVG Technologies CZ, s.r.o.)

R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [246072 2013-07-20] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [96568 2013-07-01] (AVG Technologies CZ, s.r.o.)

R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [39224 2013-10-23] (AVG Technologies CZ, s.r.o.)

R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [182072 2013-03-21] (AVG Technologies CZ, s.r.o.)

R3 BoiHwsetup; C:\Windows\System32\drivers\BoiHwSetup.sys [7680 2006-10-12] (Quanta Computer Corp)

S3 catchme; \??\C:\Users\Creator\AppData\Local\Temp\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-02-02 12:29 - 2014-02-02 12:30 - 00005105 _____ () C:\Users\Creator\Desktop\FRST.txt

2014-02-02 12:29 - 2014-02-02 12:29 - 00000000 ____D () C:\FRST

2014-02-02 03:17 - 2014-02-02 03:17 - 00000353 _____ () C:\Users\Creator\Desktop\eset.txt

2014-02-02 02:22 - 2014-02-02 02:22 - 02077392 _____ (Microsoft Corporation) C:\Users\Creator\Downloads\IE11-Windows6.1.exe

2014-02-02 02:22 - 2014-02-02 02:22 - 02077392 _____ (Microsoft Corporation) C:\Users\Creator\Downloads\IE11-Windows6.1 (1).exe

2014-02-02 02:22 - 2014-02-02 02:22 - 00000000 ____D () C:\Program Files\ESET

2014-02-02 02:18 - 2014-02-02 02:18 - 02347384 _____ (ESET) C:\Users\Creator\Downloads\esetsmartinstaller_enu.exe

2014-02-02 01:53 - 2014-02-02 01:56 - 00000000 ____D () C:\AdwCleaner

2014-02-02 01:51 - 2014-02-02 01:51 - 00002109 _____ () C:\Users\Creator\Desktop\JRT.txt

2014-02-02 01:46 - 2014-02-02 01:46 - 00000000 ____D () C:\Windows\ERUNT

2014-02-02 01:04 - 2014-02-02 01:44 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-02-02 01:03 - 2014-02-02 01:44 - 00000000 ____D () C:\Users\Creator\Desktop\mbar

2014-02-02 01:03 - 2014-02-02 01:03 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-02-02 00:56 - 2014-02-02 01:02 - 00000000 ____D () C:\Users\Creator\Desktop\New folder

2014-02-02 00:55 - 2014-02-02 00:55 - 00165800 _____ () C:\Users\Creator\Downloads\JavaRa-1.16-20-1-14.zip

2014-02-02 00:55 - 2014-02-02 00:55 - 00156058 _____ () C:\Users\Creator\Downloads\JavaRa-2.5.zip

2014-02-02 00:21 - 2014-02-01 23:36 - 01137152 _____ (Farbar) C:\Users\Creator\Desktop\FRST.exe

2014-02-02 00:21 - 2014-02-01 23:35 - 01166132 _____ () C:\Users\Creator\Desktop\AdwCleaner.exe

2014-02-02 00:21 - 2014-02-01 23:34 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Creator\Desktop\mbar-1.07.0.1009.exe

2014-02-02 00:21 - 2014-02-01 23:34 - 01037068 _____ (Thisisu) C:\Users\Creator\Desktop\JRT.exe

2014-02-02 00:19 - 2014-02-02 00:19 - 00000000 ____D () C:\Users\Creator\Desktop\JavaRa-2.0

2014-02-02 00:19 - 2014-02-01 23:33 - 00135237 _____ () C:\Users\Creator\Desktop\JavaRa-2.0.zip

2014-01-31 00:28 - 2014-01-31 00:28 - 00011624 _____ () C:\ComboFix.txt

2014-01-31 00:05 - 2014-01-31 00:28 - 00000000 ____D () C:\Qoobox

2014-01-31 00:05 - 2011-06-25 22:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-01-31 00:05 - 2010-11-07 09:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-01-31 00:05 - 2009-04-19 20:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-01-31 00:05 - 2000-08-30 16:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-01-31 00:05 - 2000-08-30 16:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-01-31 00:05 - 2000-08-30 16:00 - 00098816 _____ () C:\Windows\sed.exe

2014-01-31 00:05 - 2000-08-30 16:00 - 00080412 _____ () C:\Windows\grep.exe

2014-01-31 00:05 - 2000-08-30 16:00 - 00068096 _____ () C:\Windows\zip.exe

2014-01-31 00:03 - 2014-01-31 00:03 - 05177551 ____R (Swearware) C:\Users\Creator\Downloads\ComboFix.exe

2014-01-30 21:57 - 2014-01-30 21:57 - 00002240 _____ () C:\Users\Creator\Desktop\RKreport[0]_S_01302014_215734.txt

2014-01-30 21:52 - 2014-01-30 21:52 - 00002207 _____ () C:\Users\Creator\Desktop\RKreport[0]_S_01302014_215252.txt

2014-01-30 21:47 - 2014-01-30 22:02 - 00000000 ____D () C:\Users\Creator\Desktop\RK_Quarantine

2014-01-30 21:46 - 2014-01-31 00:26 - 00000000 ____D () C:\Windows\ERDNT

2014-01-30 21:44 - 2014-01-30 21:45 - 00000000 ____D () C:\Program Files\ERUNT

2014-01-30 21:44 - 2014-01-30 21:44 - 00000898 _____ () C:\Users\Creator\Desktop\NTREGOPT.lnk

2014-01-30 21:44 - 2014-01-30 21:44 - 00000879 _____ () C:\Users\Creator\Desktop\ERUNT.lnk

2014-01-30 21:43 - 2014-01-30 21:43 - 00002360 _____ () C:\Users\Creator\Desktop\Rkill-1.txt

2014-01-30 21:38 - 2014-01-30 21:38 - 00000083 _____ () C:\Users\Creator\Desktop\link.txt

2014-01-30 21:37 - 2014-01-30 21:37 - 03794432 _____ () C:\Users\Creator\Downloads\RogueKiller.exe

2014-01-30 21:37 - 2014-01-30 21:37 - 00791393 _____ (Lars Hederer ) C:\Users\Creator\Downloads\erunt-setup (2).exe

2014-01-30 21:36 - 2014-01-30 21:36 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\Creator\Downloads\rkill.exe

2014-01-30 21:36 - 2014-01-30 21:36 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\Creator\Downloads\iExplore.exe

2014-01-30 21:36 - 2014-01-30 21:36 - 00791393 _____ (Lars Hederer ) C:\Users\Creator\Downloads\erunt-setup.exe

2014-01-30 21:36 - 2014-01-30 21:36 - 00791393 _____ (Lars Hederer ) C:\Users\Creator\Downloads\erunt-setup (1).exe

2014-01-30 21:26 - 2014-01-30 21:26 - 00017708 _____ () C:\Users\Creator\Desktop\New.txt

2014-01-30 21:05 - 2014-01-30 21:05 - 00010425 _____ () C:\Users\Creator\Desktop\dds.txt

2014-01-30 21:05 - 2014-01-30 21:05 - 00007238 _____ () C:\Users\Creator\Desktop\attach.txt

2014-01-30 20:40 - 2014-01-30 20:40 - 00000000 ____D () C:\Users\Creator\AppData\Roaming\Malwarebytes

2014-01-30 20:39 - 2014-01-30 20:39 - 00001071 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-01-30 20:39 - 2014-01-30 20:39 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-01-30 20:39 - 2014-01-30 20:39 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware

2014-01-30 20:39 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-01-30 20:25 - 2014-01-30 20:25 - 00688992 ____R (Swearware) C:\Users\Creator\Downloads\dds.com

2014-01-30 20:25 - 2014-01-30 20:25 - 00688992 _____ (Swearware) C:\Users\Creator\Downloads\dds.scr

2014-01-30 20:24 - 2014-01-30 20:24 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Creator\Downloads\mbam-setup-1.75.0.1300.exe

2014-01-27 23:39 - 2014-01-27 23:39 - 00000000 ____D () C:\Users\Creator\Desktop\grub4dos

2014-01-27 23:36 - 2014-01-27 23:42 - 00000000 ____D () C:\Users\Creator\Desktop\HRBT

2014-01-27 21:08 - 2014-01-27 21:08 - 00001471 _____ () C:\Users\Creator\Desktop\iexplore.exe - Shortcut.lnk

2014-01-27 19:27 - 2014-01-27 19:27 - 00000000 ____D () C:\ProgramData\Windows Genuine Advantage

2014-01-23 19:43 - 2014-01-23 22:38 - 00000000 ____D () C:\Windows\system32\appmgmt

2014-01-23 19:29 - 2014-01-23 19:29 - 00000000 ____D () C:\Users\Creator\AppData\Local\WebInternetSecurity

2014-01-23 19:11 - 2014-01-23 19:14 - 00005163 _____ () C:\Windows\system32\jupdate-1.7.0_51-b13.log

2014-01-21 00:31 - 2014-01-21 00:31 - 00000000 ____D () C:\Program Files\7-Zip

2014-01-06 22:38 - 2014-01-06 22:38 - 00000000 ____D () C:\Windows\system32\%LOCALAPPDATA%

2014-01-06 13:42 - 2014-01-06 22:54 - 00000000 ___RD () C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2014-01-06 13:42 - 2014-01-06 22:54 - 00000000 ___RD () C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2014-01-06 13:42 - 2013-01-30 11:37 - 00000000 ____D () C:\Users\TEMP\AppData\Roaming\TuneUp Software

2014-01-06 13:42 - 2012-07-12 06:16 - 00000000 ____D () C:\Users\TEMP\AppData\Local\Microsoft Help

==================== One Month Modified Files and Folders =======

2014-02-02 12:30 - 2014-02-02 12:29 - 00005105 _____ () C:\Users\Creator\Desktop\FRST.txt

2014-02-02 12:29 - 2014-02-02 12:29 - 00000000 ____D () C:\FRST

2014-02-02 12:20 - 2012-08-28 14:12 - 00000884 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-02-02 12:19 - 2012-08-28 14:12 - 00000888 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-02-02 12:05 - 2012-07-04 10:39 - 02015491 _____ () C:\Windows\WindowsUpdate.log

2014-02-02 03:17 - 2014-02-02 03:17 - 00000353 _____ () C:\Users\Creator\Desktop\eset.txt

2014-02-02 02:22 - 2014-02-02 02:22 - 02077392 _____ (Microsoft Corporation) C:\Users\Creator\Downloads\IE11-Windows6.1.exe

2014-02-02 02:22 - 2014-02-02 02:22 - 02077392 _____ (Microsoft Corporation) C:\Users\Creator\Downloads\IE11-Windows6.1 (1).exe

2014-02-02 02:22 - 2014-02-02 02:22 - 00000000 ____D () C:\Program Files\ESET

2014-02-02 02:22 - 2013-11-12 12:51 - 00011367 _____ () C:\Windows\IE11_main.log

2014-02-02 02:18 - 2014-02-02 02:18 - 02347384 _____ (ESET) C:\Users\Creator\Downloads\esetsmartinstaller_enu.exe

2014-02-02 02:05 - 2010-11-20 13:01 - 00726316 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-02-02 02:05 - 2009-07-13 20:34 - 00020512 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-02-02 02:05 - 2009-07-13 20:34 - 00020512 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-02-02 01:58 - 2013-12-12 01:43 - 00004076 _____ () C:\Windows\setupact.log

2014-02-02 01:58 - 2009-07-13 20:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-02-02 01:56 - 2014-02-02 01:53 - 00000000 ____D () C:\AdwCleaner

2014-02-02 01:51 - 2014-02-02 01:51 - 00002109 _____ () C:\Users\Creator\Desktop\JRT.txt

2014-02-02 01:46 - 2014-02-02 01:46 - 00000000 ____D () C:\Windows\ERUNT

2014-02-02 01:44 - 2014-02-02 01:04 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-02-02 01:44 - 2014-02-02 01:03 - 00000000 ____D () C:\Users\Creator\Desktop\mbar

2014-02-02 01:03 - 2014-02-02 01:03 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-02-02 01:02 - 2014-02-02 00:56 - 00000000 ____D () C:\Users\Creator\Desktop\New folder

2014-02-02 00:55 - 2014-02-02 00:55 - 00165800 _____ () C:\Users\Creator\Downloads\JavaRa-1.16-20-1-14.zip

2014-02-02 00:55 - 2014-02-02 00:55 - 00156058 _____ () C:\Users\Creator\Downloads\JavaRa-2.5.zip

2014-02-02 00:29 - 2012-07-04 11:59 - 00000000 ____D () C:\ProgramData\MFAData

2014-02-02 00:19 - 2014-02-02 00:19 - 00000000 ____D () C:\Users\Creator\Desktop\JavaRa-2.0

2014-02-01 23:36 - 2014-02-02 00:21 - 01137152 _____ (Farbar) C:\Users\Creator\Desktop\FRST.exe

2014-02-01 23:35 - 2014-02-02 00:21 - 01166132 _____ () C:\Users\Creator\Desktop\AdwCleaner.exe

2014-02-01 23:34 - 2014-02-02 00:21 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Creator\Desktop\mbar-1.07.0.1009.exe

2014-02-01 23:34 - 2014-02-02 00:21 - 01037068 _____ (Thisisu) C:\Users\Creator\Desktop\JRT.exe

2014-02-01 23:33 - 2014-02-02 00:19 - 00135237 _____ () C:\Users\Creator\Desktop\JavaRa-2.0.zip

2014-01-31 00:28 - 2014-01-31 00:28 - 00011624 _____ () C:\ComboFix.txt

2014-01-31 00:28 - 2014-01-31 00:05 - 00000000 ____D () C:\Qoobox

2014-01-31 00:28 - 2009-07-13 18:37 - 00000000 __RHD () C:\Users\Default

2014-01-31 00:28 - 2009-07-13 18:37 - 00000000 ___RD () C:\Users\Public

2014-01-31 00:26 - 2014-01-30 21:46 - 00000000 ____D () C:\Windows\ERDNT

2014-01-31 00:23 - 2009-07-13 18:04 - 00000215 _____ () C:\Windows\system.ini

2014-01-31 00:22 - 2010-11-20 13:48 - 00044746 _____ () C:\Windows\PFRO.log

2014-01-31 00:21 - 2009-07-13 18:03 - 47185920 _____ () C:\Windows\system32\config\software.bak

2014-01-31 00:21 - 2009-07-13 18:03 - 14417920 _____ () C:\Windows\system32\config\system.bak

2014-01-31 00:21 - 2009-07-13 18:03 - 00524288 _____ () C:\Windows\system32\config\default.bak

2014-01-31 00:21 - 2009-07-13 18:03 - 00262144 _____ () C:\Windows\system32\config\security.bak

2014-01-31 00:21 - 2009-07-13 18:03 - 00262144 _____ () C:\Windows\system32\config\sam.bak

2014-01-31 00:03 - 2014-01-31 00:03 - 05177551 ____R (Swearware) C:\Users\Creator\Downloads\ComboFix.exe

2014-01-30 22:02 - 2014-01-30 21:47 - 00000000 ____D () C:\Users\Creator\Desktop\RK_Quarantine

2014-01-30 21:57 - 2014-01-30 21:57 - 00002240 _____ () C:\Users\Creator\Desktop\RKreport[0]_S_01302014_215734.txt

2014-01-30 21:52 - 2014-01-30 21:52 - 00002207 _____ () C:\Users\Creator\Desktop\RKreport[0]_S_01302014_215252.txt

2014-01-30 21:45 - 2014-01-30 21:44 - 00000000 ____D () C:\Program Files\ERUNT