Successfully blocked access keeps popping up w/o browser

loveanddaisys · February 26, 2014

So the successfully blocked access to malicious site window keeps popping up but it's from the same thing every time, this is the most recent log file from malwarebytes: 2014/02/26 00:00:54 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 49690, Process: chrome.exe)

2014/02/26 00:00:54 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 49693, Process: chrome.exe)

2014/02/26 00:00:54 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 49694, Process: chrome.exe)

2014/02/26 00:00:54 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 49695, Process: chrome.exe)

2014/02/26 00:00:55 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 49696, Process: chrome.exe)

2014/02/26 00:00:55 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 49697, Process: chrome.exe)

2014/02/26 00:00:55 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 49698, Process: chrome.exe)

2014/02/26 00:01:03 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 49701, Process: chrome.exe)

2014/02/26 00:01:03 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 49702, Process: chrome.exe)

2014/02/26 00:01:03 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 49703, Process: chrome.exe)

2014/02/26 00:01:03 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 49704, Process: chrome.exe)

2014/02/26 00:01:03 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 49705, Process: chrome.exe)

2014/02/26 00:01:03 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 49706, Process: chrome.exe)

2014/02/26 00:01:03 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 49707, Process: chrome.exe)

2014/02/26 00:01:03 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 49708, Process: chrome.exe)

2014/02/26 00:01:03 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 49709, Process: chrome.exe)

2014/02/26 00:01:03 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 49710, Process: chrome.exe)

2014/02/26 00:01:03 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 49711, Process: chrome.exe)

2014/02/26 00:01:03 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 49712, Process: chrome.exe)

2014/02/26 00:08:09 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 49895, Process: chrome.exe)

2014/02/26 00:08:09 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 49896, Process: chrome.exe)

2014/02/26 00:08:10 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 49897, Process: chrome.exe)

2014/02/26 00:11:16 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 50202, Process: chrome.exe)

2014/02/26 00:11:16 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 50203, Process: chrome.exe)

2014/02/26 00:11:16 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 50204, Process: chrome.exe)

2014/02/26 00:11:16 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 50206, Process: chrome.exe)

2014/02/26 00:20:25 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 50322, Process: chrome.exe)

2014/02/26 00:20:25 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 50324, Process: chrome.exe)

2014/02/26 00:20:25 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 50325, Process: chrome.exe)

2014/02/26 00:20:25 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 50326, Process: chrome.exe)

2014/02/26 00:27:31 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 50660, Process: chrome.exe)

2014/02/26 00:27:39 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 50662, Process: chrome.exe)

2014/02/26 00:27:39 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 50663, Process: chrome.exe)

2014/02/26 00:27:39 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 50664, Process: chrome.exe)

2014/02/26 00:33:49 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 50852, Process: chrome.exe)

2014/02/26 00:33:49 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 50854, Process: chrome.exe)

2014/02/26 00:33:49 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 50855, Process: chrome.exe)

2014/02/26 00:33:49 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 50856, Process: chrome.exe)

2014/02/26 00:50:25 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 51274, Process: chrome.exe)

2014/02/26 00:50:33 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 51276, Process: chrome.exe)

2014/02/26 00:50:33 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 51277, Process: chrome.exe)

2014/02/26 00:50:33 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 51278, Process: chrome.exe)

2014/02/26 00:53:39 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 51363, Process: chrome.exe)

2014/02/26 00:53:39 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 51366, Process: chrome.exe)

2014/02/26 00:53:39 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 51367, Process: chrome.exe)

2014/02/26 00:53:39 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 51368, Process: chrome.exe)

2014/02/26 01:01:41 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 51633, Process: chrome.exe)

2014/02/26 01:01:50 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 51637, Process: chrome.exe)

2014/02/26 01:01:50 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 51638, Process: chrome.exe)

2014/02/26 01:01:50 -0800 OWNER-PC Owner IP-BLOCK 176.121.11.12 (Type: outgoing, Port: 51639, Process: chrome.exe)

and it's the same ip address and program every time just different ports, but here are my dds file and attachment just in case you still need that.
DDS:

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 9.0.8112.16533 BrowserJavaVersion: 10.51.2

Run by Owner at 0:44:58 on 2014-02-26

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2974.1363 [GMT -8:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Spybot - Search and Destroy *Enabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

.

============== Running Processes ================

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

c:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\Hpservice.exe

C:\Windows\system32\WLANExt.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Windows Sidebar\sidebar.exe

c:\Program Files\Microsoft Security Client\NisSrv.exe

C:\Users\Owner\AppData\Local\GCC\Controller.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\system32\taskeng.exe

C:\Users\Owner\AppData\Local\GCC\Controller.exe

C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE

C:\Windows\system32\wuauclt.exe

C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

C:\Program Files\Google\Update\1.3.22.5\GoogleCrashHandler.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe

C:\Windows\System32\rundll32.exe

C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k swprv

.

============== Pseudo HJT Report ===============

.

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll

uRun: [sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun

mRun: [Windows Defender] c:\program files\windows defender\MSASCui.exe -hide

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey

mRun: [sDTray] "c:\program files\spybot - search & destroy 2\SDTray.exe"

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

TCP: NameServer = 75.75.75.75 75.75.76.76

TCP: Interfaces\{0F15F9CB-611B-45E5-84A5-75FFBC548D76} : DHCPNameServer = 75.75.75.75 75.75.76.76

Notify: igfxcui - igfxdev.dll

Notify: SDWinLogon - SDWinLogon.dll

LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\33.0.1750.117\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

Hosts: 127.0.0.1 www.spywareinfo.com

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\owner\appdata\roaming\mozilla\firefox\profiles\wsw3ci8l.default\

FF - plugin: c:\program files\adobe\reader 11.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\java\jre7\bin\dtplugin\npdeployJava1.dll

FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll

FF - plugin: c:\program files\microsoft silverlight\5.1.20913.0\npctrlui.dll

FF - plugin: c:\windows\system32\adobe\director\np32dsw_1207148.dll

FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_12_0_0_70.dll

.

============= SERVICES / DRIVERS ===============

.

R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2013-9-27 214696]

R1 MpKsl55e70710;MpKsl55e70710;c:\programdata\microsoft\microsoft antimalware\definition updates\{29de2a6a-b70b-4113-b313-e00a4d3a39b4}\MpKsl55e70710.sys [2014-2-26 39464]

R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]

R2 hpsrv;HP Service;c:\windows\system32\hpservice.exe [2011-5-13 26168]

R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2013-12-16 418376]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2013-12-16 701512]

R2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2013-9-27 104768]

R2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files\spybot - search & destroy 2\SDFSSvc.exe [2013-12-16 3921880]

R2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files\spybot - search & destroy 2\SDUpdSvc.exe [2013-12-16 1042272]

R2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files\spybot - search & destroy 2\SDWSCSvc.exe [2013-12-16 171416]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-12-16 22856]

R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\NisSrv.exe [2013-10-23 280288]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2013-9-11 770168]

.

=============== Created Last 30 ================

.

2014-02-26 08:40:16 39464 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{29de2a6a-b70b-4113-b313-e00a4d3a39b4}\MpKsl55e70710.sys

2014-02-26 03:19:18 -------- d-----w- c:\users\owner\appdata\roaming\QuickScan

2014-02-26 02:53:02 75480 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys

2014-02-25 23:49:19 -------- d-----w- c:\users\owner\appdata\local\Macromedia

2014-02-25 23:48:31 -------- d-----w- c:\users\owner\appdata\local\Mozilla

2014-02-25 23:28:43 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2014-02-25 23:28:43 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2014-02-25 23:19:28 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

2014-02-25 06:10:38 7947048 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{29de2a6a-b70b-4113-b313-e00a4d3a39b4}\mpengine.dll

2014-02-25 05:24:08 -------- d-----w- c:\users\owner\appdata\local\GCC

2014-02-25 05:23:48 -------- d-----w- c:\users\owner\appdata\local\SwvUpdater

2014-02-25 05:23:01 -------- d-----w- c:\users\owner\appdata\roaming\GoforFiles

2014-02-25 03:32:59 70992 ----a-w- c:\windows\system32\XAPOFX1_2.dll

2014-02-25 03:30:12 -------- d--h--w- c:\windows\msdownld.tmp

2014-02-25 03:30:12 -------- d-----w- c:\windows\system32\directx

2014-02-25 03:29:25 -------- d-----w- c:\program files\PCSX2 1.0.0

2014-02-25 03:23:54 -------- d-----w- c:\users\owner\appdata\local\Apple Computer

2014-02-25 03:23:07 26840 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2014-02-25 03:21:01 -------- d-----w- c:\program files\iPod

2014-02-25 03:20:58 -------- d-----w- c:\programdata\188F1432-103A-4ffb-80F1-36B633C5C9E1

2014-02-25 03:20:58 -------- d-----w- c:\program files\iTunes

2014-02-25 03:19:00 -------- d-----w- c:\users\owner\appdata\local\Apple

2014-02-25 03:17:03 -------- d-----w- c:\program files\Bonjour

2014-02-25 02:27:04 765968 ------w- c:\programdata\microsoft\microsoft antimalware\definition updates\{a97d48f2-3a54-4362-a94b-c43c461e9f1e}\gapaengine.dll

2014-02-25 02:27:04 719224 ------w- c:\programdata\microsoft\microsoft antimalware\definition updates\nisbackup\gapaengine.dll

2014-02-25 02:20:45 7947048 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll

2014-02-25 01:56:16 -------- d-----w- c:\programdata\Oracle

2014-02-25 01:55:52 1248768 ----a-w- c:\windows\system32\msxml3.dll

.

==================== Find3M ====================

.

2014-02-05 08:56:17 1806848 ----a-w- c:\windows\system32\jscript9.dll

2014-02-05 08:50:39 1129472 ----a-w- c:\windows\system32\wininet.dll

2014-02-05 08:49:56 1427968 ----a-w- c:\windows\system32\inetcpl.cpl

2014-02-05 08:48:40 142848 ----a-w- c:\windows\system32\ieUnatt.exe

2014-02-05 08:48:27 421376 ----a-w- c:\windows\system32\vbscript.dll

2014-02-05 08:47:16 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2014-01-19 07:32:23 231584 ------w- c:\windows\system32\MpSigStub.exe

2013-12-17 01:58:45 98816 ----a-w- c:\windows\system32\mfps.dll

2013-12-17 01:57:54 4096 ----a-w- c:\windows\system32\drivers\en-us\dxgkrnl.sys.mui

2013-12-17 01:57:53 974848 ----a-w- c:\windows\system32\WindowsCodecs.dll

2013-12-17 01:57:53 519680 ----a-w- c:\windows\system32\d3d11.dll

2013-12-17 01:57:53 369664 ----a-w- c:\windows\system32\WMPhoto.dll

2013-12-17 01:57:53 321024 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll

2013-12-17 01:57:53 252928 ----a-w- c:\windows\system32\dxdiag.exe

2013-12-17 01:57:53 195584 ----a-w- c:\windows\system32\dxdiagn.dll

2013-12-17 01:57:53 189440 ----a-w- c:\windows\system32\WindowsCodecsExt.dll

.

============= FINISH: 0:45:12.66 ===============

attach:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft® Windows Vista™ Home Premium

Boot Device: \Device\HarddiskVolume1

Install Date: 12/9/2013 12:04:17 PM

System Uptime: 2/25/2014 2:20:41 PM (10 hours ago)

.

Motherboard: Compal | | 306E

Processor: Intel® Core2 Duo CPU T6500 @ 2.10GHz | CPU | 2100/800mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 466 GiB total, 352.265 GiB free.

D: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

Description: Realtek RTL8101 Family PCI-E Fast Ethernet NIC (NDIS 6.0)

Device ID: PCI\VEN_10EC&DEV_8136&SUBSYS_306E103C&REV_02\4&2ABD10AA&0&00E3

Manufacturer: Realtek

Name: Realtek RTL8101 Family PCI-E Fast Ethernet NIC (NDIS 6.0)

PNP Device ID: PCI\VEN_10EC&DEV_8136&SUBSYS_306E103C&REV_02\4&2ABD10AA&0&00E3

Service: RTL8169

.

Class GUID: {36fc9e60-c465-11cf-8056-444553540000}

Description: USB Mass Storage Device

Device ID: USB\VID_0BDA&PID_0158\20071114173400000

Manufacturer: Compatible USB storage device

Name: USB Mass Storage Device

PNP Device ID: USB\VID_0BDA&PID_0158\20071114173400000

Service: USBSTOR

.

Class GUID:

Description:

Device ID: ACPI\ENE0100\3&E89B380&0

Manufacturer:

Name:

PNP Device ID: ACPI\ENE0100\3&E89B380&0

Service:

.

==== System Restore Points ===================

.

RP8: 12/9/2013 1:51:29 PM - Device Driver Package Install: Atheros Communications Inc. Network adapters

RP9: 12/9/2013 1:51:36 PM - Device Driver Package Install: Atheros Communications Inc. Network adapters

RP10: 12/9/2013 2:30:39 PM - Windows Update

RP11: 12/9/2013 2:39:13 PM - Windows Update

RP13: 12/16/2013 9:48:56 AM - Scheduled Checkpoint

RP14: 12/16/2013 10:11:14 AM - Installed Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

RP15: 12/16/2013 10:13:40 AM - Installed OpenOffice 4.0.1

RP16: 12/16/2013 10:26:18 AM - Device Driver Package Install: Intel System devices

RP17: 12/16/2013 10:30:52 AM - Windows Update

RP18: 12/16/2013 10:53:14 AM - Windows Update

RP19: 12/16/2013 5:31:35 PM - Windows Update

RP21: 12/17/2013 9:45:21 AM - Windows Live Essentials

RP23: 12/17/2013 9:46:53 AM - Installed DirectX

RP25: 12/17/2013 9:48:25 AM - Installed DirectX

RP26: 12/17/2013 10:35:38 AM - Windows Update

RP27: 2/24/2014 5:52:57 PM - Installed Java 7 Update 51

RP28: 2/24/2014 5:56:58 PM - Removed OpenOffice 4.0.1

RP29: 2/24/2014 7:17:20 PM - Device Driver Package Install: Apple, Inc. Universal Serial Bus controllers

RP30: 2/24/2014 7:17:43 PM - Device Driver Package Install: Apple Network adapters

RP31: 2/24/2014 7:19:07 PM - Installed iTunes

RP33: 2/24/2014 7:31:21 PM - Installed DirectX

RP34: 2/24/2014 10:38:50 PM - Windows Update

RP35: 2/24/2014 11:15:22 PM - Removed Java 7 Update 51

RP36: 2/25/2014 3:18:18 PM - Installed Java 7 Update 51

RP37: 2/25/2014 4:42:29 PM - Removed Google Chrome

.

==== Installed Programs ======================

.

7-Zip 9.20

Adobe AIR

Adobe Flash Player 12 Plugin

Adobe Reader XI (11.0.05)

Adobe Shockwave Player 12.0

Apple Application Support

Apple Mobile Device Support

Apple Software Update

Atheros Driver Installation Program

Bonjour

Cisco EAP-FAST Module

Cisco LEAP Module

Cisco PEAP Module

D3DX10

Google Chrome

Google Update Helper

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

iTunes

Java 7 Update 51

Java Auto Updater

Malwarebytes Anti-Malware version 1.75.0.1300

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4.5.1

Microsoft Security Client

Microsoft Security Essentials

Microsoft Silverlight

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Mozilla Firefox 26.0 (x86 en-US)

Mozilla Maintenance Service

PCSX2 - Playstation 2 Emulator

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2840629)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2861697)

Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)

Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)

Segoe UI

Spybot - Search & Destroy

swMSM

Synaptics Pointing Device Driver

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Windows Live Essentials

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

.

==== Event Viewer Messages From Past Week ========

.

2/24/2014 9:57:08 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Spybot-S&D 2 Updating Service service to connect.

2/24/2014 9:57:08 PM, Error: Service Control Manager [7000] - The Spybot-S&D 2 Updating Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

2/24/2014 9:56:40 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Spybot-S&D 2 Scanner Service service to connect.

2/24/2014 9:56:40 PM, Error: Service Control Manager [7000] - The Spybot-S&D 2 Scanner Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

2/24/2014 9:48:54 PM, Error: Service Control Manager [7031] - The Update SerialTrunc service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.

2/24/2014 5:49:24 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Google Update Service (gupdate) service to connect.

2/24/2014 5:49:24 PM, Error: Service Control Manager [7000] - The Google Update Service (gupdate) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

2/24/2014 5:49:24 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service gupdate with arguments "/comsvc" in order to run the server: {4EB61BAC-A3B6-4760-9581-655041EF4D69}

2/24/2014 5:48:11 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 109.61.0.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=260974&clcid=0x409&NRI=true&arch=x86&eng=2.1.10003.0&sig=109.61.0.0∏=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094 Signature Type: Network Inspection System Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 2.1.10003.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved

2/24/2014 5:48:11 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.165.98.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.10201.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.

2/24/2014 5:48:11 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.165.98.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x86&eng=1.1.10201.0&avdelta=1.165.98.0&asdelta=1.165.98.0∏=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094 Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.10201.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved

2/24/2014 5:48:11 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.165.98.0 Update Source: Microsoft Malware Protection Center Update Stage: Search Source Path: http://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x86&eng=1.1.10201.0&avdelta=1.165.98.0&asdelta=1.165.98.0∏=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094 Signature Type: AntiSpyware Update Type: Full User: NT AUTHORITY\NETWORK SERVICE Current Engine Version: Previous Engine Version: 1.1.10201.0 Error code: 0x80072ee7 Error description: The server name or address could not be resolved

2/24/2014 11:40:22 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: MpFilter spldr Wanarpv6

2/24/2014 11:40:22 PM, Error: Service Control Manager [7001] - The Microsoft Network Inspection System service depends on the Microsoft Malware Protection Driver service which failed to start because of the following error: A device attached to the system is not functioning.

2/24/2014 11:40:22 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.

2/24/2014 11:40:03 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

2/24/2014 11:40:02 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}

2/24/2014 11:39:57 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}

2/24/2014 11:39:56 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

2/24/2014 11:39:46 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}

2/24/2014 11:39:32 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\system32\athihvs.dll Error Code: 21

2/24/2014 11:39:02 PM, Error: EventLog [6008] - The previous system shutdown at 11:37:00 PM on 2/24/2014 was unexpected.

.

==== End Of File ===========================

Would appreciate any help I've tried everything but I just can't get rid of it.

Psychotic · February 26, 2014

Hi there,
my name is Marius and I will assist you with your malware related problems.

Before we move on, please read the following points carefully.

First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while following my instructions, Stop there and tell me the exact nature of your problem.
Do not run any other scans without instruction or add/remove software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
Post all logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

Scan with Gmer rootkit scanner

Please download Gmer from here by clicking on the "Download EXE" Button.

Double click on the randomly named GMER.exe. If asked to allow gmer.sys driver to load, please consent.
If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.
In the right panel, you will see several boxes that have been checked. Uncheck the following ...
- Sections
- IAT/EAT
- Show All ( should be unchecked by default )
[*]Leave everything else as it is. [*]Close all other running programs as well as your Browser. [*]Click the Scan button & wait for it to finish. [*]Once done click on the Save.. button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post. [*]Save it where you can easily find it, such as your desktop. [*]Please post the content of the ark.txt here.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

loveanddaisys · February 26, 2014

Thank you so much for helping me out. I scanned my computer and got this (I'm just going to copy and paste it here if that's fine cuz I don't really know how to attach a .txt file:

GMER 2.1.19357 - http://www.gmer.net

Rootkit scan 2014-02-26 11:55:29

Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST9500325AS rev.0003HPM1 465.76GB

Running: zh5gy9lu.exe; Driver: C:\Users\Owner\AppData\Local\Temp\kgloapow.sys

---- User code sections - GMER 2.1 ----

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtCreateFile + 6 7769426A 4 Bytes [28, 90, 73, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtCreateFile + B 7769426F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtMapViewOfSection + 6 776949BA 4 Bytes [28, 93, 73, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtMapViewOfSection + B 776949BF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtOpenFile + 6 77694A4A 4 Bytes [68, 90, 73, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtOpenFile + B 77694A4F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtOpenProcess + 6 77694ACA 4 Bytes [A8, 91, 73, 00] {TEST AL, 0x91; JAE 0x4}

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtOpenProcess + B 77694ACF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtOpenProcessToken + 6 77694ADA 4 Bytes CALL 7669BE70 C:\Windows\system32\SHELL32.dll

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtOpenProcessToken + B 77694ADF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtOpenProcessTokenEx + 6 77694AEA 4 Bytes [A8, 92, 73, 00] {TEST AL, 0x92; JAE 0x4}

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtOpenProcessTokenEx + B 77694AEF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtOpenThread + 6 77694B3A 4 Bytes [68, 91, 73, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtOpenThread + B 77694B3F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtOpenThreadToken + 6 77694B4A 4 Bytes [68, 92, 73, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtOpenThreadToken + B 77694B4F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtOpenThreadTokenEx + 6 77694B5A 4 Bytes CALL 7669BEF1 C:\Windows\system32\SHELL32.dll

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtOpenThreadTokenEx + B 77694B5F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtQueryAttributesFile + 6 77694BEA 4 Bytes [A8, 90, 73, 00] {TEST AL, 0x90; JAE 0x4}

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtQueryAttributesFile + B 77694BEF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtQueryFullAttributesFile + 6 77694C9A 4 Bytes CALL 7669C02F C:\Windows\system32\SHELL32.dll

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtQueryFullAttributesFile + B 77694C9F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtSetInformationFile + 6 7769517A 4 Bytes [28, 91, 73, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtSetInformationFile + B 7769517F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtSetInformationThread + 6 776951CA 4 Bytes [28, 92, 73, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtSetInformationThread + B 776951CF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtTerminateProcess 77695384 5 Bytes JMP 0003EA9B C:\Program Files\Google\Chrome\Application\chrome.exe

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtUnmapViewOfSection + 6 7769546A 4 Bytes [68, 93, 73, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2060] ntdll.dll!NtUnmapViewOfSection + B 7769546F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtCreateFile + 6 7769426A 4 Bytes [28, EC, 6E, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtCreateFile + B 7769426F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtMapViewOfSection + 6 776949BA 4 Bytes [28, EF, 6E, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtMapViewOfSection + B 776949BF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtOpenFile + 6 77694A4A 4 Bytes [68, EC, 6E, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtOpenFile + B 77694A4F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtOpenProcess + 6 77694ACA 4 Bytes [A8, ED, 6E, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtOpenProcess + B 77694ACF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtOpenProcessToken + 6 77694ADA 4 Bytes CALL 7669B9CC C:\Windows\system32\SHELL32.dll

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtOpenProcessToken + B 77694ADF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtOpenProcessTokenEx + 6 77694AEA 4 Bytes [A8, EE, 6E, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtOpenProcessTokenEx + B 77694AEF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtOpenThread + 6 77694B3A 4 Bytes [68, ED, 6E, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtOpenThread + B 77694B3F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtOpenThreadToken + 6 77694B4A 4 Bytes [68, EE, 6E, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtOpenThreadToken + B 77694B4F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtOpenThreadTokenEx + 6 77694B5A 4 Bytes CALL 7669BA4D C:\Windows\system32\SHELL32.dll

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtOpenThreadTokenEx + B 77694B5F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtQueryAttributesFile + 6 77694BEA 4 Bytes [A8, EC, 6E, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtQueryAttributesFile + B 77694BEF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtQueryFullAttributesFile + 6 77694C9A 4 Bytes CALL 7669BB8B C:\Windows\system32\SHELL32.dll

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtQueryFullAttributesFile + B 77694C9F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtSetInformationFile + 6 7769517A 4 Bytes [28, ED, 6E, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtSetInformationFile + B 7769517F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtSetInformationThread + 6 776951CA 4 Bytes [28, EE, 6E, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtSetInformationThread + B 776951CF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtTerminateProcess 77695384 5 Bytes JMP 0003EA9B C:\Program Files\Google\Chrome\Application\chrome.exe

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtUnmapViewOfSection + 6 7769546A 4 Bytes [68, EF, 6E, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[2240] ntdll.dll!NtUnmapViewOfSection + B 7769546F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtCreateFile + 6 7769426A 4 Bytes [28, AC, B9, 00]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtCreateFile + B 7769426F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtMapViewOfSection + 6 776949BA 4 Bytes [28, AF, B9, 00]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtMapViewOfSection + B 776949BF 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtOpenFile + 6 77694A4A 4 Bytes [68, AC, B9, 00]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtOpenFile + B 77694A4F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtOpenProcess + 6 77694ACA 4 Bytes [A8, AD, B9, 00]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtOpenProcess + B 77694ACF 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtOpenProcessToken + 6 77694ADA 4 Bytes CALL 766A048C C:\Windows\system32\SHELL32.dll

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtOpenProcessToken + B 77694ADF 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtOpenProcessTokenEx + 6 77694AEA 4 Bytes [A8, AE, B9, 00]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtOpenProcessTokenEx + B 77694AEF 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtOpenThread + 6 77694B3A 4 Bytes [68, AD, B9, 00]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtOpenThread + B 77694B3F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtOpenThreadToken + 6 77694B4A 4 Bytes [68, AE, B9, 00]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtOpenThreadToken + B 77694B4F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtOpenThreadTokenEx + 6 77694B5A 4 Bytes CALL 766A050D C:\Windows\system32\SHELL32.dll

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtOpenThreadTokenEx + B 77694B5F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtQueryAttributesFile + 6 77694BEA 4 Bytes [A8, AC, B9, 00]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtQueryAttributesFile + B 77694BEF 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtQueryFullAttributesFile + 6 77694C9A 4 Bytes CALL 766A064B C:\Windows\system32\SHELL32.dll

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtQueryFullAttributesFile + B 77694C9F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtSetInformationFile + 6 7769517A 4 Bytes [28, AD, B9, 00]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtSetInformationFile + B 7769517F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtSetInformationThread + 6 776951CA 4 Bytes [28, AE, B9, 00]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtSetInformationThread + B 776951CF 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtUnmapViewOfSection + 6 7769546A 4 Bytes [68, AF, B9, 00]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[3412] ntdll.dll!NtUnmapViewOfSection + B 7769546F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtCreateFile + 6 7769426A 4 Bytes [28, 60, D3, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtCreateFile + B 7769426F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtMapViewOfSection + 6 776949BA 4 Bytes [28, 63, D3, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtMapViewOfSection + B 776949BF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtOpenFile + 6 77694A4A 4 Bytes [68, 60, D3, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtOpenFile + B 77694A4F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtOpenProcess + 6 77694ACA 4 Bytes [A8, 61, D3, 00] {TEST AL, 0x61; ROL [EAX], CL}

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtOpenProcess + B 77694ACF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtOpenProcessToken + 6 77694ADA 4 Bytes CALL 766A1E40 C:\Windows\system32\SHELL32.dll

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtOpenProcessToken + B 77694ADF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtOpenProcessTokenEx + 6 77694AEA 4 Bytes [A8, 62, D3, 00] {TEST AL, 0x62; ROL [EAX], CL}

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtOpenProcessTokenEx + B 77694AEF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtOpenThread + 6 77694B3A 4 Bytes [68, 61, D3, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtOpenThread + B 77694B3F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtOpenThreadToken + 6 77694B4A 4 Bytes [68, 62, D3, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtOpenThreadToken + B 77694B4F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtOpenThreadTokenEx + 6 77694B5A 4 Bytes CALL 766A1EC1 C:\Windows\system32\SHELL32.dll

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtOpenThreadTokenEx + B 77694B5F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtQueryAttributesFile + 6 77694BEA 4 Bytes [A8, 60, D3, 00] {TEST AL, 0x60; ROL [EAX], CL}

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtQueryAttributesFile + B 77694BEF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtQueryFullAttributesFile + 6 77694C9A 4 Bytes CALL 766A1FFF C:\Windows\system32\SHELL32.dll

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtQueryFullAttributesFile + B 77694C9F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtSetInformationFile + 6 7769517A 4 Bytes [28, 61, D3, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtSetInformationFile + B 7769517F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtSetInformationThread + 6 776951CA 4 Bytes [28, 62, D3, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtSetInformationThread + B 776951CF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtTerminateProcess 77695384 5 Bytes JMP 0003EA9B C:\Program Files\Google\Chrome\Application\chrome.exe

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtUnmapViewOfSection + 6 7769546A 4 Bytes [68, 63, D3, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4220] ntdll.dll!NtUnmapViewOfSection + B 7769546F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtCreateFile + 6 7769426A 4 Bytes [28, C8, 8E, 00] {SUB AL, CL; MOV ES, [EAX]}

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtCreateFile + B 7769426F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtMapViewOfSection + 6 776949BA 4 Bytes [28, CB, 8E, 00] {SUB BL, CL; MOV ES, [EAX]}

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtMapViewOfSection + B 776949BF 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtOpenFile + 6 77694A4A 4 Bytes [68, C8, 8E, 00]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtOpenFile + B 77694A4F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtOpenProcess + 6 77694ACA 4 Bytes [A8, C9, 8E, 00] {TEST AL, 0xc9; MOV ES, [EAX]}

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtOpenProcess + B 77694ACF 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtOpenProcessToken + 6 77694ADA 4 Bytes CALL 7669D9A8 C:\Windows\system32\SHELL32.dll

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtOpenProcessToken + B 77694ADF 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtOpenProcessTokenEx + 6 77694AEA 4 Bytes [A8, CA, 8E, 00] {TEST AL, 0xca; MOV ES, [EAX]}

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtOpenProcessTokenEx + B 77694AEF 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtOpenThread + 6 77694B3A 4 Bytes [68, C9, 8E, 00]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtOpenThread + B 77694B3F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtOpenThreadToken + 6 77694B4A 4 Bytes [68, CA, 8E, 00]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtOpenThreadToken + B 77694B4F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtOpenThreadTokenEx + 6 77694B5A 4 Bytes CALL 7669DA29 C:\Windows\system32\SHELL32.dll

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtOpenThreadTokenEx + B 77694B5F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtQueryAttributesFile + 6 77694BEA 4 Bytes [A8, C8, 8E, 00] {TEST AL, 0xc8; MOV ES, [EAX]}

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtQueryAttributesFile + B 77694BEF 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtQueryFullAttributesFile + 6 77694C9A 4 Bytes CALL 7669DB67 C:\Windows\system32\SHELL32.dll

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtQueryFullAttributesFile + B 77694C9F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtSetInformationFile + 6 7769517A 4 Bytes [28, C9, 8E, 00] {SUB CL, CL; MOV ES, [EAX]}

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtSetInformationFile + B 7769517F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtSetInformationThread + 6 776951CA 4 Bytes [28, CA, 8E, 00] {SUB DL, CL; MOV ES, [EAX]}

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtSetInformationThread + B 776951CF 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtUnmapViewOfSection + 6 7769546A 4 Bytes [68, CB, 8E, 00]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4416] ntdll.dll!NtUnmapViewOfSection + B 7769546F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtCreateFile + 6 7769426A 4 Bytes [28, A4, 02, 01]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtCreateFile + B 7769426F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtMapViewOfSection + 6 776949BA 4 Bytes [28, A7, 02, 01]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtMapViewOfSection + B 776949BF 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtOpenFile + 6 77694A4A 4 Bytes [68, A4, 02, 01]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtOpenFile + B 77694A4F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtOpenProcess + 6 77694ACA 4 Bytes [A8, A5, 02, 01] {TEST AL, 0xa5; ADD AL, [ECX]}

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtOpenProcess + B 77694ACF 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtOpenProcessToken + 6 77694ADA 4 Bytes CALL 766A4D84 C:\Windows\system32\SHELL32.dll

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtOpenProcessToken + B 77694ADF 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtOpenProcessTokenEx + 6 77694AEA 4 Bytes [A8, A6, 02, 01] {TEST AL, 0xa6; ADD AL, [ECX]}

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtOpenProcessTokenEx + B 77694AEF 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtOpenThread + 6 77694B3A 4 Bytes [68, A5, 02, 01]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtOpenThread + B 77694B3F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtOpenThreadToken + 6 77694B4A 4 Bytes [68, A6, 02, 01]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtOpenThreadToken + B 77694B4F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtOpenThreadTokenEx + 6 77694B5A 4 Bytes CALL 766A4E05 C:\Windows\system32\SHELL32.dll

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtOpenThreadTokenEx + B 77694B5F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtQueryAttributesFile + 6 77694BEA 4 Bytes [A8, A4, 02, 01] {TEST AL, 0xa4; ADD AL, [ECX]}

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtQueryAttributesFile + B 77694BEF 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtQueryFullAttributesFile + 6 77694C9A 4 Bytes CALL 766A4F43 C:\Windows\system32\SHELL32.dll

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtQueryFullAttributesFile + B 77694C9F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtSetInformationFile + 6 7769517A 4 Bytes [28, A5, 02, 01]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtSetInformationFile + B 7769517F 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtSetInformationThread + 6 776951CA 4 Bytes [28, A6, 02, 01]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtSetInformationThread + B 776951CF 1 Byte [E2]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtUnmapViewOfSection + 6 7769546A 4 Bytes [68, A7, 02, 01]

.text C:\Users\Owner\AppData\Local\GCC\CHROME~1\chrome.exe[4500] ntdll.dll!NtUnmapViewOfSection + B 7769546F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtCreateFile + 6 7769426A 4 Bytes [28, 10, 14, 00] {SUB [EAX], DL; ADC AL, 0x0}

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtCreateFile + B 7769426F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtMapViewOfSection + 6 776949BA 4 Bytes [28, 13, 14, 00] {SUB [EBX], DL; ADC AL, 0x0}

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtMapViewOfSection + B 776949BF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtOpenFile + 6 77694A4A 4 Bytes [68, 10, 14, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtOpenFile + B 77694A4F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtOpenProcess + 6 77694ACA 4 Bytes [A8, 11, 14, 00] {TEST AL, 0x11; ADC AL, 0x0}

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtOpenProcess + B 77694ACF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtOpenProcessToken + 6 77694ADA 4 Bytes CALL 76695EF0 C:\Windows\system32\SHELL32.dll

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtOpenProcessToken + B 77694ADF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtOpenProcessTokenEx + 6 77694AEA 4 Bytes [A8, 12, 14, 00] {TEST AL, 0x12; ADC AL, 0x0}

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtOpenProcessTokenEx + B 77694AEF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtOpenThread + 6 77694B3A 4 Bytes [68, 11, 14, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtOpenThread + B 77694B3F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtOpenThreadToken + 6 77694B4A 4 Bytes [68, 12, 14, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtOpenThreadToken + B 77694B4F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtOpenThreadTokenEx + 6 77694B5A 4 Bytes CALL 76695F71 C:\Windows\system32\SHELL32.dll

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtOpenThreadTokenEx + B 77694B5F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtQueryAttributesFile + 6 77694BEA 4 Bytes [A8, 10, 14, 00] {TEST AL, 0x10; ADC AL, 0x0}

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtQueryAttributesFile + B 77694BEF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtQueryFullAttributesFile + 6 77694C9A 4 Bytes CALL 766960AF C:\Windows\system32\SHELL32.dll

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtQueryFullAttributesFile + B 77694C9F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtSetInformationFile + 6 7769517A 4 Bytes [28, 11, 14, 00] {SUB [ECX], DL; ADC AL, 0x0}

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtSetInformationFile + B 7769517F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtSetInformationThread + 6 776951CA 4 Bytes [28, 12, 14, 00] {SUB [EDX], DL; ADC AL, 0x0}

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtSetInformationThread + B 776951CF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtTerminateProcess 77695384 5 Bytes JMP 0003EA9B C:\Program Files\Google\Chrome\Application\chrome.exe

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtUnmapViewOfSection + 6 7769546A 4 Bytes [68, 13, 14, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4588] ntdll.dll!NtUnmapViewOfSection + B 7769546F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtCreateFile + 6 7769426A 4 Bytes [28, B8, 17, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtCreateFile + B 7769426F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtMapViewOfSection + 6 776949BA 4 Bytes [28, BB, 17, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtMapViewOfSection + B 776949BF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtOpenFile + 6 77694A4A 4 Bytes [68, B8, 17, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtOpenFile + B 77694A4F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtOpenProcess + 6 77694ACA 4 Bytes [A8, B9, 17, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtOpenProcess + B 77694ACF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtOpenProcessToken + 6 77694ADA 4 Bytes CALL 76696298 C:\Windows\system32\SHELL32.dll

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtOpenProcessToken + B 77694ADF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtOpenProcessTokenEx + 6 77694AEA 4 Bytes [A8, BA, 17, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtOpenProcessTokenEx + B 77694AEF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtOpenThread + 6 77694B3A 4 Bytes [68, B9, 17, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtOpenThread + B 77694B3F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtOpenThreadToken + 6 77694B4A 4 Bytes [68, BA, 17, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtOpenThreadToken + B 77694B4F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtOpenThreadTokenEx + 6 77694B5A 4 Bytes CALL 76696319 C:\Windows\system32\SHELL32.dll

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtOpenThreadTokenEx + B 77694B5F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtQueryAttributesFile + 6 77694BEA 4 Bytes [A8, B8, 17, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtQueryAttributesFile + B 77694BEF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtQueryFullAttributesFile + 6 77694C9A 4 Bytes CALL 76696457 C:\Windows\system32\SHELL32.dll

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtQueryFullAttributesFile + B 77694C9F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtSetInformationFile + 6 7769517A 4 Bytes [28, B9, 17, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtSetInformationFile + B 7769517F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtSetInformationThread + 6 776951CA 4 Bytes [28, BA, 17, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtSetInformationThread + B 776951CF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtTerminateProcess 77695384 5 Bytes JMP 0003EA9B C:\Program Files\Google\Chrome\Application\chrome.exe

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtUnmapViewOfSection + 6 7769546A 4 Bytes [68, BB, 17, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4604] ntdll.dll!NtUnmapViewOfSection + B 7769546F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtCreateFile + 6 7769426A 4 Bytes [28, 9C, 88, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtCreateFile + B 7769426F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtMapViewOfSection + 6 776949BA 4 Bytes [28, 9F, 88, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtMapViewOfSection + B 776949BF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtOpenFile + 6 77694A4A 4 Bytes [68, 9C, 88, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtOpenFile + B 77694A4F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtOpenProcess + 6 77694ACA 4 Bytes [A8, 9D, 88, 00] {TEST AL, 0x9d; MOV [EAX], AL}

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtOpenProcess + B 77694ACF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtOpenProcessToken + 6 77694ADA 4 Bytes CALL 7669D37C C:\Windows\system32\SHELL32.dll

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtOpenProcessToken + B 77694ADF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtOpenProcessTokenEx + 6 77694AEA 4 Bytes [A8, 9E, 88, 00] {TEST AL, 0x9e; MOV [EAX], AL}

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtOpenProcessTokenEx + B 77694AEF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtOpenThread + 6 77694B3A 4 Bytes [68, 9D, 88, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtOpenThread + B 77694B3F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtOpenThreadToken + 6 77694B4A 4 Bytes [68, 9E, 88, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtOpenThreadToken + B 77694B4F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtOpenThreadTokenEx + 6 77694B5A 4 Bytes CALL 7669D3FD C:\Windows\system32\SHELL32.dll

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtOpenThreadTokenEx + B 77694B5F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtQueryAttributesFile + 6 77694BEA 4 Bytes [A8, 9C, 88, 00] {TEST AL, 0x9c; MOV [EAX], AL}

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtQueryAttributesFile + B 77694BEF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtQueryFullAttributesFile + 6 77694C9A 4 Bytes CALL 7669D53B C:\Windows\system32\SHELL32.dll

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtQueryFullAttributesFile + B 77694C9F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtSetInformationFile + 6 7769517A 4 Bytes [28, 9D, 88, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtSetInformationFile + B 7769517F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtSetInformationThread + 6 776951CA 4 Bytes [28, 9E, 88, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtSetInformationThread + B 776951CF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtTerminateProcess 77695384 5 Bytes JMP 0003EA9B C:\Program Files\Google\Chrome\Application\chrome.exe

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtUnmapViewOfSection + 6 7769546A 4 Bytes [68, 9F, 88, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[4908] ntdll.dll!NtUnmapViewOfSection + B 7769546F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtCreateFile + 6 7769426A 4 Bytes [28, DC, CC, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtCreateFile + B 7769426F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtMapViewOfSection + 6 776949BA 4 Bytes [28, DF, CC, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtMapViewOfSection + B 776949BF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtOpenFile + 6 77694A4A 4 Bytes [68, DC, CC, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtOpenFile + B 77694A4F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtOpenProcess + 6 77694ACA 4 Bytes [A8, DD, CC, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtOpenProcess + B 77694ACF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtOpenProcessToken + 6 77694ADA 4 Bytes CALL 766A17BC C:\Windows\system32\SHELL32.dll

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtOpenProcessToken + B 77694ADF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtOpenProcessTokenEx + 6 77694AEA 4 Bytes [A8, DE, CC, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtOpenProcessTokenEx + B 77694AEF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtOpenThread + 6 77694B3A 4 Bytes [68, DD, CC, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtOpenThread + B 77694B3F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtOpenThreadToken + 6 77694B4A 4 Bytes [68, DE, CC, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtOpenThreadToken + B 77694B4F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtOpenThreadTokenEx + 6 77694B5A 4 Bytes CALL 766A183D C:\Windows\system32\SHELL32.dll

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtOpenThreadTokenEx + B 77694B5F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtQueryAttributesFile + 6 77694BEA 4 Bytes [A8, DC, CC, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtQueryAttributesFile + B 77694BEF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtQueryFullAttributesFile + 6 77694C9A 4 Bytes CALL 766A197B C:\Windows\system32\SHELL32.dll

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtQueryFullAttributesFile + B 77694C9F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtSetInformationFile + 6 7769517A 4 Bytes [28, DD, CC, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtSetInformationFile + B 7769517F 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtSetInformationThread + 6 776951CA 4 Bytes [28, DE, CC, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtSetInformationThread + B 776951CF 1 Byte [E2]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtTerminateProcess 77695384 5 Bytes JMP 0003EA9B C:\Program Files\Google\Chrome\Application\chrome.exe

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtUnmapViewOfSection + 6 7769546A 4 Bytes [68, DF, CC, 00]

.text C:\Program Files\Google\Chrome\Application\chrome.exe[5288] ntdll.dll!NtUnmapViewOfSection + B 7769546F 1 Byte [E2]

---- EOF - GMER 2.1 ----

loveanddaisys · February 28, 2014

Umm I just checked and I could not find any folder with app data on it. I'm sorry.

loveanddaisys · February 28, 2014

Nevermind, I got it, will post back to let you know if that helped.

loveanddaisys · February 28, 2014

I just tried to delete it but it's saying I don't have permission when I'm the administrator, not sure what to do about that.

Psychotic · February 28, 2014

@guku: Don´t post within other user´s topics, please!

Combofix

Combofix should only be run when adviced by a team member!

Link

Important - Save the file to your desktop!

Deactivate any and all of your antivirus programs /spyware scanners - they can prevent CF from doing its work.
Run Combofix.exe

When finished, Combofix creates a log file named C:\Combofix.txt. Please post its content in your next reply.

Note: When receiving an error message containing ""Illegal operation attempted on a registry key that has been marked for deletion" simply restart your computer to fix this.

loveanddaisys · February 28, 2014

ComboFix 14-02-24.02 - Owner 02/28/2014 4:10.1.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2974.1974 [GMT -8:00]

Running from: c:\users\Owner\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}

SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

SP: Spybot - Search and Destroy *Disabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((( Files Created from 2014-01-28 to 2014-02-28 )))))))))))))))))))))))))))))))

.

2014-02-28 12:19 . 2014-02-28 12:20 -------- d-----w- c:\users\Owner\AppData\Local\temp

2014-02-28 12:19 . 2014-02-28 12:19 -------- d-----w- c:\users\Default\AppData\Local\temp

2014-02-28 11:55 . 2014-02-28 11:55 39464 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{260950FC-AD3D-4808-9C75-68DDED3A5FE6}\MpKsl0f7ad670.sys

2014-02-28 07:23 . 2014-02-25 01:57 765968 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4789B600-BDCF-4D23-AADB-39390334ECB2}\gapaengine.dll

2014-02-28 07:20 . 2014-02-06 07:08 7947048 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{260950FC-AD3D-4808-9C75-68DDED3A5FE6}\mpengine.dll

2014-02-28 07:19 . 2014-02-28 07:19 40960 ----a-r- c:\users\Owner\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\NewShortcut1_9559F7CA5E344237A2D9D856464AD727.exe

2014-02-28 07:19 . 2014-02-28 07:19 40960 ----a-r- c:\users\Owner\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\ARPPRODUCTICON.exe

2014-02-26 19:29 . 2014-02-06 07:08 7947048 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2014-02-26 03:19 . 2014-02-26 03:19 -------- d-----w- c:\users\Owner\AppData\Roaming\QuickScan

2014-02-26 02:53 . 2014-02-26 03:02 75480 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys

2014-02-25 23:49 . 2014-02-25 23:49 -------- d-----w- c:\users\Owner\AppData\Local\Macromedia

2014-02-25 23:48 . 2014-02-25 23:48 -------- d-----w- c:\users\Owner\AppData\Local\Mozilla

2014-02-25 23:28 . 2014-02-26 00:34 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2014-02-25 23:28 . 2014-02-26 00:34 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2014-02-25 23:28 . 2014-02-25 23:28 -------- d-----w- c:\windows\system32\Macromed

2014-02-25 23:19 . 2014-02-25 23:19 -------- d-----w- c:\program files\Common Files\Java

2014-02-25 23:19 . 2014-02-25 23:19 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

2014-02-25 05:24 . 2014-02-28 08:54 -------- d-----w- c:\users\Owner\AppData\Local\GCC

2014-02-25 05:23 . 2014-02-25 05:52 -------- d-----w- c:\users\Owner\AppData\Local\SwvUpdater

2014-02-25 05:23 . 2014-02-25 05:25 -------- d-----w- c:\users\Owner\AppData\Roaming\GoforFiles

2014-02-25 03:34 . 2014-02-25 03:34 -------- d-----w- c:\program files\7-Zip

2014-02-25 03:32 . 2008-10-27 18:04 514384 ----a-w- c:\windows\system32\XAudio2_3.dll

2014-02-25 03:30 . 2014-02-25 05:54 -------- d--h--w- c:\windows\msdownld.tmp

2014-02-25 03:29 . 2014-02-25 03:33 -------- d-----w- c:\program files\PCSX2 1.0.0

2014-02-25 03:23 . 2014-02-25 03:26 -------- d-----w- c:\users\Owner\AppData\Roaming\Apple Computer

2014-02-25 03:23 . 2014-02-25 03:23 -------- d-----w- c:\users\Owner\AppData\Local\Apple Computer

2014-02-25 03:23 . 2014-02-25 03:23 -------- dc----w- c:\windows\system32\DRVSTORE

2014-02-25 03:23 . 2012-08-21 21:01 26840 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2014-02-25 03:21 . 2014-02-25 03:21 -------- d-----w- c:\program files\iPod

2014-02-25 03:20 . 2014-02-25 03:22 -------- d-----w- c:\programdata\188F1432-103A-4ffb-80F1-36B633C5C9E1

2014-02-25 03:20 . 2014-02-25 03:22 -------- d-----w- c:\program files\iTunes

2014-02-25 03:20 . 2014-02-25 03:20 -------- d-----w- c:\programdata\Apple Computer

2014-02-25 03:19 . 2014-02-25 03:19 -------- d-----w- c:\users\Owner\AppData\Local\Apple

2014-02-25 03:18 . 2014-02-25 03:18 -------- d-----w- c:\program files\Apple Software Update

2014-02-25 03:17 . 2014-02-25 03:17 -------- d-----w- c:\program files\Bonjour

2014-02-25 03:16 . 2014-02-25 03:18 -------- d-----w- c:\programdata\Apple

2014-02-25 03:16 . 2014-02-25 03:20 -------- d-----w- c:\program files\Common Files\Apple

2014-02-25 02:27 . 2014-02-25 01:57 765968 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

2014-02-25 02:27 . 2014-02-25 01:57 765968 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{A97D48F2-3A54-4362-A94B-C43C461E9F1E}\gapaengine.dll

2014-02-25 01:56 . 2014-02-25 23:20 -------- d-----w- c:\programdata\Oracle

2014-02-25 01:55 . 2013-12-05 02:12 1248768 ----a-w- c:\windows\system32\msxml3.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-01-19 07:32 . 2013-12-16 18:31 231584 ------w- c:\windows\system32\MpSigStub.exe

2013-12-17 17:49 . 2011-03-29 02:36 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2013-12-17 01:59 . 2013-12-17 01:59 161792 ----a-w- c:\windows\system32\msls31.dll

2013-12-17 01:59 . 2013-12-17 01:59 86528 ----a-w- c:\windows\system32\iesysprep.dll

2013-12-17 01:59 . 2013-12-17 01:59 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe

2013-12-17 01:59 . 2013-12-17 01:59 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe

2013-12-17 01:59 . 2013-12-17 01:59 48640 ----a-w- c:\windows\system32\mshtmler.dll

2013-12-17 01:59 . 2013-12-17 01:59 74752 ----a-w- c:\windows\system32\iesetup.dll

2013-12-17 01:59 . 2013-12-17 01:59 63488 ----a-w- c:\windows\system32\tdc.ocx

2013-12-17 01:59 . 2013-12-17 01:59 367104 ----a-w- c:\windows\system32\html.iec

2013-12-17 01:59 . 2013-12-17 01:59 23552 ----a-w- c:\windows\system32\licmgr10.dll

2013-12-17 01:59 . 2013-12-17 01:59 152064 ----a-w- c:\windows\system32\wextract.exe

2013-12-17 01:59 . 2013-12-17 01:59 150528 ----a-w- c:\windows\system32\iexpress.exe

2013-12-17 01:59 . 2013-12-17 01:59 11776 ----a-w- c:\windows\system32\mshta.exe

2013-12-17 01:59 . 2013-12-17 01:59 35840 ----a-w- c:\windows\system32\imgutil.dll

2013-12-17 01:59 . 2013-12-17 01:59 110592 ----a-w- c:\windows\system32\IEAdvpack.dll

2013-12-17 01:59 . 2013-12-17 01:59 101888 ----a-w- c:\windows\system32\admparse.dll

2013-12-17 01:58 . 2013-12-17 01:58 98816 ----a-w- c:\windows\system32\mfps.dll

2013-12-17 01:58 . 2013-12-17 01:58 979456 ----a-w- c:\windows\system32\MFH264Dec.dll

2013-12-17 01:58 . 2013-12-17 01:58 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll

2013-12-17 01:58 . 2013-12-17 01:58 302592 ----a-w- c:\windows\system32\mfmp4src.dll

2013-12-17 01:58 . 2013-12-17 01:58 2873344 ----a-w- c:\windows\system32\mf.dll

2013-12-17 01:58 . 2013-12-17 01:58 261632 ----a-w- c:\windows\system32\mfreadwrite.dll

2013-12-17 01:58 . 2013-12-17 01:58 209920 ----a-w- c:\windows\system32\mfplat.dll

2013-12-17 01:58 . 2013-12-17 01:58 586240 ----a-w- c:\windows\system32\stobject.dll

2013-12-17 01:58 . 2013-12-17 01:58 135680 ----a-w- c:\windows\system32\XpsRasterService.dll

2013-12-17 01:58 . 2013-12-17 01:58 847360 ----a-w- c:\windows\system32\OpcServices.dll

2013-12-17 01:58 . 2013-12-17 01:58 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe

2013-12-17 01:58 . 2013-12-17 01:58 478720 ----a-w- c:\windows\system32\dxgi.dll

2013-12-17 01:58 . 2013-12-17 01:58 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll

2013-12-17 01:58 . 2013-12-17 01:58 258048 ----a-w- c:\windows\system32\winspool.drv

2013-12-17 01:58 . 2013-12-17 01:58 1554432 ----a-w- c:\windows\system32\xpsservices.dll

2013-12-17 01:57 . 2013-12-17 01:57 4096 ----a-w- c:\windows\system32\drivers\en-US\dxgkrnl.sys.mui

2013-12-17 01:57 . 2013-12-17 01:57 974848 ----a-w- c:\windows\system32\WindowsCodecs.dll

2013-12-17 01:57 . 2013-12-17 01:57 519680 ----a-w- c:\windows\system32\d3d11.dll

2013-12-17 01:57 . 2013-12-17 01:57 369664 ----a-w- c:\windows\system32\WMPhoto.dll

2013-12-17 01:57 . 2013-12-17 01:57 321024 ----a-w- c:\windows\system32\PhotoMetadataHandler.dll

2013-12-17 01:57 . 2013-12-17 01:57 252928 ----a-w- c:\windows\system32\dxdiag.exe

2013-12-17 01:57 . 2013-12-17 01:57 195584 ----a-w- c:\windows\system32\dxdiagn.dll

2013-12-17 01:57 . 2013-12-17 01:57 189440 ----a-w- c:\windows\system32\WindowsCodecsExt.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-12 137752]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-12 171032]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-12 172568]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-09-05 958576]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 948440]

"SDTray"="c:\program files\Spybot - Search & Destroy 2\SDTray.exe" [2013-07-25 5624784]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2011-10-14 2299176]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2014-02-06 152392]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

@="Service"

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - MPKSL0F7AD670

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2014-02-26 00:51 1150280 ----a-w- c:\program files\Google\Chrome\Application\33.0.1750.117\Installer\chrmstp.exe

.

Contents of the 'Scheduled Tasks' folder

.

2014-02-28 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-25 00:34]

.

2014-02-27 c:\windows\Tasks\Check for updates (Spybot - Search & Destroy).job

- c:\program files\Spybot - Search & Destroy 2\SDUpdate.exe [2013-12-16 18:57]

.

2014-02-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2014-02-26 00:51]

.

2014-02-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2014-02-26 00:51]

.

2014-02-26 c:\windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job

- c:\program files\Spybot - Search & Destroy 2\SDImmunize.exe [2013-12-16 18:49]

.

2013-12-16 c:\windows\Tasks\Scan the system (Spybot - Search & Destroy).job

- c:\program files\Spybot - Search & Destroy 2\SDScan.exe [2013-12-16 18:51]

.

------- Supplementary Scan -------

.

TCP: DhcpNameServer = 75.75.75.75 75.75.76.76

FF - ProfilePath - c:\users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\wsw3ci8l.default\

.

- - - - ORPHANS REMOVED - - - -

.

Notify-SDWinLogon - SDWinLogon.dll

SafeBoot-WudfPf

SafeBoot-WudfRd

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2014-02-28 04:20

Windows 6.0.6002 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

Completion time: 2014-02-28 04:22:45

ComboFix-quarantined-files.txt 2014-02-28 12:22

.

Pre-Run: 373,160,554,496 bytes free

Post-Run: 374,673,907,712 bytes free

.

- - End Of File - - 1A20AF1190E9B1F77B00C06EDC5CFADD

5C616939100B85E558DA92B899A0FC36

Psychotic · March 2, 2014

Full System Scan with Malwarebytes Antimalware

If not existing, please download

Malwarebytes' Anti-Malware to your desktop. Double-click mbam-setup.exe and follow the prompts to install the program. At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.

If the program is already installed:

Run Malwarebytes Antimalware
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform fullscan, place a checkmark on all hard drives, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location.
The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
Post that log back here.

Scan with ESET Online Scan

Please go to here to run the online scannner from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked
Click on Advanced Settings and ensure these options are ticked:
- Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth Technology

[*]Click Scan[*]Wait for the scan to finish[*]If any threats were found, click the 'List of found threats' , then click Export to text file.... [*]Save it to your desktop, then please copy and paste that log as a reply to this topic.

loveanddaisys · March 3, 2014

Malwarebytes Anti-Malware (Trial) 1.75.0.1300

www.malwarebytes.org

Database version: v2014.03.02.04

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 9.0.8112.16421

Owner :: OWNER-PC [administrator]

Protection: Enabled

3/2/2014 12:58:49 PM

mbam-log-2014-03-02 (12-58-49).txt

Scan type: Full scan (C:\|D:\|E:\|)

Scan options disabled: P2P

Objects scanned: 445679

Time elapsed: 3 hour(s), 58 minute(s), 11 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

C:\Windows.old\Documents and Settings\Owner\Downloads\cbsidlm-cbsi145-Chipset_Driver_Intel_Ver8301010zip-ORG-162229.exe a variant of Win32/CNETInstaller.B potentially unwanted application

C:\Windows.old.000\Documents and Settings\Owner\Downloads\cbsidlm-cbsi145-Chipset_Driver_Intel_Ver8301010zip-ORG-162229.exe a variant of Win32/CNETInstaller.B potentially unwanted application

C:\Users\Owner\Downloads\cbsidlm-cbsi145-Chipset_Driver_Intel_Ver8301010zip-ORG-162229.exe a variant of Win32/CNETInstaller.B potentially unwanted application deleted - quarantined

Psychotic · March 5, 2014

C:\Windows.old

This is a remaining of an old Windows installation - you may simply delete the folder.

Then we can do the cleanup - if you are facing any issues, report that immediately.

Delete junk with adwCleaner

Please download AdwCleaner to your desktop.

Run adwcleaner.exe
Hit Scan and wait for the scan to finish.
Confirm the message but don´t uncheck anything.
Hit Clean
When the run is finished, it will open up a text file
Please post its contents within your next reply
You´ll find the log file at C:\AdwCleaner[s1].txt also

SecurityCheck

Please download SecurityCheck: LINK1 LINK2

Save it to your desktop, start it and follow the instructions in the window.
After the scan finished the (checkup.txt) will open. Copy its content to your thread.

loveanddaisys · March 5, 2014

# AdwCleaner v3.020 - Report created 05/03/2014 at 13:26:16

# Updated 27/02/2014 by Xplode

# Operating System : Windows Vista Home Premium Service Pack 2 (32 bits)

# Username : Owner - OWNER-PC

# Running from : C:\Users\Owner\Links\adwcleaner.exe

# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\Users\Owner\AppData\Local\SwvUpdater

Folder Deleted : C:\Users\Owner\AppData\Roaming\goforfiles

File Deleted : C:\Windows\System32\Tasks\GoforFilesUpdate

***** [ Shortcuts ] *****

***** [ Registry ] *****

[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{96091409-455A-4A86-A2AC-2A1B2D3E0096}

[#] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{96091409-455A-4A86-A2AC-2A1B2D3E0096}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Key Deleted : HKCU\Software\GoforFiles

Key Deleted : HKLM\Software\GoforFiles

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16533

-\\ Mozilla Firefox v26.0 (en-US)

[ File : C:\Users\Owner\AppData\Roaming\Mozilla\Firefox\Profiles\wsw3ci8l.default\prefs.js ]

-\\ Google Chrome v33.0.1750.146

[ File : C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [1459 octets] - [05/03/2014 13:25:09]

AdwCleaner[s0].txt - [1430 octets] - [05/03/2014 13:26:16]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [1490 octets] ##########

Results of screen317's Security Check version 0.99.80

Windows Vista Service Pack 2 x86 (UAC is enabled)

Internet Explorer 9

Internet Explorer 8

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Enabled!

Microsoft Security Essentials

Antivirus up to date!

`````````Anti-malware/Other Utilities Check:`````````

MVPS Hosts File

Spybot - Search & Destroy

Malwarebytes Anti-Malware version 1.75.0.1300

Java 7 Update 51

Adobe Flash Player 12.0.0.70

Adobe Reader XI

Mozilla Firefox (26.0)

Google Chrome 33.0.1750.117

Google Chrome 33.0.1750.146

````````Process Check: objlist.exe by Laurent````````

Microsoft Security Essentials MSMpEng.exe

Microsoft Security Essentials msseces.exe

Malwarebytes Anti-Malware mbamservice.exe

Malwarebytes Anti-Malware mbamgui.exe

Spybot Teatimer.exe is disabled!

Malwarebytes' Anti-Malware mbamscheduler.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 6 % Defragment your hard drive soon! (Do NOT defrag if SSD!)

````````````````````End of Log``````````````````````

Psychotic · March 6, 2014

Your system is clean!

Uninstall our tools using delfix

Please follow these steps in order:

In the case we used Defogger to turn off your CD emulation software. You can start it again and use the Enable button.
In the case we used Combofix. Deactivate your antivirus software once more, then rename the combofix.exe to uninstall.exe and run it one last time. You shall be noted that Combofix has been removed.
In any case please download delfix to your desktop.
- Close all other programms and start delfix.
- Please check all the boxes and run the tool.
- delfix will now delete all found traces of our removal process

[*] If there is still something left please delete it manualy.

Recommendations: How to protect yourself

System Updates
Please ensure to have automatic updates activated in your control panel.
For further information and a tutorial, see this Microsoft Support article.
Protection
What you need is one (not more) virus scanner with background protection. Additionally I recommend a special malware scanner to run on demand weekly.
Personally I am using avast! Antivirus Free Edition and Malwarebytes Anti-Malware. They offer good protection for free.
- To keep your browser free of advertising, you may install the Adblock Plus browser extension.
  It will filter unwanted advertising out of the website´s content.
- To protect yourself from accidentally visiting malicious web sites, install the Web of Trust (WOT) browser extension.
  It will display a green (safe), yellow (unknown) or red (potentially dangerous) icon for a visited website within your browser.
  In addition, before accessing a dangerous classified web site, a warning screen is displayed.
[*]Up to date Software
Keep your Windows and your third party software up to date. The easiest way to get infected is an outdated windows, followed by: browser(s) (including add-ons and plug-ins), Adobe Flash Player and Adobe Reader, Java Runtime Environment, your antivirus program and so on. These links may help you to check:
- Secunia Personal Software Inspector - checks if your software has updates available.
- SecurityCheck (by screen317) - scans your computer for most vulnerable outdated software.
- Mozilla: Check your plugins - The webpage will tell you if you have outdated plugins running in your Firefox browser.
[*]Backup
Hardware issues, malware, fire, lightning strike: There is a long list of different ways to loose all your data. Back up your files regularly. Use the windows internal backup function or a third party tool and save your data onto an external hard drive, cloud storage, optical media like CDs or DVDs or (if available) a professional network backup system. [*]Behaviour
The commonest error when using a computer is "error 80" - what means that the error is located about 80cm in front of the monitor. This is a common joke between IT support technicians but it shows that all the safety mechanisms won´t help you if aren´t careful enough.
- While surfing the internet, don´t click on anything you don´t know. In the worst case, it infects your system with malware.
- Watch your step in social networks! Many cyber criminals use them to spread malware, mine personal pata (to be sold to advertising companies, for example) or simply do damage to other users. Even if a received hyperlink within a message seems to be coming from one of your friends, have a closer look. In addition, don´t click everything.
- When installing software, have a look to each of the setup windows and uncheck any additional toolbars or free programs that may be offered additionally. Most of today´s setup procedures contain potentially unwanted programs so keep them off your system.
- Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
  They are a security risk which can make your computer susceptible to a wide variety of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.

loveanddaisys · March 7, 2014

Actually it still comes up, not as often but it does. :/

Psychotic · March 7, 2014

Please add the protection log of Malwarebytes

loveanddaisys · March 7, 2014

2014/03/07 08:41:01 -0800 OWNER-PC (null) MESSAGE Executing scheduled update: Daily

2014/03/07 08:41:01 -0800 OWNER-PC (null) MESSAGE Starting protection

2014/03/07 08:41:01 -0800 OWNER-PC (null) MESSAGE Protection started successfully

2014/03/07 08:41:01 -0800 OWNER-PC (null) MESSAGE Starting IP protection

2014/03/07 08:41:07 -0800 OWNER-PC (null) MESSAGE IP Protection started successfully

2014/03/07 08:41:08 -0800 OWNER-PC (null) MESSAGE Starting database refresh

2014/03/07 08:41:08 -0800 OWNER-PC (null) MESSAGE Stopping IP protection

2014/03/07 08:41:08 -0800 OWNER-PC (null) MESSAGE IP Protection stopped successfully

2014/03/07 08:41:08 -0800 OWNER-PC (null) MESSAGE Scheduled update executed successfully: database updated from version v2014.03.02.04 to version v2014.03.07.06

2014/03/07 08:41:12 -0800 OWNER-PC (null) MESSAGE Database refreshed successfully

2014/03/07 08:41:12 -0800 OWNER-PC (null) MESSAGE Starting IP protection

2014/03/07 08:41:16 -0800 OWNER-PC (null) MESSAGE IP Protection started successfully

2014/03/07 08:44:01 -0800 OWNER-PC Owner IP-BLOCK 78.140.143.6 (Type: outgoing, Port: 49254, Process: chrome.exe)

Psychotic · March 8, 2014

Malwarebytes is doing its job and prevents chrome from opening advertising pop ups.

The blocked IP is a known malware server as you can see here: https://www.virustotal.com/en/ip-address/78.140.143.6/information/

Everything looks good!

loveanddaisys · March 9, 2014

thank you very much! You're a life saver dude!

Psychotic · March 10, 2014

You´re welcome!

Successfully blocked access keeps popping up w/o browser

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information