Help! Play Now Radio malware

petalxrain · February 28, 2014

Hi,

I am using a firefox browser and I recently downloaded a file without knowing that something called "Play Now Radio" was attached to it. Every time I surf the internet, I get unwanted ads that pop up. I've already blocked popups from the "Options" tab as well installed a firefox addon called "Adblock", however these have no effect on the ads. My anti-virus, Bitdefender, was unable to detect Play Now Radio and I've searched for many ways to get rid of this, but to no success. I've also tried Hitman Pro, but it didn't detect it either.

Any help would be greatly appreciated.

gringo_pr · February 28, 2014

Hello petalxrain

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

I would like you to run this program for me.

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Gringo

petalxrain · March 1, 2014

Hi Gringo,

I've ran the tool and the FRST.txt I got was:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-02-2014 02
Ran by Debbie (administrator) on DEBBIE-PC on 28-02-2014 22:21:06
Running from C:\Users\Debbie\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Bitdefender) C:\Program Files\Bitdefender\Bitdefender\vsserv.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe
() C:\Program Files\Level Quality Watcher\v1.01\levelqualitywatcher64.exe
() c:\Program Files\SavingsbullFilter\SavingsbullFilterService64.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender\updatesrv.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.3.0\ToolbarUpdater.exe
() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.3.0\loggingserver.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender\bdagent.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(ScanSoft, Inc.) C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\opwareSE2.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\17.3.0\ScriptHelper.exe
() C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_70.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_70.exe
(Pay By Ads LTD) C:\Users\Debbie\AppData\Roaming\playnowradio\playnowradio\1.3.4.8\playnowradio.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-10] (Realtek Semiconductor)
HKLM\...\Run: [bdagent] - C:\Program Files\Bitdefender\Bitdefender\bdagent.exe [1739480 2014-02-25] (Bitdefender)
HKLM\...\Run: [] - [X]
HKLM\...\Run: [AdAwareTray] - C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe [4114264 2014-01-23] ()
HKLM-x32\...\Run: [iAStorIcon] - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [277504 2012-08-16] (Intel Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [sunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [OpwareSE2] - C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\OpwareSE2.exe [49152 2003-05-08] (ScanSoft, Inc.)
HKLM-x32\...\Run: [OPSE reminder] - C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe [729088 2003-07-07] (ScanSoft, Inc.)
HKLM-x32\...\Run: [vProt] - C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe [2552856 2014-02-28] ()
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\.DEFAULT\...\Run: [bitdefender Wallet Agent] - C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe [567888 2014-02-06] (Bitdefender)
HKU\.DEFAULT\...\Run: [bitdefender Wallet] - C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe [1001536 2014-02-06] (Bitdefender)
HKU\.DEFAULT\...\Run: [bitdefender Wallet Application Agent] - C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe [614232 2014-02-06] (Bitdefender)
HKU\S-1-5-21-4039069230-3056711612-840082808-1001\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)
HKU\S-1-5-21-4039069230-3056711612-840082808-1001\...\Run: [bitdefender Wallet Agent] - C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe [567888 2014-02-06] (Bitdefender)
HKU\S-1-5-21-4039069230-3056711612-840082808-1001\...\Run: [bitdefender Wallet] - C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe [1001536 2014-02-06] (Bitdefender)
HKU\S-1-5-21-4039069230-3056711612-840082808-1001\...\Run: [bitdefender Wallet Application Agent] - C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe [614232 2014-02-06] (Bitdefender)
HKU\S-1-5-21-4039069230-3056711612-840082808-1001\...\MountPoints2: {a2817b93-6d9b-11e3-b21e-902b349b6304} - E:\disk.exe
Startup: C:\Users\Debbie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.ca/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.memoryexpress.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ca.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x16738258BD13CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-CA
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://search.conduit.com/Results.aspx?ctid=CT3320218&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP4B3B4237-8D05-4D45-91F5-6AFFFF191450&q={searchTerms}&SSPV=
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://search.conduit.com/Results.aspx?ctid=CT3320218&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP4B3B4237-8D05-4D45-91F5-6AFFFF191450&q={searchTerms}&SSPV=
SearchScopes: HKCU - {6D338532-16F0-4B22-9D6B-7871AF4F7E46} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3291326&CUI=UN88699182031022317&UM=2
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://mysearch.avg.com/search?cid={C6CC89AA-A44D-4BE6-A44B-CDE5272BD7DE}&mid=c96daefbb1b047d3ace74162727f8af7-fafc50c6feb82824f0c71546275a9aa30acaeb06〈=en&ds=re011&coid=avgtbdisre&cmpid=&pr=sa&d=2014-02-27 21:13:57&v=17.3.1.91&pid=safeguard&sg=&sap=dsp&q={searchTerms}
BHO: Bitdefender Wallet - {09F58E74-42B4-4D70-BA26-35FC954E7A17} - C:\Program Files\Bitdefender\Bitdefender\pmbxie.dll (Bitdefender)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: IEOptimizer - {10AD2C61-0898-4348-8600-14A342F22AC3} - C:\Program Files (x86)\SavingsBull\IEOptimizer.dll ()
BHO-x32: Bitdefender Wallet - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender\Antispam32\pmbxie.dll (Bitdefender)
BHO-x32: AVG SafeGuard toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG SafeGuard toolbar\17.3.1.91\AVG SafeGuard toolbar_toolbar.dll (AVG Secure Search)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM-x32 - AVG SafeGuard toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG SafeGuard toolbar\17.3.1.91\AVG SafeGuard toolbar_toolbar.dll (AVG Secure Search)
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\17.3.0\ViProtocol.dll (AVG Secure Search)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 75.153.176.1

FireFox:
========
FF ProfilePath: C:\Users\Debbie\AppData\Roaming\Mozilla\Firefox\Profiles\kg4tqr1a.default
FF user.js: detected! => C:\Users\Debbie\AppData\Roaming\Mozilla\Firefox\Profiles\kg4tqr1a.default\user.js
FF Homepage: google.ca
FF Keyword.URL: user_pref("keyword.URL", "");
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1209149.dll (Adobe Systems, Inc.)
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\17.3.0\\npsitesafety.dll (AVG Technologies)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.21.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml
FF Extension: SavingsBull - C:\Users\Debbie\AppData\Roaming\Mozilla\Firefox\Profiles\kg4tqr1a.default\Extensions\SavingsBull@jetpack [2014-02-27]
FF Extension: DownloadHelper - C:\Users\Debbie\AppData\Roaming\Mozilla\Firefox\Profiles\kg4tqr1a.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-08-26]
FF Extension: NoSquint - C:\Users\Debbie\AppData\Roaming\Mozilla\Firefox\Profiles\kg4tqr1a.default\Extensions\nosquint@urandom.ca.xpi [2013-02-25]
FF Extension: Adblock Plus - C:\Users\Debbie\AppData\Roaming\Mozilla\Firefox\Profiles\kg4tqr1a.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-02-25]
FF HKLM-x32\...\Firefox\Extensions: [ffpwdman@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender\Antispam32\ffpwdman\
FF Extension: Bitdefender Wallet - C:\Program Files\Bitdefender\Bitdefender\Antispam32\ffpwdman\ []
FF HKLM-x32\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG SafeGuard toolbar\FireFoxExt\17.3.1.91
FF Extension: AVG SafeGuard toolbar - C:\ProgramData\AVG SafeGuard toolbar\FireFoxExt\17.3.1.91 [2014-02-27]

==================== Services (Whitelisted) =================

R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [702744 2014-01-23] ()
R2 Level Quality Watcher; C:\Program Files\Level Quality Watcher\v1.01\levelqualitywatcher64.exe [710976 2014-01-27] ()
R2 SavingsbullFilterService64; c:\Program Files\SavingsbullFilter\SavingsbullFilterService64.exe [210432 2014-02-12] ()
R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender\updatesrv.exe [67320 2014-01-01] (Bitdefender)
R2 VSSERV; C:\Program Files\Bitdefender\Bitdefender\vsserv.exe [1507248 2014-02-25] (Bitdefender)
R2 vToolbarUpdater17.3.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.3.0\ToolbarUpdater.exe [1772056 2014-02-27] (AVG Secure Search)

==================== Drivers (Whitelisted) ====================

R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [893440 2014-01-27] (BitDefender)
R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-11-02] (BitDefender)
R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [635392 2014-01-27] (BitDefender)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [46368 2014-02-27] (AVG Technologies)
R1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC)
S3 BDSandBox; C:\Windows\system32\drivers\bdsandbox.sys [82824 2014-01-01] (BitDefender SRL)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-25] (Disc Soft Ltd)
R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [150256 2013-08-23] (BitDefender LLC)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [27456 2012-08-16] (Intel Corporation)
R1 Netfilter64; C:\Windows\System32\drivers\Netfilter64.sys [61592 2013-12-17] (NetFilterSDK.com)
R3 trufos; C:\Windows\System32\DRIVERS\trufos.sys [329800 2013-07-17] (BitDefender S.R.L.)
S3 gdrv; \??\C:\Windows\gdrv.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-02-28 22:17 - 2014-02-28 22:17 - 00001340 _____ () C:\Users\Debbie\Desktop\Play Now Radio.lnk
2014-02-28 22:14 - 2014-02-28 22:16 - 00035379 _____ () C:\Users\Debbie\Desktop\Addition.txt
2014-02-28 22:13 - 2014-02-28 22:21 - 00015298 _____ () C:\Users\Debbie\Desktop\FRST.txt
2014-02-28 22:13 - 2014-02-28 22:21 - 00000000 ____D () C:\FRST
2014-02-28 22:13 - 2014-02-28 22:13 - 02155520 _____ (Farbar) C:\Users\Debbie\Desktop\FRST64.exe
2014-02-27 22:39 - 2014-02-27 22:39 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\LavasoftStatistics
2014-02-27 22:27 - 2014-02-28 22:11 - 00002312 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-02-27 22:26 - 2014-02-27 22:26 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-02-27 22:26 - 2014-02-27 22:26 - 00000000 ____D () C:\Program Files\Lavasoft
2014-02-27 22:26 - 2014-02-27 22:26 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-02-27 21:14 - 2014-02-27 21:14 - 00000000 ____D () C:\Users\Debbie\AppData\Local\AVG SafeGuard toolbar
2014-02-27 21:14 - 2014-02-27 21:14 - 00000000 ____D () C:\ProgramData\CDB
2014-02-27 21:13 - 2014-02-28 22:11 - 00000000 ____D () C:\Program Files (x86)\AVG SafeGuard toolbar
2014-02-27 21:13 - 2014-02-27 21:18 - 00000000 ____D () C:\ProgramData\AVG SafeGuard toolbar
2014-02-27 21:13 - 2014-02-27 21:14 - 00003747 _____ () C:\Program Files (x86)\Mozilla Firefoxsafeguard-secure-search.xml
2014-02-27 21:13 - 2014-02-27 21:13 - 00046368 _____ (AVG Technologies) C:\Windows\system32\Drivers\avgtpx64.sys
2014-02-27 21:12 - 2014-02-27 21:14 - 00000119 _____ () C:\Windows\Reimage.ini
2014-02-27 21:06 - 2014-02-27 21:06 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
2014-02-27 20:58 - 2014-02-27 20:59 - 10820032 _____ (SurfRight B.V.) C:\Users\Debbie\Desktop\HitmanPro_x64.exe
2014-02-27 20:55 - 2014-02-27 20:55 - 00001154 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-02-27 20:55 - 2014-02-27 20:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-27 12:18 - 2014-02-27 12:20 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin
2014-02-27 11:47 - 2014-02-27 11:47 - 00000000 ____D () C:\Program Files\SavingsbullFilter
2014-02-27 10:23 - 2014-02-27 10:23 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\Malwarebytes
2014-02-27 10:22 - 2014-02-27 10:22 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-27 10:08 - 2014-02-27 10:08 - 00000000 ____D () C:\ProgramData\GridinSoft
2014-02-27 09:36 - 2014-02-27 09:37 - 00000260 _____ () C:\Windows\setup.iss
2014-02-27 09:36 - 2014-02-27 09:36 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\NewSoft
2014-02-26 16:59 - 2014-02-26 18:58 - 218358213 _____ () C:\Users\Debbie\Desktop\eksrny.rar
2014-02-25 22:27 - 2014-02-25 22:27 - 00003626 _____ () C:\Windows\System32\Tasks\$dMM6KqyKu+JyN+{$
2014-02-25 22:27 - 2014-02-25 22:27 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\playnowradio
2014-02-25 22:04 - 2014-02-28 22:20 - 09572437 _____ () C:\Windows\system32\SavingsBullFilterService.log
2014-02-25 22:04 - 2014-02-25 22:04 - 00000000 _____ () C:\Windows\SysWOW64\Service.log
2014-02-25 22:04 - 2014-02-25 22:04 - 00000000 _____ () C:\Windows\system32\Service.log
2014-02-25 22:03 - 2014-02-27 11:47 - 00000000 ____D () C:\Program Files (x86)\SavingsBull
2014-02-25 22:03 - 2014-02-25 22:03 - 00000000 ____D () C:\Program Files\Level Quality Watcher
2014-02-25 22:00 - 2014-02-25 22:01 - 00000000 ____D () C:\Program Files (x86)\freestar
2014-02-22 16:49 - 2014-02-22 16:49 - 00000222 _____ () C:\Users\Debbie\Desktop\Thief Gold.url
2014-02-22 16:49 - 2014-02-22 16:49 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-02-22 16:44 - 2014-02-23 11:54 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-22 16:44 - 2014-02-22 16:44 - 00000970 _____ () C:\Users\Public\Desktop\Steam.lnk
2014-02-21 22:19 - 2014-02-21 22:19 - 00476043 _____ () C:\Users\Debbie\Desktop\Ignite Me - Tahereh Mafi.epub
2014-02-16 15:25 - 2014-02-16 15:25 - 00000000 ____D () C:\Windows\SysWOW64\Adobe
2014-02-14 11:33 - 2014-02-27 21:14 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-13 19:09 - 2014-02-13 19:28 - 00000000 ____D () C:\Users\Debbie\Documents\Harry Potter
2014-02-13 19:08 - 2014-02-22 17:26 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-02-13 19:08 - 2014-02-13 19:08 - 00000507 _____ () C:\Windows\eReg.dat
2014-02-12 07:40 - 2014-02-06 04:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-12 07:40 - 2014-02-06 03:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-12 07:40 - 2014-02-06 03:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-12 07:40 - 2014-02-06 03:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-12 07:40 - 2014-02-06 03:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-12 07:40 - 2014-02-06 03:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-12 07:40 - 2014-02-06 02:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-12 07:40 - 2014-02-06 02:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-12 07:40 - 2014-02-06 02:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-12 07:40 - 2014-02-06 02:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-12 07:40 - 2014-02-06 02:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-12 07:40 - 2014-02-06 02:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-12 07:40 - 2014-02-06 02:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-12 07:40 - 2014-02-06 02:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-12 07:40 - 2014-02-06 02:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-12 07:40 - 2014-02-06 02:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-12 07:40 - 2014-02-06 02:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-12 07:40 - 2014-02-06 01:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-12 07:40 - 2014-02-06 01:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-12 07:40 - 2014-02-06 01:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-12 07:40 - 2014-02-06 01:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-12 07:40 - 2014-02-06 01:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-12 07:40 - 2014-02-06 01:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-12 07:40 - 2014-02-06 01:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-12 07:40 - 2014-02-06 01:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-12 07:40 - 2014-02-06 01:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-12 07:40 - 2014-02-06 01:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-12 07:40 - 2014-02-06 01:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-12 07:40 - 2014-02-06 01:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-12 07:40 - 2014-02-06 01:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-12 07:40 - 2014-02-06 01:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-12 07:40 - 2014-02-06 00:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-12 07:40 - 2014-02-06 00:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-12 07:40 - 2014-02-06 00:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-12 07:40 - 2014-02-06 00:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-12 07:40 - 2014-02-06 00:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-12 07:40 - 2013-12-21 01:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-12 07:40 - 2013-12-21 00:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-12 07:39 - 2014-02-06 02:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-12 07:39 - 2014-02-06 02:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-12 07:39 - 2014-02-06 01:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-12 07:27 - 2013-12-31 15:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-12 07:27 - 2013-12-31 15:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-12 07:27 - 2013-12-05 18:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-12 07:27 - 2013-12-05 18:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-12 07:27 - 2013-12-05 18:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-12 07:27 - 2013-12-05 18:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-12 07:27 - 2013-12-03 18:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-12 07:27 - 2013-12-03 18:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-12 07:27 - 2013-12-03 18:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-12 07:27 - 2013-12-03 18:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-12 07:27 - 2013-12-03 18:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-12 07:27 - 2013-12-03 18:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-12 07:27 - 2013-12-03 18:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-12 07:27 - 2013-12-03 18:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-12 07:27 - 2013-12-03 18:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-12 07:27 - 2013-12-03 18:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-12 07:27 - 2013-12-03 18:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-12 07:27 - 2013-12-03 18:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-12 07:27 - 2013-12-03 18:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-12 07:27 - 2013-12-03 18:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-12 07:27 - 2013-12-03 17:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-12 07:27 - 2013-12-03 17:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-12 07:27 - 2013-12-03 17:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-12 07:27 - 2013-12-03 17:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-12 07:26 - 2013-12-24 15:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-12 07:26 - 2013-12-24 14:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-12 07:26 - 2013-11-26 00:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-12 07:26 - 2013-11-22 14:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-02-03 21:38 - 2014-02-03 21:38 - 00000000 ___SD () C:\Users\Debbie\Documents\My Data Sources

==================== One Month Modified Files and Folders =======

2014-02-28 22:21 - 2014-02-28 22:13 - 00015298 _____ () C:\Users\Debbie\Desktop\FRST.txt
2014-02-28 22:21 - 2014-02-28 22:13 - 00000000 ____D () C:\FRST
2014-02-28 22:20 - 2014-02-25 22:04 - 09572437 _____ () C:\Windows\system32\SavingsBullFilterService.log
2014-02-28 22:18 - 2013-02-21 14:31 - 01496683 _____ () C:\Windows\WindowsUpdate.log
2014-02-28 22:18 - 2009-07-13 20:45 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-28 22:18 - 2009-07-13 20:45 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-28 22:17 - 2014-02-28 22:17 - 00001340 _____ () C:\Users\Debbie\Desktop\Play Now Radio.lnk
2014-02-28 22:16 - 2014-02-28 22:14 - 00035379 _____ () C:\Users\Debbie\Desktop\Addition.txt
2014-02-28 22:16 - 2009-07-13 21:13 - 00784326 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-28 22:13 - 2014-02-28 22:13 - 02155520 _____ (Farbar) C:\Users\Debbie\Desktop\FRST64.exe
2014-02-28 22:11 - 2014-02-27 22:27 - 00002312 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-02-28 22:11 - 2014-02-27 21:13 - 00000000 ____D () C:\Program Files (x86)\AVG SafeGuard toolbar
2014-02-28 22:10 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-28 22:10 - 2009-07-13 20:51 - 00090588 _____ () C:\Windows\setupact.log
2014-02-27 22:39 - 2014-02-27 22:39 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\LavasoftStatistics
2014-02-27 22:26 - 2014-02-27 22:26 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-02-27 22:26 - 2014-02-27 22:26 - 00000000 ____D () C:\Program Files\Lavasoft
2014-02-27 22:26 - 2014-02-27 22:26 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-02-27 21:55 - 2013-02-25 20:14 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-27 21:18 - 2014-02-27 21:13 - 00000000 ____D () C:\ProgramData\AVG SafeGuard toolbar
2014-02-27 21:14 - 2014-02-27 21:14 - 00000000 ____D () C:\Users\Debbie\AppData\Local\AVG SafeGuard toolbar
2014-02-27 21:14 - 2014-02-27 21:14 - 00000000 ____D () C:\ProgramData\CDB
2014-02-27 21:14 - 2014-02-27 21:13 - 00003747 _____ () C:\Program Files (x86)\Mozilla Firefoxsafeguard-secure-search.xml
2014-02-27 21:14 - 2014-02-27 21:12 - 00000119 _____ () C:\Windows\Reimage.ini
2014-02-27 21:14 - 2014-02-14 11:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-27 21:13 - 2014-02-27 21:13 - 00046368 _____ (AVG Technologies) C:\Windows\system32\Drivers\avgtpx64.sys
2014-02-27 21:06 - 2014-02-27 21:06 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
2014-02-27 21:06 - 2014-01-18 17:58 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-02-27 20:59 - 2014-02-27 20:58 - 10820032 _____ (SurfRight B.V.) C:\Users\Debbie\Desktop\HitmanPro_x64.exe
2014-02-27 20:55 - 2014-02-27 20:55 - 00001154 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-02-27 20:55 - 2014-02-27 20:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-27 20:52 - 2010-11-20 19:47 - 00293330 _____ () C:\Windows\PFRO.log
2014-02-27 19:42 - 2009-07-13 20:45 - 00374184 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-02-27 12:20 - 2014-02-27 12:18 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin
2014-02-27 11:47 - 2014-02-27 11:47 - 00000000 ____D () C:\Program Files\SavingsbullFilter
2014-02-27 11:47 - 2014-02-25 22:03 - 00000000 ____D () C:\Program Files (x86)\SavingsBull
2014-02-27 10:23 - 2014-02-27 10:23 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\Malwarebytes
2014-02-27 10:22 - 2014-02-27 10:22 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-27 10:08 - 2014-02-27 10:08 - 00000000 ____D () C:\ProgramData\GridinSoft
2014-02-27 09:37 - 2014-02-27 09:36 - 00000260 _____ () C:\Windows\setup.iss
2014-02-27 09:37 - 2013-02-21 15:54 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-02-27 09:36 - 2014-02-27 09:36 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\NewSoft
2014-02-26 18:58 - 2014-02-26 16:59 - 218358213 _____ () C:\Users\Debbie\Desktop\eksrny.rar
2014-02-26 17:45 - 2013-02-25 17:00 - 00000000 ___RD () C:\Users\Debbie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-26 07:35 - 2013-02-21 14:28 - 00768192 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-25 22:27 - 2014-02-25 22:27 - 00003626 _____ () C:\Windows\System32\Tasks\$dMM6KqyKu+JyN+{$
2014-02-25 22:27 - 2014-02-25 22:27 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\playnowradio
2014-02-25 22:04 - 2014-02-25 22:04 - 00000000 _____ () C:\Windows\SysWOW64\Service.log
2014-02-25 22:04 - 2014-02-25 22:04 - 00000000 _____ () C:\Windows\system32\Service.log
2014-02-25 22:03 - 2014-02-25 22:03 - 00000000 ____D () C:\Program Files\Level Quality Watcher
2014-02-25 22:01 - 2014-02-25 22:00 - 00000000 ____D () C:\Program Files (x86)\freestar
2014-02-25 22:01 - 2013-02-25 17:00 - 00000000 ____D () C:\Users\Debbie
2014-02-23 21:38 - 2013-03-16 22:07 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\vlc
2014-02-23 11:54 - 2014-02-22 16:44 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-22 21:12 - 2013-06-27 21:06 - 00000000 ____D () C:\Users\Debbie\Documents\Resumes and Cover Letters
2014-02-22 17:26 - 2014-02-13 19:08 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-02-22 16:49 - 2014-02-22 16:49 - 00000222 _____ () C:\Users\Debbie\Desktop\Thief Gold.url
2014-02-22 16:49 - 2014-02-22 16:49 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-02-22 16:44 - 2014-02-22 16:44 - 00000970 _____ () C:\Users\Public\Desktop\Steam.lnk
2014-02-21 22:19 - 2014-02-21 22:19 - 00476043 _____ () C:\Users\Debbie\Desktop\Ignite Me - Tahereh Mafi.epub
2014-02-20 19:55 - 2013-02-25 20:14 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-20 19:55 - 2013-02-25 20:13 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-20 19:55 - 2013-02-25 20:13 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-16 15:27 - 2013-02-25 20:13 - 00000000 ____D () C:\Windows\SysWOW64\Macromed
2014-02-16 15:25 - 2014-02-16 15:25 - 00000000 ____D () C:\Windows\SysWOW64\Adobe
2014-02-15 09:48 - 2013-02-27 20:12 - 00000000 ____D () C:\Users\Debbie\Desktop\Beatricemon
2014-02-14 21:03 - 2013-08-14 12:56 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-14 21:02 - 2013-02-21 16:52 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-13 19:28 - 2014-02-13 19:09 - 00000000 ____D () C:\Users\Debbie\Documents\Harry Potter
2014-02-13 19:08 - 2014-02-13 19:08 - 00000507 _____ () C:\Windows\eReg.dat
2014-02-12 18:51 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\rescache
2014-02-12 07:47 - 2013-02-26 14:41 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-02-06 04:16 - 2014-02-12 07:40 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-06 03:30 - 2014-02-12 07:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-06 03:30 - 2014-02-12 07:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-06 03:12 - 2014-02-12 07:40 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-06 03:07 - 2014-02-12 07:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-06 03:06 - 2014-02-12 07:40 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-06 02:57 - 2014-02-12 07:40 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-06 02:56 - 2014-02-12 07:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-06 02:52 - 2014-02-12 07:40 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-06 02:49 - 2014-02-12 07:40 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-06 02:48 - 2014-02-12 07:40 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-06 02:48 - 2014-02-12 07:40 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-06 02:38 - 2014-02-12 07:39 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-06 02:32 - 2014-02-12 07:40 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-06 02:20 - 2014-02-12 07:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-06 02:17 - 2014-02-12 07:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-06 02:11 - 2014-02-12 07:39 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-06 02:01 - 2014-02-12 07:40 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-06 02:00 - 2014-02-12 07:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-06 01:57 - 2014-02-12 07:40 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-06 01:57 - 2014-02-12 07:40 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-06 01:52 - 2014-02-12 07:40 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-06 01:52 - 2014-02-12 07:40 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-06 01:50 - 2014-02-12 07:40 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-06 01:49 - 2014-02-12 07:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-06 01:47 - 2014-02-12 07:40 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-06 01:46 - 2014-02-12 07:40 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-06 01:25 - 2014-02-12 07:40 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-06 01:25 - 2014-02-12 07:39 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-06 01:24 - 2014-02-12 07:40 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-06 01:22 - 2014-02-12 07:40 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-06 01:13 - 2014-02-12 07:40 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-06 01:09 - 2014-02-12 07:40 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-06 01:03 - 2014-02-12 07:40 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-06 00:55 - 2014-02-12 07:40 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-06 00:41 - 2014-02-12 07:40 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-06 00:40 - 2014-02-12 07:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-06 00:36 - 2014-02-12 07:40 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-06 00:34 - 2014-02-12 07:40 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-03 21:38 - 2014-02-03 21:38 - 00000000 ___SD () C:\Users\Debbie\Documents\My Data Sources

Some content of TEMP:
====================
C:\Users\Debbie\AppData\Local\Temp\-6xahoqj.dll
C:\Users\Debbie\AppData\Local\Temp\BackupSetup.exe
C:\Users\Debbie\AppData\Local\Temp\bitool.dll
C:\Users\Debbie\AppData\Local\Temp\firefoxjre_exe-1.exe
C:\Users\Debbie\AppData\Local\Temp\firefoxjre_exe.exe
C:\Users\Debbie\AppData\Local\Temp\HitmanPro.exe
C:\Users\Debbie\AppData\Local\Temp\htmlayout.dll
C:\Users\Debbie\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Debbie\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Debbie\AppData\Local\Temp\mconduitinstaller.exe
C:\Users\Debbie\AppData\Local\Temp\NEventMessages.dll
C:\Users\Debbie\AppData\Local\Temp\nsa61B.exe
C:\Users\Debbie\AppData\Local\Temp\nsaF1AC.exe
C:\Users\Debbie\AppData\Local\Temp\nsfD8CA.exe
C:\Users\Debbie\AppData\Local\Temp\nsk6A01.exe
C:\Users\Debbie\AppData\Local\Temp\nsk91A0.exe
C:\Users\Debbie\AppData\Local\Temp\nskE25E.exe
C:\Users\Debbie\AppData\Local\Temp\nsr827F.exe
C:\Users\Debbie\AppData\Local\Temp\nsu474.exe
C:\Users\Debbie\AppData\Local\Temp\nsuF361.exe
C:\Users\Debbie\AppData\Local\Temp\oi_{27A7AE8A-2898-4178-8AAD-1D223E0CDE36}.exe
C:\Users\Debbie\AppData\Local\Temp\ose00000.exe
C:\Users\Debbie\AppData\Local\Temp\playnowradio.exe
C:\Users\Debbie\AppData\Local\Temp\qc_a402013b_7656_4f6f_b57f_5a8ef69f5fc4_32.exe
C:\Users\Debbie\AppData\Local\Temp\Quarantine.exe
C:\Users\Debbie\AppData\Local\Temp\ReimagePackage.exe
C:\Users\Debbie\AppData\Local\Temp\SecondStepInstaller.exe
C:\Users\Debbie\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Debbie\AppData\Local\Temp\SPStub.exe
C:\Users\Debbie\AppData\Local\Temp\vcredist_x64.exe
C:\Users\Debbie\AppData\Local\Temp\WrapperSoftonicOmgSearchProtect.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2014-02-18 20:46

==================== End Of Log ============================

The Addition.txt is attached.

Addition.txt

petalxrain · March 2, 2014

Hi Gringo,

I ran the two programs and received the following logs:

AdwCleaner[s1].txt:

# AdwCleaner v3.020 - Report created 02/03/2014 at 12:17:12
# Updated 27/02/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Debbie - DEBBIE-PC
# Running from : C:\Users\Debbie\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****

Service Deleted : Level Quality Watcher

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\AVG SafeGuard toolbar
Folder Deleted : C:\ProgramData\AVG Secure Search
Folder Deleted : C:\Program Files (x86)\AVG SafeGuard toolbar
Folder Deleted : C:\Program Files (x86)\Common Files\AVG Secure Search
Folder Deleted : C:\Windows\SysWOW64\AI_RecycleBin
Folder Deleted : C:\Program Files\Level Quality Watcher
Folder Deleted : C:\Users\Debbie\AppData\Local\AVG SafeGuard toolbar
Folder Deleted : C:\Users\Debbie\AppData\LocalLow\AVG SafeGuard toolbar
Folder Deleted : C:\Users\Debbie\AppData\Roaming\playnowradio
File Deleted : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\safeguard-secure-search.xml
File Deleted : C:\Users\Debbie\AppData\Roaming\Mozilla\Firefox\Profiles\kg4tqr1a.default\user.js

***** [ Shortcuts ] *****

***** [ Registry ] *****

Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\conduit.com
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.BrowserWndAPI
Key Deleted : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.BrowserWndAPI.1
Key Deleted : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.PugiObj
Key Deleted : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.PugiObj.1
Key Deleted : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
Key Deleted : HKLM\SOFTWARE\Classes\S
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{10AD2C61-0898-4348-8600-14A342F22AC3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10AD2C61-0898-4348-8600-14A342F22AC3}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{10AD2C61-0898-4348-8600-14A342F22AC3}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{10AD2C61-0898-4348-8600-14A342F22AC3}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\1ClickDownload
Key Deleted : HKCU\Software\AVG SafeGuard toolbar
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\Software\AVG SafeGuard toolbar
Key Deleted : HKLM\Software\AVG Security Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG SafeGuard toolbar

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16518

-\\ Mozilla Firefox v27.0.1 (en-US)

[ File : C:\Users\Debbie\AppData\Roaming\Mozilla\Firefox\Profiles\kg4tqr1a.default\prefs.js ]

Line Deleted : user_pref("avg.userPreferences.URLBarFocus.whiteList", "bing\\.com|google\\.\\w+|yahoo\\.\\w+|gmail\\.\\w+|hotmail\\.\\w+|live\\.\\w+|isearch\\.avg\\.com|mysearch\\.avg\\.com");

*************************

AdwCleaner[R0].txt - [7918 octets] - [14/01/2014 20:51:38]
AdwCleaner[R1].txt - [7172 octets] - [02/03/2014 12:04:06]
AdwCleaner[s0].txt - [8003 octets] - [14/01/2014 22:08:58]
AdwCleaner[s1].txt - [6862 octets] - [02/03/2014 12:17:12]

########## EOF - C:\AdwCleaner\AdwCleaner[s1].txt - [6922 octets] ##########

JRT.txt:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows 7 Home Premium x64
Ran by Debbie on 02/03/2014 at 12:23:25.96
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\adawarebp
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{6D338532-16F0-4B22-9D6B-7871AF4F7E46}

~~~ Files

~~~ Folders

~~~ FireFox

Successfully deleted the following from C:\Users\Debbie\AppData\Roaming\mozilla\firefox\profiles\kg4tqr1a.default\prefs.js

Emptied folder: C:\Users\Debbie\AppData\Roaming\mozilla\firefox\profiles\kg4tqr1a.default\minidumps [372 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 02/03/2014 at 12:29:01.41
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I browsed for about an hour after running the two tests and I don't see the popup ads that used to come every 5-10 pages. My default home page (originally google) changed to AVG search, but other than that, there aren't any problems. I'm not sure if everything has been resolved, but it looks like it because there are no remaining symptoms that I can see. If that is the case, thank you so much for helping me with this really annoying problem!

gringo_pr · March 3, 2014

Hello petalxrain

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

petalxrain · March 4, 2014

Hi Gringo,

I ran the combofix program and received this log:

ComboFix 14-03-03.02 - Debbie 03/03/2014 22:07:36.2.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.8086.5597 [GMT -8:00]
Running from: c:\users\Debbie\Desktop\ComboFix.exe
AV: Ad-Aware Antivirus *Disabled/Outdated* {D87B6541-12A1-DAEA-0033-9B8057AAB996}
AV: Bitdefender Antivirus *Disabled/Updated* {9A0813D8-CED6-F86B-072E-28D2AF25A83D}
FW: Ad-Aware Firewall *Disabled* {E040E464-58CE-DBB2-2B6C-32B5A979FEED}
SP: Ad-Aware Antivirus *Disabled/Outdated* {631A84A5-349B-D564-3A83-A0F22C2DF32B}
SP: Bitdefender Antispyware *Disabled/Updated* {2169F23C-E8EC-F7E5-3D9E-13A0D4A2E280}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((   Files Created from 2014-02-04 to 2014-03-04 )))))))))))))))))))))))))))))))
.
.
2014-03-04 06:12 . 2014-03-04 06:12   --------   d-----w-   c:\users\Default\AppData\Local\temp
2014-03-02 20:23 . 2014-03-02 20:23   --------   d-----w-   c:\windows\ERUNT
2014-03-01 06:13 . 2014-03-01 06:22   --------   d-----w-   C:\FRST
2014-02-28 06:39 . 2014-02-28 06:39   --------   d-----w-   c:\users\Debbie\AppData\Roaming\LavasoftStatistics
2014-02-28 06:26 . 2014-02-28 06:26   --------   d-----w-   c:\program files\Lavasoft
2014-02-28 06:26 . 2014-02-28 06:26   --------   d-----w-   c:\program files\Common Files\Lavasoft
2014-02-28 06:26 . 2014-02-28 06:26   --------   d-----w-   c:\programdata\Lavasoft
2014-02-28 05:14 . 2014-02-28 05:14   --------   d-----w-   c:\programdata\CDB
2014-02-28 05:13 . 2014-03-02 18:25   50976   ----a-w-   c:\windows\system32\drivers\avgtpx64.sys
2014-02-28 05:06 . 2014-02-28 05:06   12872   ----a-w-   c:\windows\system32\bootdelete.exe
2014-02-28 04:55 . 2014-02-28 04:55   --------   d-----w-   c:\program files (x86)\Mozilla Maintenance Service
2014-02-27 19:47 . 2014-02-27 19:47   --------   d-----w-   c:\program files\SavingsbullFilter
2014-02-27 18:23 . 2014-02-27 18:23   --------   d-----w-   c:\users\Debbie\AppData\Roaming\Malwarebytes
2014-02-27 18:22 . 2014-02-27 18:22   --------   d-----w-   c:\programdata\Malwarebytes
2014-02-27 18:08 . 2014-02-27 18:08   --------   d-----w-   c:\programdata\GridinSoft
2014-02-27 17:36 . 2014-02-27 17:36   --------   d-----w-   c:\users\Debbie\AppData\Roaming\NewSoft
2014-02-26 06:03 . 2014-02-27 19:47   --------   d-----w-   c:\program files (x86)\SavingsBull
2014-02-26 06:03 . 2014-02-26 06:04   --------   d-----w-   C:\temp
2014-02-26 06:00 . 2014-02-26 06:00   --------   d-----w-   c:\users\Debbie\AppData\Local\Programs
2014-02-26 06:00 . 2014-02-26 06:01   --------   d-----w-   c:\program files (x86)\freestar
2014-02-25 14:36 . 2014-02-25 14:36   --------   d-----w-   c:\windows\Migration
2014-02-23 00:44 . 2014-02-23 19:54   --------   d-----w-   c:\program files (x86)\Common Files\Steam
2014-02-23 00:44 . 2014-02-23 19:54   --------   d-----w-   c:\program files (x86)\Steam
2014-02-16 23:25 . 2014-02-16 23:25   --------   d-----w-   c:\windows\SysWow64\Adobe
2014-02-14 03:02 . 2000-01-04 14:39   212992   ----a-w-   c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\ILog.dll
2014-02-12 15:39 . 2014-02-06 10:11   5768704   ----a-w-   c:\windows\system32\jscript9.dll
2014-02-12 15:39 . 2014-02-06 09:25   4244480   ----a-w-   c:\windows\SysWow64\jscript9.dll
2014-02-12 15:26 . 2013-12-24 23:09   1987584   ----a-w-   c:\windows\SysWow64\d3d10warp.dll
2014-02-12 15:26 . 2013-12-24 22:48   2565120   ----a-w-   c:\windows\system32\d3d10warp.dll
2014-02-12 15:26 . 2013-11-26 08:16   3419136   ----a-w-   c:\windows\SysWow64\d2d1.dll
2014-02-12 15:26 . 2013-11-22 22:48   3928064   ----a-w-   c:\windows\system32\d2d1.dll
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-03-01 18:18 . 2013-07-18 01:10   389240   ----a-w-   c:\windows\system32\drivers\trufos.sys
2014-02-21 03:55 . 2013-02-26 04:13   71048   ----a-w-   c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-21 03:55 . 2013-02-26 04:13   692616   ----a-w-   c:\windows\SysWow64\FlashPlayerApp.exe
2014-02-15 05:02 . 2013-02-22 00:52   88567024   ----a-w-   c:\windows\system32\MRT.exe
2014-01-28 01:16 . 2014-01-01 19:18   893440   ----a-w-   c:\windows\system32\drivers\avc3.sys
2014-01-28 01:15 . 2014-01-01 19:18   635392   ----a-w-   c:\windows\system32\drivers\avckf.sys
2014-01-01 19:52 . 2014-01-01 19:52   76944   ----a-w-   c:\windows\system32\drivers\bdvedisk.sys
2014-01-01 19:52 . 2014-01-01 19:52   34384   ----a-w-   c:\windows\system32\bdsandboxuh.dll
2014-01-01 19:51 . 2014-01-01 19:18   82824   ----a-w-   c:\windows\system32\drivers\bdsandbox.sys
2014-01-01 19:51 . 2014-01-01 19:15   84848   ----a-w-   c:\windows\system32\bdsandboxuiskin.dll
2014-01-01 19:51 . 2014-01-02 18:46   74512   ----a-w-   c:\windows\SysWow64\bdsandboxuiskin32.dll
2014-01-01 19:51 . 2014-01-01 19:15   74512   ----a-w-   c:\windows\system32\bdsandboxuiskin32.dll
2013-12-25 20:12 . 2013-12-25 20:12   49152   ----a-r-   c:\users\Debbie\AppData\Roaming\Microsoft\Installer\{115BFE3B-1CB6-42C3-AF35-21898D724F13}\GameExecute.exe
2013-12-25 20:00 . 2013-12-25 20:00   283064   ----a-w-   c:\windows\system32\drivers\dtsoftbus01.sys
2013-12-18 04:46 . 2013-12-18 04:45   101184   ----a-w-   c:\windows\system32\stkMonitor.dll
2013-12-18 00:09 . 2013-12-18 00:09   61592   ----a-w-   c:\windows\system32\drivers\netfilter64.sys
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2013-10-28 3675352]
"Bitdefender Wallet Agent"="c:\program files\Bitdefender\Bitdefender\pmbxag.exe" [2014-02-06 567888]
"Bitdefender Wallet Application Agent"="c:\program files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe" [2014-02-06 614232]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIconLaunch.exe" [2012-08-23 56128]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"OpwareSE2"="c:\program files (x86)\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"OPSE reminder"="c:\program files (x86)\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" [2003-07-07 729088]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Bitdefender Wallet Agent"="c:\program files\Bitdefender\Bitdefender\pmbxag.exe" [2014-02-06 567888]
"Bitdefender Wallet"="c:\program files\Bitdefender\Bitdefender\pwdmanui.exe" [2014-02-06 1001536]
"Bitdefender Wallet Application Agent"="c:\program files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe" [2014-02-06 614232]
.
c:\users\Debbie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 vToolbarUpdater18.0.0;vToolbarUpdater18.0.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.0.0\ToolbarUpdater.exe;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.0.0\ToolbarUpdater.exe [x]
R3 BDSandBox;BDSandBox;c:\windows\system32\drivers\bdsandbox.sys;c:\windows\SYSNATIVE\drivers\bdsandbox.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 avc3;avc3;c:\windows\system32\DRIVERS\avc3.sys;c:\windows\SYSNATIVE\DRIVERS\avc3.sys [x]
S0 gzflt;gzflt;c:\windows\system32\DRIVERS\gzflt.sys;c:\windows\SYSNATIVE\DRIVERS\gzflt.sys [x]
S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorA.sys [x]
S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorF.sys [x]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys;c:\windows\SYSNATIVE\drivers\avgtpx64.sys [x]
S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 Netfilter64;Netfilter64;c:\windows\system32\drivers\Netfilter64.sys;c:\windows\SYSNATIVE\drivers\Netfilter64.sys [x]
S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 jhi_service;Intel® Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [x]
S2 LavasoftAdAwareService11;Ad-Aware Service 11;c:\program files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe;c:\program files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [x]
S2 SavingsbullFilterService64;SavingsbullFilterService64;c:\program files\SavingsbullFilter\SavingsbullFilterService64.exe;c:\program files\SavingsbullFilter\SavingsbullFilterService64.exe [x]
S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [x]
S2 UPDATESRV;Bitdefender Desktop Update Service;c:\program files\Bitdefender\Bitdefender\updatesrv.exe;c:\program files\Bitdefender\Bitdefender\updatesrv.exe [x]
S3 avchv;avchv Function Driver;c:\windows\system32\DRIVERS\avchv.sys;c:\windows\SYSNATIVE\DRIVERS\avchv.sys [x]
S3 avckf;avckf;c:\windows\system32\DRIVERS\avckf.sys;c:\windows\SYSNATIVE\DRIVERS\avckf.sys [x]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\DRIVERS\LVUSBS64.sys;c:\windows\SYSNATIVE\DRIVERS\LVUSBS64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2014-03-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-02-26 03:55]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-08-25 170304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-08-25 398656]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-08-25 441152]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-06-11 12503184]
"Bdagent"="c:\program files\Bitdefender\Bitdefender\bdagent.exe" [2014-02-25 1739480]
"AdAwareTray"="c:\program files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe" [2014-01-24 4114264]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm

mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.254 75.153.176.1
FF - ProfilePath - c:\users\Debbie\AppData\Roaming\Mozilla\Firefox\Profiles\kg4tqr1a.default\
FF - prefs.js: browser.startup.homepage - google.ca
FF - prefs.js: keyword.URL -
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
AddRemove-Intel® Integrated Performance Primitives 1.1 - c:\windows\system32\UninstIPP.isu
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-4039069230-3056711612-840082808-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F4A59118-5B7A-32D0-C531-E26585C77406}*]
"oadleajllnblhhpndlcfgjjjfahdeb"=hex:6a,61,68,62,6c,65,62,70,69,6d,66,6d,6e,6e,
   6c,66,70,69,6f,70,00,00
"najigdodhfcchoedghnmijhingjo"=hex:6a,61,68,62,6c,65,62,70,69,6d,66,6d,6e,6e,
   6c,66,70,69,6f,70,00,00
"oahlecdjeadobkknhdjeglhlmdepca"=hex:64,61,68,62,65,65,66,65,00,fc
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2014-03-03 22:14:48
ComboFix-quarantined-files.txt 2014-03-04 06:14
ComboFix2.txt 2014-03-04 06:02
.
Pre-Run: 718,471,860,224 bytes free
Post-Run: 718,405,091,328 bytes free
.
- - End Of File - - E2E973BF64F2BAB2D895DF7F5C9A3FDE

I haven't noticed any pop ups for the past day that used to show up every few pages. My "new tab" default was changed to an AVG search engine (http://mysearch.avg.com), but other than that, there aren't any changes.

gringo_pr · March 4, 2014

Hello petalxrain

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Please start by opening Notepad and copy/paste the text in the box into the window:

ClearJavaCache::

Save it to your desktop as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.

Restart if you have to.

Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
- report from Combofix
- let me know of any problems you may have had
- How is the computer doing now after running the script?

Gringo

petalxrain · March 6, 2014

Hi Gringo,

I ran the Combofix with the CFScript and received this log:

ComboFix 14-03-03.02 - Debbie 05/03/2014 16:44:59.3.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.8086.6315 [GMT -8:00]
Running from: c:\users\Debbie\Desktop\ComboFix.exe
Command switches used :: c:\users\Debbie\Desktop\CFScript.txt
AV: Ad-Aware Antivirus *Disabled/Outdated* {D87B6541-12A1-DAEA-0033-9B8057AAB996}
AV: Bitdefender Antivirus *Disabled/Updated* {9A0813D8-CED6-F86B-072E-28D2AF25A83D}
FW: Ad-Aware Firewall *Disabled* {E040E464-58CE-DBB2-2B6C-32B5A979FEED}
SP: Ad-Aware Antivirus *Disabled/Outdated* {631A84A5-349B-D564-3A83-A0F22C2DF32B}
SP: Bitdefender Antispyware *Disabled/Updated* {2169F23C-E8EC-F7E5-3D9E-13A0D4A2E280}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((   Files Created from 2014-02-06 to 2014-03-06 )))))))))))))))))))))))))))))))
.
.
2014-03-06 00:49 . 2014-03-06 00:49   --------   d-----w-   c:\users\Default\AppData\Local\temp
2014-03-04 06:26 . 2014-03-04 06:26   --------   d-----w-   c:\program files (x86)\Common Files\Skype
2014-03-02 20:23 . 2014-03-02 20:23   --------   d-----w-   c:\windows\ERUNT
2014-03-01 06:13 . 2014-03-01 06:22   --------   d-----w-   C:\FRST
2014-02-28 06:39 . 2014-02-28 06:39   --------   d-----w-   c:\users\Debbie\AppData\Roaming\LavasoftStatistics
2014-02-28 06:26 . 2014-02-28 06:26   --------   d-----w-   c:\program files\Lavasoft
2014-02-28 06:26 . 2014-02-28 06:26   --------   d-----w-   c:\program files\Common Files\Lavasoft
2014-02-28 06:26 . 2014-02-28 06:26   --------   d-----w-   c:\programdata\Lavasoft
2014-02-28 05:14 . 2014-02-28 05:14   --------   d-----w-   c:\programdata\CDB
2014-02-28 05:13 . 2014-03-02 18:25   50976   ----a-w-   c:\windows\system32\drivers\avgtpx64.sys
2014-02-28 05:06 . 2014-02-28 05:06   12872   ----a-w-   c:\windows\system32\bootdelete.exe
2014-02-28 04:55 . 2014-02-28 04:55   --------   d-----w-   c:\program files (x86)\Mozilla Maintenance Service
2014-02-27 19:47 . 2014-02-27 19:47   --------   d-----w-   c:\program files\SavingsbullFilter
2014-02-27 18:23 . 2014-02-27 18:23   --------   d-----w-   c:\users\Debbie\AppData\Roaming\Malwarebytes
2014-02-27 18:22 . 2014-02-27 18:22   --------   d-----w-   c:\programdata\Malwarebytes
2014-02-27 18:08 . 2014-02-27 18:08   --------   d-----w-   c:\programdata\GridinSoft
2014-02-27 17:36 . 2014-02-27 17:36   --------   d-----w-   c:\users\Debbie\AppData\Roaming\NewSoft
2014-02-26 06:03 . 2014-02-27 19:47   --------   d-----w-   c:\program files (x86)\SavingsBull
2014-02-26 06:03 . 2014-02-26 06:04   --------   d-----w-   C:\temp
2014-02-26 06:00 . 2014-02-26 06:00   --------   d-----w-   c:\users\Debbie\AppData\Local\Programs
2014-02-26 06:00 . 2014-02-26 06:01   --------   d-----w-   c:\program files (x86)\freestar
2014-02-25 14:36 . 2014-02-25 14:36   --------   d-----w-   c:\windows\Migration
2014-02-23 00:44 . 2014-02-23 19:54   --------   d-----w-   c:\program files (x86)\Common Files\Steam
2014-02-23 00:44 . 2014-02-23 19:54   --------   d-----w-   c:\program files (x86)\Steam
2014-02-16 23:25 . 2014-02-16 23:25   --------   d-----w-   c:\windows\SysWow64\Adobe
2014-02-14 03:02 . 2000-01-04 14:39   212992   ----a-w-   c:\program files (x86)\Common Files\InstallShield\engine\6\Intel 32\ILog.dll
2014-02-12 15:39 . 2014-02-06 10:11   5768704   ----a-w-   c:\windows\system32\jscript9.dll
2014-02-12 15:39 . 2014-02-06 09:25   4244480   ----a-w-   c:\windows\SysWow64\jscript9.dll
2014-02-12 15:26 . 2013-12-24 23:09   1987584   ----a-w-   c:\windows\SysWow64\d3d10warp.dll
2014-02-12 15:26 . 2013-12-24 22:48   2565120   ----a-w-   c:\windows\system32\d3d10warp.dll
2014-02-12 15:26 . 2013-11-26 08:16   3419136   ----a-w-   c:\windows\SysWow64\d2d1.dll
2014-02-12 15:26 . 2013-11-22 22:48   3928064   ----a-w-   c:\windows\system32\d2d1.dll
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-03-01 18:18 . 2013-07-18 01:10   389240   ----a-w-   c:\windows\system32\drivers\trufos.sys
2014-02-21 03:55 . 2013-02-26 04:13   71048   ----a-w-   c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-21 03:55 . 2013-02-26 04:13   692616   ----a-w-   c:\windows\SysWow64\FlashPlayerApp.exe
2014-02-15 05:02 . 2013-02-22 00:52   88567024   ----a-w-   c:\windows\system32\MRT.exe
2014-01-28 01:16 . 2014-01-01 19:18   893440   ----a-w-   c:\windows\system32\drivers\avc3.sys
2014-01-28 01:15 . 2014-01-01 19:18   635392   ----a-w-   c:\windows\system32\drivers\avckf.sys
2014-01-01 19:52 . 2014-01-01 19:52   76944   ----a-w-   c:\windows\system32\drivers\bdvedisk.sys
2014-01-01 19:52 . 2014-01-01 19:52   34384   ----a-w-   c:\windows\system32\bdsandboxuh.dll
2014-01-01 19:51 . 2014-01-01 19:18   82824   ----a-w-   c:\windows\system32\drivers\bdsandbox.sys
2014-01-01 19:51 . 2014-01-01 19:15   84848   ----a-w-   c:\windows\system32\bdsandboxuiskin.dll
2014-01-01 19:51 . 2014-01-02 18:46   74512   ----a-w-   c:\windows\SysWow64\bdsandboxuiskin32.dll
2014-01-01 19:51 . 2014-01-01 19:15   74512   ----a-w-   c:\windows\system32\bdsandboxuiskin32.dll
2013-12-25 20:12 . 2013-12-25 20:12   49152   ----a-r-   c:\users\Debbie\AppData\Roaming\Microsoft\Installer\{115BFE3B-1CB6-42C3-AF35-21898D724F13}\GameExecute.exe
2013-12-25 20:00 . 2013-12-25 20:00   283064   ----a-w-   c:\windows\system32\drivers\dtsoftbus01.sys
2013-12-18 04:46 . 2013-12-18 04:45   101184   ----a-w-   c:\windows\system32\stkMonitor.dll
2013-12-18 00:09 . 2013-12-18 00:09   61592   ----a-w-   c:\windows\system32\drivers\netfilter64.sys
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2013-10-28 3675352]
"Bitdefender Wallet Agent"="c:\program files\Bitdefender\Bitdefender\pmbxag.exe" [2014-02-06 567888]
"Bitdefender Wallet Application Agent"="c:\program files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe" [2014-02-06 614232]
"Bitdefender Wallet"="c:\program files\Bitdefender\Bitdefender\pwdmanui.exe" [2014-02-06 1001536]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIconLaunch.exe" [2012-08-23 56128]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"OpwareSE2"="c:\program files (x86)\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
"OPSE reminder"="c:\program files (x86)\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" [2003-07-07 729088]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Bitdefender Wallet Agent"="c:\program files\Bitdefender\Bitdefender\pmbxag.exe" [2014-02-06 567888]
"Bitdefender Wallet"="c:\program files\Bitdefender\Bitdefender\pwdmanui.exe" [2014-02-06 1001536]
"Bitdefender Wallet Application Agent"="c:\program files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe" [2014-02-06 614232]
.
c:\users\Debbie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 vToolbarUpdater18.0.0;vToolbarUpdater18.0.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.0.0\ToolbarUpdater.exe;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.0.0\ToolbarUpdater.exe [x]
R3 BDSandBox;BDSandBox;c:\windows\system32\drivers\bdsandbox.sys;c:\windows\SYSNATIVE\drivers\bdsandbox.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 avc3;avc3;c:\windows\system32\DRIVERS\avc3.sys;c:\windows\SYSNATIVE\DRIVERS\avc3.sys [x]
S0 gzflt;gzflt;c:\windows\system32\DRIVERS\gzflt.sys;c:\windows\SYSNATIVE\DRIVERS\gzflt.sys [x]
S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorA.sys [x]
S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorF.sys [x]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys;c:\windows\SYSNATIVE\drivers\avgtpx64.sys [x]
S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 Netfilter64;Netfilter64;c:\windows\system32\drivers\Netfilter64.sys;c:\windows\SYSNATIVE\drivers\Netfilter64.sys [x]
S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 jhi_service;Intel® Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [x]
S2 LavasoftAdAwareService11;Ad-Aware Service 11;c:\program files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe;c:\program files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [x]
S2 SavingsbullFilterService64;SavingsbullFilterService64;c:\program files\SavingsbullFilter\SavingsbullFilterService64.exe;c:\program files\SavingsbullFilter\SavingsbullFilterService64.exe [x]
S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [x]
S2 UPDATESRV;Bitdefender Desktop Update Service;c:\program files\Bitdefender\Bitdefender\updatesrv.exe;c:\program files\Bitdefender\Bitdefender\updatesrv.exe [x]
S3 avchv;avchv Function Driver;c:\windows\system32\DRIVERS\avchv.sys;c:\windows\SYSNATIVE\DRIVERS\avchv.sys [x]
S3 avckf;avckf;c:\windows\system32\DRIVERS\avckf.sys;c:\windows\SYSNATIVE\DRIVERS\avckf.sys [x]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\DRIVERS\LVUSBS64.sys;c:\windows\SYSNATIVE\DRIVERS\LVUSBS64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2014-03-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-02-26 03:55]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-08-25 170304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-08-25 398656]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-08-25 441152]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-06-11 12503184]
"Bdagent"="c:\program files\Bitdefender\Bitdefender\bdagent.exe" [2014-02-25 1739480]
"AdAwareTray"="c:\program files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe" [2014-01-24 4114264]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm

mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 192.168.1.254 75.153.176.1
FF - ProfilePath - c:\users\Debbie\AppData\Roaming\Mozilla\Firefox\Profiles\kg4tqr1a.default\
FF - prefs.js: browser.startup.homepage - google.ca
FF - prefs.js: keyword.URL -
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
AddRemove-Intel® Integrated Performance Primitives 1.1 - c:\windows\system32\UninstIPP.isu
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-4039069230-3056711612-840082808-1001\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F4A59118-5B7A-32D0-C531-E26585C77406}*]
"oadleajllnblhhpndlcfgjjjfahdeb"=hex:6a,61,68,62,6c,65,62,70,69,6d,66,6d,6e,6e,
   6c,66,70,69,6f,70,00,00
"najigdodhfcchoedghnmijhingjo"=hex:6a,61,68,62,6c,65,62,70,69,6d,66,6d,6e,6e,
   6c,66,70,69,6f,70,00,00
"oahlecdjeadobkknhdjeglhlmdepca"=hex:64,61,68,62,65,65,66,65,00,fc
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2014-03-05 16:51:11
ComboFix-quarantined-files.txt 2014-03-06 00:51
ComboFix2.txt 2014-03-04 06:14
ComboFix3.txt 2014-03-04 06:02
.
Pre-Run: 716,424,085,504 bytes free
Post-Run: 716,358,938,624 bytes free
.
- - End Of File - - D4B8290B0BEB15BF475AB7B8423AA552

Everything still seems to be fine. No pop up ads or anything else I've noticed other than my "new tab" default that changed to an AVG search engine (http://mysearch.avg.com).

gringo_pr · March 6, 2014

Hello petalxrain

I would like to see a report that combofix makes.

extra combofix report

push the "windows key" + "R" (between the "Ctrl" button and "Alt" Button)
please copy and past the following into the box

C:\Qoobox\Add-Remove Programs.txt

click ok

copy and paste the report into this topic for me to review

Gringo

petalxrain · March 6, 2014

Hi Gringo,

Here is the following log:

??????
Adobe Digital Editions 2.0
Adobe Flash Player 12 Plugin
Adobe Reader XI (11.0.06)
Adobe Shockwave Player 12.0
Battle for Wesnoth 1.10.5
Canon MF Toolbox 4.9.1.1.mf02
Corda
DAEMON Tools Lite
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Intel® Control Center
Intel® Management Engine Components
Intel® Processor Graphics
Intel® Rapid Storage Technology
Intel® SDK for OpenCL - CPU Only Runtime Package
Java 7 Update 21
Java Auto Updater
Microsoft Office 2010
Microsoft Office Access MUI (English) 2010
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Excel MUI (English) 2010
Microsoft Office Home and Student 2010
Microsoft Office OneNote MUI (English) 2010
Microsoft Office Outlook MUI (English) 2010
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2010
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Single Image 2010
Microsoft Office Word MUI (English) 2010
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Mozilla Firefox 27.0.1 (x86 en-US)
Mozilla Maintenance Service
MSVC90_x86
OmniPage SE 2.0
OpenOffice.org 3.4.1
Presto! PageManager 7.15.11
RE: Alistair++ 1
Realtek Ethernet Controller Driver
Realtek High Definition Audio Driver
SavingsBull
Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)
Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)
Security Update for Microsoft Excel 2010 (KB2826033) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553284) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2687423) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2826023) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2826035) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2850016) 32-Bit Edition
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition
Skype™ 6.11
Steam
swMSM
Thief Gold
Torchlight
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition
Update for Microsoft Office 2010 (KB2837583) 32-Bit Edition
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition
Update for Microsoft PowerPoint 2010 (KB2775360) 32-Bit Edition
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition
VLC media player 2.0.5

There's been no visible changes since the last time in that there are no more pop up ads and everything seems to be running fine.

gringo_pr · March 9, 2014

Hello petalxrain

These logs are looking allot better. But we still have some work to do.

Please print out these instructions, or copy them to a Notepad file. It will make it easier for you to follow the instructions and complete all of the necessary steps..

uninstall some programs

NOTE** Because of the cleanup process some of the programs I have listed may not be in add/remove anymore this is fine just move to the next item on the list.

You can remove these programs using add/remove or you can use the free uninstaller from Revo (Revo does allot better of a job)

Programs to remove
- Java 7 Update 21
  SavingsBull

Please download and install Revo Uninstaller Free

Double click Revo Uninstaller to run it.
From the list of programs double click on The Program to remove
When prompted if you want to uninstall click Yes.
Be sure the Moderate option is selected then click Next.
The program will run, If prompted again click Yes
when the built-in uninstaller is finished click on Next.
Once the program has searched for leftovers click Next.
Check/tick the bolded items only on the list then click Delete
when prompted click on Yes and then on next.
put a check on any folders that are found and select delete
when prompted select yes then on next
Once done click Finish.

.

Install Java:

Please go here to install Java

click on the Free Java Download Button
click on Agree and start Free download
click on Run
click on run again
click on install
when install is complete click on close

Clean Out Temp Files

This small application you may want to keep and use once a week to keep the computer clean.
Download CCleaner from here CCleaner
- Run the installer to install the application.
- When it gives you the option to install Yahoo toolbar uncheck the box next to it.
- Run CCleaner. default settings are fine
- Click Run Cleaner.
- Close CCleaner.

Run Malwarebytes

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to
- Update Malwarebytes' Anti-Malware
- and Launch Malwarebytes' Anti-Malware
then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.
When completed, a log will open in Notepad. please copy and paste the log into your next reply
- If you accidently close it, the log file is saved here and will be named like this:
- C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.

Click OK to either and let MBAM proceed with the disinfection process.

If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Download HijackThis

Go Here to download HijackThis program
Save HijackThis to your desktop.
Right Click on Hijackthis and select "Run as Admin" (XP users just need to double click to run)
Click on "Do A system scan and save a logfile" (if you do not see "Do A system scan and save a logfile" then click on main menu)
copy and paste hijackthis report into the topic

"information and logs"

In your next post I need the following
- Log From MBAM
- report from Hijackthis
- let me know of any problems you may have had
- How is the computer doing now?

Gringo

petalxrain · March 11, 2014

Hi Gringo,

I ran all the suggested programs and received the two logs.

MBAM log:

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.03.11.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16518
Debbie :: DEBBIE-PC [administrator]

10/03/2014 8:55:58 PM
mbam-log-2014-03-10 (20-55-58).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 220839
Time elapsed: 2 minute(s), 24 second(s)

Memory Processes Detected: 1
C:\Program Files\SavingsbullFilter\SavingsbullFilterService64.exe (PUP.Optional.SavingsBull.A) -> 1476 -> Delete on reboot.

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 5
HKLM\SYSTEM\CurrentControlSet\Services\SavingsbullFilterService64 (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
HKCU\Software\SavingsBull (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
HKCU\Software\AppDataLow\Software\Savings Bull (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
HKCU\Software\AppDataLow\Software\SavingsBull (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\SavingsbullFilter (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 2
C:\Program Files\SavingsbullFilter (PUP.Optional.SavingsBull.A) -> Delete on reboot.
C:\Program Files (x86)\SavingsBull (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

Files Detected: 28
C:\Program Files\SavingsbullFilter\sample.dll (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files\SavingsbullFilter\Installbat64.dll (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files\SavingsbullFilter\Microsoft.Deployment.WindowsInstaller.dll (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files\SavingsbullFilter\Microsoft.Deployment.WindowsInstaller.xml (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files\SavingsbullFilter\nfapi.dll (PUP.Optional.SavingsBull.A) -> Delete on reboot.
C:\Program Files\SavingsbullFilter\nfregdrv.exe (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files\SavingsbullFilter\ProtocolFilters.dll (PUP.Optional.SavingsBull.A) -> Delete on reboot.
C:\Program Files\SavingsbullFilter\SavingsbullFilterService64.exe (PUP.Optional.SavingsBull.A) -> Delete on reboot.
C:\Program Files (x86)\SavingsBull\background.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\SavingsBull\bootstrap.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\SavingsBull\bootstrap.js.old (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\SavingsBull\CustomActionInstall (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\SavingsBull\CustomActionUninstall (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\SavingsBull\ff_main.js.old (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\SavingsBull\icon128.png (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\SavingsBull\icon16.png (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\SavingsBull\icon32.png (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\SavingsBull\icon48.png (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\SavingsBull\icon64.png (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\SavingsBull\icon8.png (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\SavingsBull\IEOptimizer.dll (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\SavingsBull\IEOptimizer64.dll (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\SavingsBull\manifest.json (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\SavingsBull\marcopolo.js (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\SavingsBull\Microsoft.Deployment.WindowsInstaller.dll (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\SavingsBull\Microsoft.Deployment.WindowsInstaller.xml (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\SavingsBull\SendJson.dll (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\SavingsBull\uninstaller.exe (PUP.Optional.SavingsBull.A) -> Quarantined and deleted successfully.

(end)

HijackThis Log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:03:34 PM, on 10/03/2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.16518)
Boot mode: Normal

Running processes:
C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\opwareSE2.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_70.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_70.exe
C:\Users\Debbie\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Bitdefender Wallet - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender\Antispam32\pmbxie.dll
O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL
O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIconLaunch.exe "C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" 60
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" -r "C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini"
O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [bitdefender Wallet Agent] "C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe"
O4 - HKCU\..\Run: [bitdefender Wallet Application Agent] "C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe"
O4 - HKCU\..\Run: [bitdefender Wallet] "C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe" --hidden --nowizard
O4 - HKUS\S-1-5-18\..\Run: [bitdefender Wallet Agent] "C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [bitdefender Wallet] "C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe" --hidden --nowizard (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [bitdefender Wallet Application Agent] "C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [bitdefender Wallet Agent] "C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe" (User 'Default user')
O4 - Startup: OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Intel® Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel® Capability Licensing Service Interface - Intel® Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel® Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Ad-Aware Service 11 (LavasoftAdAwareService11) - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe
O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel® Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
O23 - Service: Bitdefender Desktop Update Service (UPDATESRV) - Bitdefender - C:\Program Files\Bitdefender\Bitdefender\updatesrv.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: Bitdefender Virus Shield (VSSERV) - Bitdefender - C:\Program Files\Bitdefender\Bitdefender\vsserv.exe
O23 - Service: vToolbarUpdater18.0.0 - Unknown owner - C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.0.0\ToolbarUpdater.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10073 bytes

I didn't have a problem with any of the programs you suggested. Everything seems to be running normal without any popup ads. However, my firefox "new tab" is still set to http://mysearch.avg.com/tab?pid=&coid=&cid=&mid=&ds=&v=〈=&pr=&sg=&d=&sap=nt&src=xp and all attempts to change it back to default doesn't work. However, it's not a big deal and I'm quite happy that I don't have the annoying popup ads.

gringo_pr · March 11, 2014

Hello petalxrain

I want you to reset firefox back to defaults, this will remove everything from Firefox

I will let you keep your bookmarks so to do that you can go here - Export BookMarks

Now to reset firefox do the following.

At the top of the Firefox window, click the "Firefox" button,
go over to the "Help" sub-menu
- (on Windows XP, click the Help menu at the top of the Firefox window) and select "Troubleshooting Information".
Click the "Reset Firefox" button in the upper-right corner of the Troubleshooting Information page.
click "Reset Firefox" in the confirmation window that opens.
Firefox will close and be reset. When it's done. Click "Finish" and Firefox will open.

restart the computer and check firefox for me now

Gringo

petalxrain · March 14, 2014

Hi Gringo,

I've done as you suggested and I didn't notice any difference in that my "new tab" is still set to AVG secure search.

gringo_pr · March 16, 2014

Hello petalxrain

I would like you to rerun FRST again for me and send me the reports again for me please

Gringo

petalxrain · March 17, 2014

Hi Gringo,

I received this log:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Debbie (administrator) on DEBBIE-PC on 16-03-2014 17:04:05
Running from C:\Users\Debbie\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Bitdefender) C:\Program Files\Bitdefender\Bitdefender\vsserv.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender\updatesrv.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender\bdagent.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(ScanSoft, Inc.) C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\opwareSE2.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-10] (Realtek Semiconductor)
HKLM\...\Run: [bdagent] - C:\Program Files\Bitdefender\Bitdefender\bdagent.exe [1739480 2014-02-25] (Bitdefender)
HKLM\...\Run: [AdAwareTray] - C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe [4114264 2014-01-23] ()
HKLM-x32\...\Run: [iAStorIcon] - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [277504 2012-08-16] (Intel Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [OpwareSE2] - C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\OpwareSE2.exe [49152 2003-05-08] (ScanSoft, Inc.)
HKLM-x32\...\Run: [OPSE reminder] - C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe [729088 2003-07-07] (ScanSoft, Inc.)
HKLM-x32\...\Run: [sunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\.DEFAULT\...\Run: [bitdefender Wallet Agent] - C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe [567888 2014-02-06] (Bitdefender)
HKU\.DEFAULT\...\Run: [bitdefender Wallet] - C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe [1001536 2014-02-06] (Bitdefender)
HKU\.DEFAULT\...\Run: [bitdefender Wallet Application Agent] - C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe [614232 2014-02-06] (Bitdefender)
HKU\S-1-5-21-4039069230-3056711612-840082808-1001\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)
HKU\S-1-5-21-4039069230-3056711612-840082808-1001\...\Run: [bitdefender Wallet Agent] - C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe [567888 2014-02-06] (Bitdefender)
HKU\S-1-5-21-4039069230-3056711612-840082808-1001\...\Run: [bitdefender Wallet Application Agent] - C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr.exe [614232 2014-02-06] (Bitdefender)
HKU\S-1-5-21-4039069230-3056711612-840082808-1001\...\Run: [bitdefender Wallet] - C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe [1001536 2014-02-06] (Bitdefender)
Startup: C:\Users\Debbie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.memoryexpress.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x16738258BD13CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-CA
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: HKLM-x32 - Default Value = {CCC7B159-1D8C-11E3-B2AD-F3EF3D58318D}
URLSearchHook: HKLM-x32 - SiteFinder - {CCC7B159-1D8C-11E3-B2AD-F3EF3D58318D} - C:\Program Files (x86)\SiteFinder\SiteFinder.dll (Site Finder)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=md_14_11_ff&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyEzy0ByCtAtDyEtCyE0ByBtN0D0Tzu0SzztDtCtN1L2XzutBtFtCzztFtBtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyBtA0CzzyEzytDtBtG0DtCyE0DtG0DtDyDyEtG0Dzz0ByEtGtDtDtA0D0D0C0AtD0AyB0F0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCyEtD0C0FyD0B0BtGyEtC0A0BtGyEyD0BtBtG0DtD0DzytGyEtB0FyC0D0CyEzyzyyDyBtD2Q&cr=746986552&ir=
SearchScopes: HKCU - DefaultScope {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=md_14_11_ff&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyEzy0ByCtAtDyEtCyE0ByBtN0D0Tzu0SzztDtCtN1L2XzutBtFtCzztFtBtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyBtA0CzzyEzytDtBtG0DtCyE0DtG0DtDyDyEtG0Dzz0ByEtGtDtDtA0D0D0C0AtD0AyB0F0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCyEtD0C0FyD0B0BtGyEtC0A0BtGyEyD0BtBtG0DtD0DzytGyEtB0FyC0D0CyEzyzyyDyBtD2Q&cr=746986552&ir=
SearchScopes: HKCU - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=md_14_11_ff&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyEzy0ByCtAtDyEtCyE0ByBtN0D0Tzu0SzztDtCtN1L2XzutBtFtCzztFtBtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyBtA0CzzyEzytDtBtG0DtCyE0DtG0DtDyDyEtG0Dzz0ByEtGtDtDtA0D0D0C0AtD0AyB0F0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCyEtD0C0FyD0B0BtGyEtC0A0BtGyEyD0BtBtG0DtD0DzytGyEtB0FyC0D0CyEzyzyyDyBtD2Q&cr=746986552&ir=
BHO: Bitdefender Wallet - {09F58E74-42B4-4D70-BA26-35FC954E7A17} - C:\Program Files\Bitdefender\Bitdefender\pmbxie.dll (Bitdefender)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Bitdefender Wallet - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender\Antispam32\pmbxie.dll (Bitdefender)
BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - SiteFinder - {CCC7B159-1D8C-11E3-B2AD-F3EF3D58318D} - C:\Program Files (x86)\SiteFinder\SiteFinder.dll (Site Finder)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 75.153.176.1

FireFox:
========
FF ProfilePath: C:\Users\Debbie\AppData\Roaming\Mozilla\Firefox\Profiles\j4a8dp1s.default-1394591909608
FF user.js: detected! => C:\Users\Debbie\AppData\Roaming\Mozilla\Firefox\Profiles\j4a8dp1s.default-1394591909608\user.js
FF DefaultSearchEngine: Mysearchdial
FF SearchEngineOrder.1: Mysearchdial
FF SelectedSearchEngine: Mysearchdial
FF Homepage: google.ca
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1209149.dll (Adobe Systems, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Site Finder - C:\Users\Debbie\AppData\Roaming\Mozilla\Firefox\Profiles\j4a8dp1s.default-1394591909608\Extensions\sitefinder@sitefinder.com [2014-03-11]
FF Extension: Adblock Plus - C:\Users\Debbie\AppData\Roaming\Mozilla\Firefox\Profiles\j4a8dp1s.default-1394591909608\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-03-11]
FF HKLM-x32\...\Firefox\Extensions: [ffpwdman@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender\Antispam32\ffpwdman\
FF Extension: Bitdefender Wallet - C:\Program Files\Bitdefender\Bitdefender\Antispam32\ffpwdman\ []

==================== Services (Whitelisted) =================

R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [702744 2014-01-23] ()
R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender\updatesrv.exe [67320 2014-01-01] (Bitdefender)
R2 VSSERV; C:\Program Files\Bitdefender\Bitdefender\vsserv.exe [1507248 2014-02-25] (Bitdefender)
S2 vToolbarUpdater18.0.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.0.0\ToolbarUpdater.exe [X]

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [893440 2014-01-27] (BitDefender)
R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-11-02] (BitDefender)
R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [635392 2014-01-27] (BitDefender)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-03-02] (AVG Technologies)
R1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [103504 2011-11-14] (BitDefender LLC)
S3 BDSandBox; C:\Windows\system32\drivers\bdsandbox.sys [82824 2014-01-01] (BitDefender SRL)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-12-25] (Disc Soft Ltd)
R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [150256 2013-08-23] (BitDefender LLC)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [27456 2012-08-16] (Intel Corporation)
R1 Netfilter64; C:\Windows\System32\drivers\Netfilter64.sys [61592 2013-12-17] (NetFilterSDK.com)
R3 trufos; C:\Windows\System32\DRIVERS\trufos.sys [389240 2014-03-01] (BitDefender S.R.L.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 gdrv; \??\C:\Windows\gdrv.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-03-16 17:04 - 2014-03-16 17:04 - 00014280 _____ () C:\Users\Debbie\Desktop\FRST.txt
2014-03-16 17:03 - 2014-03-16 17:03 - 02157056 _____ (Farbar) C:\Users\Debbie\Desktop\FRST64.exe
2014-03-13 11:25 - 2014-03-16 11:22 - 00022836 ____H () C:\Users\Debbie\Desktop\~WRL0003.tmp
2014-03-12 17:54 - 2014-02-28 23:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-12 17:54 - 2014-02-28 22:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-12 17:54 - 2014-02-28 22:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-12 17:54 - 2014-02-28 21:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-12 17:54 - 2014-02-28 21:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-12 17:54 - 2014-02-28 21:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-12 17:54 - 2014-02-28 21:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-12 17:54 - 2014-02-28 21:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-12 17:54 - 2014-02-28 21:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-12 17:54 - 2014-02-28 21:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-12 17:54 - 2014-02-28 21:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-12 17:54 - 2014-02-28 21:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-12 17:54 - 2014-02-28 21:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-12 17:54 - 2014-02-28 21:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-12 17:54 - 2014-02-28 21:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-12 17:54 - 2014-02-28 21:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-12 17:54 - 2014-02-28 21:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-12 17:54 - 2014-02-28 20:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-12 17:54 - 2014-02-28 20:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-12 17:54 - 2014-02-28 20:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-12 17:54 - 2014-02-28 20:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-12 17:54 - 2014-02-28 20:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-12 17:54 - 2014-02-28 20:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-12 17:54 - 2014-02-28 20:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-12 17:54 - 2014-02-28 20:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-12 17:54 - 2014-02-28 20:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-12 17:54 - 2014-02-28 20:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-12 17:54 - 2014-02-28 20:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-12 17:54 - 2014-02-28 20:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-12 17:54 - 2014-02-28 20:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-12 17:54 - 2014-02-28 20:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-12 17:54 - 2014-02-28 20:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-12 17:54 - 2014-02-28 20:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-12 17:54 - 2014-02-28 20:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-12 17:54 - 2014-02-28 19:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-12 17:54 - 2014-02-28 19:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-12 17:54 - 2014-02-28 19:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-12 17:54 - 2014-02-28 19:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-12 17:54 - 2014-02-28 19:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-12 17:54 - 2014-02-28 19:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-12 17:54 - 2014-02-06 18:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-12 17:54 - 2014-02-03 19:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-12 17:54 - 2014-02-03 19:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-12 17:54 - 2014-02-03 19:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-12 17:54 - 2014-02-03 19:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-12 17:54 - 2014-01-28 19:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-12 17:54 - 2014-01-28 19:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-12 17:54 - 2014-01-27 19:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-11 19:57 - 2014-03-11 20:24 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\FlvPlayer
2014-03-11 19:57 - 2014-03-11 19:57 - 00003240 _____ () C:\Windows\System32\Tasks\MySearchDial
2014-03-11 19:57 - 2014-03-11 19:57 - 00000296 _____ () C:\Windows\Tasks\MySearchDial.job
2014-03-11 19:57 - 2014-03-11 19:57 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\SimilarSites
2014-03-11 19:57 - 2014-03-11 19:57 - 00000000 ____D () C:\Program Files (x86)\SiteFinder
2014-03-11 19:57 - 2014-03-11 19:57 - 00000000 ____D () C:\Program Files (x86)\SimilarSites
2014-03-11 06:37 - 2014-03-16 15:21 - 00000406 _____ () C:\Windows\system32\checkdnsid.xml
2014-03-10 21:01 - 2014-03-16 10:09 - 00000728 _____ () C:\Windows\setupact.log
2014-03-10 21:01 - 2014-03-10 21:01 - 00000000 _____ () C:\Windows\setuperr.log
2014-03-10 21:00 - 2014-03-11 20:25 - 00008958 _____ () C:\Windows\PFRO.log
2014-03-10 20:55 - 2014-03-10 20:55 - 00001116 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-03-10 20:55 - 2014-03-10 20:55 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-03-10 20:55 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-10 20:50 - 2014-03-10 20:50 - 00002774 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-03-10 20:50 - 2014-03-10 20:50 - 00000829 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-03-10 20:50 - 2014-03-10 20:50 - 00000000 ____D () C:\ProgramData\Oracle
2014-03-10 20:50 - 2014-03-10 20:50 - 00000000 ____D () C:\Program Files\CCleaner
2014-03-10 20:49 - 2014-03-10 20:49 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-03-10 20:49 - 2014-03-10 20:49 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-03-10 20:49 - 2014-03-10 20:49 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-03-10 20:49 - 2014-03-10 20:49 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-03-10 20:43 - 2014-03-10 20:43 - 00003266 _____ () C:\Windows\System32\Tasks\{2BBDA6A8-2765-4E73-8998-DAD29C4705A8}
2014-03-10 20:42 - 2014-03-10 20:43 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-03-05 17:51 - 2014-03-05 17:51 - 00015662 _____ () C:\ComboFix.txt
2014-03-03 22:52 - 2014-03-05 17:51 - 00000000 ____D () C:\Qoobox
2014-03-03 22:52 - 2011-06-25 23:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-03-03 22:52 - 2010-11-07 10:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-03-03 22:52 - 2009-04-19 21:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-03-03 22:52 - 2000-08-30 17:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-03-03 22:52 - 2000-08-30 17:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-03-03 22:52 - 2000-08-30 17:00 - 00098816 _____ () C:\Windows\sed.exe
2014-03-03 22:52 - 2000-08-30 17:00 - 00080412 _____ () C:\Windows\grep.exe
2014-03-03 22:52 - 2000-08-30 17:00 - 00068096 _____ () C:\Windows\zip.exe
2014-03-03 22:51 - 2014-03-03 23:01 - 00000000 ____D () C:\Windows\erdnt
2014-03-02 13:23 - 2014-03-02 13:23 - 00000000 ____D () C:\Windows\ERUNT
2014-03-02 13:03 - 2014-03-02 13:03 - 01244192 _____ () C:\Users\Debbie\Desktop\AdwCleaner.exe
2014-02-28 23:13 - 2014-03-16 17:04 - 00000000 ____D () C:\FRST
2014-02-27 23:39 - 2014-02-27 23:39 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\LavasoftStatistics
2014-02-27 23:27 - 2014-03-16 10:09 - 00002312 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-02-27 23:26 - 2014-02-27 23:26 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-02-27 23:26 - 2014-02-27 23:26 - 00000000 ____D () C:\Program Files\Lavasoft
2014-02-27 23:26 - 2014-02-27 23:26 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-02-27 22:14 - 2014-02-27 22:14 - 00000000 ____D () C:\ProgramData\CDB
2014-02-27 22:13 - 2014-03-02 11:26 - 00003747 _____ () C:\Program Files (x86)\Mozilla Firefoxsafeguard-secure-search.xml
2014-02-27 22:13 - 2014-03-02 11:25 - 00050976 _____ (AVG Technologies) C:\Windows\system32\Drivers\avgtpx64.sys
2014-02-27 22:12 - 2014-02-27 22:14 - 00000119 _____ () C:\Windows\Reimage.ini
2014-02-27 22:06 - 2014-02-27 22:06 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
2014-02-27 21:58 - 2014-02-27 21:59 - 10820032 _____ (SurfRight B.V.) C:\Users\Debbie\Desktop\HitmanPro_x64.exe
2014-02-27 21:55 - 2014-02-27 21:55 - 00001154 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-02-27 21:55 - 2014-02-27 21:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-27 11:23 - 2014-02-27 11:23 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\Malwarebytes
2014-02-27 11:22 - 2014-02-27 11:22 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-27 11:08 - 2014-02-27 11:08 - 00000000 ____D () C:\ProgramData\GridinSoft
2014-02-27 10:36 - 2014-02-27 10:37 - 00000260 _____ () C:\Windows\setup.iss
2014-02-27 10:36 - 2014-02-27 10:36 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\NewSoft
2014-02-26 17:59 - 2014-02-26 19:58 - 218358213 _____ () C:\Users\Debbie\Desktop\eksrny.rar
2014-02-25 23:27 - 2014-02-25 23:27 - 00003626 _____ () C:\Windows\System32\Tasks\$dMM6KqyKu+JyN+{$
2014-02-25 23:04 - 2014-03-10 21:00 - 56036527 _____ () C:\Windows\system32\SavingsBullFilterService.log
2014-02-25 23:04 - 2014-02-25 23:04 - 00000000 _____ () C:\Windows\SysWOW64\Service.log
2014-02-25 23:04 - 2014-02-25 23:04 - 00000000 _____ () C:\Windows\system32\Service.log
2014-02-25 23:00 - 2014-02-25 23:01 - 00000000 ____D () C:\Program Files (x86)\freestar
2014-02-22 17:49 - 2014-02-22 17:49 - 00000222 _____ () C:\Users\Debbie\Desktop\Thief Gold.url
2014-02-22 17:49 - 2014-02-22 17:49 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-02-22 17:44 - 2014-03-10 20:54 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-22 17:44 - 2014-02-22 17:44 - 00000970 _____ () C:\Users\Public\Desktop\Steam.lnk
2014-02-16 16:25 - 2014-02-16 16:25 - 00000000 ____D () C:\Windows\SysWOW64\Adobe
2014-02-14 12:33 - 2014-02-27 22:14 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified Files and Folders =======

2014-03-16 17:04 - 2014-03-16 17:04 - 00014280 _____ () C:\Users\Debbie\Desktop\FRST.txt
2014-03-16 17:04 - 2014-02-28 23:13 - 00000000 ____D () C:\FRST
2014-03-16 17:03 - 2014-03-16 17:03 - 02157056 _____ (Farbar) C:\Users\Debbie\Desktop\FRST64.exe
2014-03-16 16:55 - 2013-02-25 21:14 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-16 15:21 - 2014-03-11 06:37 - 00000406 _____ () C:\Windows\system32\checkdnsid.xml
2014-03-16 13:36 - 2013-02-21 15:31 - 01596435 _____ () C:\Windows\WindowsUpdate.log
2014-03-16 11:22 - 2014-03-13 11:25 - 00022836 ____H () C:\Users\Debbie\Desktop\~WRL0003.tmp
2014-03-16 10:16 - 2009-07-13 21:45 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-16 10:16 - 2009-07-13 21:45 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-16 10:15 - 2009-07-13 22:13 - 00784326 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-16 10:09 - 2014-03-10 21:01 - 00000728 _____ () C:\Windows\setupact.log
2014-03-16 10:09 - 2014-02-27 23:27 - 00002312 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-03-16 10:09 - 2009-07-13 22:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-15 08:21 - 2013-06-27 22:06 - 00000000 ____D () C:\Users\Debbie\Documents\Resumes and Cover Letters
2014-03-14 15:54 - 2009-07-13 22:08 - 00032568 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-13 10:13 - 2009-07-13 21:45 - 00374184 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-12 21:19 - 2013-02-26 15:41 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-03-11 20:25 - 2014-03-10 21:00 - 00008958 _____ () C:\Windows\PFRO.log
2014-03-11 20:24 - 2014-03-11 19:57 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\FlvPlayer
2014-03-11 19:57 - 2014-03-11 19:57 - 00003240 _____ () C:\Windows\System32\Tasks\MySearchDial
2014-03-11 19:57 - 2014-03-11 19:57 - 00000296 _____ () C:\Windows\Tasks\MySearchDial.job
2014-03-11 19:57 - 2014-03-11 19:57 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\SimilarSites
2014-03-11 19:57 - 2014-03-11 19:57 - 00000000 ____D () C:\Program Files (x86)\SiteFinder
2014-03-11 19:57 - 2014-03-11 19:57 - 00000000 ____D () C:\Program Files (x86)\SimilarSites
2014-03-11 17:55 - 2013-02-25 21:14 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-11 17:55 - 2013-02-25 21:13 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-11 17:55 - 2013-02-25 21:13 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-10 21:01 - 2014-03-10 21:01 - 00000000 _____ () C:\Windows\setuperr.log
2014-03-10 21:00 - 2014-02-25 23:04 - 56036527 _____ () C:\Windows\system32\SavingsBullFilterService.log
2014-03-10 20:55 - 2014-03-10 20:55 - 00001116 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-03-10 20:55 - 2014-03-10 20:55 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-03-10 20:54 - 2014-02-22 17:44 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-03-10 20:54 - 2013-12-25 13:00 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\DAEMON Tools Lite
2014-03-10 20:52 - 2013-02-21 15:22 - 00000000 ____D () C:\Windows\Panther
2014-03-10 20:50 - 2014-03-10 20:50 - 00002774 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-03-10 20:50 - 2014-03-10 20:50 - 00000829 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-03-10 20:50 - 2014-03-10 20:50 - 00000000 ____D () C:\ProgramData\Oracle
2014-03-10 20:50 - 2014-03-10 20:50 - 00000000 ____D () C:\Program Files\CCleaner
2014-03-10 20:49 - 2014-03-10 20:49 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-03-10 20:49 - 2014-03-10 20:49 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-03-10 20:49 - 2014-03-10 20:49 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-03-10 20:49 - 2014-03-10 20:49 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-03-10 20:49 - 2013-03-10 11:29 - 00000000 ____D () C:\Program Files (x86)\Java
2014-03-10 20:43 - 2014-03-10 20:43 - 00003266 _____ () C:\Windows\System32\Tasks\{2BBDA6A8-2765-4E73-8998-DAD29C4705A8}
2014-03-10 20:43 - 2014-03-10 20:42 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-03-05 17:51 - 2014-03-05 17:51 - 00015662 _____ () C:\ComboFix.txt
2014-03-05 17:51 - 2014-03-03 22:52 - 00000000 ____D () C:\Qoobox
2014-03-05 17:49 - 2009-07-13 19:34 - 00000215 _____ () C:\Windows\system.ini
2014-03-03 23:26 - 2013-02-26 16:05 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-03 23:26 - 2013-02-26 16:05 - 00000000 ____D () C:\ProgramData\Skype
2014-03-03 23:02 - 2009-07-13 20:20 - 00000000 __RHD () C:\Users\Default
2014-03-03 23:01 - 2014-03-03 22:51 - 00000000 ____D () C:\Windows\erdnt
2014-03-02 13:23 - 2014-03-02 13:23 - 00000000 ____D () C:\Windows\ERUNT
2014-03-02 13:17 - 2014-01-14 21:51 - 00000000 ____D () C:\AdwCleaner
2014-03-02 13:03 - 2014-03-02 13:03 - 01244192 _____ () C:\Users\Debbie\Desktop\AdwCleaner.exe
2014-03-02 11:26 - 2014-02-27 22:13 - 00003747 _____ () C:\Program Files (x86)\Mozilla Firefoxsafeguard-secure-search.xml
2014-03-02 11:25 - 2014-02-27 22:13 - 00050976 _____ (AVG Technologies) C:\Windows\system32\Drivers\avgtpx64.sys
2014-03-01 11:18 - 2013-07-17 18:10 - 00389240 _____ (BitDefender S.R.L.) C:\Windows\system32\Drivers\trufos.sys
2014-02-28 23:05 - 2014-03-12 17:54 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-28 22:17 - 2014-03-12 17:54 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-28 22:16 - 2014-03-12 17:54 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-28 21:58 - 2014-03-12 17:54 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-28 21:52 - 2014-03-12 17:54 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-28 21:51 - 2014-03-12 17:54 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-28 21:42 - 2014-03-12 17:54 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-28 21:40 - 2014-03-12 17:54 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-28 21:37 - 2014-03-12 17:54 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-28 21:33 - 2014-03-12 17:54 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-28 21:33 - 2014-03-12 17:54 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-28 21:32 - 2014-03-12 17:54 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-28 21:30 - 2014-03-12 17:54 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-28 21:23 - 2014-03-12 17:54 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-02-28 21:17 - 2014-03-12 17:54 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-28 21:11 - 2014-03-12 17:54 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-28 21:02 - 2014-03-12 17:54 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-28 20:54 - 2014-03-12 17:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-28 20:52 - 2014-03-12 17:54 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-28 20:51 - 2014-03-12 17:54 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-28 20:47 - 2014-03-12 17:54 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-28 20:43 - 2014-03-12 17:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-28 20:43 - 2014-03-12 17:54 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-28 20:42 - 2014-03-12 17:54 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-28 20:40 - 2014-03-12 17:54 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-28 20:38 - 2014-03-12 17:54 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-28 20:37 - 2014-03-12 17:54 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-28 20:35 - 2014-03-12 17:54 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-28 20:18 - 2014-03-12 17:54 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-28 20:16 - 2014-03-12 17:54 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-28 20:14 - 2014-03-12 17:54 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-28 20:10 - 2014-03-12 17:54 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-28 20:03 - 2014-03-12 17:54 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-28 20:00 - 2014-03-12 17:54 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-28 19:57 - 2014-03-12 17:54 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-28 19:38 - 2014-03-12 17:54 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-28 19:32 - 2014-03-12 17:54 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-28 19:27 - 2014-03-12 17:54 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-28 19:25 - 2014-03-12 17:54 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-28 19:25 - 2014-03-12 17:54 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-27 23:39 - 2014-02-27 23:39 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\LavasoftStatistics
2014-02-27 23:26 - 2014-02-27 23:26 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-02-27 23:26 - 2014-02-27 23:26 - 00000000 ____D () C:\Program Files\Lavasoft
2014-02-27 23:26 - 2014-02-27 23:26 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-02-27 22:14 - 2014-02-27 22:14 - 00000000 ____D () C:\ProgramData\CDB
2014-02-27 22:14 - 2014-02-27 22:12 - 00000119 _____ () C:\Windows\Reimage.ini
2014-02-27 22:14 - 2014-02-14 12:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-27 22:06 - 2014-02-27 22:06 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
2014-02-27 22:06 - 2014-01-18 18:58 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-02-27 21:59 - 2014-02-27 21:58 - 10820032 _____ (SurfRight B.V.) C:\Users\Debbie\Desktop\HitmanPro_x64.exe
2014-02-27 21:55 - 2014-02-27 21:55 - 00001154 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-02-27 21:55 - 2014-02-27 21:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-27 11:23 - 2014-02-27 11:23 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\Malwarebytes
2014-02-27 11:22 - 2014-02-27 11:22 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-27 11:08 - 2014-02-27 11:08 - 00000000 ____D () C:\ProgramData\GridinSoft
2014-02-27 10:37 - 2014-02-27 10:36 - 00000260 _____ () C:\Windows\setup.iss
2014-02-27 10:37 - 2013-02-21 16:54 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-02-27 10:36 - 2014-02-27 10:36 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\NewSoft
2014-02-26 19:58 - 2014-02-26 17:59 - 218358213 _____ () C:\Users\Debbie\Desktop\eksrny.rar
2014-02-26 18:45 - 2013-02-25 18:00 - 00000000 ___RD () C:\Users\Debbie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-26 08:35 - 2013-02-21 15:28 - 00768192 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-25 23:27 - 2014-02-25 23:27 - 00003626 _____ () C:\Windows\System32\Tasks\$dMM6KqyKu+JyN+{$
2014-02-25 23:04 - 2014-02-25 23:04 - 00000000 _____ () C:\Windows\SysWOW64\Service.log
2014-02-25 23:04 - 2014-02-25 23:04 - 00000000 _____ () C:\Windows\system32\Service.log
2014-02-25 23:01 - 2014-02-25 23:00 - 00000000 ____D () C:\Program Files (x86)\freestar
2014-02-25 23:01 - 2013-02-25 18:00 - 00000000 ____D () C:\Users\Debbie
2014-02-23 22:38 - 2013-03-16 23:07 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\vlc
2014-02-22 18:26 - 2014-02-13 20:08 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-02-22 17:49 - 2014-02-22 17:49 - 00000222 _____ () C:\Users\Debbie\Desktop\Thief Gold.url
2014-02-22 17:49 - 2014-02-22 17:49 - 00000000 ____D () C:\Users\Debbie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-02-22 17:44 - 2014-02-22 17:44 - 00000970 _____ () C:\Users\Public\Desktop\Steam.lnk
2014-02-16 16:27 - 2013-02-25 21:13 - 00000000 ____D () C:\Windows\SysWOW64\Macromed
2014-02-16 16:25 - 2014-02-16 16:25 - 00000000 ____D () C:\Windows\SysWOW64\Adobe
2014-02-15 10:48 - 2013-02-27 21:12 - 00000000 ____D () C:\Users\Debbie\Desktop\Beatricemon
2014-02-14 22:03 - 2013-08-14 13:56 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-14 22:02 - 2013-02-21 17:52 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2014-03-10 18:26

==================== End Of Log ============================

gringo_pr · March 17, 2014

Hello petalxrain

I need you to download this script I have made for you --> fixlist.txt

It needs to be saved Next to the "Farbar Recovery Scan Tool" (FRST) program (If asked to overwrite existing one please allow)

Run FRST again but this time press the Fix button just once and wait.

When finished, it will make a log (fixlog.txt) next to FRST. Please copy and paste the content of this file to your reply.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Gringo

petalxrain · March 18, 2014

Hi Gringo,

I'm not sure if I did this properly, but I received this log:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-03-2014
Ran by Debbie at 2014-03-17 21:45:01 Run:1
Running from C:\Users\Debbie\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
SearchScopes: HKCU - DefaultScope {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = http://start.mysearc...ults.php?f=4&q={searchTerms}&a=md_14_11_ff&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyEzy0ByCtAtDyEtCyE0ByBtN0D0Tzu0SzztDtCtN1L2XzutBtFtCzztFtBtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyBtA0CzzyEzytDtBtG0DtCyE0DtG0DtDyDyEtG0Dzz0ByEtGtDtDtA0D0D0C0AtD0AyB0F0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCyEtD0C0FyD0B0BtGyEtC0A0BtGyEyD0BtBtG0DtD0DzytGyEtB0FyC0D0CyEzyzyyDyBtD2Q&cr=746986552&ir=
SearchScopes: HKLM - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = http://start.mysearc...ults.php?f=4&q={searchTerms}&a=md_14_11_ff&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyEzy0ByCtAtDyEtCyE0ByBtN0D0Tzu0SzztDtCtN1L2XzutBtFtCzztFtBtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyBtA0CzzyEzytDtBtG0DtCyE0DtG0DtDyDyEtG0Dzz0ByEtGtDtDtA0D0D0C0AtD0AyB0F0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCyEtD0C0FyD0B0BtGyEtC0A0BtGyEyD0BtBtG0DtD0DzytGyEtB0FyC0D0CyEzyzyyDyBtD2Q&cr=746986552&ir=
SearchScopes: HKCU - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = http://start.mysearc...ults.php?f=4&q={searchTerms}&a=md_14_11_ff&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyEzy0ByCtAtDyEtCyE0ByBtN0D0Tzu0SzztDtCtN1L2XzutBtFtCzztFtBtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyBtA0CzzyEzytDtBtG0DtCyE0DtG0DtDyDyEtG0Dzz0ByEtGtDtDtA0D0D0C0AtD0AyB0F0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCyEtD0C0FyD0B0BtGyEtC0A0BtGyEyD0BtBtG0DtD0DzytGyEtB0FyC0D0CyEzyzyyDyBtD2Q&cr=746986552&ir=
FF DefaultSearchEngine: Mysearchdial
FF SearchEngineOrder.1: Mysearchdial
FF SelectedSearchEngine: Mysearchdial
S2 vToolbarUpdater18.0.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.0.0\ToolbarUpdater.exe [X]
2014-03-11 19:57 - 2014-03-11 19:57 - 00003240 _____ () C:\Windows\System32\Tasks\MySearchDial
2014-03-11 19:57 - 2014-03-11 19:57 - 00000296 _____ () C:\Windows\Tasks\MySearchDial.job
2014-03-10 21:00 - 2014-02-25 23:04 - 56036527 _____ () C:\Windows\system32\SavingsBullFilterService.log
2014-02-27 22:14 - 2014-02-27 22:12 - 00000119 _____ () C:\Windows\Reimage.ini

*****************

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8} => Key deleted successfully.
HKCR\CLSID\{77AA745B-F4F8-45DA-9B14-61D2D95054C8} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8} => Key deleted successfully.
HKCR\CLSID\{77AA745B-F4F8-45DA-9B14-61D2D95054C8} => Key not found.
Firefox DefaultSearchEngine deleted successfully.
Firefox SearchEngineOrder.1 deleted successfully.
Firefox SelectedSearchEngine deleted successfully.
vToolbarUpdater18.0.0 => Service deleted successfully.
C:\Windows\System32\Tasks\MySearchDial => Moved successfully.
C:\Windows\Tasks\MySearchDial.job => Moved successfully.
C:\Windows\system32\SavingsBullFilterService.log => Moved successfully.
C:\Windows\Reimage.ini => Moved successfully.

==== End of Fixlog ====

Thanks for your continued help!

gringo_pr · March 19, 2014

Greetings

These logs are looking very good, we are almost done!!! Just one more scan to go.

:Remove unneeded start-up entries:

This part of the fix is purely optional

These are programs that start up when you turn on your computer but don't need to be, any of these programs you can click on their icons (or start from the control panel) and start the program when you need it. By stopping these programs you will boot up faster and your computer will work faster.

Run HijackThis (rightclick and run as admin)
Click on the Scan button
Put a check beside all of the items listed below (if present):
- O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
  O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
  O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
  O4 - Startup: OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
Close all open windows and browsers/email, etc...
Click on the "Fix Checked" button
When completed, close the application.
- NOTE**You can research each of those lines >here< and see if you want to keep them or not
  just copy the name between the brackets and paste into the search space
  O4 - HKLM\..\Run: [IntelliPoint]

Eset Online Scanner

**Note** You will need to use Internet explorer for this scan - Vista and win 7 right click on IE shortcut and run as admin

Go Eset web page to run an online scanner from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
click on the Run ESET Online Scanner button
Tick the box next to YES, I accept the Terms of Use.
- Click Start
When asked, allow the add/on to be installed
- Click Start
Make sure that the option Remove found threats is unticked
Click on Advanced Settings, ensure the options
- Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
wait for the virus definitions to be downloaded
Wait for the scan to finish

When the scan is complete

If no threats were found
- put a checkmark in "Uninstall application on close"
- close program
- report to me that nothing was found

If threats were found
- click on "list of threats found"
- click on "export to text file" and save it as ESET SCAN and save to the desktop
- Click on back
- put a checkmark in "Uninstall application on close"
- click on finish
- close program
- copy and paste the report here

Gringo

petalxrain · March 20, 2014

Hi Gringo,

I received the following report due to found threats:

C:\$RECYCLE.BIN\S-1-5-21-4039069230-3056711612-840082808-1001\$RL5D6JY.exe   Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\AdwCleaner\Quarantine\C\Program Files\Level Quality Watcher\v1.01\levelqualitywatcher64.exe.vir   a variant of Win64/Adware.Adpeak.C application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir   Win32/Toolbar.Conduit.Y potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\KeyBar_1.13\hk64tbKeyB.dll.vir   Win64/Toolbar.Conduit.B potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\KeyBar_1.13\hktbKeyB.dll.vir   Win32/Toolbar.Conduit.X potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\KeyBar_1.13\KeyBar_1.13ToolbarHelper.exe.vir   Win32/Toolbar.Conduit.V potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\KeyBar_1.13\ldrtbKeyB.dll.vir   a variant of Win32/Toolbar.Conduit.P potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\KeyBar_1.13\prxtbKeyB.dll.vir   Win32/Toolbar.Conduit.X potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\KeyBar_1.13\tbKeyB.dll.vir   a variant of Win32/Toolbar.Conduit.X potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mozilla Firefox\browser\nsprotector.js.vir   Win32/Conduit.SearchProtect.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\PutLockerDownloader\PutLockerDownloaderIE.exe.vir   Win32/Packed.ScrambleWrapper.C potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\PutLockerDownloader.com\PTLextsetup.exe.vir   Win32/Packed.ScrambleWrapper.C potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchprotect\bin\ChromeModule.dll.vir   probably a variant of Win32/Conduit.SearchProtect.C potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchprotect\bin\FirefoxModule.dll.vir   probably a variant of Win32/Conduit.SearchProtect.C potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchprotect\bin\InternetExplorerModule.dll.vir   probably a variant of Win32/Conduit.SearchProtect.C potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchprotect\bin\SPRunner.exe.vir   a variant of Win32/Conduit.SearchProtect.D potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchprotect\ffprotect\application.js.vir   Win32/Conduit.SearchProtect.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Searchprotect\ffprotect\nsprotector.js.vir   Win32/Conduit.SearchProtect.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Debbie\AppData\Local\Conduit\CT3291326\KeyBar_1.13AutoUpdateHelper.exe.vir   a variant of Win32/Toolbar.Conduit.X potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Debbie\AppData\LocalLow\KeyBar_1.13\hk64tbKey0.dll.vir   a variant of Win64/Toolbar.Conduit.B potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Debbie\AppData\LocalLow\KeyBar_1.13\hk64tbKeyB.dll.vir   Win64/Toolbar.Conduit.B potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Debbie\AppData\LocalLow\KeyBar_1.13\hktbKey0.dll.vir   a variant of Win32/Toolbar.Conduit.X potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Debbie\AppData\LocalLow\KeyBar_1.13\hktbKeyB.dll.vir   Win32/Toolbar.Conduit.X potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Debbie\AppData\LocalLow\KeyBar_1.13\ldrtbKey0.dll.vir   a variant of Win32/Toolbar.Conduit.P potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Debbie\AppData\LocalLow\KeyBar_1.13\ldrtbKeyB.dll.vir   a variant of Win32/Toolbar.Conduit.P potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Debbie\AppData\LocalLow\KeyBar_1.13\tbKey0.dll.vir   a variant of Win32/Toolbar.Conduit.X potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Debbie\AppData\LocalLow\KeyBar_1.13\tbKey1.dll.vir   a variant of Win32/Toolbar.Conduit.Y potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Debbie\AppData\LocalLow\KeyBar_1.13\tbKeyB.dll.vir   a variant of Win32/Toolbar.Conduit.X potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Debbie\AppData\LocalLow\KeyBar_1.13\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.12\bin\PriceGongIE.dll.vir   a variant of Win32/PriceGong.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Debbie\AppData\Roaming\playnowradio\playnowradio\1.3.4.8\chrmXtn.dll.vir   a variant of Win32/Toolbar.Montiera.H potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Debbie\AppData\Roaming\playnowradio\playnowradio\1.3.4.8\playnowradio.exe.vir   a variant of Win32/Toolbar.Montiera.H potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Debbie\AppData\Roaming\Searchprotect\bin\ChromeModule.dll.vir   probably a variant of Win32/Conduit.SearchProtect.C potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Debbie\AppData\Roaming\Searchprotect\bin\CltMngSvc.exe.vir   Win32/Conduit.SearchProtect.E potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Debbie\AppData\Roaming\Searchprotect\bin\FirefoxModule.dll.vir   probably a variant of Win32/Conduit.SearchProtect.C potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Debbie\AppData\Roaming\Searchprotect\bin\InternetExplorerModule.dll.vir   probably a variant of Win32/Conduit.SearchProtect.C potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Debbie\AppData\Roaming\Searchprotect\ffprotect\application.js.vir   Win32/Conduit.SearchProtect.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Debbie\AppData\Roaming\Searchprotect\ffprotect\nsprotector.js.vir   Win32/Conduit.SearchProtect.A potentially unwanted application
C:\Users\Debbie\AppData\Local\Temp\is1496958499\1065151_stp\wajam_validate.exe   Win32/Wajam.F potentially unwanted application

gringo_pr · March 22, 2014

Hello petalxrain

There are some minor things in your online scan that should be removed.

delete files

Copy all text in the code box (below)...to Notepad.

@echo offrd /s /q "C:\AdwCleaner\"del /f /s /q "C:\$RECYCLE.BIN\S-1-5-21-4039069230-3056711612-840082808-1001\$RL5D6JY.exe"del /f /s /q "C:\Users\Debbie\AppData\Local\Temp\is1496958499\1065151_stp\wajam_validate.exe"del %0

Save the Notepad file on your desktop...as delfile.bat... save type as "All Files"
It should look like this: <--XP<--vista
Double click on delfile.bat to execute it.
A black CMD window will flash, then disappear...this is normal.
The files and folders, if found...will have been deleted and the "delfile.bat" file will also be deleted.

The rest of the Online scan is only reporting backups created during the course of this fix C:\Qoobox\Quarantine\, and/or items located in System Restore's cache C:\System Volume Information\, Whatever is in these folders can't harm you unless you choose to perform a manual restore. the following steps will remove these backups.

Very well done!! This is my general post for when your logs show no more signs of malware - Please let me know if you still are having problems with your computer and what these problems are.

:Why we need to remove some of our tools:

Some of the tools we have used to clean your computer were made by fellow malware fighters and are very powerful and if used incorrectly or at the wronge time can make the computer an expensive paper weight.
They are updated all the time and some of them more than once a day so by the time you are ready to use them again they will already be outdated.
The following procedures will implement some cleanup procedures to remove these tools. It will also reset your System Restore by flushing out previous restore points and create a new restore point. It will also remove all the backups our tools may have made.

:DeFogger:

Note** Defogger only needs to be run if it was run when we first started. If you have not already run it then skip this.

To re-enable your Emulation drivers, double click DeFogger to run the tool.
- The application window will appear
- Click the Re-enable button to re-enable your CD Emulation drivers
- Click Yes to continue
- A 'Finished!' message will appear
- Click OK
- DeFogger will now ask to reboot the machine - click OK.
Your Emulation drivers are now re-enabled.

:Uninstall ComboFix:

turn off all active protection software
push the "windows key" + "R" (between the "Ctrl" button and "Alt" Button)
please copy and past the following into the box ComboFix /Uninstall and click OK.
Note the space between the X and the /Uninstall, it needs to be there.

:Remove the rest of our tools:

Please download DelFix and save it to desktop. This tool will remove all the tools we used to clean your pc.

Double-click DelFix.exe.
select all options avalible
Click the Run button.
The tool will delete itself once it finishes, if not delete it by yourself.
If asked to restart the computer, please do so

:The programs you can keep:

Some of the programs that we have used would be a good idea to keep and used often in helping to keep the computer clean. I use these programs on my computer.

Revo Uninstaller Free - this is the uninstaller that I had you download and works allot better than add/remove in windows and has saved me more than once from corrupted installs and uninstalls
CCleaner - This is a good program to clean out temp files, I would use this once a week or before any malware scan to remove unwanted temp files - It has a built in registry cleaner but I would leave that alone and not use any registry cleaner
Malwarebytes' Anti-Malware The Gold standerd today in antimalware scanners

:Security programs:

One of the questions I am asked all the time is "What programs do you use" I have at this time 4 computers in my home and I have this setup on all 4 of them.

Microsoft Security Essentials - provides real-time protection for your home PC that guards against viruses, spyware, and other malicious software.
WinPatrol As a robust security monitor, WinPatrol will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. WinPatrol takes snapshot of your critical system resources and alerts you to any changes that may occur without your knowledge.
Malwarebytes' Anti-Malware Malwarebytes' Anti-Malware is a new and powerful anti-malware tool. It is
totally free but for real-time protection you will have to pay a small one-time fee. We used this to help clean your computer and recomend keeping it and using often. (I have upgraded to the paid version of MBAM and I am glad I did)
Note** If you decide to install MSE you will need to uninstall your present Antivirus

:Security awareness:

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article

Strong passwords: How to create and use them Then consider a password keeper, to keep all your passwords safe. KeePass is a small utility that allows you to manage all your passwords.

As Java seems to get exploited on a daily basis I advise to disable java in your web browsers - How to disable java in your web browsers - Disable Java

The other question I am asked all the time is "How can I prevent this from happening again." and the short answer to that is to be aware of what is out there and how to start spotting dangers.

Here are some articles that are must reads and should be read by everybody in your household that uses the internet

internetsafety
Internet Safety for Kids

Here is some more reading for you from some of my colleges

PC Safety and Security - What Do I Need? from my friends at Tech Support Forum
COMPUTER SECURITY - a short guide to staying safer online from my friends at Malware Removal

quoted from Tech Support Forum

Conclusion
There is no such thing as 'perfect security'. This applies to many things, not just computer systems. Using the above guide you should be able to take all the reasonable steps you can to prevent infection. However, the most important part of all this is you, the user. Surf sensibly and think before you download a file or click on a link. Take a few moments to assess the possible risks and you should be able to enjoy all the internet has to offer.

I'd be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can then be closed.

I Will Keep This Open For About Three Days, If Anything Comes Up - Just Come Back And Let Me Know, after that time you will have to send me a PM

My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here --><-- Don't worry every little bit helps.

Gringo

petalxrain · March 23, 2014

Thanks a lot for everything, Gringo! You were a great help!!!

gringo_pr · March 24, 2014

you are more than welcome

gringo

gringo_pr · March 27, 2014

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.

Help! Play Now Radio malware

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information