Compromised system - Remote access

dante18 · March 16, 2014

Today, my PC was compromised in the form of remote access. I was getting random mouse clicks and keyboard inputs.

When I clicked the start button, I suppose the hacker was still typing while in my system - he wrote "I dunno what to do next".

I consider myself to be intermediately savvy with the PC - have always kept it clean with ESET NOD32 Antivirus 5, stayed away from Malware and Adware in general. After the compromise, I disabled my network adapter and rebooted my computer. I then ran a full PC scan and was found to have these:

C:\w\chLogic.exe Win32/Conduit.SearchProtect.J potentially unwanted application

C:\Users\Soo\AppData\Roaming\Adobe\ieLogic.exe Win32/Toolbar.Conduit potentially unwanted application

C:\Users\Soo\AppData\Roaming\Adobe\w.exe a variant of Win32/Complitly.A potentially unwanted application

They were subsequently quarantined or deleted. Running the Malwarebytes Anti-Malware scan turned out to be clear. I have also ran DDS and attached the scan results.

Can anyone offer some advice on steps to take next, and how to prevent future similar attacks?

Thanks in advance!

dds.txt

attach.txt

Maniac · March 16, 2014

Hello dante18 and :welcome: ! My name is Borislav and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.
Do not perform any kind of scanning and fixing without my instructions. If you want to proceed on your own, please let me know.

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as µTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

When you are done, please generate a new fresh DDS log files.

dante18 · March 17, 2014

Thanks for your reply! I have disabled uTorrent and here are the logs:

DDS.txt

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 11.0.9600.16521 BrowserJavaVersion: 10.51.2

Run by Soo at 20:20:34 on 2014-03-17

Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.3582.1593 [GMT 8:00]

.

AV: ESET NOD32 Antivirus 5.0 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}

SP: ESET NOD32 Antivirus 5.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ================

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\atiesrxx.exe

C:\Windows\system32\atieclxx.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Windows\system32\PnkBstrA.exe

C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\System32\WUDFHost.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesApp32.exe

C:\Windows\system32\taskhost.exe

C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe

C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe

C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe

C:\Program Files\Mindjet\MindManager 10\MmReminderService.exe

C:\Program Files\Acronis\DriveMonitor\adm_tray.exe

C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe

C:\Windows\system\HsMgr.exe

C:\Program Files\ASUS\ASUS Ai Charger\AiChargerAP.exe

C:\Program Files\ASUS Xonar DG Audio\Customapp\ASUSAUDIOCENTER.EXE

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files\Logitech Gaming Software\LCore.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\DAEMON Tools Lite\DTLite.exe

C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe

C:\Program Files\Internet Download Manager\IDMan.exe

C:\Users\Soo\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

C:\Users\Soo\AppData\Roaming\Spotify\spotify.exe

C:\Users\Soo\AppData\Roaming\Dropbox\bin\Dropbox.exe

C:\Program Files\Internet Download Manager\IEMonitor.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Users\Soo\AppData\Roaming\Spotify\Data\SpotifyHelper.exe

C:\Windows\system32\DllHost.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

C:\Program Files\Microsoft Office\Office15\MsoSync.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

.

============== Pseudo HJT Report ===============

.

uSearch Bar = Preserve

BHO: IDM integration (IDMIEHlprObj Class): {0055C089-8582-441B-A0BF-17B458C2A3A8} - c:\program files\internet download manager\IDMIECC.dll

BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - c:\program files\microsoft office\office15\OCHelper.dll

BHO: CmjBrowserHelperObject Object: {6FE6A929-59D1-4763-91AD-29B61CFFB35B} - c:\program files\mindjet\mindmanager 10\Mm8InternetExplorer.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office\office15\URLREDIR.DLL

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll

BHO: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrun

uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun

uRun: [uTorrent] "c:\users\soo\appdata\roaming\utorrent\uTorrent.exe" /MINIMIZED

uRun: [iCloudServices] c:\program files\common files\apple\internet services\iCloudServices.exe

uRun: [iDMan] c:\program files\internet download manager\IDMan.exe /onboot

uRun: [spotify Web Helper] "c:\users\soo\appdata\roaming\spotify\data\SpotifyWebHelper.exe"

uRun: [spotify] "c:\users\soo\appdata\roaming\spotify\spotify.exe" /uri spotify:autostart

mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice

mRun: [XboxStat] "c:\program files\microsoft xbox 360 accessories\XboxStat.exe" silentrun

mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 10.0\acrobat\Acrotray.exe"

mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

mRun: [MMReminderService] c:\program files\mindjet\mindmanager 10\MMReminderService.exe

mRun: [adm_tray.exe] c:\program files\acronis\drivemonitor\adm_tray.exe

mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe"

mRun: [Cmaudio8788] RunDll32 cmicnfgp.cpl,CMICtrlWnd

mRun: [Cmaudio8788GX] c:\windows\system\HsMgr.exe Envoke

mRun: [ASUS Ai Charger] c:\program files\asus\asus ai charger\AiChargerAP.exe

mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"

mRun: [startCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun

mRun: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "c:\program files\amd avt\bin\kdbsync.exe" aml

mRun: [Launch LCore] c:\program files\logitech gaming software\LCore.exe /minimized

StartupFolder: c:\users\soo\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\soo\appdata\roaming\dropbox\bin\Dropbox.exe

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: Download all links with IDM - c:\program files\internet download manager\IEGetAll.htm

IE: Download with IDM - c:\program files\internet download manager\IEExt.htm

IE: {2F72393D-2472-4F82-B600-ED77F354B7FF} - {6FE6A929-59D1-4763-91AD-29B61CFFB35B} - c:\program files\mindjet\mindmanager 10\Mm8InternetExplorer.dll

IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - c:\program files\microsoft office\office15\OCHelper.dll

Trusted Zone: dell.com

TCP: NameServer = 192.168.1.254

TCP: Interfaces\{4D331FC6-3C59-4362-8A9B-CEAC57CEFA9A} : DHCPNameServer = 8.8.8.8

TCP: Interfaces\{AC1D41B4-47B0-45F7-99EB-43A63C53259D} : DHCPNameServer = 165.21.83.88 165.21.100.88

TCP: Interfaces\{AFA90A4F-3679-4635-918B-EAFB4138B73D} : DHCPNameServer = 203.116.1.94 203.116.254.150

TCP: Interfaces\{D65CB062-1A70-4AC0-8C96-142023D35D99} : DHCPNameServer = 192.168.1.254

Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office15\MSOXMLMF.DLL

Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - c:\program files\microsoft office\office15\MSOSB.DLL

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll

SSODL: WebCheck - <orphaned>

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\33.0.1750.154\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

mASetup: {90EF4A5E-85DB-4825-96F5-1AB93C2A8EEB} - c:\program files\mindjet\mindmanager 10\sys\MmInternetExplorerActiveSetup.vbs

Hosts: 72.8.150.50 us.actual.battle.net

Hosts: 72.8.150.50 eu.actual.battle.net

Hosts: 72.8.150.50 enGB.nydus.battle.net

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\soo\appdata\roaming\mozilla\firefox\profiles\kj7pbnul.default-1394959147407\

FF - plugin: c:\progra~1\mif5ba~1\office15\NPSPWRAP.DLL

FF - plugin: c:\program files\adobe\acrobat 10.0\acrobat\air\nppdf32.dll

FF - plugin: c:\program files\adobe\reader 11.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\battlelog web plugins\2.3.0\npesnlaunch.dll

FF - plugin: c:\program files\common files\adobe\oobe\pdapp\ccm\utilities\npAdobeAAMDetect32.dll

FF - plugin: c:\program files\common files\adobe\oobe\pdapp\ccm\utilities\npAdobeAAMDetect64.dll

FF - plugin: c:\program files\google\update\1.3.22.5\npGoogleUpdate3.dll

FF - plugin: c:\program files\java\jre7\bin\dtplugin\npdeployJava1.dll

FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll

FF - plugin: c:\program files\microsoft silverlight\5.1.30214.0\npctrlui.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npMeetingJoinPluginOC.dll

FF - plugin: c:\program files\ubisoft\ubisoft game launcher\npuplaypc.dll

FF - plugin: c:\program files\ubisoft\ubisoft game launcher\npuplaypchub.dll

FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_12_0_0_77.dll

FF - plugin: c:\windows\system32\wat\npWatWeb.dll

.

============= SERVICES / DRIVERS ===============

.

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2013-5-29 242240]

R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2013-4-30 217088]

R2 eamonm;eamonm;c:\windows\system32\drivers\eamonm.sys [2011-8-9 163424]

R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2011-8-9 974944]

R2 epfwwfpr;epfwwfpr;c:\windows\system32\drivers\epfwwfpr.sys [2011-8-4 103112]

R2 IDMWFP;IDMWFP;c:\windows\system32\drivers\idmwfp.sys [2013-10-9 107488]

R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\tuneup utilities 2014\TuneUpUtilitiesService32.exe [2013-8-29 1740600]

R3 AiCharger;AiCharger;c:\windows\system32\drivers\AiCharger.sys [2012-11-2 13952]

R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2012-5-14 86656]

R3 cmudaxp;ASUS Xonar DG Audio Interface;c:\windows\system32\drivers\cmudaxp.sys [2013-7-22 1768960]

R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-11-24 19720]

R3 LGSHidFilt;Logitech Gaming KMDF HID Filter Driver;c:\windows\system32\drivers\LGSHidFilt.Sys [2013-5-30 39960]

R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [2009-11-24 14856]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2009-3-1 139776]

R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\tuneup utilities 2014\TuneUpUtilitiesDriver32.sys [2013-8-21 12320]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]

S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-9-5 171680]

S3 AirDisplay;Air Display Support;c:\windows\system32\drivers\AVVideoCard.sys [2012-9-24 14784]

S3 AirDisplayMirror;Air Display Mirror Support;c:\windows\system32\drivers\AVVideoCardMirror.sys [2012-9-24 14784]

S3 andnetadb;ADB Interface DriverNet;c:\windows\system32\drivers\lgandnetadb.sys [2013-4-18 25856]

S3 AndNetDiag;LGE AndroidNet USB Serial Port;c:\windows\system32\drivers\lgandnetdiag.sys [2013-4-18 23168]

S3 ANDNetModem;LGE AndroidNet USB Modem;c:\windows\system32\drivers\lgandnetmodem.sys [2013-6-28 27776]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]

S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\drivers\ssudbus.sys [2013-6-4 84248]

S3 GenericMount;Generic Mount Driver;c:\windows\system32\drivers\GenericMount.sys [2009-9-21 57840]

S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\ieetwcollector.exe [2014-3-13 108032]

S3 KINONI_Wave;Kinoni Audio Source;c:\windows\system32\drivers\kinonivad.sys [2013-2-26 18432]

S3 kinonivd;Kinoni Video Source;c:\windows\system32\drivers\kinonivd.sys [2013-2-26 2782080]

S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [2013-7-25 18944]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-10-29 14848]

S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2014-3-13 49152]

S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2012-7-25 1343400]

S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-5-6 11520]

S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe [2005-9-23 2799808]

S4 NAUpdate;Nero Update;c:\program files\nero\update\NASvc.exe [2011-9-23 641832]

.

=============== File Associations ===============

.

FileExt: .scr: AutoCADScriptFile=c:\windows\system32\notepad.exe "%1"

.

=============== Created Last 30 ================

.

2014-03-16 08:58:19 -------- d-----w- c:\users\soo\appdata\roaming\Malwarebytes

2014-03-16 08:58:13 -------- d-----w- c:\programdata\Malwarebytes

2014-03-16 08:58:12 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2014-03-16 08:58:12 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2014-03-14 08:27:16 7947048 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{20da7bae-44c3-41ab-b221-16922295c9f5}\mpengine.dll

2014-03-13 08:22:39 5694464 ----a-w- c:\windows\system32\mstscax.dll

2014-03-13 01:16:12 32256 ----a-w- c:\windows\system32\TsUsbGDCoInstaller.dll

2014-03-13 01:16:11 12800 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyControl.exe

2014-03-13 01:16:10 855552 ----a-w- c:\windows\system32\rdvidcrl.dll

2014-03-13 01:16:10 76288 ----a-w- c:\windows\system32\TSWbPrxy.exe

2014-03-13 01:16:10 53248 ----a-w- c:\windows\system32\tsgqec.dll

2014-03-13 01:16:10 50176 ----a-w- c:\windows\system32\MsRdpWebAccess.dll

2014-03-13 01:16:10 49152 ----a-w- c:\windows\system32\drivers\TsUsbFlt.sys

2014-03-13 01:16:10 350208 ----a-w- c:\windows\system32\wksprt.exe

2014-03-13 01:16:10 17920 ----a-w- c:\windows\system32\wksprtPS.dll

2014-03-13 01:16:10 14336 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll

2014-03-13 01:16:10 1068544 ----a-w- c:\windows\system32\mstsc.exe

2014-03-13 01:13:00 792576 ----a-w- c:\windows\system32\TSWorkspace.dll

2014-03-08 10:11:13 -------- d-----w- c:\programdata\188F1432-103A-4ffb-80F1-36B633C5C9E1

2014-03-08 10:11:13 -------- d-----w- c:\program files\iTunes

2014-03-08 10:11:13 -------- d-----w- c:\program files\iPod

2014-03-08 10:09:04 159744 ----a-w- c:\program files\mozilla firefox\plugins\npqtplugin5.dll

2014-03-08 10:09:04 159744 ----a-w- c:\program files\mozilla firefox\plugins\npqtplugin4.dll

2014-03-08 10:09:04 159744 ----a-w- c:\program files\mozilla firefox\plugins\npqtplugin3.dll

2014-03-08 10:09:04 159744 ----a-w- c:\program files\mozilla firefox\plugins\npqtplugin2.dll

2014-03-08 10:09:04 159744 ----a-w- c:\program files\mozilla firefox\plugins\npqtplugin.dll

2014-03-08 10:09:04 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll

2014-03-08 10:09:04 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin4.dll

2014-03-08 10:09:04 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin3.dll

2014-03-08 10:09:04 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin2.dll

2014-03-08 10:09:04 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin.dll

2014-03-01 05:11:27 -------- d-----w- c:\programdata\Xilisoft

2014-03-01 05:11:27 -------- d-----w- c:\program files\Xilisoft

2014-02-24 10:56:40 -------- d-----w- c:\programdata\Rockstar Games

2014-02-24 10:56:11 -------- d-----w- c:\program files\Rockstar Games

.

==================== Find3M ====================

.

2014-03-12 12:39:06 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2014-03-12 12:39:06 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2014-03-01 04:11:20 2724864 ----a-w- c:\windows\system32\mshtml.tlb

2014-03-01 04:10:48 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll

2014-03-01 03:52:43 61952 ----a-w- c:\windows\system32\iesetup.dll

2014-03-01 03:51:53 51200 ----a-w- c:\windows\system32\ieetwproxystub.dll

2014-03-01 03:38:26 112128 ----a-w- c:\windows\system32\ieUnatt.exe

2014-03-01 03:38:23 108032 ----a-w- c:\windows\system32\ieetwcollector.exe

2014-03-01 03:37:35 553472 ----a-w- c:\windows\system32\jscript9diag.dll

2014-03-01 03:31:30 646144 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe

2014-03-01 03:14:15 4244480 ----a-w- c:\windows\system32\jscript9.dll

2014-03-01 03:00:08 1964032 ----a-w- c:\windows\system32\inetcpl.cpl

2014-03-01 02:32:16 1820160 ----a-w- c:\windows\system32\wininet.dll

2014-02-07 01:07:56 2349056 ----a-w- c:\windows\system32\win32k.sys

2014-02-04 02:04:22 1230336 ----a-w- c:\windows\system32\WindowsCodecs.dll

2014-02-04 02:04:11 509440 ----a-w- c:\windows\system32\qedit.dll

2014-01-29 02:06:47 381440 ----a-w- c:\windows\system32\wer.dll

2014-01-28 02:07:07 185344 ----a-w- c:\windows\system32\wwansvc.dll

2014-01-23 07:54:38 1239208 ----a-w- c:\windows\system32\FM20.DLL

2014-01-17 08:24:12 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx

2014-01-17 08:24:12 69632 ----a-w- c:\windows\system32\QuickTime.qts

2014-01-09 15:31:21 16400 ----a-w- c:\windows\system32\drivers\LNonPnP.sys

2013-12-24 23:09:41 1987584 ----a-w- c:\windows\system32\d3d10warp.dll

2013-12-21 08:56:47 454656 ----a-w- c:\windows\system32\vbscript.dll

2013-12-18 13:10:01 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

2013-12-17 22:13:56 231584 ------w- c:\windows\system32\MpSigStub.exe

.

============= FINISH: 20:21:03.59 ===============

attach.txt

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Ultimate

Boot Device: \Device\HarddiskVolume1

Install Date: 26/7/2012 12:52:25 PM

System Uptime: 17/3/2014 8:01:24 PM (0 hours ago)

.

Motherboard: Gigabyte Technology Co., Ltd. | | EP45-UD3P

Processor: Intel® Core2 Quad CPU Q9550 @ 2.83GHz | Socket 775 | 2834/333mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 119 GiB total, 14.216 GiB free.

D: is FIXED (NTFS) - 233 GiB total, 15.95 GiB free.

E: is FIXED (NTFS) - 466 GiB total, 12.18 GiB free.

F: is CDROM ()

G: is CDROM ()

H: is Removable

I: is Removable

J: is Removable

K: is Removable

L: is FIXED (NTFS) - 931 GiB total, 313.364 GiB free.

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

No restore point in system.

.

==== Installed Programs ======================

.

µTorrent

7-Zip 9.20

Acronis Drive Monitor

Adobe Acrobat X Pro - English, Français, Deutsch

Adobe Digital Editions 2.0

Adobe Flash Player 12 ActiveX

Adobe Flash Player 12 Plugin

Adobe Photoshop CC

Adobe Reader XI (11.0.06)

AMD Accelerated Video Transcoding

AMD APP SDK Runtime

AMD Catalyst Install Manager

AMD Drag and Drop Transcoding

AMD Media Foundation Decoders

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ASUS Ai Charger

ASUS Xonar DG Audio Driver

Battlelog Web Plugins

Bonjour

Castlevania: Lords of Shadow 2

Catalyst Control Center

Catalyst Control Center - Branding

Catalyst Control Center Graphics Previews Common

Catalyst Control Center Localization All

ccc-utility

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

CCleaner

CrystalDiskInfo 6.0.0

CrystalDiskMark 3.0.2f

D3DX10

DAEMON Tools Lite

Definition Update for Microsoft Office 2013 (KB2760587) 32-Bit Edition

Dropbox

DVD43 Plug-in v1.0.0.6

ESET NOD32 Antivirus

FARO LS 1.1.406.58

Fotosizer 2.08

Fraps (remove only)

Google Chrome

Google Update Helper

Guitar Pro 6

HD Tune Pro 5.00

iCloud

Internet Download Manager

iPhone Folders

iTunes

Java 7 Update 51

Java Auto Updater

KeePass Password Safe 2.25

L.A. Noire

LG PC Suite

LG United Mobile Drivers

Logitech Gaming Software

Logitech Gaming Software 8.51

Malwarebytes Anti-Malware version 1.75.0.1300

Microsoft .NET Framework 4.5.1

Microsoft .NET Framework 4.5.1 (????)

Microsoft .NET Framework 4.5.1 (CHS)

Microsoft Access MUI (English) 2013

Microsoft Access Setup Metadata MUI (English) 2013

Microsoft Application Error Reporting

Microsoft DCF MUI (English) 2013

Microsoft Excel MUI (English) 2013

Microsoft Games for Windows - LIVE Redistributable

Microsoft Games for Windows Marketplace

Microsoft Groove MUI (English) 2013

Microsoft InfoPath MUI (English) 2013

Microsoft Lync MUI (English) 2013

Microsoft Mouse and Keyboard Center

Microsoft Office OSM MUI (English) 2013

Microsoft Office OSM UX MUI (English) 2013

Microsoft Office Professional Plus 2013

Microsoft Office Proofing (English) 2013

Microsoft Office Proofing Tools 2013 - English

Microsoft Office Proofing Tools 2013 - Español

Microsoft Office Shared MUI (English) 2013

Microsoft Office Shared Setup Metadata MUI (English) 2013

Microsoft OneNote MUI (English) 2013

Microsoft Outlook MUI (English) 2013

Microsoft PowerPoint MUI (English) 2013

Microsoft Publisher MUI (English) 2013

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft SQL Server Compact 4.0 ENU

Microsoft Visual Basic for Applications 7.1 (x86)

Microsoft Visual Basic for Applications 7.1 (x86) English

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610

Microsoft Visual Studio 2005 Tools for Applications - ENU

Microsoft Word MUI (English) 2013

Microsoft Xbox 360 Accessories 1.2

Microsoft_VC80_CRT_x86

Microsoft_VC90_CRT_x86

Mindjet MindManager 2012

Movie Maker

Mozilla Firefox 26.0 (x86 en-US)

Mozilla Maintenance Service

MSVCRT

MSVCRT110

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Nero Burning ROM 11

Nero Burning ROM 11 Help (CHM)

Nero ControlCenter 11

Nero ControlCenter 11 Help (CHM)

Nero Core Components 11

Nero RescueAgent 11

Nero RescueAgent 11 Help (CHM)

Nero Update

nero.prerequisites.msi

NVIDIA PhysX

OpenAL

Outils de vérification linguistique 2013 de Microsoft Office - Français

Outlast

PDF Settings CC

Photo Common

Photo Gallery

PhotoScape

Power Tab Editor 1.7

PunkBuster Services

QuickTime 7

Rockstar Games Social Club

Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)

Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)

Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition

Skype™ 6.11

Spotify

Steam

Tom Clancy's Splinter Cell® Blacklist™

TuneUp Utilities 2014

TuneUp Utilities 2014 (en-US)

TunnelBear 1.0.38

Ubisoft Game Launcher

Update for Microsoft Lync 2013 (KB2817678) 32-Bit Edition

Update for Microsoft Lync 2013 (KB2863908) 32-Bit Edition

Update for Microsoft Outlook 2013 (KB2863911) 32-Bit Edition

Uplay

VLC media player 2.1.3

Windows Live Communications Platform

Windows Live Essentials

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Photo Common

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

WinRAR 4.00 (32-bit)

Xilisoft Video Converter Ultimate

Xiph.Org Open Codecs 0.85.17777

.

==== Event Viewer Messages From Past Week ========

.

17/3/2014 8:08:15 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk7\DR7.

16/3/2014 10:13:13 PM, Error: Schannel [36888] - The following fatal alert was generated: 10. The internal error state is 10.

13/3/2014 10:24:41 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk3\DR3.

.

==== End Of File ===========================

Maniac · March 17, 2014

Step 1

Please uninstall the following applications:

TuneUp Utilities 2014

TuneUp Utilities 2014 (en-US)

Step 2

Please run a Quick Scan with Malwarebytes and post the log:

Open up Malwarebytes => Settings Tab => Scanner Settings => Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

dante18 · March 18, 2014

Hi Borislav, thank you for the reply! I have removed the software, and here is the log of the scan with Malwarebytes:

----------------------------------------

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org

Database version: v2014.03.17.09

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 11.0.9600.16521

Soo :: SOO-PC [administrator]

18/3/2014 9:59:54 AM

mbam-log-2014-03-18 (09-59-54).txt

Scan type: Quick scan

Scan options disabled: Heuristics/Shuriken | P2P

Objects scanned: 224850

Time elapsed: 4 minute(s), 49 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

Maniac · March 18, 2014

Step 1

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Step 2

Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Scan button. Wait until is finished.
Click on Clean.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner\AdwCleaner[s0].txt as well.

In your next reply, post the following log files:

Junkware Removal Tool log
AdwCleaner log

dante18 · March 19, 2014

JRT.txt

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.2 (02.20.2014:1)

OS: Windows 7 Ultimate x86

Ran by Soo on 19/03/2014 at 18:31:41.47

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\systweak

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasapi32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasmancs

Successfully deleted: [Registry Key] "hkey_current_user\software\apn pip"

Successfully deleted: [Registry Key] "hkey_current_user\software\pip"

~~~ Files

~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{004D6E43-C67A-41A2-8C0B-C1B08811BA16}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{03BFB14E-B802-4ED9-B21C-15479C553D72}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{063DFB33-3F42-4B10-84E0-C81A184786AA}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{0B280470-B665-4DB0-97AE-4985C91BE324}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{0B6BD780-D469-478A-904D-BAAD1E07EE74}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{0D242D01-EF0F-40BE-8D71-BAFB12380EA2}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{0DDA2E97-6FE4-46E9-9FCE-D2A6B0706A40}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{0DFDE31F-2DE1-42F4-873E-3772F6CD83D5}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{0E0B23A8-7D46-4489-A2D5-6D0EC4CEF0B2}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{0EA0D9CD-5AF9-4239-97CC-8BF6BD7451D2}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{0F071D9D-401F-4238-867E-3447718C50A0}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{10B50E29-4223-49F0-BE74-C8C7A463CF8D}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{1142522E-484A-40A9-BB13-810C9B19208B}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{12C7C6AF-496D-4633-9227-6EDEFEE46482}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{12E23364-72C0-4B33-8AC7-6824448C69C2}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{13C8FABD-55F4-4007-A6F8-2BB34BBD8C92}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{13CEB2B3-6C58-4582-8773-D2B5BBAFE719}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{1534B3CD-7556-40D9-B9AA-B89F977EC119}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{1579C972-BBD5-43B0-999F-0F6589003898}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{15B7F9CA-1FCA-44B2-A671-11B24C767410}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{1911C2D7-D91F-43EA-8BC9-14246A2D1DE0}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{1979B0BA-64A9-4011-99AD-819DD54C995D}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{1A245C61-48D3-420C-AC9F-144963477473}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{1D4AB2DF-A627-4660-BBE1-8CF2F3A73318}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{1D8749CC-EA99-413B-B2F5-D480D7C2004D}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{1E30AD4D-4C8E-48CA-A092-6B7390673640}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{1ED5B6C4-7527-4695-BAC9-A2FC57A6DACF}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{1F1A6B2D-B3B9-4247-B9B0-4EB66A0F863B}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{20125713-A918-49A2-BEEF-7AD4893C5090}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{23BCFE78-FDE1-441D-A986-22D8C103033F}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{24CD1538-496D-47FD-833F-EF3872DECC47}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{24DD82E1-333E-40F1-92CD-D51906918FFB}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{270093BA-2C58-483B-ABC0-0CE81C49C583}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{28DE649F-F55D-4D17-B2BB-86BFEFEE0DAE}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{2A1261A3-8CDA-494C-A25A-971301704968}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{2A34E1AC-44DD-499D-87EF-26D1EE0F9B00}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{2AA70CE6-FD4D-4972-AF29-B8E3B1691762}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{2ABC9667-81B3-45B4-9077-2B627FA50BD8}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{2AC28745-72EC-4CC6-8AD0-04255CA09692}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{2AF3AA72-EB81-4C32-9D44-C7F65859F8CC}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{2C138D21-4A96-4E28-878E-EFDEAEC318C1}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{30C212C8-5926-4743-BF59-6F9FE9C3F934}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{31423818-6BD0-488A-B9C4-4B5E55E3CA63}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{334C79F7-DC49-45FC-9B30-175B4CCDC418}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{338D6516-D10E-4D9C-9C58-1D9CB8E7FB41}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{3423DA8E-699F-43B9-85CA-F9DECAF93267}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{3461396C-30BB-438A-A3AB-AC82A4068668}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{393EFE69-2CCA-4909-B434-DA8D81A6089F}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{3AC1E2BE-39E2-4F59-BBDE-73F3B2AC464A}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{3B4638C8-A7BE-40B2-BBC7-ADB9CD585079}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{3C6B90DA-BD0D-419B-929D-6CD3ECAF413A}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{3CA2BD01-E663-45D6-A1D0-DB32BDBD40E7}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{420A6E83-966D-4D7B-A52C-5783CCB8743E}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{458F421C-C84C-40ED-87A4-696205B61BFE}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{4651D3C1-6E75-413B-ABAF-52AF8CC3F2D7}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{4665BD87-1B46-480C-B510-CE33D298A3DF}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{46D5453E-9257-41EC-82B6-8394D1C912E9}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{4878A81F-0284-4B7E-A03D-62B9DC02054F}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{4C1543BB-D5D4-4940-9858-CD2E7084D384}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{4DEA047D-18FD-4062-AA3D-48F9F622CE60}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{4E099FF4-359F-4424-BCF8-17F99A88D1CE}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{5128C995-0184-40DA-BF4D-E489CBCE6E26}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{519D992E-2BB7-4D24-8EE2-B2F43436DD0A}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{523ED79C-5205-41E5-9734-EA7257622726}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{561064E4-BE4E-4946-AAAF-D13E0AC9F7B0}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{57274AFA-66EB-4C9E-9793-A34C30220571}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{58D802C8-0632-40FE-88EA-AC8E4300B507}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{59C16483-9F0A-4EA0-B69B-53D122E1B7AC}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{5B0B15A9-12DA-456D-AF34-6EB9DA546A6A}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{5B380D3B-E3A8-4209-84CD-DBF16DF3F35D}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{5ED957A0-41CB-4A88-B62F-53BD46121F7D}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{612BA1EC-44F5-4FF0-9682-196603243B9A}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{61D98BD5-C030-4185-821E-5F1EA362CE15}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{64315F4B-1B2D-4824-B006-621FA15C8AD7}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{64832030-01D5-4490-A41B-6FAB65ECA2B6}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{652F08F9-4DCD-4043-B7C5-F79735630603}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{656F79F7-11D8-4930-BA00-EFC550849EA1}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{658822E8-FACB-43CA-8C8E-47AE9B3986A5}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{6596AD82-09BA-4F97-91F6-DE834CA37456}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{65F15556-0703-498E-A7BB-AFDDC9231E25}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{6723236B-F09F-474E-959E-F2CD2983D59B}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{68586920-E213-4A97-815D-9809EEA8D7B1}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{69FE2D67-4BD1-4B84-BFCE-744C0C4C99D0}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{6B2BCFE5-A70D-4E9B-A128-C0F508B556AA}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{6E2219B1-0F0F-4B9A-9DD6-589596F68F5E}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{6E681C79-072E-4D6B-A82D-59D93F9F61AA}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{6F24ACA7-1FA9-4491-A14E-14D28AFA5F71}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{730B7684-B28E-4927-984D-7FB1CCF412BE}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{731A235B-0BDF-44D7-BBED-C005B61E31BA}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{75D4CB7A-E54D-4774-9484-1EDF866A3FEB}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{7685FAFB-CA5C-40CB-9CA3-01065441DA9D}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{7786EC36-A1E4-4F2B-BA78-72BD4BE065DD}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{789B6F55-539B-4295-BFA1-505161DF52F0}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{798FB673-50C7-44DF-BBF3-FB5E1535B525}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{7DD13C21-1164-4F52-BDB7-3C4999132877}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{875F793D-795A-474A-B8FB-F413138322E4}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{884F92E5-F556-4519-9C1D-FB1CB77BD883}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{89306510-1515-4CC8-B753-A215527EF982}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{8943F8C4-4132-4377-8EAF-0DC8B923C23A}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{89AEB47E-9368-4E9B-8343-016302D0C712}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{8B584222-7B0B-422B-AC5B-CAED6820CFAC}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{8B973A36-D745-4477-9771-361FF36BCD8E}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{8B9CC694-15D5-4993-B64D-F624B8F6AC3C}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{8F67756C-B267-485C-AAA3-A4B51CA7337E}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{901871C5-FD39-4BC0-AC08-842F4C9CDC22}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{9218010C-9A20-40F2-8AC5-5D8B35FD30D9}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{93E68D6E-D462-47E4-A900-CA617F23C3B2}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{93E77C25-7701-4D05-B8B3-D16F16C92C7A}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{944FF0D6-74B2-4273-B518-D91907351D9D}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{951DB1D0-75C7-4498-9251-EDEB6FFB59C9}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{969E6A4C-16E5-44C8-98E1-F327194F2F3A}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{96AFD589-096A-4220-8D51-8C662D184FD1}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{974C2DF3-D828-4236-80BF-7F0A6089EF6E}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{99ECE224-550A-4C49-9E12-B64637805CC1}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{9E9B6B74-3861-47B1-9D0F-56B2FB98C448}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{9FCE0D32-25D9-4781-AD2B-1EA34CCD815D}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{A0EFF58B-3AC7-439B-8261-DCAD25A73CE4}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{A12AF087-4385-4573-A753-F5F66E8315E0}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{A152072E-A5A8-4D45-8479-53972FB81EAF}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{A402C203-51AF-45FB-B270-6C7837F27A4C}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{A7B13FC4-0DF6-435E-9A2B-649227780636}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{A9BCA619-4F8F-4325-B549-24A8F7E9FAAB}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{AA3E3D94-C9B6-4C8C-98EC-0BCD62A160B1}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{AB3E5884-BB1C-4863-89AB-218F0F50E314}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{ACAA08B7-3808-4E57-8F70-DCD73AAE90C1}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{AE28785D-259E-48BF-BA79-AF346BC4126A}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{B01C1D0E-C1C8-45F3-8250-9439ECBF6D25}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{B5425230-C8D9-4B32-B4BD-838D83707CE2}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{B7EC748D-708C-4FA0-9F6E-713B9D5E5E94}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{B7FFF7A8-F64A-47B5-A568-51959540A6A4}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{B81C67DF-9BC3-4E3B-A9A8-DDB312D9C072}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{B8511FCD-5407-411D-8F67-BF0584E128A8}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{B859DFBD-9611-4669-81D3-C40FB65EB0CE}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{B9D24FE6-74B3-45F4-B2A1-967F515B8310}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{BAAD42D2-CA1E-4AB0-A53E-18925569926C}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{BAC42C8C-DCC1-427D-A3FD-EF6480634EA3}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{BAF6820B-317A-4BBB-B804-ACC9FB5BE38D}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{BDC5FBB4-D385-499C-8028-C6CE1FBAF6EE}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{BE0A68AB-829C-4CDF-817E-B8CC56781232}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{C0AB290D-1BAD-42FD-AE94-CD80E0480662}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{C298EE98-3314-499D-9712-7DA82CC2633C}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{C37FF000-F1A1-41CD-9813-9F19880ECEB0}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{C3BD67C5-1ACB-4FA1-A10D-856BA11449C8}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{C65B7FEC-696A-488C-9896-CD2C2127BFC8}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{C674F7F2-3A84-43D2-A2F8-0083AC42AAC9}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{C76D1E27-470F-4F11-ADE9-9B8B21A1E33E}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{CA385B1F-90B6-4E42-AF4C-752FE4A7C1F9}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{CAD35B3D-7EEB-47B6-B06E-54B84E888EDC}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{CBF9E594-0151-425B-8DA9-9BDDB9453A38}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{CE4BDE11-5E40-418E-A4A9-8F492AFF25BF}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{CE81B929-E884-4961-B798-EE46882D1A1B}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{D07229EF-CC15-44C7-A4A7-E172477E4820}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{D1D3CB15-78AC-4044-8359-30A1B4E4476A}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{D2937CF7-DD00-4AAD-871F-AAAD9E927099}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{D4047955-0FF2-4D39-8F7C-F9F93FF7752B}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{D4539E86-D11E-4D88-B35A-507BD87189DB}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{D5444084-A8B3-4DD5-BC3B-8C78F8A9C090}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{D66D0305-9250-4C15-8506-49C0191F19B5}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{D7684FD3-B0C6-41A6-9205-55DA988E166C}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{DA080A95-6D79-4817-B602-A00861FDDBB8}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{DBD3429B-2192-4E3F-8E26-309D6E9D487C}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{DC18F4E8-86CB-4269-A409-E24D49D0DAFD}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{DDC39D25-9874-4F9C-A7DD-92000F5B27A6}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{DF42D64F-D660-4E12-8E36-3751B7E65977}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{DF7FD1D3-2F19-4A28-8467-AA1909F5ABFB}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{E0D0B05B-5FFE-4DF5-AED4-1794DB4B3908}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{E2097562-15B3-4B70-B4DF-C9FD2D6C1726}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{E455B018-10D3-4BB8-8A48-E7B86DABD554}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{E478F033-CBB7-4D76-880E-668D3044F726}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{E5362311-1FDA-422A-B3DD-1BF0F41C0E46}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{E5602A7A-ED8B-4CFA-8DA1-136DF115BE8A}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{E8140762-F0E2-47AD-8088-0306C6B68161}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{E82B2F3F-D81A-438B-810B-64C8CCC5EE03}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{E8E88A58-E24E-43E5-BA51-2FBA43818AE3}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{EA167B6F-403D-4941-B0F6-8DC5C2D65F52}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{EA652BD4-8074-4F6D-BDFC-BC40208C997D}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{EAC7367A-87A5-412A-8072-819A578667ED}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{EB6C3F49-BD0F-43ED-856B-B95BCF3F5C7C}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{ECA35195-4835-411C-92DB-736BBACDF3ED}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{EDB295EC-B3FC-4830-9A9E-B14DA513A4A0}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{F0CD3E3D-B681-4353-A3D6-5C6079F073CA}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{F30E7E51-E6CC-4AF7-8BD9-3A67BA305D76}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{F4B01B8F-01F6-4EBB-9C9F-AF36AFBB25DC}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{F5807CD3-E3D3-48BE-8D36-A19150E390D6}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{F70A0AFA-E929-4A0A-B92D-10686D90A8D5}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{FA260602-6632-4D5B-BF97-0323ECED86E1}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{FB7F2DCD-55F3-4DCA-914A-05D4A371BF00}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{FC352DD0-1898-42DB-83BC-4516EDD93A30}

Successfully deleted: [Empty Folder] C:\Users\Soo\appdata\local\{FC9ECEDA-6D7D-42AE-9ABA-90DE22415486}

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 19/03/2014 at 18:33:37.28

Computer was rebooted

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

AdwCleaner log

# AdwCleaner v3.022 - Report created 19/03/2014 at 18:35:42

# Updated 13/03/2014 by Xplode

# Operating System : Windows 7 Ultimate Service Pack 1 (32 bits)

# Username : Soo - SOO-PC

# Running from : C:\Users\Soo\Desktop\AdwCleaner.exe

# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASMANCS

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}

Key Deleted : HKLM\Software\PIP

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16521

-\\ Mozilla Firefox v26.0 (en-US)

[ File : C:\Users\Soo\AppData\Roaming\Mozilla\Firefox\Profiles\kj7pbnul.default-1394959147407\prefs.js ]

-\\ Google Chrome v33.0.1750.154

[ File : C:\Users\Soo\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [1289 octets] - [19/03/2014 18:34:46]

AdwCleaner[s0].txt - [1220 octets] - [19/03/2014 18:35:42]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [1280 octets] ##########

Maniac · March 20, 2014

Please scan your machine with ESET OnlineScan

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer.
  Save it to your Desktop.
- Double click on the to download the ESET Smart Installer. icon on your Desktop.
Check "YES, I accept the Terms of Use."
Click the Start button.
Accept any security warnings from your browser.
Under Scan Settings, check "Scan Archives" and "Remove found threats"
Click Advanced settings and select the following:
- Scan potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth technology
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, click List Threats
Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Click the Back button.
Click the Finish button.

dante18 · March 21, 2014

Hi Borislav,

It appears to be clean!

Screenshot%202014-03-22%2003.15.49.png

Maniac · March 21, 2014

How are things there now?

dante18 · March 22, 2014

There have been no attacks since the last time. Does that mean my system is clear after all the recommended steps?

Maniac · March 23, 2014

It seems to be.

Here some last steps:

Step 1

Download OTL to your desktop and run it.
Click on CleanUp button.
You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.

Step 2

Double click on AdwCleaner.exe to run the tool.
Click on Uninstall
Confirm with Yes

Step 3

Please uninstall ESET Online Scanner .

Step 4

Some malware preventions:

users.telenet.be/bluepatchy/miekiemoes/prevention.html

Safe surfing!

AdvancedSetup · April 3, 2014

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Compromised system - Remote access

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information