Group Policy blocking everything

doveman · March 18, 2014

So my brother appears to have picked up a virus that is preventing him doing anything, accessing the Internet, uninstalling software, etc as every time he tries it says the Group Policy does not allow him to and he should contact his System Administrator. It seems it was intermittent for a while and he managed to use Iron Portable to access the Net but now even that doesn't work.

He said he updated Avast the other night, although he had an error from that sometime about being unable to access the DNS server so maybe it didn't actually update.

Luckily I put a VHD on his system, so I'm booted to that now so that I could download and install/update MBAM and I'm running that scan. I've also downloaded Combofix.exe, dds.scr, OTL.exe, SecurityCheck.exe and tweaking.com_windows_repair_aio.zip, as I can't download anything from the infected Windows but I understand I need to boot into that to run them and I'm not sure I'll be able to.

So if someone could advise and assist, that would be much appreciated.

doveman · March 18, 2014

I'm running MBAM from the VHD, doing a full scan of the infected Windows partition (mounted as Y:) but I guess I need to be booted into the infected Windows for it to scan the registry but as I can't update MBAM from there, can I copy the database files from the VHD install to the Y: partition? I had a look in the usual folders and couldn't identify anything that looked like a database.

doveman · March 18, 2014

MBAM from the VHD scanning the infected Windows didn't find anything:

---
From VHD:

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.03.18.06

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 8.0.7601.17514
Lynne :: RDP-PC [administrator]

18/03/2014 16:23:25
mbam-log-2014-03-18 (16-23-25).txt

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
---

Whilst the outdated MBAM running from the infected Windows did identify some problems:

Database version: v2013.09.02.05

Windows 7 Service Pack 1 x64 NTFS (Safe Mode)
Internet Explorer 10.0.9200.16844
Steve :: STE-PC [administrator]

18/03/2014 15:55:30
MBAM-log-2014-03-18 (15-58-41).txt

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 5
HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> No action taken.
HKCU\SOFTWARE\DataMngr_Toolbar (PUP.Optional.DataMngr) -> No action taken.
HKCU\Software\DataMngr (PUP.Optional.DataMngr) -> No action taken.
HKCU\Software\BabSolution\Updater (PUP.Optional.Babylon.A) -> No action taken.
HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> No action taken.

Registry Values Detected: 1
HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Data: 0O1O1FtGtCtH1T1M1R1XtGtB -> No action taken.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 1
C:\Users\Steve\AppData\Roaming\Babylon (PUP.Optional.Babylon.A) -> No action taken.

Files Detected: 1
C:\Users\Steve\AppData\Roaming\Babylon\log_file.txt (PUP.Optional.Babylon.A) -> No action taken.

---

Even in Safe Mode with Networking there's still no Internet Access, so I can't TeamViewer in and fix anything and my brother will have to reboot to the VHD to upload any diagnostic logs we create. We did manage to uninstall Avast in this mode though, which we couldn't before.

I also got him to check there weren't any active Software Restriction Policies in gpedit.msc but that showed none are defined.

kevinf80 · March 18, 2014

Hello and

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

See if you can do the following and post the produced log...

Please download Farbar Recovery Scan Tool from here:

http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

save it to a USB flash drive. Ensure to get the correct version for your system, 32 bit or 64 bit

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Plug the flash drive into the infected PC.

If you are using Windows 8 consult How to use the Windows 8 System Recovery Environment Command Prompt Here: http://www.bleepingcomputer.com/tutorials/windows-8-recovery-environment-command-prompt/ to enter System Recovery Command prompt.

If you are using Vista or Windows 7 enter System Recovery Options.

Plug the flashdrive into the infected PC.

Enter System Recovery Options I give two methods, use whichever is convenient for you.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Select Your Country as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select Your Country as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair

System Restore

Windows Complete PC Restore

Windows Memory Diagnostic Tool

Command Prompt

Select Command Prompt
In the command window type in notepad and press Enter.
The notepad opens. Under File menu select Open.
Select "Computer" and find your flash drive letter and close the notepad.
In the command window type e:\frst64 or e:\frst depending on your version. Press Enter
Note: Replace letter e with the drive letter of your flash drive.
The tool will start to run.
When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

Kevin

doveman · March 19, 2014

Hi Kevin and thanks for offering to help

Here's the frst.log:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by SYSTEM on MININT-UCRBCLS on 19-03-2014 11:58:49
Running from H:\
Windows 7 Ultimate Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery
The current controlset is ControlSet002
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Eraser] - C:\Program Files\Eraser\Eraser.exe [980368 2011-11-05] (The Eraser Project)
HKLM\...\Run: [COMODO Internet Security] - C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1612504 2013-11-11] (COMODO)
HKLM\...\Run: [Classic Start Menu] - C:\Program Files\Classic Shell\ClassicStartMenu.exe [151552 2013-06-29] (IvoSoft)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-03-29] (Realtek Semiconductor)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-13] (Adobe Systems Incorporated)
HKLM Group Policy restriction on software: C:\Program Files\AVAST Software <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files (x86)\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Sandboxie <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\AVAST Software <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKU\Steve\...\Run: [PeerBlock] - C:\Program Files\PeerBlock\peerblock.exe [2513992 2014-01-14] (PeerBlock, LLC)
HKU\Steve\...\Run: [DVDFab Passkey] - C:\Program Files (x86)\DVDFab Passkey\DVDFabPasskey.exe [1517600 2014-02-13] (Fengtao Software Inc.)
HKU\Steve\...\Run: [Jitsi] - C:\Program Files\Jitsi\Jitsi.exe [403192 2013-12-21] (jitsi.org)
HKU\Steve\...\Run: [Plex Media Server] - C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe [4409480 2014-03-12] (Plex, Inc.)
HKU\Steve\...\Run: [arqyjv] - regsvr32.exe /s "C:\ProgramData\arqyjv.dat"
HKU\Steve\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x91000000
==================== Services (Whitelisted) =================
S4 AcrylicController; C:\Program Files (x86)\Acrylic DNS Proxy\AcrylicService.exe [508928 2013-08-20] ()
S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-11-16] (Advanced Micro Devices, Inc.)
S2 cmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [6254152 2013-10-19] (COMODO)
S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [164056 2013-09-24] (COMODO)
S4 dnscrypt-proxy; C:\DNSCrypt\dnscrypt-proxy.exe [401920 2013-07-20] ()
S2 EaseUS Agent; C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe [68168 2013-05-10] (CHENGDU YIWO Tech Development Co., Ltd)
S3 FileZilla Server; C:\Program Files (x86)\FileZilla Server\FileZilla Server.exe [632320 2012-02-26] (FileZilla Project)
S3 Guard Agent; C:\Program Files (x86)\EaseUS\Todo Backup\bin\GuardAgent.exe [23624 2013-05-10] (CHENGDU YIWO Tech Development Co., Ltd)
S2 MCEBuddy2x; C:\Program Files\MCEBuddy2x\MCEBuddy.Service.exe [30208 2013-04-07] ()
S2 MPExtended Service; C:\Program Files (x86)\MPExtended\Service\MPExtended.ServiceHosts.CoreService.exe [6144 2013-07-14] (Microsoft)
S2 MPExtended WebMediaPortal; C:\Program Files (x86)\MPExtended\WebMediaPortal\MPExtended.ServiceHosts.WebMediaPortal.exe [16384 2013-07-14] ()
S4 MPstandbyHandlerService; C:\Tools\MPStandbyHandler\MPstandbyHandlerService.exe [29696 2009-07-04] ()
S2 MySQL; C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld.exe [7599616 2009-08-18] ()
S2 NFSserver; C:\Program Files\nfsd\nfsd.exe [224256 2012-12-18] (Dr. Hanewinkel -- www.haneWIN.de)
S2 NoIPDUCService4; C:\Program Files (x86)\No-IP\ducservice.exe [11264 2013-01-24] ()
S2 PhenomMsrTweaker; C:\Program Files\PhenomMsrTweaker\PhenomMsrTweakerService.exe [188416 2010-06-03] ()
S2 PMAPDaemon; C:\Program Files\nfsd\pmapd.exe [124416 2012-04-23] (Dr. Hanewinkel -- www.haneWIN.de)
S4 Power Triggers; C:\Program Files (x86)\Derek Smith\Power Triggers\PowerTriggersService.exe [10240 2013-02-05] (Derek Smith)
S2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [187592 2014-01-17] (Sandboxie Holdings, LLC)
S2 TVService; C:\Program Files (x86)\Team MediaPortal\MediaPortal TV Server\TVService.exe [232448 2013-11-16] (Team MediaPortal)
==================== Drivers (Whitelisted) ====================
S2 AODDriver4.1; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [53888 2012-03-05] (Advanced Micro Devices)
S0 asahci64; C:\Windows\System32\DRIVERS\asahci64.sys [52440 2012-12-26] (Asmedia Technology)
S1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [23168 2013-09-24] (COMODO)
S1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [709144 2013-11-14] (COMODO)
S1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [48872 2013-09-24] (COMODO)
S1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-08-31] (Disc Soft Ltd)
S3 dvdfab; C:\Windows\System32\drivers\dvdfab.sys [79232 2011-08-15] (Fengtao Software Inc.)
S0 EUBKMON; C:\Windows\System32\drivers\EUBKMON.sys [48200 2013-05-10] ()
S3 HCW99BDA; C:\Windows\System32\Drivers\hcw99bda.sys [147968 2013-06-10] (Hauppauge Computer Works, Inc.)
S3 hcw99rc; C:\Windows\System32\Drivers\hcw99rc.sys [12800 2013-06-10] (Hauppauge Computer Works, Inc.)
S1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [96800 2013-09-24] (COMODO)
S3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [128200 2013-04-26] (Qualcomm Atheros Co., Ltd.)
S4 NebAudio-amd64; C:\Windows\System32\DRIVERS\nebaudio-amd64.sys [18592 2013-06-10] (Nebula Media Solutions Ltd)
S4 NebVideo-amd64; C:\Windows\System32\DRIVERS\NebVideo-amd64.sys [28192 2013-06-10] (Nebula Media Solutions Ltd)
S3 pbfilter; C:\Program Files\PeerBlock\pbfilter.sys [22600 2014-01-14] ()
S1 RAMDiskVE; C:\Windows\System32\Drivers\RAMDiskVE.sys [86768 2013-08-08] (Dataram, Inc.)
S3 rspLLL; C:\Windows\System32\DRIVERS\rspLLL64.sys [23968 2013-02-07] (Resplendence Software Projects Sp.)
S3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [202600 2014-01-17] (Sandboxie Holdings, LLC)
S5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] () <===== ATTENTION Necurs Rootkit?
S3 VBoxUSB; C:\Windows\System32\Drivers\VBoxUSB.sys [106256 2013-09-06] (Oracle Corporation)
S3 WinRing0_1_2_0; C:\Program Files\PhenomMsrTweaker\WinRing0x64.sys [14544 2010-06-03] (OpenLibSys.org)
S3 cpuz136; \??\d:\wintemp\user\cpuz136\cpuz136_x64.sys [X]
S4 sptd; \SystemRoot\System32\Drivers\sptd.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-03-19 11:58 - 2014-03-19 11:58 - 00000000 ____D () C:\FRST
2014-03-18 10:30 - 2014-03-18 10:31 - 00002992 _____ () C:\Users\Steve\Desktop\RKreport[0]_S_03182014_183006.txt
2014-03-18 10:19 - 2014-03-18 10:31 - 00000000 ____D () C:\Users\Steve\Desktop\RK_Quarantine
2014-03-18 01:33 - 2014-03-18 15:57 - 00102560 _____ () C:\Windows\PFRO.log
2014-03-14 03:59 - 2014-02-23 00:13 - 02241536 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2014-03-14 03:59 - 2014-02-23 00:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2014-03-14 03:59 - 2014-02-23 00:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2014-03-14 03:59 - 2014-02-23 00:12 - 19273216 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-03-14 03:59 - 2014-02-23 00:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2014-03-14 03:59 - 2014-02-23 00:12 - 00197120 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2014-03-14 03:59 - 2014-02-23 00:11 - 15404032 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2014-03-14 03:59 - 2014-02-23 00:11 - 03960320 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2014-03-14 03:59 - 2014-02-23 00:11 - 02648576 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2014-03-14 03:59 - 2014-02-23 00:11 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2014-03-14 03:59 - 2014-02-23 00:11 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2014-03-14 03:59 - 2014-02-23 00:11 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2014-03-14 03:59 - 2014-02-23 00:11 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2014-03-14 03:59 - 2014-02-23 00:11 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2014-03-14 03:59 - 2014-02-23 00:11 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2014-03-14 03:59 - 2014-02-22 22:54 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-14 03:59 - 2014-02-22 22:54 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-14 03:59 - 2014-02-22 22:53 - 14358016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-14 03:59 - 2014-02-22 22:53 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-14 03:59 - 2014-02-22 22:53 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-14 03:59 - 2014-02-22 22:53 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-14 03:59 - 2014-02-22 22:53 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-03-14 03:59 - 2014-02-22 22:53 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-14 03:59 - 2014-02-22 22:53 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-14 03:59 - 2014-02-22 22:53 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-14 03:59 - 2014-02-22 22:53 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-03-14 03:59 - 2014-02-22 22:53 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-14 03:59 - 2014-02-22 22:53 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-14 03:59 - 2014-02-22 22:53 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-14 03:59 - 2014-02-22 22:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-03-14 03:59 - 2014-02-22 22:31 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-14 03:59 - 2014-02-22 21:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2014-03-14 03:59 - 2014-02-22 21:35 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-03-13 06:54 - 2014-02-06 17:25 - 03159552 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2014-03-13 06:54 - 2014-02-03 18:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2014-03-13 06:54 - 2014-02-03 18:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\System32\qedit.dll
2014-03-13 06:54 - 2014-02-03 18:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-13 06:54 - 2014-02-03 18:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-13 06:54 - 2014-01-28 18:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\System32\wer.dll
2014-03-13 06:54 - 2014-01-28 18:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-13 06:54 - 2014-01-27 18:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\System32\wwansvc.dll
2014-03-10 04:00 - 2014-03-19 03:16 - 00000448 _____ () C:\Windows\setupact.log
2014-03-10 04:00 - 2014-03-10 04:00 - 00000000 _____ () C:\Windows\setuperr.log
==================== One Month Modified Files and Folders =======
2014-03-19 11:58 - 2014-03-19 11:58 - 00000000 ____D () C:\FRST
2014-03-19 03:17 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-19 03:16 - 2014-03-10 04:00 - 00000448 _____ () C:\Windows\setupact.log
2014-03-19 03:15 - 2013-06-12 10:10 - 00000000 ____D () C:\Program Files\PeerBlock
2014-03-19 03:15 - 2013-05-31 07:13 - 01650390 _____ () C:\Windows\WindowsUpdate.log
2014-03-19 02:59 - 2013-06-26 08:46 - 00000000 ____D () C:\Users\Steve\AppData\Roaming\Jitsi
2014-03-18 16:50 - 2013-05-31 13:21 - 00003918 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{CF99CB76-C13B-46F8-BB02-2EB95C26AEE8}
2014-03-18 16:08 - 2009-07-13 20:45 - 00028000 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-18 16:08 - 2009-07-13 20:45 - 00028000 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-18 15:58 - 2013-06-29 23:19 - 00000000 ____D () C:\ProgramData\boost_interprocess
2014-03-18 15:57 - 2014-03-18 01:33 - 00102560 _____ () C:\Windows\PFRO.log
2014-03-18 15:57 - 2013-06-10 11:33 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-03-18 10:31 - 2014-03-18 10:30 - 00002992 _____ () C:\Users\Steve\Desktop\RKreport[0]_S_03182014_183006.txt
2014-03-18 10:31 - 2014-03-18 10:19 - 00000000 ____D () C:\Users\Steve\Desktop\RK_Quarantine
2014-03-18 07:43 - 2009-07-13 19:20 - 00000000 ___HD () C:\Windows\System32\GroupPolicy
2014-03-18 07:26 - 2013-09-29 11:16 - 00000084 _____ () C:\Windows\winamp.ini
2014-03-18 07:23 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\System32\NDF
2014-03-18 02:48 - 2013-06-26 10:09 - 00000000 ____D () C:\Users\Steve\.get_iplayer
2014-03-17 16:00 - 2013-06-26 11:29 - 00000000 ____D () C:\Users\Steve\AppData\Roaming\uTorrent
2014-03-17 12:22 - 2013-08-07 06:20 - 00003924 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-03-17 09:56 - 2013-07-16 09:58 - 00005076 _____ () C:\Windows\Sandboxie.ini
2014-03-17 08:58 - 2013-07-08 15:30 - 00000000 ____D () C:\Users\Steve\AppData\Roaming\vlc
2014-03-14 09:56 - 2013-07-08 10:00 - 00000000 ____D () C:\ProgramData\Package Cache
2014-03-14 09:31 - 2013-05-31 16:09 - 00000000 ____D () C:\Windows\Panther
2014-03-14 09:30 - 2009-07-13 20:45 - 05154752 _____ () C:\Windows\System32\FNTCACHE.DAT
2014-03-11 10:17 - 2009-07-13 21:13 - 00782642 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-03-10 13:25 - 2013-06-18 13:18 - 00000000 ____D () C:\Users\Steve\AppData\Roaming\MediaMonkey
2014-03-10 04:00 - 2014-03-10 04:00 - 00000000 _____ () C:\Windows\setuperr.log
2014-03-09 05:58 - 2013-08-26 07:30 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-03-09 05:56 - 2013-06-12 18:10 - 00000000 ____D () C:\Windows\Minidump
2014-03-05 03:13 - 2013-06-12 11:17 - 00000000 ____D () C:\Program Files\nfsd
2014-03-01 03:46 - 2013-10-03 05:16 - 00000000 ____D () C:\Users\Steve\.VirtualBox
2014-02-23 00:13 - 2014-03-14 03:59 - 02241536 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2014-02-23 00:13 - 2014-03-14 03:59 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2014-02-23 00:13 - 2014-03-14 03:59 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2014-02-23 00:12 - 2014-03-14 03:59 - 19273216 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-02-23 00:12 - 2014-03-14 03:59 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2014-02-23 00:12 - 2014-03-14 03:59 - 00197120 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2014-02-23 00:11 - 2014-03-14 03:59 - 15404032 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2014-02-23 00:11 - 2014-03-14 03:59 - 03960320 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2014-02-23 00:11 - 2014-03-14 03:59 - 02648576 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2014-02-23 00:11 - 2014-03-14 03:59 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2014-02-23 00:11 - 2014-03-14 03:59 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2014-02-23 00:11 - 2014-03-14 03:59 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2014-02-23 00:11 - 2014-03-14 03:59 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2014-02-23 00:11 - 2014-03-14 03:59 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2014-02-23 00:11 - 2014-03-14 03:59 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2014-02-22 22:54 - 2014-03-14 03:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-22 22:54 - 2014-03-14 03:59 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-22 22:53 - 2014-03-14 03:59 - 14358016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-22 22:53 - 2014-03-14 03:59 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-22 22:53 - 2014-03-14 03:59 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-22 22:53 - 2014-03-14 03:59 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-22 22:53 - 2014-03-14 03:59 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-02-22 22:53 - 2014-03-14 03:59 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-22 22:53 - 2014-03-14 03:59 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-22 22:53 - 2014-03-14 03:59 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-22 22:53 - 2014-03-14 03:59 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-02-22 22:53 - 2014-03-14 03:59 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-22 22:53 - 2014-03-14 03:59 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-22 22:53 - 2014-03-14 03:59 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-22 22:35 - 2014-03-14 03:59 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-02-22 22:31 - 2014-03-14 03:59 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-22 21:39 - 2014-03-14 03:59 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2014-02-22 21:35 - 2014-03-14 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-02-20 01:45 - 2013-06-29 06:18 - 00000000 ____D () C:\Program Files (x86)\DVDFab Passkey
2014-02-17 19:00 - 2013-09-26 03:07 - 00000000 ____D () C:\Windows\System32\MRT
2014-02-17 19:00 - 2013-05-31 06:47 - 88567024 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
==================== Known DLLs (Whitelisted) ================
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
==================== Memory info ===========================
Percentage of memory in use: 10%
Total physical RAM: 7675.91 MB
Available physical RAM: 6898.29 MB
Total Pagefile: 7674.11 MB
Available Pagefile: 6883.43 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB
==================== Drives ================================
Drive c: (Win7 x64) (Fixed) (Total:49.93 GB) (Free:13.68 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (Data) (Fixed) (Total:881.58 GB) (Free:140.59 GB) NTFS
Drive g: (U3 System) (CDROM) (Total:0.01 GB) (Free:0 GB) CDFS
Drive h: () (Removable) (Total:7.47 GB) (Free:1.12 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (2nd Drive) (Fixed) (Total:74.53 GB) (Free:62.76 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 75 GB) (Disk ID: 82F371B0)
Partition 1: (Active) - (Size=75 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 932 GB) (Disk ID: B60C6404)
Partition: GPT Partition Type.
========================================================
Disk: 2 (Size: 7 GB) (Disk ID: 8118385B)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0B)
LastRegBack: 2014-03-09 16:18
==================== End Of Log ============================

I can see a few dodgy things in there.

Group Policy restrictions preventing antivirus software from running.

HKU\Steve\...\Run: [arqyjv] - regsvr32.exe /s "C:\ProgramData\arqyjv.dat"

S5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] () <===== ATTENTION Necurs Rootkit?

I think this might be a false positive as I recall that's a util I installed on his system for unlocking files that Windows or some program doesn't release properly, although it may of course now be infected.

Although you haven't asked for it, I already have the RKReport so I might as well post that too:

RogueKiller V8.8.11 [Mar 14 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Safe mode with network support
User : Steve [Admin rights]
Mode : Scan -- Date : 03/18/2014 18:30:06
| ARK || FAK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 12 ¤¤¤
[RUN][sUSP PATH] HKCU\[...]\Run : arqyjv (regsvr32.exe /s "C:\ProgramData\arqyjv.dat" [x][x]) -> FOUND
[RUN][sUSP PATH] HKUS\S-1-5-21-4142153632-2294863933-3660688552-1000\[...]\Run : arqyjv (regsvr32.exe /s "C:\ProgramData\arqyjv.dat" [x][x]) -> FOUND
[DNS][PUM] HKLM\[...]\CCSet\[...]\{0FCE7B46-F992-46B3-8A95-131C19CB514C} : NameServer (178.21.23.150,205.204.88.60) -> FOUND
[DNS][PUM] HKLM\[...]\CS001\[...]\{0FCE7B46-F992-46B3-8A95-131C19CB514C} : NameServer (8.8.8.8,178.21.23.150) -> FOUND
[DNS][PUM] HKLM\[...]\CS002\[...]\{0FCE7B46-F992-46B3-8A95-131C19CB514C} : NameServer (178.21.23.150,205.204.88.60) -> FOUND
[DNS][PUM] HKLM\[...]\CS003\[...]\{0FCE7B46-F992-46B3-8A95-131C19CB514C} : NameServer (178.21.23.150,205.204.88.60) -> FOUND
[HJ POL][PUM] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND
[HJ POL][PUM] HKLM\[...]\System : EnableLUA (0) -> FOUND
[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND
[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : EnableLUA (0) -> FOUND
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Scheduled tasks : 0 ¤¤¤
¤¤¤ Startup Entries : 0 ¤¤¤
¤¤¤ Web browsers : 0 ¤¤¤
¤¤¤ Browser Addons : 0 ¤¤¤
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤
¤¤¤ External Hives: ¤¤¤
¤¤¤ Infection : ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts
46.246.119.139 status.block.aid
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST380011A ATA Device +++++
--- User ---
[MBR] 2dfd374ccb98d1a2d2a6d98704bdd456
[bSP] 282fac6be2415fb3a09ba7c6033a71f6 : MBR Code unknown
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 76316 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ IDE) SAMSUNG HD103SJ ATA Device +++++
--- User ---
[MBR] bcf0a4665750be325143551ffafb79bf
[bSP] 8c61c2170b04633d45ac0abd435b0a63 : MBR Code unknown
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 51125 Mo
1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 104707992 | Size: 902740 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[0]_S_03182014_183006.txt >>

kevinf80 · March 19, 2014

I see your reference to unlocker, i`d rather kill with FRST just to be sure. It can always be reinstalled later.

Save the attached file [color=red]fixlist.txt to your flash drive, same place as FRST.

Now please enter System Recovery Options as you did to get the log.

Run FRST and press the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Re-boot your system if it boots to normal mode run FRST again, if you have no Internet connection it will have to be transferred to sick PC desktop....

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Also this one if possible...

Download Farbar Service Scanner from here: http://www.bleepingcomputer.com/download/farbar-service-scanner/dl/62/ and run it on the computer with the issue.

Make sure the following options are checked:

Internet Services
Windows Firewall
System Restore
Security Center/Action Center
Windows Update
Windows Defender

Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.

Post those logs...

Kevin

fixlist.txt

doveman · March 19, 2014

Thanks, this is what we've got now. Still no Internet access (tested with IE in Sandboxie and Iron Portable unsandboxed).

I note that FSS.txt shows that Windows Firewall, Action Center, System Restore and Defender were all disabled but that's intentional as he uses Comodo Firewall and EaseUS ToDo Backup instead, although it's probably a good idea to run Defender as well (I do that) but we can reset those once everything is working normally.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-03-2014
Ran by SYSTEM at 2014-03-19 14:00:25 Run:1
Running from H:\
Boot Mode: Recovery
==============================================
Content of fixlist:
*****************
Start
HKLM Group Policy restriction on software: C:\Program Files\AVAST Software <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files (x86)\Malwarebytes' Anti-Malware <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Sandboxie <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\AVAST Software <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKU\Steve\...\Run: [arqyjv] - regsvr32.exe /s "C:\ProgramData\arqyjv.dat"
C:\ProgramData\arqyjv.dat
S5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] () <===== ATTENTION Necurs Rootkit?
C:\Program Files\Unlocker\UnlockerDriver5.sys
C:\Program Files\Unlocker
End
*****************
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKU\Steve\Software\Microsoft\Windows\CurrentVersion\Run\\arqyjv => Value deleted successfully.
"C:\ProgramData\arqyjv.dat" => File/Directory not found.
UnlockerDriver5 => Service deleted successfully.
C:\Program Files\Unlocker\UnlockerDriver5.sys => Moved successfully.
C:\Program Files\Unlocker => Moved successfully.
==== End of Fixlog ====

Farbar Service Scanner Version: 25-02-2014
Ran by Steve (administrator) on 19-03-2014 at 14:08:07
Running from "D:\Portable Apps\Antivirus"
Microsoft Windows 7 Ultimate Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Attempt to access Google.com returned error: Other errors
Attempt to access Yahoo.com returned error: Other errors

Windows Firewall:
=============
mpsdrv Service is not running. Checking service configuration:
The start type of mpsdrv service is OK.
The ImagePath of mpsdrv service is OK.
MpsSvc Service is not running. Checking service configuration:
The start type of MpsSvc service is set to Disabled. The default start type is Auto.
The ImagePath of MpsSvc service is OK.
The ServiceDll of MpsSvc service is OK.

Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0

System Restore:
============
SDRSVC Service is not running. Checking service configuration:
The start type of SDRSVC service is set to Disabled. The default start type is 3.
The ImagePath of SDRSVC service is OK.
The ServiceDll of SDRSVC service is OK.

System Restore Disabled Policy:
========================

Action Center:
============
wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is set to Disabled. The default start type is Auto.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.

Windows Update:
============
Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Disabled. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.

Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1

Other Services:
==============

File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll
[2013-08-21 02:44] - [2012-10-18 20:29] - 0317952 ____A (Microsoft Corporation) 6D7E8A022DB7DAD500789CBA5C2EF005
C:\Windows\System32\drivers\afd.sys
[2013-11-13 10:25] - [2013-09-28 01:14] - 0496128 ____A (Microsoft Corporation) 50AB05903CBEF298D135A943D4432E3C
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys
[2014-01-15 10:30] - [2013-11-26 11:34] - 1897408 ____A (Microsoft Corporation) F55B41AA6114568AC558ADBABDA85620
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll
[2013-11-13 10:24] - [2013-10-12 02:23] - 0706560 ____A (Microsoft Corporation) F513F0CE75F873A0050A34379A8E76B5
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe
[2013-08-21 02:44] - [2012-10-18 18:02] - 0027136 ____A (Microsoft Corporation) DFDE777FAF31DC25E3624E8071073146
C:\Windows\System32\rpcss.dll => MD5 is legit

**** End of log ****

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Steve (administrator) on STE-PC on 19-03-2014 14:05:33
Running from D:\Portable Apps\Antivirus
Windows 7 Ultimate Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
() C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld.exe
(The Eraser Project) C:\Program Files\Eraser\Eraser.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
() C:\Program Files\PhenomMsrTweaker\PhenomMsrTweakerService.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(PeerBlock, LLC) C:\Program Files\PeerBlock\peerblock.exe
(Fengtao Software Inc.) C:\Program Files (x86)\DVDFab Passkey\DVDFabPasskey.exe
(Dr. Hanewinkel -- www.haneWIN.de) C:\Program Files\nfsd\pmapd.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(jitsi.org) C:\Program Files\Jitsi\Jitsi.exe
(Plex, Inc.) C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe
(Team MediaPortal) C:\Program Files (x86)\Team MediaPortal\MediaPortal TV Server\TVService.exe
(Dr. Hanewinkel -- www.haneWIN.de) C:\Program Files\nfsd\nfsd.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
(Python Software Foundation) C:\Program Files (x86)\Plex\Plex Media Server\PlexScriptHost.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
(Plex, Inc.) C:\Program Files (x86)\Plex\Plex Media Server\PlexDlnaServer.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe

==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Eraser] - C:\Program Files\Eraser\Eraser.exe [980368 2011-11-05] (The Eraser Project)
HKLM\...\Run: [COMODO Internet Security] - C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1612504 2013-11-11] (COMODO)
HKLM\...\Run: [Classic Start Menu] - C:\Program Files\Classic Shell\ClassicStartMenu.exe [151552 2013-06-29] (IvoSoft)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-03-29] (Realtek Semiconductor)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-13] (Adobe Systems Incorporated)
HKU\S-1-5-21-4142153632-2294863933-3660688552-1000\...\Run: [PeerBlock] - C:\Program Files\PeerBlock\peerblock.exe [2513992 2014-01-14] (PeerBlock, LLC)
HKU\S-1-5-21-4142153632-2294863933-3660688552-1000\...\Run: [DVDFab Passkey] - C:\Program Files (x86)\DVDFab Passkey\DVDFabPasskey.exe [1517600 2014-02-13] (Fengtao Software Inc.)
HKU\S-1-5-21-4142153632-2294863933-3660688552-1000\...\Run: [Jitsi] - C:\Program Files\Jitsi\Jitsi.exe [403192 2013-12-21] (jitsi.org)
HKU\S-1-5-21-4142153632-2294863933-3660688552-1000\...\Run: [Plex Media Server] - C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe [4409480 2014-03-12] (Plex, Inc.)
HKU\S-1-5-21-4142153632-2294863933-3660688552-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x91000000
HKU\S-1-5-21-4142153632-2294863933-3660688552-1000\...\MountPoints2: {0fab9013-2910-11e3-b928-bc5ff40da1b3} - G:\LaunchU3.exe -a
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.hotmail.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x265878F82F5ECE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = https://startpage.com/uk/
SearchScopes: HKCU - DefaultScope {7EF8172E-A5BC-412F-8E06-3145060F9F95} URL = https://startpage.com/do/search?query={searchTerms}&cat=web&pl=ie&language=english_uk
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=7633BC5FF40DA1B3&affID=119357&tt=110813_Dmntr&tsp=4974
SearchScopes: HKCU - {7EF8172E-A5BC-412F-8E06-3145060F9F95} URL = https://startpage.com/do/search?query={searchTerms}&cat=web&pl=ie&language=english_uk
BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
BHO: LastPass Vault - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll (LastPass)
BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: LastPass Vault - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPToolbar.dll (LastPass)
BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
Toolbar: HKLM - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll (LastPass)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
Toolbar: HKLM-x32 - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll (LastPass)
DPF: HKLM-x32 {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} http://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1377038263962
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
ShellExecuteHooks-x32: DVDIdleShell Class - {93994DE8-8239-4655-B1D1-5F4E91300429} - D:\Portable Apps\DVDFree\DVDShell.dll [49152 2006-05-25] (Fengtao Software Inc.)
Hosts: 46.246.119.139 status.block.aid
Tcpip\..\Interfaces\{0FCE7B46-F992-46B3-8A95-131C19CB514C}: [NameServer]178.21.23.150,205.204.88.60
==================== Services (Whitelisted) =================
S4 AcrylicController; C:\Program Files (x86)\Acrylic DNS Proxy\AcrylicService.exe [508928 2013-08-20] ()
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-11-16] (Advanced Micro Devices, Inc.)
R2 cmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [6254152 2013-10-20] (COMODO)
S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [164056 2013-09-24] (COMODO)
S4 dnscrypt-proxy; C:\DNSCrypt\dnscrypt-proxy.exe [401920 2013-07-20] ()
R2 EaseUS Agent; C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe [68168 2013-05-10] (CHENGDU YIWO Tech Development Co., Ltd)
S3 FileZilla Server; C:\Program Files (x86)\FileZilla Server\FileZilla Server.exe [632320 2012-02-26] (FileZilla Project)
S3 Guard Agent; C:\Program Files (x86)\EaseUS\Todo Backup\bin\GuardAgent.exe [23624 2013-05-10] (CHENGDU YIWO Tech Development Co., Ltd)
U2 MCEBuddy2x; C:\Program Files\MCEBuddy2x\MCEBuddy.Service.exe [30208 2013-04-07] ()
S2 MPExtended Service; C:\Program Files (x86)\MPExtended\Service\MPExtended.ServiceHosts.CoreService.exe [6144 2013-07-14] (Microsoft)
S2 MPExtended WebMediaPortal; C:\Program Files (x86)\MPExtended\WebMediaPortal\MPExtended.ServiceHosts.WebMediaPortal.exe [16384 2013-07-14] ()
S4 MPstandbyHandlerService; C:\Tools\MPStandbyHandler\MPstandbyHandlerService.exe [29696 2009-07-04] ()
R2 MySQL; C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld.exe [7599616 2009-08-18] ()
R2 NFSserver; C:\Program Files\nfsd\nfsd.exe [224256 2012-12-18] (Dr. Hanewinkel -- www.haneWIN.de)
S2 NoIPDUCService4; C:\Program Files (x86)\No-IP\ducservice.exe [11264 2013-01-24] ()
R2 PhenomMsrTweaker; C:\Program Files\PhenomMsrTweaker\PhenomMsrTweakerService.exe [188416 2010-06-03] ()
R2 PMAPDaemon; C:\Program Files\nfsd\pmapd.exe [124416 2012-04-23] (Dr. Hanewinkel -- www.haneWIN.de)
S4 Power Triggers; C:\Program Files (x86)\Derek Smith\Power Triggers\PowerTriggersService.exe [10240 2013-02-05] (Derek Smith)
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [187592 2014-01-17] (Sandboxie Holdings, LLC)
R2 TVService; C:\Program Files (x86)\Team MediaPortal\MediaPortal TV Server\TVService.exe [232448 2013-11-16] (Team MediaPortal)
==================== Drivers (Whitelisted) ====================
R2 AODDriver4.1; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [53888 2012-03-05] (Advanced Micro Devices)
R0 asahci64; C:\Windows\System32\DRIVERS\asahci64.sys [52440 2012-12-26] (Asmedia Technology)
R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [23168 2013-09-24] (COMODO)
R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [709144 2013-11-14] (COMODO)
R1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [48872 2013-09-24] (COMODO)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-08-31] (Disc Soft Ltd)
R3 dvdfab; C:\Windows\System32\drivers\dvdfab.sys [79232 2011-08-15] (Fengtao Software Inc.)
R0 EUBKMON; C:\Windows\System32\drivers\EUBKMON.sys [48200 2013-05-10] ()
R3 HCW99BDA; C:\Windows\System32\Drivers\hcw99bda.sys [147968 2013-06-10] (Hauppauge Computer Works, Inc.)
R3 hcw99rc; C:\Windows\System32\Drivers\hcw99rc.sys [12800 2013-06-10] (Hauppauge Computer Works, Inc.)
R1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [96800 2013-09-24] (COMODO)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [128200 2013-04-26] (Qualcomm Atheros Co., Ltd.)
S4 NebAudio-amd64; C:\Windows\System32\DRIVERS\nebaudio-amd64.sys [18592 2013-06-10] (Nebula Media Solutions Ltd)
S4 NebVideo-amd64; C:\Windows\System32\DRIVERS\NebVideo-amd64.sys [28192 2013-06-10] (Nebula Media Solutions Ltd)
R3 pbfilter; C:\Program Files\PeerBlock\pbfilter.sys [22600 2014-01-14] ()
R1 RAMDiskVE; C:\Windows\System32\Drivers\RAMDiskVE.sys [86768 2013-08-08] (Dataram, Inc.)
S3 rspLLL; C:\Windows\System32\DRIVERS\rspLLL64.sys [23968 2013-02-07] (Resplendence Software Projects Sp.)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [202600 2014-01-17] (Sandboxie Holdings, LLC)
S3 VBoxUSB; C:\Windows\System32\Drivers\VBoxUSB.sys [106256 2013-09-06] (Oracle Corporation)
R3 WinRing0_1_2_0; C:\Program Files\PhenomMsrTweaker\WinRing0x64.sys [14544 2010-06-03] (OpenLibSys.org)
S3 cpuz136; \??\d:\wintemp\user\cpuz136\cpuz136_x64.sys [X]
S4 sptd; \SystemRoot\System32\Drivers\sptd.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========
2014-03-19 19:58 - 2014-03-19 14:05 - 00000000 ____D () C:\FRST
2014-03-18 18:30 - 2014-03-18 18:31 - 00002992 _____ () C:\Users\Steve\Desktop\RKreport[0]_S_03182014_183006.txt
2014-03-18 18:19 - 2014-03-18 18:31 - 00000000 ____D () C:\Users\Steve\Desktop\RK_Quarantine
2014-03-18 09:33 - 2014-03-18 23:57 - 00102560 _____ () C:\Windows\PFRO.log
2014-03-14 11:59 - 2014-02-23 08:13 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-14 11:59 - 2014-02-23 08:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-14 11:59 - 2014-02-23 08:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-14 11:59 - 2014-02-23 08:12 - 19273216 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-14 11:59 - 2014-02-23 08:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-14 11:59 - 2014-02-23 08:12 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-14 11:59 - 2014-02-23 08:11 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-14 11:59 - 2014-02-23 08:11 - 03960320 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-14 11:59 - 2014-02-23 08:11 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-14 11:59 - 2014-02-23 08:11 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-03-14 11:59 - 2014-02-23 08:11 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-14 11:59 - 2014-02-23 08:11 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-03-14 11:59 - 2014-02-23 08:11 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-14 11:59 - 2014-02-23 08:11 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-14 11:59 - 2014-02-23 08:11 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-14 11:59 - 2014-02-23 06:54 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-14 11:59 - 2014-02-23 06:54 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-14 11:59 - 2014-02-23 06:53 - 14358016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-14 11:59 - 2014-02-23 06:53 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-14 11:59 - 2014-02-23 06:53 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-14 11:59 - 2014-02-23 06:53 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-14 11:59 - 2014-02-23 06:53 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-03-14 11:59 - 2014-02-23 06:53 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-14 11:59 - 2014-02-23 06:53 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-14 11:59 - 2014-02-23 06:53 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-14 11:59 - 2014-02-23 06:53 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-03-14 11:59 - 2014-02-23 06:53 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-14 11:59 - 2014-02-23 06:53 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-14 11:59 - 2014-02-23 06:53 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-14 11:59 - 2014-02-23 06:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-14 11:59 - 2014-02-23 06:31 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-14 11:59 - 2014-02-23 05:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-03-14 11:59 - 2014-02-23 05:35 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-03-13 14:54 - 2014-02-07 01:25 - 03159552 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-13 14:54 - 2014-02-04 02:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-13 14:54 - 2014-02-04 02:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-13 14:54 - 2014-02-04 02:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-13 14:54 - 2014-02-04 02:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-13 14:54 - 2014-01-29 02:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-13 14:54 - 2014-01-29 02:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-13 14:54 - 2014-01-28 02:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-10 12:00 - 2014-03-19 14:01 - 00000560 _____ () C:\Windows\setupact.log
2014-03-10 12:00 - 2014-03-10 12:00 - 00000000 _____ () C:\Windows\setuperr.log
==================== One Month Modified Files and Folders =======
2014-03-19 14:05 - 2014-03-19 19:58 - 00000000 ____D () C:\FRST
2014-03-19 14:03 - 2013-06-30 07:19 - 00000000 ____D () C:\ProgramData\boost_interprocess
2014-03-19 14:03 - 2013-06-26 16:46 - 00000000 ____D () C:\Users\Steve\AppData\Roaming\Jitsi
2014-03-19 14:03 - 2013-06-12 18:10 - 00000000 ____D () C:\Program Files\PeerBlock
2014-03-19 14:01 - 2014-03-10 12:00 - 00000560 _____ () C:\Windows\setupact.log
2014-03-19 14:01 - 2009-07-14 05:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-19 13:51 - 2013-05-31 15:13 - 01663973 _____ () C:\Windows\WindowsUpdate.log
2014-03-19 13:50 - 2013-09-29 19:16 - 00000084 _____ () C:\Windows\winamp.ini
2014-03-19 13:42 - 2013-05-31 21:21 - 00003918 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{CF99CB76-C13B-46F8-BB02-2EB95C26AEE8}
2014-03-19 12:33 - 2009-07-14 04:45 - 00028000 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-19 12:33 - 2009-07-14 04:45 - 00028000 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-18 23:57 - 2014-03-18 09:33 - 00102560 _____ () C:\Windows\PFRO.log
2014-03-18 23:57 - 2013-06-10 19:33 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-03-18 18:31 - 2014-03-18 18:30 - 00002992 _____ () C:\Users\Steve\Desktop\RKreport[0]_S_03182014_183006.txt
2014-03-18 18:31 - 2014-03-18 18:19 - 00000000 ____D () C:\Users\Steve\Desktop\RK_Quarantine
2014-03-18 15:43 - 2009-07-14 03:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-03-18 15:23 - 2009-07-14 03:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-03-18 10:48 - 2013-06-26 18:09 - 00000000 ____D () C:\Users\Steve\.get_iplayer
2014-03-18 00:00 - 2013-06-26 19:29 - 00000000 ____D () C:\Users\Steve\AppData\Roaming\uTorrent
2014-03-17 20:22 - 2013-08-07 14:20 - 00003924 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-03-17 17:56 - 2013-07-16 17:58 - 00005076 _____ () C:\Windows\Sandboxie.ini
2014-03-17 16:58 - 2013-07-08 23:30 - 00000000 ____D () C:\Users\Steve\AppData\Roaming\vlc
2014-03-14 17:56 - 2013-07-08 18:00 - 00000000 ____D () C:\ProgramData\Package Cache
2014-03-14 17:31 - 2013-06-01 00:09 - 00000000 ____D () C:\Windows\Panther
2014-03-14 17:30 - 2009-07-14 04:45 - 05154752 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-11 18:17 - 2009-07-14 05:13 - 00782642 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-10 21:25 - 2013-06-18 21:18 - 00000000 ____D () C:\Users\Steve\AppData\Roaming\MediaMonkey
2014-03-10 12:00 - 2014-03-10 12:00 - 00000000 _____ () C:\Windows\setuperr.log
2014-03-09 13:58 - 2013-08-26 15:30 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-03-09 13:56 - 2013-06-13 02:10 - 00000000 ____D () C:\Windows\Minidump
2014-03-05 11:13 - 2013-06-12 19:17 - 00000000 ____D () C:\Program Files\nfsd
2014-03-01 11:46 - 2013-10-03 13:16 - 00000000 ____D () C:\Users\Steve\.VirtualBox
2014-02-23 08:13 - 2014-03-14 11:59 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-23 08:13 - 2014-03-14 11:59 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-23 08:13 - 2014-03-14 11:59 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-23 08:12 - 2014-03-14 11:59 - 19273216 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-23 08:12 - 2014-03-14 11:59 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-23 08:12 - 2014-03-14 11:59 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-23 08:11 - 2014-03-14 11:59 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-23 08:11 - 2014-03-14 11:59 - 03960320 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-23 08:11 - 2014-03-14 11:59 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-23 08:11 - 2014-03-14 11:59 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-02-23 08:11 - 2014-03-14 11:59 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-23 08:11 - 2014-03-14 11:59 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-02-23 08:11 - 2014-03-14 11:59 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-23 08:11 - 2014-03-14 11:59 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-23 08:11 - 2014-03-14 11:59 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-23 06:54 - 2014-03-14 11:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-23 06:54 - 2014-03-14 11:59 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-23 06:53 - 2014-03-14 11:59 - 14358016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-23 06:53 - 2014-03-14 11:59 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-23 06:53 - 2014-03-14 11:59 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-23 06:53 - 2014-03-14 11:59 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-23 06:53 - 2014-03-14 11:59 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-02-23 06:53 - 2014-03-14 11:59 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-23 06:53 - 2014-03-14 11:59 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-23 06:53 - 2014-03-14 11:59 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-23 06:53 - 2014-03-14 11:59 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-02-23 06:53 - 2014-03-14 11:59 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-23 06:53 - 2014-03-14 11:59 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-23 06:53 - 2014-03-14 11:59 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-23 06:35 - 2014-03-14 11:59 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-23 06:31 - 2014-03-14 11:59 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-23 05:39 - 2014-03-14 11:59 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2014-02-23 05:35 - 2014-03-14 11:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-02-20 09:45 - 2013-06-29 14:18 - 00000000 ____D () C:\Program Files (x86)\DVDFab Passkey
2014-02-18 03:03 - 2013-09-26 11:07 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-18 03:00 - 2013-05-31 14:47 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2014-03-10 00:18
==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014
Ran by Steve at 2014-03-19 14:06:11
Running from D:\Portable Apps\Antivirus
Boot Mode: Normal
==========================================================

==================== Security Center ========================
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
µTorrent (HKCU\...\uTorrent) (Version: 3.3.2.30303 - BitTorrent Inc.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 11 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 11.8.800.94 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.8.800.94 - Adobe Systems Incorporated)
Agent Ransack 2010 (64-bit) (HKLM\...\Agent Ransack (64-bit)_is1) (Version: - )
AMD Catalyst Install Manager (HKLM\...\{2BFD590F-1D73-3533-E734-FDDAC3746E4A}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
AMD Fuel (Version: 2012.1116.1515.27190 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.71116.1554 - Advanced Micro Devices, Inc.) Hidden
AMD VISION Engine Control Center (x32 Version: 2012.1116.1515.27190 - Advanced Micro Devices, Inc.) Hidden
Amnesia - The Dark Descent (HKLM-x32\...\{54B7A3C7-0940-4C16-A509-FC3C3758D22A}_is1) (Version: 1.0.0 - Frictional Games)
Ant Movie Catalog (HKLM-x32\...\Ant Movie Catalog_is1) (Version: 4.1.2 - Ant Software)
Ashampoo Burning Studio 2013 v.11.0.6 (HKLM-x32\...\{91B33C97-0FBA-74AE-E802-D782F5C8AA89}_is1) (Version: 11.0.6 - Ashampoo GmbH & Co. KG)
ASIO4ALL (HKLM-x32\...\ASIO4ALL) (Version: 2.10 - Michael Tippach)
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.16.4.0 - Asmedia Technology)
Asmedia ASM106x SATA Host Controller Driver (HKLM-x32\...\{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}) (Version: 1.4.1.000 - Asmedia Technology)
ASRock eXtreme Tuner v0.1.351 (HKLM-x32\...\ASRock eXtreme Tuner_is1) (Version: - )
AviSynth 2.5 (HKLM-x32\...\AviSynth) (Version: - )
Black Mirror 3 (HKLM-x32\...\Black Mirror 3) (Version: 1.0.21.0 - Viva Media LLC)
Blade Runner (HKLM-x32\...\Blade Runner_is1) (Version: - Keron)
Bonjour (HKLM\...\{E4F5E48E-7155-4CF9-88CD-7F377EC9AC54}) (Version: 2.0.4.0 - Apple Inc.)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.1116.1515.27190 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.1116.1515.27190 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2012.1116.1514.27190 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.1116.1514.27190 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.1116.1514.27190 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.1116.1514.27190 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.1116.1514.27190 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.1116.1514.27190 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.1116.1514.27190 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.1116.1514.27190 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.1116.1514.27190 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.1116.1514.27190 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.1116.1514.27190 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.1116.1514.27190 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.1116.1514.27190 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.1116.1514.27190 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.1116.1514.27190 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.1116.1514.27190 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.1116.1514.27190 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.1116.1514.27190 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.1116.1514.27190 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.1116.1514.27190 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.1116.1514.27190 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.1116.1514.27190 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.1116.1515.27190 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.04 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.1.4003 - CDBurnerXP)
Classic Shell (HKLM\...\{FEA1590B-540A-41FC-A95C-664493C82A21}) (Version: 3.6.8 - IvoSoft)
COMODO Firewall (HKLM\...\{A0BABADE-E154-4F08-97A1-2903CD110E88}) (Version: 6.2.20728.2847 - COMODO Security Solutions Inc.)
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6514.5001 - Microsoft Corporation)
CPUID CPU-Z 1.65.0 (HKLM\...\CPUID CPU-Z_is1) (Version: - )
CryptSync (HKLM\...\{F315D3EC-A858-4278-942D-54271F494F6A}) (Version: 1.0.214 - Stefans Tools)
CutePDF Writer 3.0 (HKLM\...\CutePDF Writer Installation) (Version: 3.0 - CutePDF.com)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.47.1.0337 - Disc Soft Ltd)
Dracula Origin (HKLM-x32\...\{35A0C956-ACF1-41AB-89DE-1772C8A27ACB}) (Version: 1.00.0777 - Frogwares)
Dropbox (HKCU\...\Dropbox) (Version: 2.0.26 - Dropbox, Inc.)
DVD Flick 1.3.0.7 (HKLM-x32\...\DVD Flick_is1) (Version: 1.3.0.7 - Dennis Meuwissen)
DVD Shrink 3.2 (HKLM-x32\...\DVD Shrink_is1) (Version: - DVD Shrink)
DVDFab Passkey 8.2.1.0 (13/02/2014) (HKLM-x32\...\DVDFab Passkey 8_is1) (Version: - Fengtao Software Inc.)
DVDStyler v2.3 (HKLM-x32\...\DVDStyler_is1) (Version: - )
EaseUS Todo Backup Free 6.0 (HKLM-x32\...\EaseUS Todo Backup Free 6.0_is1) (Version: 6.0 - CHENGDU YIWO Tech Development Co., Ltd)
eMule (HKLM-x32\...\eMule) (Version: - )
Eraser 6.0.9.2343 (HKLM\...\{3D33F6F0-4D90-484D-A1D9-09AE791CCBD9}) (Version: 6.0.2343 - The Eraser Project)
Exact Audio Copy 1.0beta3 (HKLM-x32\...\Exact Audio Copy) (Version: 1.0beta3 - Andre Wiethoff)
FileBot (HKLM\...\{117E1610-81C4-412C-9DBB-E43566F026B1}) (Version: 3.62 - Reinhard Pointner)
FileZilla Server (HKLM-x32\...\FileZilla Server) (Version: beta 0.9.41 - FileZilla Project)
foobar2000 v1.2.6 (HKLM-x32\...\foobar2000) (Version: 1.2.6 - Peter Pawlowski)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 6.0.6.722 - Foxit Corporation)
Free Audio Dub version 1.7.9.908 (HKLM-x32\...\Free Audio Dub_is1) (Version: 1.7.9.908 - DVDVideoSoft Ltd.)
Free Videos To DVD V 4.0.0 (HKLM-x32\...\Free Videos To DVD_is1) (Version: 4.0.0.0 - Koyote soft)
Geeks3D FurMark 1.11.0 (HKLM-x32\...\{2397CAD4-2263-4CD0-96BE-E43A980B9C9A}_is1) (Version: - Geeks3D)
Genie Timeline (HKLM-x32\...\Genie Timeline) (Version: 4.0 - Genie9)
get_iplayer 4.8 (HKLM-x32\...\get_iplayer) (Version: 4.8 - infradead.org)
Ghost Pirates (HKLM-x32\...\Ghost Pirates_is1) (Version: - dtp)
GIMP 2.8.6 (HKLM\...\GIMP-2_is1) (Version: 2.8.6 - The GIMP Team)
GNU Privacy Guard (HKLM-x32\...\GnuPG) (Version: 1.4.15 - Free Software Foundation)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.22.5 - Google Inc.) Hidden
Haali Media Splitter (HKLM-x32\...\HaaliMkx) (Version: - )
HandBrake 0.9.9.1 (HKLM-x32\...\HandBrake) (Version: 0.9.9.1 - )
haneWIN NFS Server 1.2.9 (HKLM\...\haneWIN NFS Server_is1) (Version: - Dr. Hanewinkel)
Huffyuv AVI lossless video codec (Remove Only) (HKLM\...\HUFFYUV) (Version: - )
HWiNFO64 Version 4.22 (HKLM\...\HWiNFO64_is1) (Version: 4.22 - Martin Malík - REALiX)
IIS 7.5 Express (HKLM-x32\...\{3A30B5F5-F12C-490F-8CD4-D200C75DF7E8}) (Version: 7.5.1190 - Microsoft Corporation)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
InfraRecorder 0.53 (x64 edition) (HKLM\...\{2C22EA92-CB30-4932-0053-000001000000}) (Version: 0.53.00.00 - Christian Kindahl)
iuVCS x64 (HKLM\...\iuVCS x64_is1) (Version: 0.14.0.63 - Ivan Uskov's software labaratory.)
Java 7 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.5 - Sun Microsystems, Inc.) Hidden
Jitsi (HKLM\...\{4C1E749F-B189-47EC-8414-67DEF69DCAA4}) (Version: 2.5.5006 - Jitsi)
Jitsi (HKLM\...\{650A9287-EAEF-4818-8B11-0274B2AEC1E2}) (Version: 2.4.4997 - Jitsi)
Kits Configuration Installer (x32 Version: 8.59.25584 - Microsoft) Hidden
LastPass (uninstall only) (HKLM-x32\...\LastPass) (Version: - LastPass)
LatencyMon 5.00 (HKLM\...\LatencyMon_is1) (Version: - Resplendence Software Projects Sp.)
LAV Filters 0.58.2 (HKLM-x32\...\lavfilters_is1) (Version: 0.58.2 - Hendrik Leppkes)
Link Shell Extension (HKLM\...\HardlinkShellExt) (Version: 3.7.4.8 - Hermann Schinagl)
MakeMKV v1.8.7 (HKLM-x32\...\MakeMKV) (Version: v1.8.7 - GuinpinSoft inc)
Malwarebytes Anti-Malware version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
MCEBuddy 2.3 (HKLM\...\{0D3796AA-D867-4278-AEBC-3616AD1F7C3A}) (Version: 2.3.12 - MCEBuddy)
MediaInfo 0.7.64 (HKLM\...\MediaInfo) (Version: 0.7.64 - MediaArea.net)
MediaMonkey 4.0 (HKLM-x32\...\MediaMonkey_is1) (Version: 4.0 - Ventis Media Inc.)
MediaPortal (HKLM-x32\...\MediaPortal) (Version: 1.6.0 Pre Release - Team MediaPortal)
MediaPortal TV Server / Client (HKLM-x32\...\MediaPortal TV Server) (Version: 1.6.0 Pre Release - Team MediaPortal)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Excel Viewer (HKLM-x32\...\{95120000-003F-0409-0000-0000000FF1CE}) (Version: 12.0.6425.1000 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mp3tag v2.57 (HKLM-x32\...\Mp3tag) (Version: v2.57 - Florian Heidenreich)
MPC-HC 1.6.8 (HKLM-x32\...\{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1) (Version: 1.6.8.7417 - MPC-HC Team)
MPExtended Service (HKLM-x32\...\{51E13803-D64F-4953-85C7-168789B1C6A0}) (Version: 0.5.4.0 - MPExtended)
MPExtended WebMediaPortal (HKLM-x32\...\{92FF10BC-E0FA-4BAE-AE9D-46986776A688}) (Version: 0.5.4.0 - MPExtended)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MySQL Server 5.1 (HKLM\...\{561AB451-B967-475C-80E0-3B6679C38B52}) (Version: 5.1.38 - MySQL AB)
Nero 8 Micro (HKLM-x32\...\Nero8Lite_is1) (Version: 8.3.20.0 - UpdatePack.nl)
No-IP DUC (HKLM-x32\...\NoIPDUC) (Version: 4.0.1 - Vitalwerks Internet Solutions LLC)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 5.9 - )
NVIDIA GAME System Software 2.8.1 (HKLM-x32\...\{4F0C7CCF-5666-474B-B02E-AC514A95EC93}) (Version: 2.8.1 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{3282FBE1-35FC-48D8-98CA-115A5EF1F9B4}) (Version: 9.13.0604 - NVIDIA Corporation)
Oracle VM VirtualBox 4.2.18 (HKLM\...\{230C9C86-26A9-437F-8152-34D5F4C3F680}) (Version: 4.2.18 - Oracle Corporation)
PDF Settings CC (x32 Version: 12.0 - Adobe Systems Incorporated) Hidden
PeerBlock 1.2 (r693) (HKLM\...\{015C5B35-B678-451C-9AEE-821E8D69621C}_is1) (Version: 1.2.0.693 - PeerBlock, LLC)
PhenomMsrTweaker (HKLM\...\{2CD600E3-55E9-47B3-9611-6FE0ECC04BF9}) (Version: 2.0.4 - Martin Kinkelin)
Pinball FX2 (HKLM-x32\...\Pinball FX2_is1) (Version: - )
Plex Media Server (HKLM-x32\...\{e9921c42-812d-4b39-9c02-612724349e82}) (Version: 0.9.907 - Plex, Inc.)
Plex Media Server (x32 Version: 0.9.907 - Plex, Inc.) Hidden
Power Triggers (HKLM-x32\...\{02682DDE-2797-4207-B51B-920EC7AD570A}) (Version: 2.0.3 - Derek Smith)
PrinterShare 2.3.06 (HKLM\...\{A8F58241-BE2F-4D8E-88D9-2A5788EBFBCD}) (Version: 2.3.6.0 - Printer Anywhere Inc.)
Qualcomm Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.17 - Qualcomm Atheros Communications Inc.)
Radeon RAMDisk (HKLM-x32\...\{43494C37-69B8-4DBC-A98D-568F7C76F585}) (Version: 4.2.1.0 - Dataram, Inc.)
Realtek HDMI Audio Driver for ATI (HKLM-x32\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.6650 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6873 - Realtek Semiconductor Corp.)
Robin Hood - The Legend of Sherwood (HKLM-x32\...\Robin Hood - The Legend of Sherwood) (Version: - Wanadoo Edition)
Sandboxie 4.08 (64-bit) (HKLM\...\Sandboxie) (Version: 4.08 - Sandboxie Holdings, LLC)
Sherlock Holmes versus Jack the Ripper (HKLM-x32\...\{3F64C088-9A45-41B3-8B99-71AFAB720A56}) (Version: 1.00.0777 - Frogwares)
SketchUp 8 (HKLM-x32\...\{8EB62C87-AAA6-4850-A5BC-64155884B973}) (Version: 3.0.16846 - Trimble Navigation Limited)
SolveigMM AVI Trimmer (HKLM-x32\...\SolveigMM AVI Trimmer 2.1.1307.29) (Version: 2.1.1307.29 - Solveig Multimedia)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Tales of Monkey Island (HKLM-x32\...\Tales of Monkey Island_is1) (Version: - GOG.com)
TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.26038 - TeamViewer)
The 11th Hour (HKLM-x32\...\The 11th Hour) (Version: 1.0 - DotEmu)
The 7th Guest (HKLM-x32\...\The 7th Guest) (Version: 1.0 - DotEmu)
The Testament of Sherlock Holmes (HKLM-x32\...\{38A96559-FF39-4089-A609-BFD76C4A6C07}_is1) (Version: 1.00.2 - Focus Home Interactive)
TreeSize Professional 3.21 (HKLM-x32\...\TreeSize Professional_is1) (Version: - JAM Software)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
VideoReDo TVSuite Version 4.20.7.629 (HKLM-x32\...\VideoReDo4_is1) (Version: - DRD Systems, Inc.)
Virtual VCR (HKLM-x32\...\{14F06853-8A15-4731-BBDC-C9B40A866A63}) (Version: - www.digtv.ws)
VirtualDJ Home FREE (HKLM-x32\...\{A6AC699F-8315-40CA-8F70-E917494978AB}) (Version: 7.4 - Atomix Productions)
Vlafy MJPEG Encoder 1.0.0.5 (HKLM\...\fvMJPEGEncoderx64_is1) (Version: - )
VLC media player 2.0.8 (HKLM-x32\...\VLC media player) (Version: 2.0.8 - VideoLAN)
Wallace and Gromit Grand Adventures (HKLM-x32\...\{9BB6FE41-A1CA-493D-AE34-5ADB4FE0DC03}) (Version: 1.00.0000 - Telltale Games)
Windows Driver Package - EventGhost Emprex MCE USB (01/25/2010 1.0.2.0) (HKLM\...\A75886BFC9856A2EB378E38872695A4195112D49) (Version: 01/25/2010 1.0.2.0 - EventGhost)
Windows Software Development Kit (HKLM-x32\...\{363a2c1e-637f-45ce-933b-5a5463efd945}) (Version: 8.59.29750 - Microsoft Corporation)
Windows Software Development Kit EULA (x32 Version: 8.59.25584 - Microsoft Corporations) Hidden
WinFF 1.5 (Codename EMMA) (HKLM\...\WinFF_is1) (Version: - WinFF.org)
WinX DVD Ripper Platinum 7.2.0 (HKLM-x32\...\WinX DVD Ripper Platinum_is1) (Version: - Digiarty Software, Inc.)
WM Recorder (HKLM-x32\...\WM Recorder14.14.1.1) (Version: 14.14.1.1 - AllAlex, Inc)
Worms Crazy Golf (HKLM-x32\...\Worms Crazy Golf_is1) (Version: - )
WPT Redistributables (x32 Version: 8.59.29750 - Microsoft) Hidden
WPTx64 (x32 Version: 8.59.29722 - Microsoft) Hidden
X64 Debuggers And Tools (HKLM\...\{83510B2D-E0C6-1A23-7E4E-43CFD5C8722D}) (Version: 8.59.25584 - Microsoft Corporation)
XBMC (HKCU\...\XBMC) (Version: - Team XBMC)
xrecode II 1.0.0.202 (HKLM-x32\...\{AFE83615-88BE-47F6-B3E4-A3FEF8B7B57F}_is1) (Version: - )
==================== Restore Points =========================

==================== Hosts content: ==========================
2009-07-14 02:34 - 2013-06-18 20:06 - 00000855 ____A C:\Windows\system32\Drivers\etc\hosts
46.246.119.139 status.block.aid
==================== Scheduled Tasks (whitelisted) =============
Task: {3DC4BD02-A8FA-4248-A2B2-077C6A299DB3} - System32\Tasks\COMODO\COMODO Welcome {CEB54B45-2B5E-4FF5-9223-6735CD80FE69} => C:\Program Files\COMODO\COMODO Internet Security\cis.exe [2013-11-20] (COMODO)
Task: {4CC70E65-1730-4B34-8DED-8446E3DF5D26} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-21] (Google Inc.)
Task: {5E117B20-9511-4980-B235-5A6D2D764871} - System32\Tasks\Encrypt Data Backup to Dropbox => C:\Program Files (x86)\7-Zipa\Compress data backup.bat [2013-08-30] ()
Task: {6F5E2FFC-8FDE-490C-908C-E119B1B5FD24} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-07-22] (Piriform Ltd)
Task: {AD6AD53A-8B9F-46E4-A38B-9196902E5895} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2013-11-11] (COMODO)
Task: {D03F72A6-C2F2-45DE-B891-347B384D9EC2} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-21] (Google Inc.)
Task: {ECD4D6E9-5E37-4AB1-B832-B915A244968A} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2013-06-26 20:34 - 2012-10-04 18:49 - 00087152 _____ () C:\Windows\System32\cpwmon64.dll
2004-09-30 18:15 - 2004-09-30 18:15 - 00192000 _____ () C:\Program Files\LinkShellExtension\RockallDLL.dll
2009-08-18 20:09 - 2009-08-18 20:09 - 07599616 _____ () C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld.exe
2010-06-03 12:54 - 2010-06-03 12:54 - 00188416 _____ () C:\Program Files\PhenomMsrTweaker\PhenomMsrTweakerService.exe
2013-12-21 16:45 - 2013-12-21 16:45 - 00057104 _____ () C:\Program Files\Jitsi\native\sysactivitynotifications.dll
2013-12-21 16:45 - 2013-12-21 16:45 - 00027024 _____ () C:\Program Files\Jitsi\native\hid.dll
2013-12-21 16:45 - 2013-12-21 16:45 - 00322768 _____ () C:\Program Files\Jitsi\native\jnopus.dll
2013-12-21 16:45 - 2013-12-21 16:45 - 00132144 _____ () C:\Program Files\Jitsi\native\jnspeex.dll
2013-12-21 16:45 - 2013-12-21 16:45 - 04823288 _____ () C:\Program Files\Jitsi\native\jnffmpeg.dll
2013-12-21 16:45 - 2013-12-21 16:45 - 00033504 _____ () C:\Program Files\Jitsi\native\jng722.dll
2013-12-21 16:45 - 2013-12-21 16:45 - 00087112 _____ () C:\Program Files\Jitsi\native\jnwasapi.dll
2013-12-21 16:45 - 2013-12-21 16:45 - 00260328 _____ () C:\Program Files\Jitsi\native\jnportaudio.dll
2013-12-21 16:45 - 2013-12-21 16:45 - 00060800 _____ () C:\Program Files\Jitsi\native\jnwincoreaudio.dll
2013-12-21 16:45 - 2013-12-21 16:45 - 00278112 _____ () C:\Program Files\Jitsi\native\jndirectshow.dll
2013-12-21 16:45 - 2013-12-21 16:45 - 00055376 _____ () C:\Program Files\Jitsi\native\jnawtrenderer.dll
2013-12-21 16:45 - 2013-12-21 16:45 - 00082168 _____ () C:\Program Files\Jitsi\native\globalshortcut.dll
2013-12-21 16:45 - 2013-12-21 16:45 - 00019704 _____ () C:\Program Files\Jitsi\native\jdic_misc.dll
2013-12-21 16:45 - 2013-12-21 16:45 - 00198424 _____ () C:\Program Files\Jitsi\native\jmsofficecomm.dll
2011-02-09 00:56 - 2011-02-09 00:56 - 00301568 _____ () C:\Program Files (x86)\Notepad++\NppShell_04.dll
2013-06-29 14:18 - 2011-04-20 16:05 - 00065536 _____ () C:\Program Files (x86)\DVDFab Passkey\zlibwapi.dll
2014-03-12 19:57 - 2014-03-12 19:57 - 00073352 _____ () C:\Program Files (x86)\Plex\Plex Media Server\zlib.dll
2014-03-12 19:56 - 2014-03-12 19:56 - 00195720 _____ () C:\Program Files (x86)\Plex\Plex Media Server\libidn.dll
2014-03-12 19:56 - 2014-03-12 19:56 - 00840840 _____ () C:\Program Files (x86)\Plex\Plex Media Server\libxml2.dll
2014-03-12 19:56 - 2014-03-12 19:56 - 00051848 _____ () C:\Program Files (x86)\Plex\Plex Media Server\soci_sqlite3-vc80-3_0.dll
2014-03-12 19:56 - 2014-03-12 19:56 - 00089224 _____ () C:\Program Files (x86)\Plex\Plex Media Server\soci_core-vc80-3_0.dll
2014-03-12 19:56 - 2014-03-12 19:56 - 07605400 _____ () C:\Program Files (x86)\Plex\Plex Media Server\avcodec-54.dll
2014-03-12 19:56 - 2014-03-12 19:56 - 00202392 _____ () C:\Program Files (x86)\Plex\Plex Media Server\avutil-52.dll
2014-03-12 19:56 - 2014-03-12 19:56 - 01453720 _____ () C:\Program Files (x86)\Plex\Plex Media Server\avformat-54.dll
2014-03-12 19:56 - 2014-03-12 19:56 - 00352920 _____ () C:\Program Files (x86)\Plex\Plex Media Server\swscale-2.dll
2014-03-12 19:57 - 2014-03-12 19:57 - 00507528 _____ () C:\Program Files (x86)\Plex\Plex Media Server\tag.dll
2014-03-12 19:57 - 2014-03-12 19:57 - 08495240 _____ () C:\Program Files (x86)\Plex\Plex Media Server\WebKit.dll
2014-03-12 19:56 - 2014-03-12 19:56 - 00952968 _____ () C:\Program Files (x86)\Plex\Plex Media Server\CFLite.dll
2014-03-12 19:56 - 2014-03-12 19:56 - 01291400 _____ () C:\Program Files (x86)\Plex\Plex Media Server\JavaScriptCore.dll
2014-03-12 19:56 - 2014-03-12 19:56 - 01038984 _____ () C:\Program Files (x86)\Plex\Plex Media Server\cairo.dll
2014-03-12 19:57 - 2014-03-12 19:57 - 00073352 _____ () C:\Program Files (x86)\Plex\Plex Media Server\zlib1.dll
2004-09-30 17:09 - 2004-09-30 17:09 - 00155648 _____ () C:\Program Files\LinkShellExtension\32\RockallDLL.dll
2013-11-16 16:01 - 2013-11-16 16:01 - 00130048 _____ () C:\Program Files (x86)\Team MediaPortal\MediaPortal TV Server\StreamingServer.dll
2014-03-12 19:57 - 2014-03-12 19:57 - 00045192 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\_socket.pyd
2014-03-12 19:57 - 2014-03-12 19:57 - 00028808 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\_ssl.pyd
2014-03-12 19:57 - 2014-03-12 19:57 - 00019080 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\_hashlib.pyd
2014-03-12 19:57 - 2014-03-12 19:57 - 00032392 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\simplejson\_speedups.pyd
2014-03-12 19:57 - 2014-03-12 19:57 - 00836744 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\lxml\etree.pyd
2014-03-12 19:56 - 2014-03-12 19:56 - 00062600 _____ () C:\Program Files (x86)\Plex\Plex Media Server\libexslt.dll
2014-03-12 19:56 - 2014-03-12 19:56 - 00166024 _____ () C:\Program Files (x86)\Plex\Plex Media Server\libxslt.dll
2014-03-12 19:57 - 2014-03-12 19:57 - 00192648 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\lxml\objectify.pyd
2014-03-12 19:57 - 2014-03-12 19:57 - 00016520 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\select.pyd
2014-03-12 19:57 - 2014-03-12 19:57 - 00056456 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\OpenSSL\crypto.pyd
2014-03-12 19:57 - 2014-03-12 19:57 - 00018056 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\OpenSSL\rand.pyd
2014-03-12 19:57 - 2014-03-12 19:57 - 00044680 _____ () C:\Program Files (x86)\Plex\Plex Media Server\Exts\OpenSSL\SSL.pyd
2014-03-12 19:57 - 2014-03-12 19:57 - 00083080 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\_ctypes.pyd
2014-03-12 19:57 - 2014-03-12 19:57 - 00111752 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\pyexpat.pyd
2014-03-12 19:57 - 2014-03-12 19:57 - 00692360 _____ () C:\Program Files (x86)\Plex\Plex Media Server\DLLs\unicodedata.pyd
2013-05-31 20:21 - 2013-05-10 11:08 - 00098888 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CodeLog.dll
2013-05-31 20:21 - 2013-05-10 11:08 - 00029768 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CompressFile.dll
2013-05-31 20:21 - 2008-11-25 16:18 - 01291264 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\libxml2.dll
2013-05-31 20:21 - 2004-10-05 02:08 - 00055808 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\zlib1.dll
2013-05-31 20:21 - 2013-05-10 11:08 - 00050248 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\TBGetRemoteNetInfo.dll
2013-05-31 20:21 - 2013-05-22 15:25 - 00093256 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ActivationOnline.dll
2013-05-31 20:21 - 2013-05-22 15:25 - 00030280 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\DiskSearchImg.dll
2013-05-31 20:21 - 2013-05-10 11:08 - 00293960 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ExchBackupSize.dll
2013-05-31 20:21 - 2013-05-10 11:08 - 00578632 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ExImage.dll
2013-05-31 20:21 - 2013-05-10 11:08 - 00468040 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ExchBackupSizeEx.dll
2013-05-31 20:21 - 2013-05-10 11:08 - 00068680 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\EnumTapeDevice.dll
2013-05-31 20:21 - 2013-05-10 11:09 - 00069192 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\TbTapeBrowse.dll
2013-05-31 20:21 - 2013-05-20 16:44 - 00022600 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\AccountManager.dll
2013-05-31 20:21 - 2013-05-10 11:08 - 00115784 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\NasOperator.dll
2013-05-31 20:21 - 2013-05-10 11:08 - 00135752 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\CloudOperator.dll
2013-05-31 20:21 - 2013-05-10 11:08 - 00037960 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\ActiveOnline.dll
2013-05-31 20:21 - 2013-05-20 16:44 - 00135240 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\VMConfig.dll
2013-05-31 20:21 - 2013-05-10 11:08 - 00096840 _____ () C:\Program Files (x86)\EaseUS\Todo Backup\bin\TBFireWall.dll
2013-07-14 14:32 - 2013-07-14 14:32 - 00016384 _____ () C:\Program Files (x86)\MPExtended\WebMediaPortal\MPExtended.ServiceHosts.WebMediaPortal.exe
2013-01-24 18:12 - 2013-01-24 18:12 - 00011264 _____ () C:\Program Files (x86)\No-IP\ducservice.exe
2013-01-24 06:34 - 2013-01-24 06:34 - 00067584 _____ () C:\Program Files (x86)\No-IP\ducapi.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\TEMP:0888F409
AlternateDataStreams: C:\ProgramData\TEMP:3440EB47
AlternateDataStreams: C:\ProgramData\TEMP:66633281
==================== Safe Mode (whitelisted) ===================

==================== Disabled items from MSCONFIG ==============
MSCONFIG\Services: avast! Antivirus => 2
==================== Faulty Device Manager Devices =============
Name: ATI HDMI Audio
Description: ATI HDMI Audio
Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}
Manufacturer: Realtek
Service: RTHDMIAzAudService
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

==================== Event log errors: =========================
Application errors:
==================
Error: (03/19/2014 02:03:04 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/19/2014 00:24:21 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/19/2014 11:17:57 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/18/2014 11:59:20 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/18/2014 06:13:55 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/18/2014 03:54:57 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/18/2014 03:39:48 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/18/2014 00:19:41 PM) (Source: Application Hang) (User: )
Description: The program soffice.bin version 4.1.1.2 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 1b2c
Start Time: 01cf42a397f0c7e9
Termination Time: 0
Application Path: D:\Portable Apps\LibreOfficePortable\App\libreoffice\program\soffice.bin
Report Id: 93804aa3-ae97-11e3-b88b-bc5ff40da1b3
Error: (03/18/2014 11:15:38 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/18/2014 11:11:25 AM) (Source: Application Hang) (User: )
Description: The program soffice.bin version 4.1.1.2 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
Process ID: 1118
Start Time: 01cf429a92d83542
Termination Time: 0
Application Path: D:\Portable Apps\LibreOfficePortable\App\libreoffice\program\soffice.bin
Report Id: 0897d05c-ae8e-11e3-bdb8-bc5ff40da1b3

System errors:
=============
Error: (03/19/2014 01:51:39 PM) (Source: Service Control Manager) (User: )
Description: The TVService service did not shut down properly after receiving a preshutdown control.
Error: (03/19/2014 11:18:27 AM) (Source: Service Control Manager) (User: )
Description: The TVService service did not shut down properly after receiving a preshutdown control.
Error: (03/19/2014 11:18:01 AM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Error: (03/19/2014 11:15:58 AM) (Source: Service Control Manager) (User: )
Description: The TVService service did not shut down properly after receiving a preshutdown control.
Error: (03/18/2014 06:13:47 PM) (Source: DCOM) (User: )
Description: 1068fdPHost{D3DCB472-7261-43CE-924B-0704BD730D5F}
Error: (03/18/2014 06:13:47 PM) (Source: DCOM) (User: )
Description: 1068fdPHost{145B4335-FE2A-4927-A040-7C35AD3180EF}
Error: (03/18/2014 06:12:23 PM) (Source: DCOM) (User: )
Description: 1084EventSystem{1BE1F766-5536-11D1-B726-00C04FB926AF}
Error: (03/18/2014 06:12:17 PM) (Source: DCOM) (User: )
Description: 1084ShellHWDetection{DD522ACC-F821-461A-A407-50B198B896DC}
Error: (03/18/2014 06:12:16 PM) (Source: Service Control Manager) (User: )
Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
%%1068
Error: (03/18/2014 06:12:16 PM) (Source: Service Control Manager) (User: )
Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
%%1068

Microsoft Office Sessions:
=========================
Error: (03/19/2014 02:03:04 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/19/2014 00:24:21 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/19/2014 11:17:57 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/18/2014 11:59:20 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/18/2014 06:13:55 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/18/2014 03:54:57 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/18/2014 03:39:48 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/18/2014 00:19:41 PM) (Source: Application Hang)(User: )
Description: soffice.bin4.1.1.21b2c01cf42a397f0c7e90D:\Portable Apps\LibreOfficePortable\App\libreoffice\program\soffice.bin93804aa3-ae97-11e3-b88b-bc5ff40da1b3
Error: (03/18/2014 11:15:38 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/18/2014 11:11:25 AM) (Source: Application Hang)(User: )
Description: soffice.bin4.1.1.2111801cf429a92d835420D:\Portable Apps\LibreOfficePortable\App\libreoffice\program\soffice.bin0897d05c-ae8e-11e3-bdb8-bc5ff40da1b3

CodeIntegrity Errors:
===================================
Date: 2013-06-13 04:54:27.183
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.
Date: 2013-06-13 04:41:39.577
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\l3codeca.acm because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================
Percentage of memory in use: 31%
Total physical RAM: 7675.91 MB
Available physical RAM: 5219.67 MB
Total Pagefile: 15350 MB
Available Pagefile: 12481.14 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: (Win7 x64) (Fixed) (Total:49.93 GB) (Free:13.68 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Data) (Fixed) (Total:881.58 GB) (Free:140.33 GB) NTFS
Drive f: (2nd Drive) (Fixed) (Total:74.53 GB) (Free:62.76 GB) NTFS
Drive g: (U3 System) (CDROM) (Total:0.01 GB) (Free:0 GB) CDFS
Drive h: () (Removable) (Total:7.47 GB) (Free:1.12 GB) FAT32
Drive r: (RAMDISK) (Fixed) (Total:0.35 GB) (Free:0.35 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 75 GB) (Disk ID: 82F371B0)
Partition 1: (Active) - (Size=75 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 932 GB) (Disk ID: B60C6404)
Partition: GPT Partition Type.
========================================================
Disk: 2 (Size: 356 MB) (Disk ID: A5A35057)
Partition: GPT Partition Type.
========================================================
Disk: 3 (Size: 7 GB) (Disk ID: 8118385B)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0B)
==================== End Of Log ============================

kevinf80 · March 19, 2014

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Attempt to access Google.com returned error: Other errors
Attempt to access Yahoo.com returned error: Other errors

Looks like the loss of connection is related to some setting on the system...

Can you reset the hosts file to get rid of Block Aid, then reset the DNS settings to default, get rid of the set up as it is at present....

Re-boot and see if the connection returns....

doveman · March 19, 2014

Thanks, resetting the hosts file and the IP/DNS settings to Automatic got it working again

Everything seems to be working OK now, with the exception of the taskbar Jump List for Windows Explorer, which apparently has some pre-existing pinned entries missing now and also won't let us pin any new folders to it. I even removed a pinned folder and then tried to re-pin it back but that didn't work. It also doesn't show any Recent items at the moment.

I know the Recent list has a default limit of 10, so I'm not sure if there's also a limit for pinned items that he might have reached but from what he's telling me, it's not behaving as it used to.

Was there any clue exactly what the virus was and whether it might have done anything else he should be concerned about, such as stealing his passwords?

I've re-installed Avast now and enabled the HIPS and Sandbox in Comodo. I also setup a SRP as per this guide http://blog.windowsnt.lv/2011/06/01/preventing-malware-with-srp-english/ but set it to not apply to Administrators and created a new Admin account and changed his normal account to a LUA but then he started getting some errors and some programs couldn't run, even though they were in Program Files which is allowed by the SRP, so I've had to set it back to an Admin account for now and just hope that the security software protects him.

kevinf80 · March 19, 2014

There is always the possibility that passwords may have been harvested, any passwords that protect anything financial should have been changed, preferably from a known clean system. For now i`d like to run another two indepth scans, these will be very thorough so may take several hours to complete...

When we are confident the system is definitely clean we can move on:

Run Malwarebytes, Open > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a FULL scan

Make sure that everything is checked, and click Remove Selected on any found items.

Post the produced log..

Next,

We need to run an online AV scan to ensure there are no remnants of any infection left on your system that may have been missed. This scan is very thorough and well worth running, it can take several hours please be patient and let it complete:

Run Eset Online Scanner

**Note** You will need to use Internet explorer for this scan - Vista and win 7 right click on IE shortcut and run as admin

Go to Eset web page http://www.eset.com/us/online-scanner/ to run an online scan from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
click on the Run ESET Online Scanner button
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the add/on to be installed
Click Start
Make sure that the option Remove found threats is unticked
Click on Advanced Settings, ensure the options
Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
wait for the virus definitions to be downloaded
Wait for the scan to finish

When the scan is complete

If no threats were found
put a checkmark in "Uninstall application on close"
close program
report to me that nothing was found

If threats were found

click on "list of threats found"
click on "export to text file" and save it as ESET SCAN and save to the desktop
Click on back
put a checkmark in "Uninstall application on close"
click on finish

close program

copy and paste the report in next reply

Thanks,

Kevin...

AdvancedSetup · March 21, 2014

Are you still with us?

This topic will be closed soon if we do not hear back from you.

doveman · March 21, 2014

Yep, sorry. I told my brother to do the ESET online scan overnight (last night) as it might take a few hours, so hopefully I'll get the logs from him today or else I'll chase him up.

kevinf80 · March 21, 2014

Thank you for the update...

doveman · March 22, 2014

OK, sorry for the delay. Here's the MBAM log:

Malwarebytes Anti-Malware 1.75.0.1300www.malwarebytes.orgDatabase version: v2014.03.19.10Windows 7 Service Pack 1 x64 NTFSInternet Explorer 10.0.9200.16844Steve :: STE-PC [administrator]19/03/2014 21:44:57MBAM-log-2014-03-20 (00-04-22).txtScan type: Full scan (C:\|D:\|E:\|F:\|R:\|V:\|)Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 734326Time elapsed: 2 hour(s), 10 minute(s), 53 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 5HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> No action taken.HKCU\SOFTWARE\DataMngr_Toolbar (PUP.Optional.DataMngr.A) -> No action taken.HKCU\Software\DataMngr (PUP.Optional.DataMngr.A) -> No action taken.HKCU\Software\BabSolution\Updater (PUP.Optional.Babylon.A) -> No action taken.HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> No action taken.Registry Values Detected: 1HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Data: 0O1O1FtGtCtH1T1M1R1XtGtB -> No action taken.Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 2D:\Download\FreeAudioDub.exe (PUP.Optional.OpenCandy) -> No action taken.D:\Portable Apps\FreeFileSync\$PLUGINSDIR\OCSetupHlp.dll (PUP.Optional.OpenCandy) -> No action taken.(end)

He's removed all the registry keys/registry values but we've left the 2 files for now. He needs to use FreeFileSync and I believe OpenCandy is just an adware thing anyway. I'm not sure if he currently has installed or is using FreeAudioDub but probably not or else I guess we'd be seeing other references to OpenCandy in the registry or system partition.

ESET has identified these:

C:\Program Files (x86)\EaseUS\Todo Backup\bin\PxeServer.dll a variant of Win32/TFTPD32.A potentially unsafe application
C:\Program Files (x86)\Free Videos To DVD\Helper.dll a variant of Win32/Toolbar.SearchSuite.P potentially unwanted application
C:\Program Files (x86)\uTorrent\uTorrent.exe a variant of Win32/Bunndle potentially unsafe application
D:\Download\FreeAudioDub.exe Win32/OpenCandy potentially unsafe application
D:\Portable Apps\FreeFileSync\$PLUGINSDIR\OCSetupHlp.dll Win32/OpenCandy potentially unsafe application
D:\Portable Apps\RipBot264\Tools\Process\Process.exe Win32/PrcView potentially unsafe application
D:\Portable Apps\Utils\MaxxMEM2_preview\MaxxMEM2_preview.exe a variant of Win32/Packed.MultiPacked.N trojan

EaseUS looks like it's probably a false positive and has just identified that component allows for TFTP connections. I'll delete MaxxMEM2_preview as he doesn't really need that anyway. I know he uses Free Videos to DVD (I tried about 10 different free programs to do the same thing for him without any adware but all of them had one or more issues, so he's back on that for now), uTorrent, FreeFileSync and RipBot264 occasionally.

Besides his Windows Explorer Pinned List/Recents not working correctly, I'm not sure if Windows Updates is either as it's set to Automatically Update but it's showing the notification icon prompting him to update manually, which I imagine shouldn't appear if it's on Automatic. I'll try changing it to manual and back though to see if that fixes it.

kevinf80 · March 22, 2014

I would recommend all of those entries are removed, I guess that choice is up to you. Also the use of P2P applications such as uTorrent is against Forum protocol, I did post advice against such applications in my opening reply:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

As the system has suffered possible registry/system damage due to infection run the following:

download Portable Windows Repair (all in one) from one of the following:

http://www.tweaking.com/content/page/windows_repair_all_in_one.html

http://www.majorgeeks.com/Tweaking.com_-_Windows_Repair_Portable_d7222.html

http://www.bleepingcomputer.com/download/windows-repair-all-in-one-portable/

Unzip the contents into a newly created folder on your desktop.

Open the folder, run the tool by right click on Repair_Windows (icon with red briefcase) select "Run as Administrator"

From the main GUI do the following:

Select Tab 3 and allow it to run SFC

Select Tab 4 and Create System Restore Point

Select Repairs tab => Click the Start

The repairs window will open, Check the boxes as indicated, also the "Restart" options, the select Start...

DON'T use the computer while each scan is in progress.

Post the log, to access select "settings" tab > "open log folder" tab, log will be named _Windows_Repair_Log

Let me know if there are any remaining issues or concerns,

Kevin

doveman · March 23, 2014

I would recommend all of those entries are removed, I guess that choice is up to you. Also the use of P2P applications such as uTorrent is against Forum protocol, I did post advice against such applications in my opening reply:

Yes, uTorrent has been disabled from running whilst you've been assisting, as per the Forum protocol. I'll certainly look for alternatives without adware like OpenCandy for FreeFileSync, FreeAudioDub (if my brother needs that) and Free Videos to DVD. I'll test if EaseUS ToDo Backup still works if I delete the PxeServer.dll file, as my brother doesn't need to use any network functions in that software.

Regarding Portable Windows Repair, I just wanted to confirm that you mean I should uncheck the bottom two Repair Options?

kevinf80 · March 23, 2014

Yes please, those are specific to windows 8.

doveman · March 23, 2014

OK, thanks.

I decided to test it on my own system first (I unchecked the Reset File Permissions step though, as it says that can take a 'very significant amount of time' and I couldn't have my system unavailable for too long), partly because I wanted to check that so many fixes wouldn't cause unforeseen problems on my brother's system as I don't live near him, so can't just pop over to fix any problems that are hard to fix remotely but also because I've had some problems on my system with Volume Shadow Service and MySQL not installing/working properly (plus ocassional issues with IE but they could be related to plugins or some other third-party software). After restarting, it locked up soon after WIndows finished loading. The mouse cursor wouldn't move and the keyboard couldn't even toggle Capslock and after 10-15mins I realised I had to hard reset. The next time it worked better and the mouse cursor and keyboard were functioning, although it still took 5-10mins before it would actually receive any input, so hopefully it's OK now and if the same thing happens on my brother's system, a second reboot will sort it out but I'm still a bit nervous.

I do have the VHD installed on there which I can use for remote access if it goes wrong though and have just made a EaseUS system backup to restore to if necessary, so I guess I don't need to be overly concerned. I just thought you might like to know that it seems it can cause some problems, even if they're only temporary.

kevinf80 · March 23, 2014

I`ve used this tool many times and never experienced any issues whatsoever, I guess there has to be a first. A fresh restore point was requested before the final step to reset any significant changes that may have been made by malware/infection....

Let me know what happens...

doveman · March 25, 2014

Yeah, I'm always the first one to run into problems

Having read them a bit more, I have to say I'm a bit concerned by repair items 1 & 2 as it seems to say it will grant every user/group (except Guest) full rights to every registry key and system file.

This doesn't sound like how Windows is normally configured as I don't think normal Users have such rights and if they did, surely there wouldn't be much security advantage in running as a User rather than an Administrator would there?

kevinf80 · March 25, 2014

Any settings you do not agree with can be can either be unticked or reset to the way you like once the tool is finished

doveman · March 25, 2014

OK, thanks.

kevinf80 · March 25, 2014

Thank you...

AdvancedSetup · March 31, 2014

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Group Policy blocking everything

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information