Identifying "appInit_Dlls" as a registry rootkit activity or not; please help

CioCZ · March 25, 2014

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume1

Install Date: 10/29/2012 4:13:19 AM

System Uptime: 3/25/2014 5:10:12 AM (4 hours ago)

.

Motherboard: CLEVO | | P170EM

Processor: Intel® Core i7-3720QM CPU @ 2.60GHz | SOCKET 0 | 2601/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 224 GiB total, 91.329 GiB free.

D: is FIXED (NTFS) - 699 GiB total, 448.029 GiB free.

E: is CDROM ()

F: is CDROM ()

G: is CDROM ()

T: is FIXED (NTFS) - 224 GiB total, 36.416 GiB free.

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP236: 3/16/2014 5:44:58 AM - Installed DirectX

RP237: 3/16/2014 9:56:34 PM - Norton 360 Registry Clean

RP238: 3/18/2014 12:15:03 PM - Norton 360 Registry Clean

RP239: 3/20/2014 11:39:30 AM - Norton 360 Registry Clean

RP240: 3/23/2014 10:18:37 AM - Norton 360 Registry Clean

.

==== Installed Programs ======================

.

7-Zip 9.20 (x64 edition)

ABBYY FineReader 5.0 Sprint Plus

ActivClient CAC x64

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader X (10.1.4)

AIM for Windows

Amazon Kindle

ApproveIt Desktop

ArcSoft PhotoImpression

AuthenTec TrueSuite

Bigfoot Networks Killer Network Manager

BisonCam

BitComet 1.34 64-bit

Bonjour

Borderlands

Borderlands 2

Cheat Engine 6.1

Combined Community Codec Pack 2011-11-11

Content Manager Assistant for PlayStation®

Creative System Information

Crysis® 2

DAEMON Tools Lite

DBsign Web Signer

Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition

Diablo III

EPSON Copy Utility

EPSON EIC CX5400

EPSON Photo Print

EPSON Printer Software

EPSON Scan

EPSON Smart Panel

Facebook Video Calling 2.0.0.447

FileASSASSIN

FLAC 1.2.1b (remove only)

foobar2000 v1.2.9

Garmin ANT Agent

Garmin Communicator Plugin

Garmin Communicator Plugin x64

Garmin USB Drivers

Garmin WebUpdater

GeForce Experience NvStream Client Components

Google Chrome

Google Update Helper

Hotkey 6.0045

IBM Lotus Forms Viewer 3.5.1

Intel® Control Center

Intel® Management Engine Components

Intel® OpenCL CPU Runtime

Intel® Processor Graphics

Intel® Rapid Storage Technology

Intel® Update Manager

Intel® USB 3.0 eXtensible Host Controller Driver

Intel® SSD Toolbox

Intel® Trusted Connect Service Client

iriver plus 4

Java 7 Update 45

Java Auto Updater

Malwarebytes Anti-Exploit version 0.10.0.1000

Malwarebytes Anti-Malware version 1.75.0.1300

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Office 2010 Service Pack 1 (SP1)

Microsoft Office Access MUI (English) 2010

Microsoft Office Access Setup Metadata MUI (English) 2010

Microsoft Office Excel MUI (English) 2010

Microsoft Office Groove MUI (English) 2010

Microsoft Office InfoPath MUI (English) 2010

Microsoft Office Office 32-bit Components 2010

Microsoft Office OneNote MUI (English) 2010

Microsoft Office Outlook MUI (English) 2010

Microsoft Office PowerPoint MUI (English) 2010

Microsoft Office Professional Plus 2010

Microsoft Office Proof (English) 2010

Microsoft Office Proof (French) 2010

Microsoft Office Proof (Spanish) 2010

Microsoft Office Proofing (English) 2010

Microsoft Office Publisher MUI (English) 2010

Microsoft Office Shared 32-bit MUI (English) 2010

Microsoft Office Shared MUI (English) 2010

Microsoft Office Shared Setup Metadata MUI (English) 2010

Microsoft Office Word MUI (English) 2010

Microsoft Silverlight

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Mirror's Edge™

Motorola Device Manager

Motorola Device Software Update

Motorola Mobile Drivers Installation 5.9.0

Mozilla Firefox 18.0.1 (x86 en-US)

Mozilla Maintenance Service

Norton 360 Premier Edition

Norton Management

NVIDIA Control Panel 335.23

NVIDIA GeForce Experience 1.8.2

NVIDIA Graphics Driver 335.23

NVIDIA Install Application

NVIDIA LED Visualizer 1.0

NVIDIA Network Service

NVIDIA Optimus Update 11.10.11

NVIDIA PhysX

NVIDIA PhysX System Software 9.13.1220

NVIDIA ShadowPlay 11.10.11

NVIDIA Update 11.10.11

NVIDIA Update Core

NVIDIA Virtual Audio 1.2.20

Origin

PunkBuster Services

QuickTime

Realtek Ethernet Controller Driver

Realtek High Definition Audio Driver

Realtek PCIE Card Reader

SCHOOLDAYS HQ

Security Update for Microsoft Excel 2010 (KB2826033) 64-Bit Edition

Security Update for Microsoft Office 2010 (KB2553284) 64-Bit Edition

Security Update for Microsoft Office 2010 (KB2553371) 64-Bit Edition

Security Update for Microsoft Office 2010 (KB2589320) 64-Bit Edition

Security Update for Microsoft Office 2010 (KB2598243) 64-Bit Edition

Security Update for Microsoft Office 2010 (KB2687423) 64-Bit Edition

Security Update for Microsoft Office 2010 (KB2687510) 64-Bit Edition

Security Update for Microsoft Office 2010 (KB2826023) 64-Bit Edition

Security Update for Microsoft Office 2010 (KB2826035) 64-Bit Edition

Security Update for Microsoft Office 2010 (KB2850016) 64-Bit Edition

Security Update for Microsoft Publisher 2010 (KB2553147) 64-Bit Edition

Security Update for Microsoft Word 2010 (KB2863902) 64-Bit Edition

SHIELD Streaming

Smart Technology Programming Software 7.0.13.22

Sniper Ghost Warrior 2

Sound Blaster Recon3D

Sound Blaster Recon3D Extras

StarCraft II

Steam

Synaptics Pointing Device Driver

The Sims™ 3

The Sims™ 3 High-End Loft Stuff

The Sims™ 3 Late Night

THX TruStudio Pro

Total War: SHOGUN 2

Update for Microsoft Access 2010 (KB2553446) 64-Bit Edition

Update for Microsoft Filter Pack 2.0 (KB2837594) 64-Bit Edition

Update for Microsoft InfoPath 2010 (KB2817369) 64-Bit Edition

Update for Microsoft InfoPath 2010 (KB2817396) 64-Bit Edition

Update for Microsoft Office 2010 (KB2553065)

Update for Microsoft Office 2010 (KB2553267) 64-Bit Edition

Update for Microsoft Office 2010 (KB2553310) 64-Bit Edition

Update for Microsoft Office 2010 (KB2566458)

Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition

Update for Microsoft Office 2010 (KB2589352) 64-Bit Edition

Update for Microsoft Office 2010 (KB2589375) 64-Bit Edition

Update for Microsoft Office 2010 (KB2597087) 64-Bit Edition

Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition

Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition

Update for Microsoft Office 2010 (KB2767886) 64-Bit Edition

Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition

Update for Microsoft Office 2010 (KB2825640) 64-Bit Edition

Update for Microsoft Office 2010 (KB2850079) 64-Bit Edition

Update for Microsoft Office 2010 (KB2863818) 64-Bit Edition

Update for Microsoft Office 2010 (KB2878225) 64-Bit Edition

Update for Microsoft OneNote 2010 (KB2553290) 64-Bit Edition

Update for Microsoft OneNote 2010 (KB2837595) 64-Bit Edition

Update for Microsoft Outlook 2010 (KB2687567) 64-Bit Edition

Update for Microsoft Outlook Social Connector 2010 (KB2553406) 64-Bit Edition

Update for Microsoft PowerPoint 2010 (KB2553145) 64-Bit Edition

Update for Microsoft PowerPoint 2010 (KB2775360) 64-Bit Edition

Update for Microsoft SharePoint Workspace 2010 (KB2760601) 64-Bit Edition

Update for Microsoft Visio 2010 (KB2878227) 64-Bit Edition

Update for Microsoft Visio Viewer 2010 (KB2810066) 64-Bit Edition

Ventrilo Client for Windows x64

Viewer_armyifx

VLC media player 2.0.3

WD Drive Utilities

WD Security

WD SmartWare

WebCam Installer

WinRAR 4.20 (64-bit)

XSplit

.

==== Event Viewer Messages From Past Week ========

.

3/25/2014 5:10:25 AM, Error: Service Control Manager [7000] - The Motorola Device Manager

Service service failed to start due to the following error: The application has failed to start

because its side-by-side configuration is incorrect. Please see the application event log or use

the command-line sxstrace.exe tool for more detail.

3/24/2014 12:50:20 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds)

was reached while waiting for a transaction response from the MBAMScheduler service.

.

==== End Of File ===========================

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 10.0.9200.16843 BrowserJavaVersion: 10.45.2

Run by Inopiquez at 9:16:43 on 2014-03-25

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.16280.12505 [GMT 4.5:30]

.

AV: Norton 360 Premier Edition *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton 360 Premier Edition *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

FW: Norton 360 Premier Edition *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Program Files\AuthenTec TrueSuite\TrueSuiteService.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\WUDFHost.exe

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Program Files\Common Files\ActivIdentity\ac.sharedstore.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\ActivIdentity\ActivClient\acevents.exe

C:\Windows\system32\svchost.exe -k WbioSvcGroup

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Bigfoot Networks\Killer Network Manager\BFNService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Intel\iCLS Client\HeciServer.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files (x86)\Norton Management\Engine\3.2.2.12\ccSvcHst.exe

C:\Program Files (x86)\Norton 360 Premier Edition\Engine\20.4.0.40\ccSvcHst.exe

C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

C:\Windows\SysWOW64\PnkBstrA.exe

C:\Windows\SysWOW64\PnkBstrB.exe

C:\Program Files (x86)\Hotkey\PowerBiosServer.exe

C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe

C:\Program Files (x86)\Western Digital\WD SmartWare\WDRulesEngine.exe

C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files (x86)\Norton Management\Engine\3.2.2.12\ccSvcHst.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Program Files\AuthenTec TrueSuite\TouchControl.exe

C:\Windows\Explorer.EXE

C:\Program Files\AuthenTec TrueSuite\BioMonitor.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\AuthenTec TrueSuite\KeepSafe\fvsvr.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\SmartTechnology\Software\SaiMfd.exe

C:\Program Files\ActivIdentity\ActivClient\acevents.exe

C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

C:\Program Files\ActivIdentity\ActivClient\acsagent.exe

C:\Program Files (x86)\Hotkey\Hotkey.exe

C:\Program Files\Qualcomm Atheros\Killer Network Manager\KillerNetManager.exe

C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application

\iusb3mon.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files (x86)\Western Digital\WD Security\WDDriveAutoUnlock.exe

C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe

C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Program Files (x86)\Norton 360 Premier Edition\Engine\20.4.0.40\ccSvcHst.exe

C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Windows\system32\wuauclt.exe

C:\Program Files\SmartTechnology\Software\ProfilerU.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

C:\Users\Inopiquez\Desktop\mbar\mbar.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

mWinlogon: Userinit = userinit.exe,

BHO: PE_IE_Helper Class: {0941C58F-E461-4E03-BD7D-44C27392ADE1} - C:\Program Files (x86)\IBM

\Lotus Forms\Viewer\3.5\PEhelper.dll

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files

(x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files

(x86)\Norton 360 Premier Edition\Engine\20.4.0.40\coieplg.dll

BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files

(x86)\Norton 360 Premier Edition\Engine\20.4.0.40\ips\ipsbho.dll

BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files

(x86)\Microsoft Office\Office14\GROOVEEX.DLL

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files

(x86)\Java\jre7\bin\ssv.dll

BHO: TrueSuite Website Log On: {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files

\AuthenTec TrueSuite\x86\IEBHO.dll

BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files

(x86)\Microsoft Office\Office14\URLREDIR.DLL

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files

(x86)\Java\jre7\bin\jp2ssv.dll

TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360

Premier Edition\Engine\20.4.0.40\coieplg.dll

uRun: [Auto] E:\autorun.exe

uRun: [EPSON Stylus CX7400 Series] C:\Windows\System32\spool\DRIVERS\x64\3\E_IATICDA.EXE /FU "C:

\Windows\TEMP\E_S33CC.tmp" /EF "HKCU"

mRun: [uSB3MON] "C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver

\Application\iusb3mon.exe"

mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun: [AprvRemoveLegacyExcelKeys] "C:\Program Files (x86)\ApproveIt\Support\Tools\AprvClean.exe"

-k HKCU SOFTWARE\Microsoft\Office\Excel\Addins\OfficeAddIn.OfficeAddIn

mRun: [AprvRemoveLegacyWordKeys] "C:\Program Files (x86)\ApproveIt\Support\Tools\AprvClean.exe"

-k HKCU SOFTWARE\Microsoft\Office\Word\Addins\OfficeAddIn.OfficeAddIn

mRun: [WD Drive Unlocker] C:\Program Files (x86)\Western Digital\WD Security

\WDDriveAutoUnlock.exe

mRun: [WD Quick View] C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe

mRun: [Malwarebytes Anti-Exploit] C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\ACTIVC~1.LNK - C:\Program

Files\ActivIdentity\ActivClient\acsagent.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\APPROV~1.LNK - C:\Windows

\Installer\{4E01B649-0023-4EB5-9263-57DE317C3418}\Icon9557F1BC1.ico

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BIGFOO~1.LNK - C:\Program

Files\Bigfoot Networks\Killer Network Manager\KillerNetManager.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\Hotkey.lnk - C:\Program

Files (x86)\Hotkey\Hotkey.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\QUALCO~1.LNK - C:\Program

Files\Qualcomm Atheros\Killer Network Manager\KillerNetManager.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableLUA = dword:0

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program

Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program

Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

LSP: %SYSTEMROOT%\system32\BfLLR.dll

-windows-i586.cab

TCP: NameServer = 10.155.0.1 208.67.222.222 208.67.220.220

TCP: Interfaces\{04AD7831-602D-4F62-81F4-A9C935A8F2A3} : DHCPNameServer = 192.168.42.129

TCP: Interfaces\{E9B35DFD-E8BC-4EB3-9506-310D908D31CD} : DHCPNameServer = 12.151.47.3

69.60.160.196

TCP: Interfaces\{EF08AD78-F2E5-46F7-9690-8618BC82851F} : DHCPNameServer = 10.155.0.1

208.67.222.222 208.67.220.220

TCP: Interfaces\{EF08AD78-F2E5-46F7-9690-8618BC82851F}\3584C4D2D45435D21413 : DHCPNameServer =

10.155.0.1 208.67.222.222 208.67.220.220

TCP: Interfaces\{EF08AD78-F2E5-46F7-9690-8618BC82851F}\3584C4D2D45435D22433 : DHCPNameServer =

10.155.0.1 208.67.222.222 208.67.220.220

TCP: Interfaces\{EF08AD78-F2E5-46F7-9690-8618BC82851F}\3584C4D2D45435D27433 : DHCPNameServer =

10.155.0.1 208.67.222.222 208.67.220.220

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files

\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

AppInit_DLLs= C:\Windows\SysWOW64\nvinit.dll

SSODL: WebCheck - <orphaned>

SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files

(x86)\Microsoft Office\Office14\GROOVEEX.DLL

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome

\Application\33.0.1750.154\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --

system-level --multi-install --chrome

x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files

\Microsoft Office\Office14\GROOVEEX.DLL

x64-BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - <orphaned>

x64-BHO: TrueSuite Website Log On: {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files

\AuthenTec TrueSuite\IEBHO.dll

x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program

Files\Microsoft Office\Office14\URLREDIR.DLL

x64-BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} -

x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

x64-Run: [synTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe

x64-Run: [KeepSafe] "C:\Program Files\AuthenTec TrueSuite\KeepSafe\fvsvr.exe" /startup

x64-Run: [THXCfg64] C:\Windows\System32\RunDLL32.exe C:\Windows\System32\THXCfg64.dll,RunDLLEntry

THXCfg64

x64-Run: [accrdsub] "C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe"

x64-Run: [Creative SB Monitoring Utility] RunDll32 sbavmon.dll,SBAVMonitor

x64-Run: [saiMfd] C:\Program Files\SmartTechnology\Software\SaiMfd.exe

x64-Run: [acevents] "C:\Program Files\ActivIdentity\ActivClient\acevents.exe"

x64-Run: [NvBackend] "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"

x64-Run: [shadowPlay] C:\Windows\System32\rundll32.exe C:\Windows

\System32\nvspcap64.dll,ShadowPlayOnSystemStart

x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:

\Program Files\Microsoft Office\Office14\ONBttnIE.dll

x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:

\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files

\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

x64-Notify: igfxcui - igfxdev.dll

x64-SSODL: WebCheck - <orphaned>

x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program

Files\Microsoft Office\Office14\GROOVEEX.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Inopiquez\AppData\Roaming\Mozilla\Firefox\Profiles\nm4x22fu.default\

pid=924&r=2013/04/27&hid=3229854367&lg=EN&cc=US&l=1&q=

FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Gradkell Systems, Inc\DBsign Data Security Suite\Common\Lib

\npDbsGscInfo.dll

FF - plugin: C:\Program Files (x86)\Gradkell Systems, Inc\DBsign Data Security Suite\Common\Lib

\npDBsignWeb.dll

FF - plugin: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT

\npIntelWebAPIIPT.dll

FF - plugin: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT

\npIntelWebAPIUpdater.dll

FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrlui.dll

FF - plugin: C:\Users\Inopiquez\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll

FF - plugin: C:\Windows\SysWOW64\npdeployJava1.dll

FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

.

---- FIREFOX POLICIES ----

FF - user.js: extensions.delta.tlbrSrchUrl -

FF - user.js: extensions.delta.id - aa567d420000000000007ce9d3a388f4

FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}

FF - user.js: extensions.delta.instlDay - 15883

FF - user.js: extensions.delta.vrsn - 1.8.21.5

FF - user.js: extensions.delta.vrsni - 1.8.21.5

FF - user.js: extensions.delta.vrsnTs - 1.8.21.513:10:30

FF - user.js: extensions.delta.prtnrId - delta

FF - user.js: extensions.delta.prdct - delta

FF - user.js: extensions.delta.aflt - babsst

FF - user.js: extensions.delta.smplGrp - none

FF - user.js: extensions.delta.tlbrId - base

FF - user.js: extensions.delta.instlRef - sst

FF - user.js: extensions.delta.dfltLng - en

FF - user.js: extensions.delta.excTlbr - false

FF - user.js: extensions.delta.ffxUnstlRst - true

FF - user.js: extensions.delta.admin - false

FF - user.js: extensions.delta_i.babTrack - affID=119994&tt=250613_gr2&tsp=4926

FF - user.js: extensions.delta_i.babExt -

FF - user.js: extensions.delta_i.srcExt - ss

FF - user.js: extensions.delta.autoRvrt - false

FF - user.js: extensions.delta.rvrt - false

FF - user.js: extensions.delta.newTab - false

.

============= SERVICES / DRIVERS ===============

.

R0 iusb3hcs;Intel® USB 3.0 Host Controller Switch Driver;C:\Windows\System32\drivers

\iusb3hcs.sys [2012-10-29 16152]

R0 nvpciflt;nvpciflt;C:\Windows\System32\drivers\nvpciflt.sys [2014-3-21 33736]

R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\N360x64\1404000.028\symds64.sys [2013-6

-14 493656]

R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers

\N360x64\1404000.028\symefa64.sys [2013-6-14 1139800]

R1 BfLwf;Bigfoot Networks Bandwidth Control;C:\Windows\System32\drivers\bflwfx64.sys [2011-6-26

69224]

R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-

85EF591126E7}\N360_20.3.1.22\Definitions\BASHDefs\20140319.001\BHDrvx64.sys [2014-3-19 1525976]

R1 ccSet_MCLIENT;Norton Management Settings Manager;C:\Windows\System32\drivers

\MCLIENTx64\0302020.00C\ccsetx64.sys [2013-8-22 168096]

R1 ccSet_N360;Norton 360 Settings Manager;C:\Windows\System32\drivers

\N360x64\1404000.028\ccsetx64.sys [2013-6-14 169048]

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\System32\drivers\dtsoftbus01.sys [2012

-10-30 283200]

R1 ESProtectionDriver;Malwarebytes Anti-Exploit;C:\Program Files (x86)\Malwarebytes Anti-Exploit

\mbae64.sys [2014-3-23 62168]

R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-

85EF591126E7}\N360_20.3.1.22\Definitions\IPSDefs\20140321.001\IDSviA64.sys [2014-3-22 524504]

R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\N360x64\1404000.028\ironx64.sys

[2013-6-14 224416]

R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers

\N360x64\1404000.028\symnets.sys [2013-6-14 433752]

R2 ac.sharedstore;ActivIdentity Shared Store Service;C:\Program Files\Common Files\ActivIdentity

\ac.sharedstore.exe [2009-6-4 277032]

R2 Bigfoot Networks Killer Service;Bigfoot Networks Killer Service;C:\Program Files\Bigfoot

Networks\Killer Network Manager\BFNService.exe [2011-6-26 466944]

R2 FPLService;TrueSuiteService;C:\Program Files\AuthenTec TrueSuite\TrueSuiteService.exe [2011-

11-3 299848]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid

Storage Technology\IAStorDataMgrSvc.exe [2012-10-29 13592]

R2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service

Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-1-11 627936]

R2 jhi_service;Intel® Dynamic Application Loader Host Interface Service;C:\Program Files

(x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe [2012-10-29 161560]

R2 MbaeSvc;Malwarebytes Anti-Exploit Service;C:\Program Files (x86)\Malwarebytes Anti-Exploit

\mbae-svc.exe [2014-3-23 319288]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware

\mbamscheduler.exe [2014-3-15 418376]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

[2014-3-15 701512]

R2 MCLIENT;Norton Management;C:\Program Files (x86)\Norton Management\Engine

\3.2.2.12\ccsvchst.exe [2013-8-22 143928]

R2 N360;Norton 360;C:\Program Files (x86)\Norton 360 Premier Edition\Engine

\20.4.0.40\ccsvchst.exe [2013-6-14 144368]

R2 NvNetworkService;NVIDIA Network Service;C:\Program Files (x86)\NVIDIA Corporation\NetService

\NvNetworkService.exe [2013-12-3 1593632]

R2 NvStreamSvc;NVIDIA Streamer Service;C:\Program Files\NVIDIA Corporation\NvStreamSrv

\nvstreamsvc.exe [2014-3-16 16939296]

R2 PowerBiosServer;PowerBiosServer;C:\Program Files (x86)\Hotkey\PowerBiosServer.exe [2011-2-19

35328]

R2 PST Service;PST Service;C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe

[2013-1-1 65657]

R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files

(x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2012-10-29 363800]

R2 WDBackup;WD Backup;C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe

[2012-9-20 1157056]

R2 WDDriveService;WD Drive Manager;C:\Program Files (x86)\Western Digital\WD Drive Manager

\WDDriveService.exe [2012-9-6 248248]

R2 WDRulesService;WD Rules;C:\Program Files (x86)\Western Digital\WD SmartWare\WDRulesEngine.exe

[2012-9-20 1177536]

R3 Ak27x64;Killer Wireless-N 1102 device driver;C:\Windows\System32\drivers\Ak27x64.sys [2011-6-

26 2740328]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared

\EENGINE\EraserUtilRebootDrv.sys [2013-11-25 137648]

R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2012-10-29 331264]

R3 iusb3hub;Intel® USB 3.0 Hub Driver;C:\Windows\System32\drivers\iusb3hub.sys [2012-10-29

356120]

R3 iusb3xhc;Intel® USB 3.0 eXtensible Host Controller Driver;C:\Windows\System32\drivers

\iusb3xhc.sys [2012-10-29 787736]

R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2014-3-15 25928]

R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);C:\Windows

\System32\drivers\nvvad64v.sys [2014-3-16 39200]

R3 RSBASTOR;Realtek PCIE CardReader Driver - BA;C:\Windows\System32\drivers\RtsBaStor.sys [2012-

10-29 292968]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2012-10-29 685160]

R3 SaiK0CFA;SaiK0CFA;C:\Windows\System32\drivers\SaiK0CFA.sys [2011-9-20 183104]

R3 SaiU0CFA;SaiU0CFA;C:\Windows\System32\drivers\SaiU0CFA.sys [2011-9-20 47168]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows

\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows

\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 Motorola Device Manager;Motorola Device Manager Service;C:\Program Files (x86)\Motorola

Mobility\Motorola Device Manager\MotoHelperService.exe [2012-10-2 120728]

S3 BITCOMET_HELPER_SERVICE;BitComet Disk Boost Service;C:\Program Files\BitComet\tools

\BitCometService.exe -service --> C:\Program Files\BitComet\tools\BitCometService.exe -service

[?]

S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;C:\Program Files

(x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2012-10-29 79360]

S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program

Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2012-10-29 79360]

S3 ksaud;Creative USB Audio Driver;C:\Windows\System32\drivers\ksaud.sys [2012-10-29 1825024]

S3 libusb0;LibUsb-Win32 - Kernel Driver 07/07/2009, 0.1.12.2;C:\Windows\System32\drivers

\libusb0.sys [2009-7-7 32256]

S3 motandroidusb;Mot ADB Interface Driver;C:\Windows\System32\drivers\motoandroid.sys [2009-7-11

31744]

S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine

\OSE.EXE [2010-1-10 174440]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-21 59392]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-21

31232]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-12-13 54784]

S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\drivers\wdcsam64.sys [2012-9-6 14464]

.

=============== Created Last 30 ================

.

2014-03-24 00:42:14 -------- d-----w- C:\Windows\SysWow64\NV

2014-03-24 00:42:14 -------- d-----w- C:\Windows\System32\NV

2014-03-23 05:41:21 -------- d-----w- C:\Program Files (x86)\FileASSASSIN

2014-03-23 05:40:32 -------- d-----w- C:\Program Files (x86)\Malwarebytes

Anti-Exploit

2014-03-21 01:03:41 922968 ----a-w- C:\Windows\System32\nvvsvc.exe

2014-03-21 01:03:41 6714312 ----a-w- C:\Windows\System32\nvcpl.dll

2014-03-21 01:03:41 67072 ----a-w- C:\Windows\System32\nv3dappshextr.dll

2014-03-21 01:03:41 64968 ----a-w- C:\Windows\System32\nvshext.dll

2014-03-21 01:03:41 386336 ----a-w- C:\Windows\System32\nvmctray.dll

2014-03-21 01:03:41 3649185 ----a-w- C:\Windows\System32\nvcoproc.bin

2014-03-21 01:03:41 3497816 ----a-w- C:\Windows\System32\nvsvc64.dll

2014-03-21 01:03:41 2558808 ----a-w- C:\Windows\System32\nvsvcr.dll

2014-03-21 01:03:41 1075032 ----a-w- C:\Windows\System32\nv3dappshext.dll

2014-03-20 05:49:41 91352 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys

2014-03-16 01:14:57 1179576 ----a-w- C:\Windows\System32\nvspcap64.dll

2014-03-16 01:14:57 1048152 ----a-w- C:\Windows\SysWow64\nvspcap.dll

2014-03-16 01:06:42 39200 ----a-w- C:\Windows\System32\drivers\nvvad64v.sys

2014-03-16 01:06:42 35104 ----a-w- C:\Windows\System32\nvaudcap64v.dll

2014-03-16 01:06:42 33056 ----a-w- C:\Windows\SysWow64\nvaudcap32v.dll

2014-03-15 18:36:08 -------- d-----w- C:\ProgramData\Malwarebytes' Anti-Malware

(portable)

2014-03-15 06:30:43 -------- d-----w- C:\Users\Inopiquez\AppData\Roaming

\Malwarebytes

2014-03-15 06:30:34 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

2014-03-15 06:30:34 -------- d-----w- C:\ProgramData\Malwarebytes

2014-03-15 06:30:34 -------- d-----w- C:\Program Files (x86)\Malwarebytes'

Anti-Malware

2014-03-15 06:30:24 -------- d-----w- C:\Users\Inopiquez\AppData\Local\Programs

2014-03-15 06:16:28 -------- d-----w- C:\ProgramData\SMR410

2014-03-15 03:06:08 484864 ----a-w- C:\Windows\System32\wer.dll

2014-03-15 03:06:08 381440 ----a-w- C:\Windows\SysWow64\wer.dll

2014-03-15 03:06:07 3156480 ----a-w- C:\Windows\System32\win32k.sys

2014-03-15 03:06:04 624128 ----a-w- C:\Windows\System32\qedit.dll

2014-03-15 03:06:04 509440 ----a-w- C:\Windows\SysWow64\qedit.dll

2014-03-07 05:06:29 600064 ----a-w- C:\Windows\System32\vbscript.dll

2014-03-07 05:06:29 523776 ----a-w- C:\Windows\SysWow64\vbscript.dll

2014-03-07 04:33:38 3928064 ----a-w- C:\Windows\System32\d2d1.dll

2014-03-07 04:33:38 3419136 ----a-w- C:\Windows\SysWow64\d2d1.dll

2014-03-07 04:33:38 2565120 ----a-w- C:\Windows\System32\d3d10warp.dll

2014-03-07 04:33:38 1987584 ----a-w- C:\Windows\SysWow64\d3d10warp.dll

2014-03-07 04:28:21 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

2014-03-07 04:28:21 2048 ----a-w- C:\Windows\System32\tzres.dll

2014-03-07 02:14:29 873384 ----a-w- C:\Windows\SysWow64\npdeployJava1.dll

2014-03-07 02:14:29 796072 ----a-w- C:\Windows\SysWow64\deployJava1.dll

2014-03-07 02:09:24 5 ----a-w- C:\Windows

\SysWow64\lMMLDeleteUserData42107612FX.tmp

.

==================== Find3M ====================

.

2014-02-23 08:13:41 2241536 ----a-w- C:\Windows\System32\wininet.dll

2014-02-23 08:11:59 3960320 ----a-w- C:\Windows\System32\jscript9.dll

2014-02-23 08:11:52 67072 ----a-w- C:\Windows\System32\iesetup.dll

2014-02-23 08:11:52 136704 ----a-w- C:\Windows\System32\iesysprep.dll

2014-02-23 06:54:46 1767936 ----a-w- C:\Windows\SysWow64\wininet.dll

2014-02-23 06:53:22 2877952 ----a-w- C:\Windows\SysWow64\jscript9.dll

2014-02-23 06:53:18 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll

2014-02-23 06:53:18 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll

2014-02-23 06:35:36 2706432 ----a-w- C:\Windows\System32\mshtml.tlb

2014-02-23 06:31:25 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2014-02-23 05:39:39 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe

2014-02-23 05:35:24 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe

2014-01-03 01:39:49 96168 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll

.

============= FINISH: 9:16:55.39 ===============

thank you

MrCharlie · March 25, 2014

Welcome to the forum.

Can you repost the DDS log but this time uncheck "Word Wrap" in Notepad
Format > Word Wrap > uncheck it

Then..............

Please run a Quick Scan with Malwarebytes like this and post the log:
Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.
Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.
Make sure that everything is checked, and click Remove Selected.

(If you're using the new version of Malwarebytes 2.0, run a Threat Scan)

---------------------

Then........

Please download and run RogueKiller 32 Bit to your desktop.

RogueKiller 64 Bit <---use this one for 64 bit systems

Which system am I using?

Quit all running programs.

For Windows XP, double-click to start.
For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.
When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.
(please don't put logs in code or quotes and use the default font)

General P2P/Piracy Warning:

1. If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
2. If you have illegal/cracked software, cracks, keygens, custom (Adobe) host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy.
Failure to remove such software will result in your topic being closed and no further assistance being provided.

MrC

Note:
Please read all of my instructions completely including these.

Make sure system restore is turned on and running

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>When we are done, I'll give to instructions on how to cleanup all the tools and logs

<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------
(If I don't respond within 24 hours, please send me a PM)

CioCZ · March 25, 2014