Conhost.exe and possible other threats are on my computer please help

bgik · March 28, 2014

DDs

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 11.0.9600.16521 BrowserJavaVersion: 10.51.2

Run by bgik12 at 19:38:07 on 2014-03-27

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8190.5414 [GMT -6:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}

AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\atieclxx.exe

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Windows\Explorer.EXE

C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\hasplms.exe

C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe

C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe

C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe

C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

C:\Program Files\CyberLink\Shared files\RichVideo64.exe

C:\Program Files (x86)\Razer\Core\64bit\rzovlmon.exe

C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe

C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\System32\rundll32.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedhlp.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Windows\vVX3000.exe

C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe

C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\NVIDIA Corporation\ShadowPlay\nvspcaps64.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files (x86)\Steam\Steam.exe

C:\Program Files (x86)\Skype\Phone\Skype.exe

C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

C:\Users\bgik12\AppData\Roaming\Dropbox\bin\Dropbox.exe

C:\Program Files (x86)\CyberLink\InstantBurn\Win2K\IBurn.exe

C:\Program Files (x86)\Hauppauge\DeviceCentral\HcwDCTrayTool.exe

C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe

C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe

C:\Program Files (x86)\CyberLink\Shared files\brs.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\Seagate\DiscWizard\DiscWizardMonitor.exe

C:\Program Files (x86)\Seagate\DiscWizard\TimounterMonitor.exe

C:\PROGRA~2\HAUPPA~1\DEVICE~1\HCWDEV~1.EXE

C:\Program Files (x86)\AVG\AVG2012\avgtray.exe

C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files (x86)\Common Files\Steam\SteamService.exe

C:\Users\bgik12\Desktop\security\mbar\mbar.exe

C:\Users\bgik12\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = about:blank

uURLSearchHooks: {37153479-1976-43c3-a1ee-557513977b64} - <orphaned>

uURLSearchHooks: {9565115d-c7d6-46d3-bd63-b67b481a4368} - <orphaned>

uURLSearchHooks: {51a86bb3-6602-4c85-92a5-130ee4864f13} - <orphaned>

uURLSearchHooks: {687578b9-7132-4a7a-80e4-30ee31099e03} - <orphaned>

mWinlogon: Userinit = userinit.exe,

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>

BHO: AVG Do Not Track: {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll

BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll

BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll

BHO: SteadyVideoBHO Class: {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\AMD\SteadyVideo\SteadyVideo.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

BHO: Yontoo: {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo Layers Runtime\YontooIEClient.dll

uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden

uRun: [Google Update] "C:\Users\bgik12\AppData\Local\Google\Update\GoogleUpdate.exe" /c

uRun: [spybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

uRun: [DW6] "C:\Program Files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe"

uRun: [Desktop Software] "C:\Program Files (x86)\Common Files\SupportSoft\bin\bcont.exe" /ini "C:\Program Files (x86)\ComcastUI\Desktop Software\uinstaller.ini" /fromrun /starthidden

uRun: [steam] "C:\Program Files (x86)\Steam\steam.exe" -silent

uRun: [Akamai NetSession Interface] "C:\Users\bgik12\AppData\Local\Akamai\netsession_win.exe"

uRun: [AdobeBridge] <no file>

mRun: [NUSB3MON] "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"

mRun: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"

mRun: [instantBurn] C:\PROGRA~2\CYBERL~1\INSTAN~1\Win2K\IBurn.exe

mRun: [CLMLServer] "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"

mRun: [RemoteControl9] "C:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe"

mRun: [bDRegion] C:\Program Files (x86)\Cyberlink\Shared files\brs.exe

mRun: [updatePPShortCut] "C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0"

mRun: [updatePSTShortCut] "C:\Program Files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Blu-ray Disc Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [DiscWizardMonitor.exe] C:\Program Files (x86)\Seagate\DiscWizard\DiscWizardMonitor.exe

mRun: [AcronisTimounterMonitor] C:\Program Files (x86)\Seagate\DiscWizard\TimounterMonitor.exe

mRun: [AVG_TRAY] "C:\Program Files (x86)\AVG\AVG2012\avgtray.exe"

mRun: [Razer Synapse] "C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe"

mRun: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

mRun: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

StartupFolder: C:\Users\bgik12\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\bgik12\AppData\Roaming\Dropbox\bin\Dropbox.exe

StartupFolder: C:\Users\bgik12\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\HAUPPA~1.LNK - C:\Program Files (x86)\Hauppauge\DeviceCentral\HcwDCTrayTool.exe

StartupFolder: C:\Users\bgik12\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\WOSync.lnk - C:\Program Files (x86)\WOSync\WOSync.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\LOLREC~1.LNK - C:\Program Files (x86)\LOLReplay\LOLRecorder.exe

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

TCP: NameServer = 75.75.75.75 75.75.76.76

TCP: Interfaces\{A4B67C4E-6F9B-480D-8843-062445B1BB68} : DHCPNameServer = 75.75.75.75 75.75.76.76

TCP: Interfaces\{F5281F89-8E33-458E-94E8-D133A8B2BA1A}\5437475637 : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{F5281F89-8E33-458E-94E8-D133A8B2BA1A}\84F4D454D243233483 : DHCPNameServer = 75.75.75.75 75.75.76.76

Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll

Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

SSODL: WebCheck - <orphaned>

LSA: Authentication Packages = msv1_0 relog_ap

mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"

x64-BHO: AVG Do Not Track: {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll

x64-BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll

x64-BHO: SteadyVideoBHO Class: {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

x64-Run: [seagate Scheduler2 Service] "C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedhlp.exe"

x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

x64-Run: [VX3000] C:\Windows\vVX3000.exe

x64-Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"

x64-Run: [NvBackend] "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"

x64-Run: [shadowPlay] C:\Windows\System32\rundll32.exe C:\Windows\System32\nvspcap64.dll,ShadowPlayOnSystemStart

x64-IE: {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll

x64-Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll

x64-Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll

x64-Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

x64-SSODL: WebCheck - <orphaned>

.

============= SERVICES / DRIVERS ===============

.

R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2013-9-27 248240]

R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2012-12-6 56208]

R0 RzFilter;RzFilter;C:\Windows\System32\drivers\RzFilter.sys [2013-11-9 74432]

R1 CLBStor;InstantBurn Storage Helper Driver;C:\Windows\System32\drivers\CLBStor.sys [2010-12-4 24560]

R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2010/12/04 15:31:27];C:\Program Files (x86)\CyberLink\PowerDVD9\000.fcl [2010-1-19 146928]

R2 aksdf;aksdf;C:\Windows\System32\drivers\aksdf.sys [2012-9-2 78208]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2012-12-19 240640]

R2 AMD FUEL Service;AMD FUEL Service;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-12-19 361984]

R2 AODDriver4.01;AODDriver4.01;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys [2012-4-9 57472]

R2 avgwd;AVG WatchDog;C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe [2012-2-14 193288]

R2 CLBUDF;CyberLink InstantBurn UDF Filesystem;C:\Windows\System32\drivers\CLBUDF.sys [2010-12-4 376304]

R2 hasplms;Sentinel Local License Manager;C:\Windows\System32\hasplms.exe -run --> C:\Windows\System32\hasplms.exe -run [?]

R2 MotoHelper;MotoHelper Service;C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe [2012-2-6 214896]

R2 NvNetworkService;NVIDIA Network Service;C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2014-3-27 1593632]

R2 NvStreamSvc;NVIDIA Streamer Service;C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2014-3-27 16939296]

R2 RichVideo64;Cyberlink RichVideo64 Service(CRVS);C:\Program Files\CyberLink\Shared files\RichVideo64.exe [2013-10-26 390672]

R2 RzOvlMon;Razer Overlay Subsystem Emergency Service;C:\Program Files (x86)\Razer\Core\64bit\RzOvlMon.exe [2013-10-25 32960]

R2 SgtSch2Svc;Seagate Scheduler2 Service;C:\Program Files (x86)\Common Files\Seagate\Schedule2\schedul2.exe [2009-10-16 606048]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-3-27 411936]

R3 amdiox64;AMD IO Driver;C:\Windows\System32\drivers\amdiox64.sys [2012-2-9 46136]

R3 HcwDevCentralService;HcwDevCentralService;C:\PROGRA~2\HAUPPA~1\DEVICE~1\HCWDEV~1.EXE [2013-9-26 391504]

R3 LVUSBS64;Logitech USB Monitor Filter;C:\Windows\System32\drivers\LVUSBS64.sys [2008-7-26 50072]

R3 mbamchameleon;mbamchameleon;C:\Windows\System32\drivers\mbamchameleon.sys [2014-3-27 91352]

R3 netr28x;Ralink 802.11n Wireless Driver for Windows Vista;C:\Windows\System32\drivers\netr28x.sys [2009-6-10 620544]

R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2009-11-20 75776]

R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2009-11-20 177152]

R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);C:\Windows\System32\drivers\nvvad64v.sys [2014-3-27 39200]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2010-12-4 347680]

R3 rzendpt;rzendpt;C:\Windows\System32\drivers\rzendpt.sys [2013-11-15 39080]

R3 rzudd;Razer Keyboard Driver;C:\Windows\System32\drivers\rzudd.sys [2013-11-15 149160]

S2 AVGIDSAgent;AVGIDSAgent;C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe [2012-8-13 5167736]

S2 CLKMSVC10_9EC60124;CyberLink Product - 2011/08/15 22:17:51;C:\Program Files (x86)\CyberLink\PowerDVD9\NavFilter\kmsvc.exe [2010-11-18 240112]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-3-1 161384]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2012-11-6 96256]

S3 BTCFilterService;USB Networking Driver Filter Service;C:\Windows\System32\drivers\motfilt.sys [2009-1-29 6144]

S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2013-9-8 57840]

S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2014-1-10 1512640]

S3 hcwE5bda;Hauppauge Siena Video Capture;C:\Windows\System32\drivers\hcwE5bda.sys [2013-9-26 966640]

S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-3-13 111616]

S3 lvpepf64;Volume Adapter;C:\Windows\System32\drivers\lv302a64.sys [2008-7-26 15768]

S3 LVRS64;Logitech RightSound Filter Driver;C:\Windows\System32\drivers\lvrs64.sys [2008-7-26 790424]

S3 Mo3Fltr;MMO Mouse;C:\Windows\System32\drivers\Mo3Fltr.sys [2011-7-27 12800]

S3 motccgp;Motorola USB Composite Device Driver;C:\Windows\System32\drivers\motccgp.sys [2012-1-25 22016]

S3 motccgpfl;MotCcgpFlService;C:\Windows\System32\drivers\motccgpfl.sys [2012-1-25 9728]

S3 Motousbnet;Motorola USB Networking Driver Service;C:\Windows\System32\drivers\Motousbnet.sys [2012-1-25 27136]

S3 motusbdevice;Motorola USB Dev Driver;C:\Windows\System32\drivers\motusbdevice.sys [2011-11-8 11776]

S3 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2012-3-20 134944]

S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2013-10-23 348376]

S3 RzDxgk;RzDxgk;C:\Windows\System32\drivers\RzDxgk.sys [2013-11-9 129472]

S3 ssmirrdr;ssmirrdr;C:\Windows\System32\drivers\ssmirrdr.sys [2011-3-14 10112]

S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-6-17 59392]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-2-15 52736]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-5-24 1255736]

S3 WinRing0_1_2_0;WinRing0_1_2_0;C:\Program Files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys [2012-11-13 14544]

.

=============== Created Last 30 ================

.

2014-03-28 00:53:05 -------- d-----w- C:\Users\bgik12\AppData\Roaming\AVG2012

2014-03-28 00:09:05 -------- d-----w- C:\Users\bgik12\AppData\Local\Sony Online Entertainment

2014-03-27 23:55:49 -------- d-----w- C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-03-27 23:55:04 91352 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys

2014-03-27 22:41:12 599840 ----a-w- C:\Windows\SysWow64\nvStreaming.exe

2014-03-27 22:25:49 96168 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll

2014-03-27 22:22:29 39200 ----a-w- C:\Windows\System32\drivers\nvvad64v.sys

2014-03-27 22:22:29 33056 ----a-w- C:\Windows\SysWow64\nvaudcap32v.dll

2014-03-27 22:03:19 -------- d-----w- C:\Program Files (x86)\RivaTuner Statistics Server

2014-03-27 22:02:49 -------- d-----w- C:\Users\bgik12\AppData\Local\NVIDIA Corporation

2014-03-27 22:02:40 -------- d-----w- C:\Program Files (x86)\EVGA Precision X

2014-03-27 21:58:40 1179576 ----a-w- C:\Windows\System32\nvspcap64.dll

2014-03-27 21:58:40 1048152 ----a-w- C:\Windows\SysWow64\nvspcap.dll

2014-03-27 21:56:19 -------- d-----w- C:\Users\bgik12\AppData\Local\NVIDIA

2014-03-27 21:44:37 35104 ----a-w- C:\Windows\System32\nvaudcap64v.dll

2014-03-27 21:44:36 31520 ----a-w- C:\Windows\System32\nvhdap64.dll

2014-03-27 21:44:36 2715264 ----a-w- C:\Windows\SysWow64\nvapi.dll

2014-03-27 21:44:36 197408 ----a-w- C:\Windows\System32\drivers\nvhda64v.sys

2014-03-27 21:44:36 1884448 ----a-w- C:\Windows\System32\nvdispco6433221.dll

2014-03-27 21:44:36 18302384 ----a-w- C:\Windows\System32\nvwgf2umx.dll

2014-03-27 21:44:36 17755424 ----a-w- C:\Windows\System32\nvd3dumx.dll

2014-03-27 21:44:36 1515296 ----a-w- C:\Windows\System32\nvhdagenco6420103.dll

2014-03-27 21:44:36 1511712 ----a-w- C:\Windows\System32\nvdispgenco6433221.dll

2014-03-27 21:44:36 14709720 ----a-w- C:\Windows\SysWow64\nvd3dum.dll

2014-03-27 21:42:56 -------- d-----w- C:\NVIDIA

2014-03-27 17:36:05 10521840 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{D45AA208-DE82-4302-8CD0-1122F2DD33E9}\mpengine.dll

2014-03-25 18:20:39 1031560 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{14BDCB39-1633-4339-8028-8C48F638D3E5}\gapaengine.dll

2014-03-25 18:20:18 10521840 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2014-03-24 01:48:03 -------- d-----r- C:\Program Files (x86)\Skype

2014-03-24 01:46:07 -------- d-----w- C:\Windows\en

2014-03-24 01:39:03 6072008 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\d64743211cf470101\onedrivesetup.exe

2014-03-17 00:13:14 -------- d-----w- C:\Users\bgik12\AppData\Local\Skype

2014-03-14 21:09:56 -------- d-----w- C:\Users\bgik12\AppData\Local\Ubisoft Game Launcher

2014-03-13 21:01:55 624128 ----a-w- C:\Windows\System32\qedit.dll

2014-03-13 21:01:55 509440 ----a-w- C:\Windows\SysWow64\qedit.dll

2014-03-13 21:01:55 1424384 ----a-w- C:\Windows\System32\WindowsCodecs.dll

2014-03-13 21:01:54 1230336 ----a-w- C:\Windows\SysWow64\WindowsCodecs.dll

2014-03-11 23:14:40 -------- d-----w- C:\Users\bgik12\AppData\Local\Savant_Ascent

2014-02-26 10:05:35 -------- d-----w- C:\Windows\Migration

.

==================== Find3M ====================

.

2014-03-12 02:03:11 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2014-03-12 02:03:11 692616 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2014-03-04 13:06:00 6714312 ----a-w- C:\Windows\System32\nvcpl.dll

2014-03-04 13:06:00 3497816 ----a-w- C:\Windows\System32\nvsvc64.dll

2014-03-04 13:05:58 922968 ----a-w- C:\Windows\System32\nvvsvc.exe

2014-03-04 13:05:58 64968 ----a-w- C:\Windows\System32\nvshext.dll

2014-03-04 13:05:57 386336 ----a-w- C:\Windows\System32\nvmctray.dll

2014-03-04 13:05:53 3649185 ----a-w- C:\Windows\System32\nvcoproc.bin

2014-03-01 05:17:02 2724864 ----a-w- C:\Windows\System32\mshtml.tlb

2014-03-01 05:16:26 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll

2014-03-01 04:52:55 66048 ----a-w- C:\Windows\System32\iesetup.dll

2014-03-01 04:51:59 48640 ----a-w- C:\Windows\System32\ieetwproxystub.dll

2014-03-01 04:33:52 139264 ----a-w- C:\Windows\System32\ieUnatt.exe

2014-03-01 04:33:34 111616 ----a-w- C:\Windows\System32\ieetwcollector.exe

2014-03-01 04:32:59 708608 ----a-w- C:\Windows\System32\jscript9diag.dll

2014-03-01 04:23:49 940032 ----a-w- C:\Windows\System32\MsSpellCheckingFacility.exe

2014-03-01 04:11:20 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2014-03-01 03:54:33 5768704 ----a-w- C:\Windows\System32\jscript9.dll

2014-03-01 03:52:43 61952 ----a-w- C:\Windows\SysWow64\iesetup.dll

2014-03-01 03:51:53 51200 ----a-w- C:\Windows\SysWow64\ieetwproxystub.dll

2014-03-01 03:38:26 112128 ----a-w- C:\Windows\SysWow64\ieUnatt.exe

2014-03-01 03:37:35 553472 ----a-w- C:\Windows\SysWow64\jscript9diag.dll

2014-03-01 03:35:11 2041856 ----a-w- C:\Windows\System32\inetcpl.cpl

2014-03-01 03:14:15 4244480 ----a-w- C:\Windows\SysWow64\jscript9.dll

2014-03-01 03:10:28 2334208 ----a-w- C:\Windows\System32\wininet.dll

2014-03-01 03:00:08 1964032 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

2014-03-01 02:32:16 1820160 ----a-w- C:\Windows\SysWow64\wininet.dll

2014-02-07 01:23:30 3156480 ----a-w- C:\Windows\System32\win32k.sys

2014-01-29 02:32:18 484864 ----a-w- C:\Windows\System32\wer.dll

2014-01-29 02:06:47 381440 ----a-w- C:\Windows\SysWow64\wer.dll

2014-01-28 02:32:46 228864 ----a-w- C:\Windows\System32\wwansvc.dll

2014-01-19 07:33:29 270496 ------w- C:\Windows\System32\MpSigStub.exe

2014-01-10 19:40:12 58560 ----a-w- C:\Windows\SysWow64\sirenacm.dll

.

============= FINISH: 19:39:37.04 ===============

attach

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume1

Install Date: 12/9/2010 7:53:09 PM

System Uptime: 3/27/2014 6:34:19 PM (1 hours ago)

.

Motherboard: Gigabyte Technology Co., Ltd. | | GA-870A-UD3

Processor: AMD Phenom II X6 1090T Processor | Socket M2 | 3200/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 930 GiB total, 627.385 GiB free.

D: is CDROM ()

E: is FIXED (NTFS) - 56 GiB total, 4.745 GiB free.

.

==== Disabled Device Manager Items =============

.

Class GUID: {4d36e97b-e325-11ce-bfc1-08002be10318}

Description: GIGABYTE GBB36X Controller

Device ID: PCI\VEN_197B&DEV_2363&SUBSYS_B0001458&REV_02\4&716A148&0&00A8

Manufacturer: JMicron Technology Corp.

Name: GIGABYTE GBB36X Controller

PNP Device ID: PCI\VEN_197B&DEV_2363&SUBSYS_B0001458&REV_02\4&716A148&0&00A8

Service: JRAID

.

Class GUID: {4d36e97b-e325-11ce-bfc1-08002be10318}

Description: GIGABYTE GBB36X Controller

Device ID: PCI\VEN_197B&DEV_2363&SUBSYS_B0001458&REV_03\4&2A1A2293&0&0050

Manufacturer: JMicron Technology Corp.

Name: GIGABYTE GBB36X Controller

PNP Device ID: PCI\VEN_197B&DEV_2363&SUBSYS_B0001458&REV_03\4&2A1A2293&0&0050

Service: JRAID

.

==== System Restore Points ===================

.

RP52: 11/27/2013 5:36:02 AM - Windows Update

RP468: 3/19/2014 3:00:24 AM - Windows Update

RP469: 3/23/2014 2:57:27 PM - Windows Update

RP470: 3/23/2014 7:38:58 PM - Windows Live Essentials

RP471: 3/23/2014 7:41:07 PM - Installed DirectX

RP472: 3/23/2014 7:41:37 PM - Installed DirectX

RP473: 3/23/2014 7:42:00 PM - Installed DirectX

RP474: 3/23/2014 7:43:01 PM - WLSetup

RP475: 3/27/2014 11:34:51 AM - Windows Update

RP476: 3/27/2014 3:45:50 PM - Device Driver Package Install: NVIDIA Display adapters

RP477: 3/27/2014 3:52:27 PM - Device Driver Package Install: NVIDIA Universal Serial Bus controllers

RP478: 3/27/2014 3:58:43 PM - Installed DirectX

RP479: 3/27/2014 4:23:52 PM - Installed Java 7 Update 51

RP480: 3/27/2014 4:23:55 PM - Installed DirectX

RP481: 3/27/2014 5:26:26 PM - Removed Counter-Strike 1.6

RP482: 3/27/2014 5:33:39 PM - Removed Stronghold Crusader Extreme

RP483: 3/27/2014 5:34:41 PM - Removed Stronghold Legends

RP484: 3/27/2014 5:37:03 PM - Removed Microsoft Office Click-to-Run 2010

RP485: 3/27/2014 5:38:56 PM - Removed Blacklight Retribution

RP486: 3/27/2014 5:39:47 PM - Removed Arc

RP487: 3/27/2014 5:43:17 PM - Removed Gigabyte Raid Configurer

RP488: 3/27/2014 5:44:04 PM - Configured GIGABYTE OC_GURU II

RP489: 3/27/2014 5:44:51 PM - Removed ON_OFF Charge B10.0427.1

RP490: 3/27/2014 5:58:35 PM - Removed AVG 2012

RP491: 3/27/2014 6:03:32 PM - Removed AVG 2012

RP492: 3/27/2014 6:30:39 PM - Malwarebytes Anti-Rootkit Restore Point

.

==== Installed Programs ======================

.

Adobe AIR

Adobe Creative Suite 6 Production Premium

Adobe Download Assistant

Adobe Flash Player 12 ActiveX

Adobe Flash Player 12 Plugin

Adobe Help Manager

Adobe Reader X (10.1.9)

Adobe Shockwave Player 11.6

Adobe Story

AMD Accelerated Video Transcoding

AMD APP SDK Runtime

AMD Catalyst Install Manager

AMD Drag and Drop Transcoding

AMD Fuel

AMD Media Foundation Decoders

AMD Steady Video Plug-In

AMD VISION Engine Control Center

Apple Application Support

Assassin's Creed IV Black Flag

ATI Catalyst Registration

AVG 2012

Battle.net

bl

Bonjour

Call of Duty: Ghosts

Call of Duty: Ghosts - Multiplayer

Castle Crashers

Catalyst Control Center - Branding

Catalyst Control Center Graphics Previews Common

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

ccc-utility64

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

CyberLink BD Advisor 2.0

CyberLink Blu-ray Disc Suite

CyberLink InstantBurn

CyberLink LabelPrint

CyberLink MediaShow

CyberLink Power2Go

CyberLink PowerBackup

CyberLink PowerDirector 12

CyberLink PowerDVD 9

CyberLink PowerProducer

D3DX10

Diablo III

Dropbox

EVGA Precision X 4.2.1

GeForce Experience NvStream Client Components

Google Chrome

Google Update Helper

Hauppauge Capture

Hauppauge Device Central

Hearthstone

Java 7 Update 51

Java Auto Updater

Java 6 Update 35

Junk Mail filter update

League of Legends

LightScribe System Software

Malwarebytes Anti-Malware version 1.75.0.1300

Marvel Heroes

Microsoft .NET Framework 4.5.1

Microsoft Application Error Reporting

Microsoft Office 2010

Microsoft OneDrive

Microsoft PowerPoint Viewer

Microsoft Security Client

Microsoft Security Essentials

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2005 Redistributable (x64)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610

Microsoft XNA Framework Redistributable 3.1

Microsoft_VC80_CRT_x86

Microsoft_VC80_CRT_x86_x64

Microsoft_VC80_MFC_x86

Microsoft_VC80_MFC_x86_x64

Microsoft_VC80_MFCLOC_x86

Microsoft_VC80_MFCLOC_x86_x64

Microsoft_VC90_ATL_x86

Microsoft_VC90_ATL_x86_x64

Microsoft_VC90_CRT_x86

Microsoft_VC90_CRT_x86_x64

Microsoft_VC90_MFC_x86

Microsoft_VC90_MFC_x86_x64

Microsoft_VC90_MFCLOC_x86

Mirror's Edge

MotoHelper 2.1.41 Driver 5.5.0

MotoHelper MergeModules

Motorola Mobile Drivers Installation 5.5.0

Movie Maker

MSVCRT

MSVCRT_amd64

MSVCRT110

MSVCRT110_amd64

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

NEC Electronics USB 3.0 Host Controller Driver

Need for Speed: Hot Pursuit

NVIDIA 3D Vision Controller Driver 335.21

NVIDIA 3D Vision Driver 335.23

NVIDIA Control Panel 335.23

NVIDIA GeForce Experience 1.8.2

NVIDIA Graphics Driver 335.23

NVIDIA HD Audio Driver 1.3.30.1

NVIDIA Install Application

NVIDIA LED Visualizer 1.0

NVIDIA Network Service

NVIDIA PhysX

NVIDIA PhysX System Software 9.13.1220

NVIDIA ShadowPlay 11.10.11

NVIDIA Stereoscopic 3D Driver

NVIDIA Update 11.10.11

NVIDIA Update Core

NVIDIA Virtual Audio 1.2.20

Pando Media Booster

PAYDAY 2 Demo

PDF Settings CS6

ph

Photo Common

Photo Gallery

PlanetSide 2

QuickTime

Razer Core

Razer Game Booster

Razer Synapse 2.0

Realtek Ethernet Controller Driver

Realtek HDMI Audio Driver for ATI

Realtek High Definition Audio Driver

RivaTuner Statistics Server 5.2.0

Savant - Ascent

Seagate DiscWizard

Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)

Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)

SHIELD Streaming

Skype™ 6.3

Spybot - Search & Destroy

Steam

swMSM

The Lord of the Rings FREE Trial

Thief

Uplay

Visual Studio 2008 x64 Redistributables

Warframe

Windows Live Communications Platform

Windows Live Essentials

Windows Live Family Safety

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Mail

Windows Live Messenger

Windows Live MIME IFilter

Windows Live Photo Common

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live Sync

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

.

==== Event Viewer Messages From Past Week ========

.

3/27/2014 6:36:29 PM, Error: hasplms [3] - ERROR: Sentinel LDK License Manager failed to start in a promptly manner!

3/27/2014 6:36:13 PM, Error: Service Control Manager [7003] - The AVGIDSAgent service depends the following service: AVGIDSDriver. This service might not be installed.

3/27/2014 5:44:00 PM, Error: Microsoft-Windows-DistributedCOM [10001] - Unable to start a DCOM Server: {D5641912-E47A-429C-879E-CFE13EAC7A13} as /. The error: "740" Happened while starting this command: C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\1150\INTEL3~1\IDriver.exe -Embedding

3/27/2014 5:04:28 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the eventlog service.

3/27/2014 4:19:23 PM, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.

3/27/2014 4:14:26 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the AMD External Events Utility service to connect.

3/27/2014 4:14:26 PM, Error: Service Control Manager [7000] - The AMD External Events Utility service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

3/27/2014 3:40:39 PM, Error: Service Control Manager [7038] - The nvUpdatusService service was unable to log on as .\UpdatusUser with the currently configured password due to the following error: Logon failure: the specified account password has expired. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

3/27/2014 3:40:39 PM, Error: Service Control Manager [7000] - The NVIDIA Update Service Daemon service failed to start due to the following error: The service did not start due to a logon failure.

.

==== End Of File ===========================

MrCharlie · March 28, 2014

Welcome to the forum.

Please run a Quick Scan with Malwarebytes like this:

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

If you're using Malwarebytes 2.0, please run a Threat Scan

Then.......

Please download and run RogueKiller 32 bit to your desktop.

RogueKiller<---use this one for 64 bit systems

Which system am I using?

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes and use the default font)

MrC

Note:

Please read all of my instructions completely including these.

Make sure system restore is turned on and running. Create a new restore point

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>When we are done, I'll give to instructions on how to cleanup all the tools and logs

<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

bgik · March 28, 2014

Hello, the rouguekiller 64 bit version crashed when i attempted to run both times, and yes i have a 64 bit version operating system. Here is the mbam log dedtected 101 threats not previously found.

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org

Database version: v2014.03.28.01

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.16521

bgik12 :: BUTCH [administrator]

3/27/2014 8:11:18 PM

MBAM-log-2014-03-27 (20-19-14).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 239672

Time elapsed: 7 minute(s), 43 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 9

HKCU\Software\1ClickDownload (PUP.Optional.1ClickDownload.A) -> No action taken.

HKCU\Software\AppDataLow\Software\Crossrider (PUP.Optional.CrossRider.A) -> No action taken.

HKCU\Software\AppDataLow\Software\Vid-Saver (PUP.Optional.VidSaver.A) -> No action taken.

HKCU\Software\BabSolution\Updater (PUP.Optional.Babylon.A) -> No action taken.

HKCU\Software\Cr_Installer\3491 (PUP.Optional.CrossRider.A) -> No action taken.

HKCU\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> No action taken.

HKLM\SOFTWARE\Google\Chrome\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc (PUP.Optional.CrossRider.A) -> No action taken.

HKLM\Software\Iminent (PUP.Optional.Iminent.A) -> No action taken.

HKLM\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> No action taken.

Registry Values Detected: 2

HKCU\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Data: {B8009740-9BF4-11E1-B456-1C6F654FC71B} -> No action taken.

HKLM\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Data: {B8009740-9BF4-11E1-B456-1C6F654FC71B} -> No action taken.

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 27

C:\Users\bgik12\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> No action taken.

C:\Users\bgik12\AppData\Roaming\OpenCandy\4181021078AC4BDB97671D8A588BE161 (PUP.Optional.OpenCandy) -> No action taken.

C:\Users\bgik12\AppData\Roaming\OpenCandy\506C23AA371543D48C9BC927E05D012F (PUP.Optional.OpenCandy) -> No action taken.

C:\Users\bgik12\AppData\Roaming\OpenCandy\OpenCandy_4181021078AC4BDB97671D8A588BE161 (PUP.Optional.OpenCandy) -> No action taken.

C:\Users\bgik12\AppData\Roaming\OpenCandy\OpenCandy_506C23AA371543D48C9BC927E05D012F (PUP.Optional.OpenCandy) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\mt_ffx\Delta (PUP.Optional.Delta.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\mt_ffx\Delta\delta (PUP.Optional.Delta.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\mt_ffx\Delta\delta\1.8.21.5 (PUP.Optional.Delta.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\mt_ffx\BabylonToolbar (PUP.Optional.BabylonToolbar.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\mt_ffx\BabylonToolbar\BabylonToolbar (PUP.Optional.BabylonToolbar.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\mt_ffx\BabylonToolbar\BabylonToolbar\1.8.4.9 (PUP.Optional.BabylonToolbar.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3072253 (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3072253\xpi (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3220468 (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3220468\xpi (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3220468\xpi\defaults (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3220468\xpi\defaults\preferences (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\ct3287822 (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0 (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\icons (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\icons\actions (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\js (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\js\api (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\js\lib (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Vid-Saver (PUP.Optional.VidSaver.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Vid-Saver\Chrome (PUP.Optional.VidSaver.A) -> No action taken.

Files Detected: 65

C:\Users\bgik12\AppData\Local\Temp\is1832903999\HomePageDLL.dll (PUP.Optional.Installcore) -> No action taken.

c:\users\public\music\0x00a1.exe (Trojan.Backdoor) -> No action taken.

c:\users\public\videos\gbpxp.exe (Trojan.Banker) -> No action taken.

c:\users\public\videos\mob127.bin (Malware.Trace) -> No action taken.

c:\users\public\music\dos.exe (Trojan.Agent) -> No action taken.

c:\users\public\pictures\cool profile pics\cool profile pics.exe (Trojan.Agent) -> No action taken.

c:\users\public\libraries\microsoft\suchost.exe (Trojan.Banker) -> No action taken.

c:\users\public\pictures\sample pictures\setup.exe (Trojan.Backdoor) -> No action taken.

c:\users\public\videos\helppanel.exe (Trojan.Agent) -> No action taken.

c:\users\public\videos\winhelp.exe (Trojan.MSIL) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\mconduitinstaller.exe (PUP.Optional.Conduit.A) -> No action taken.

c:\users\public\pictures\conhost.exe (Backdoor.Agent.CHGen) -> No action taken.

C:\Users\bgik12\AppData\Roaming\OpenCandy\4181021078AC4BDB97671D8A588BE161\PokkiInstaller.exe (PUP.Optional.OpenCandy) -> No action taken.

C:\Users\bgik12\AppData\Roaming\OpenCandy\506C23AA371543D48C9BC927E05D012F\3110.ico (PUP.Optional.OpenCandy) -> No action taken.

C:\Users\bgik12\AppData\Roaming\OpenCandy\506C23AA371543D48C9BC927E05D012F\avg.exe (PUP.Optional.OpenCandy) -> No action taken.

C:\Users\bgik12\AppData\Roaming\OpenCandy\506C23AA371543D48C9BC927E05D012F\AVG923_p1v3.exe (PUP.Optional.OpenCandy) -> No action taken.

C:\Users\bgik12\AppData\Roaming\OpenCandy\506C23AA371543D48C9BC927E05D012F\EBB77268-338F-4C6A-8590-AD88FED26F4A (PUP.Optional.OpenCandy) -> No action taken.

C:\Users\bgik12\AppData\Roaming\OpenCandy\506C23AA371543D48C9BC927E05D012F\OCBrowserHelper_1.0.3.85.dll (PUP.Optional.OpenCandy) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3072253\conduitStatistics.csf (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3072253\CT3072253.txt (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3072253\CT3072253.xpi (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3072253\initData.json (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3072253\manifest.json (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3072253\version.txt (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3072253\xpi\install.rdf (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3220468\conduit.xml (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3220468\conduitStatistics.csf (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3220468\CT3220468.txt (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3220468\CT3220468.xpi (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3220468\dtime.csf (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3220468\initData.json (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3220468\manifest.json (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3220468\version.txt (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3220468\xpi\install.rdf (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\CT3220468\xpi\defaults\preferences\defaults.js (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\ct3287822\chromeid.txt (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\ct3287822\CT3287822.txt (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\ct3287822\dtime.csf (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\ct3287822\initData.json (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\ct3287822\manifest.json (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\ct3287822\setup.ini.txt (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Temp\ct3287822\stub.exe (PUP.Optional.Conduit.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\background.html (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\crossriderManifest.json (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\manifest.json (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\popup.html (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\icons\icon128.png (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\icons\icon16.png (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\icons\icon48.png (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\icons\actions\1.png (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\js\background.js (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\js\api\chrome.js (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\js\api\cookie.js (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\js\api\message.js (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\js\lib\app_api.js (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\js\lib\async_api.js (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\js\lib\bg_app_api.js (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\js\lib\cookie_store.js (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\js\lib\data_store.js (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\js\lib\delegate.js (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\js\lib\events.js (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\js\lib\onBGDocumentLoad.js (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\js\lib\reports.js (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc\1.20.48_0\js\lib\util.js (PUP.Optional.CrossRider.A) -> No action taken.

C:\Users\bgik12\AppData\Local\Vid-Saver\Chrome\Vid-Saver.crx (PUP.Optional.VidSaver.A) -> No action taken.

(end)

MrCharlie · March 28, 2014

Try RK in safe mode

Did you have MB quarantine all of those???

Be back in the AM, MrC

bgik · March 28, 2014

After receiving your reply i have removed and quarantined all items. I will now reboot in safe mode and try RK again.

bgik · March 28, 2014

i rebooted in safe mode and RK was able to run and finish this time found 4 threats here is the log. After that log I "deleted" the items which I have a separate log for.

RogueKiller V8.8.15 _x64_ [Mar 27 2014] by Adlice Software

mail : http://www.adlice.com/contact/

Feedback : http://forum.adlice.com

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Safe mode

User : bgik12 [Admin rights]

Mode : Scan -- Date : 03/27/2014 20:44:04

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤

[HJ DESK][PUM] HKCU\[...]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK][PUM] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[HJ DESK][PUM] HKCU\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK][PUM] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

[Address] EAT @explorer.exe (AppCacheCheckManifest) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8BD2BC)

[Address] EAT @explorer.exe (AppCacheCloseHandle) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8BA1D8)

[Address] EAT @explorer.exe (AppCacheDeleteGroup) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E1BE0)

[Address] EAT @explorer.exe (AppCacheDeleteIEGroup) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E1C38)

[Address] EAT @explorer.exe (AppCacheDuplicateHandle) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8BA2BC)

[Address] EAT @explorer.exe (AppCacheFinalize) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E1C90)

[Address] EAT @explorer.exe (AppCacheFreeDownloadList) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E1CE8)

[Address] EAT @explorer.exe (AppCacheFreeGroupList) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD925488)

[Address] EAT @explorer.exe (AppCacheFreeIESpace) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8E8570)

[Address] EAT @explorer.exe (AppCacheFreeSpace) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E1DCC)

[Address] EAT @explorer.exe (AppCacheGetDownloadList) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E1E24)

[Address] EAT @explorer.exe (AppCacheGetFallbackUrl) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E1E7C)

[Address] EAT @explorer.exe (AppCacheGetGroupList) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD925464)

[Address] EAT @explorer.exe (AppCacheGetIEGroupList) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E1ED4)

[Address] EAT @explorer.exe (AppCacheGetInfo) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E1F2C)

[Address] EAT @explorer.exe (AppCacheGetManifestUrl) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8BBB30)

[Address] EAT @explorer.exe (AppCacheLookup) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8D56B8)

[Address] EAT @explorer.exe (CommitUrlCacheEntryA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8C5F8C)

[Address] EAT @explorer.exe (CommitUrlCacheEntryBinaryBlob) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD87BF24)

[Address] EAT @explorer.exe (CommitUrlCacheEntryW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD881F50)

[Address] EAT @explorer.exe (CreateMD5SSOHash) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9B9180)

[Address] EAT @explorer.exe (CreateUrlCacheContainerA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8E3808)

[Address] EAT @explorer.exe (CreateUrlCacheContainerW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8E36B8)

[Address] EAT @explorer.exe (CreateUrlCacheEntryA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8C5CC0)

[Address] EAT @explorer.exe (CreateUrlCacheEntryExW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD927200)

[Address] EAT @explorer.exe (CreateUrlCacheEntryW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9271DC)

[Address] EAT @explorer.exe (CreateUrlCacheGroup) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E2E4C)

[Address] EAT @explorer.exe (DeleteIE3Cache) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E7394)

[Address] EAT @explorer.exe (DeleteUrlCacheContainerA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8E8BE0)

[Address] EAT @explorer.exe (DeleteUrlCacheContainerW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8D94D0)

[Address] EAT @explorer.exe (DeleteUrlCacheEntry) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8EBD40)

[Address] EAT @explorer.exe (DeleteUrlCacheEntryA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8EBD40)

[Address] EAT @explorer.exe (DeleteUrlCacheEntryW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8EA1B0)

[Address] EAT @explorer.exe (DeleteUrlCacheGroup) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E2F4C)

[Address] EAT @explorer.exe (DeleteWpadCacheForNetworks) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9A0270)

[Address] EAT @explorer.exe (DetectAutoProxyUrl) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9A0694)

[Address] EAT @explorer.exe (DispatchAPICall) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8614E8)

[Address] EAT @explorer.exe (DllCanUnloadNow) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8DDC70)

[Address] EAT @explorer.exe (DllGetClassObject) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD877470)

[Address] EAT @explorer.exe (DllInstall) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD91CD10)

[Address] EAT @explorer.exe (DllRegisterServer) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD982E30)

[Address] EAT @explorer.exe (DllUnregisterServer) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD982E64)

[Address] EAT @explorer.exe (FindCloseUrlCache) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD86553C)

[Address] EAT @explorer.exe (FindFirstUrlCacheContainerA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD88183C)

[Address] EAT @explorer.exe (FindFirstUrlCacheContainerW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD86E8C8)

[Address] EAT @explorer.exe (FindFirstUrlCacheEntryA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8DC580)

[Address] EAT @explorer.exe (FindFirstUrlCacheEntryExA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8664A0)

[Address] EAT @explorer.exe (FindFirstUrlCacheEntryExW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8789FC)

[Address] EAT @explorer.exe (FindFirstUrlCacheEntryW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8E2DE0)

[Address] EAT @explorer.exe (FindFirstUrlCacheGroup) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E3044)

[Address] EAT @explorer.exe (FindNextUrlCacheContainerA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD881CA0)

[Address] EAT @explorer.exe (FindNextUrlCacheContainerW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD86EB5C)

[Address] EAT @explorer.exe (FindNextUrlCacheEntryA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8DC704)

[Address] EAT @explorer.exe (FindNextUrlCacheEntryExA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E318C)

[Address] EAT @explorer.exe (FindNextUrlCacheEntryExW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E335C)

[Address] EAT @explorer.exe (FindNextUrlCacheEntryW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD878680)

[Address] EAT @explorer.exe (FindNextUrlCacheGroup) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E352C)

[Address] EAT @explorer.exe (ForceNexusLookup) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9B9390)

[Address] EAT @explorer.exe (ForceNexusLookupExW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9B93E0)

[Address] EAT @explorer.exe (FreeUrlCacheSpaceA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E3648)

[Address] EAT @explorer.exe (FreeUrlCacheSpaceW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8E78B8)

[Address] EAT @explorer.exe (FtpCommandA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD98D968)

[Address] EAT @explorer.exe (FtpCommandW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD991494)

[Address] EAT @explorer.exe (FtpCreateDirectoryA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD98DA4C)

[Address] EAT @explorer.exe (FtpCreateDirectoryW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD991630)

[Address] EAT @explorer.exe (FtpDeleteFileA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD98DAEC)

[Address] EAT @explorer.exe (FtpDeleteFileW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD991798)

[Address] EAT @explorer.exe (FtpFindFirstFileA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD98DB8C)

[Address] EAT @explorer.exe (FtpFindFirstFileW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD991900)

[Address] EAT @explorer.exe (FtpGetCurrentDirectoryA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD98DDF8)

[Address] EAT @explorer.exe (FtpGetCurrentDirectoryW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD991AD8)

[Address] EAT @explorer.exe (FtpGetFileA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD98DEB8)

[Address] EAT @explorer.exe (FtpGetFileEx) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD991C60)

[Address] EAT @explorer.exe (FtpGetFileSize) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD98E0DC)

[Address] EAT @explorer.exe (FtpGetFileW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD991DF4)

[Address] EAT @explorer.exe (FtpOpenFileA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD98E36C)

[Address] EAT @explorer.exe (FtpOpenFileW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD991EF8)

[Address] EAT @explorer.exe (FtpPutFileA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD98E44C)

[Address] EAT @explorer.exe (FtpPutFileEx) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD991F88)

[Address] EAT @explorer.exe (FtpPutFileW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9920EC)

[Address] EAT @explorer.exe (FtpRemoveDirectoryA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD98E7CC)

[Address] EAT @explorer.exe (FtpRemoveDirectoryW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9921C0)

[Address] EAT @explorer.exe (FtpRenameFileA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD98E86C)

[Address] EAT @explorer.exe (FtpRenameFileW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD99231C)

[Address] EAT @explorer.exe (FtpSetCurrentDirectoryA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD98E920)

[Address] EAT @explorer.exe (FtpSetCurrentDirectoryW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD99253C)

[Address] EAT @explorer.exe (GetProxyDllInfo) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD978D3C)

[Address] EAT @explorer.exe (GetUrlCacheConfigInfoA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E3868)

[Address] EAT @explorer.exe (GetUrlCacheConfigInfoW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8E73F4)

[Address] EAT @explorer.exe (GetUrlCacheEntryBinaryBlob) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8DB510)

[Address] EAT @explorer.exe (GetUrlCacheEntryInfoA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E3B04)

[Address] EAT @explorer.exe (GetUrlCacheEntryInfoExA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E3CBC)

[Address] EAT @explorer.exe (GetUrlCacheEntryInfoExW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8CAB20)

[Address] EAT @explorer.exe (GetUrlCacheEntryInfoW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8C9C80)

[Address] EAT @explorer.exe (GetUrlCacheGroupAttributeA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E3F04)

[Address] EAT @explorer.exe (GetUrlCacheGroupAttributeW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E416C)

[Address] EAT @explorer.exe (GetUrlCacheHeaderData) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8936A0)

[Address] EAT @explorer.exe (GopherCreateLocatorA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD99A424)

[Address] EAT @explorer.exe (GopherCreateLocatorW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD99A424)

[Address] EAT @explorer.exe (GopherFindFirstFileA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD99A424)

[Address] EAT @explorer.exe (GopherFindFirstFileW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD99A424)

[Address] EAT @explorer.exe (GopherGetAttributeA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD99A424)

[Address] EAT @explorer.exe (GopherGetAttributeW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD99A424)

[Address] EAT @explorer.exe (GopherGetLocatorTypeA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD99A424)

[Address] EAT @explorer.exe (GopherGetLocatorTypeW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD99A424)

[Address] EAT @explorer.exe (GopherOpenFileA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD99A424)

[Address] EAT @explorer.exe (GopherOpenFileW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD99A424)

[Address] EAT @explorer.exe (HttpAddRequestHeadersA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD88C8C0)

[Address] EAT @explorer.exe (HttpAddRequestHeadersW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD892A20)

[Address] EAT @explorer.exe (HttpCheckDavCompliance) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9A5078)

[Address] EAT @explorer.exe (HttpCloseDependencyHandle) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8CBD00)

[Address] EAT @explorer.exe (HttpDuplicateDependencyHandle) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8CBE60)

[Address] EAT @explorer.exe (HttpEndRequestA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8C56C0)

[Address] EAT @explorer.exe (HttpEndRequestW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9A5714)

[Address] EAT @explorer.exe (HttpGetServerCredentials) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9BD5FC)

[Address] EAT @explorer.exe (HttpGetTunnelSocket) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD987BD4)

[Address] EAT @explorer.exe (HttpOpenDependencyHandle) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8D6090)

[Address] EAT @explorer.exe (HttpOpenRequestA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9A5D6C)

[Address] EAT @explorer.exe (HttpOpenRequestW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD88ABE0)

[Address] EAT @explorer.exe (HttpPushClose) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9888B4)

[Address] EAT @explorer.exe (HttpPushEnable) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD988964)

[Address] EAT @explorer.exe (HttpPushWait) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9889BC)

[Address] EAT @explorer.exe (HttpQueryInfoA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD88F8B0)

[Address] EAT @explorer.exe (HttpQueryInfoW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD89F3A0)

[Address] EAT @explorer.exe (HttpSendRequestA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD922A14)

[Address] EAT @explorer.exe (HttpSendRequestExA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9A5814)

[Address] EAT @explorer.exe (HttpSendRequestExW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8C54A4)

[Address] EAT @explorer.exe (HttpSendRequestW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD89287C)

[Address] EAT @explorer.exe (HttpWebSocketClose) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9B5E40)

[Address] EAT @explorer.exe (HttpWebSocketCompleteUpgrade) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9B63CC)

[Address] EAT @explorer.exe (HttpWebSocketQueryCloseStatus) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9B5F88)

[Address] EAT @explorer.exe (HttpWebSocketReceive) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9B6878)

[Address] EAT @explorer.exe (HttpWebSocketSend) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9B6DBC)

[Address] EAT @explorer.exe (HttpWebSocketShutdown) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9B707C)

[Address] EAT @explorer.exe (IncrementUrlCacheHeaderData) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8B04A4)

[Address] EAT @explorer.exe (InternetAlgIdToStringA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9C2440)

[Address] EAT @explorer.exe (InternetAlgIdToStringW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9C2618)

[Address] EAT @explorer.exe (InternetAttemptConnect) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD97CC48)

[Address] EAT @explorer.exe (InternetAutodial) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD981EF0)

[Address] EAT @explorer.exe (InternetAutodialCallback) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD97955C)

[Address] EAT @explorer.exe (InternetAutodialHangup) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD981F88)

[Address] EAT @explorer.exe (InternetCanonicalizeUrlA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD97CCB0)

[Address] EAT @explorer.exe (InternetCanonicalizeUrlW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD97E0CC)

[Address] EAT @explorer.exe (InternetCheckConnectionA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD97CDBC)

[Address] EAT @explorer.exe (InternetCheckConnectionW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD97E1DC)

[Address] EAT @explorer.exe (InternetClearAllPerSiteCookieDecisions) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9A67F8)

[Address] EAT @explorer.exe (InternetCloseHandle) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD888400)

[Address] EAT @explorer.exe (InternetCombineUrlA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD97D288)

[Address] EAT @explorer.exe (InternetCombineUrlW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD884DA8)

[Address] EAT @explorer.exe (InternetConfirmZoneCrossing) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9C33E4)

[Address] EAT @explorer.exe (InternetConfirmZoneCrossingA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9C33E4)

[Address] EAT @explorer.exe (InternetConfirmZoneCrossingW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD91FA00)

[Address] EAT @explorer.exe (InternetConnectA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD97D3A0)

[Address] EAT @explorer.exe (InternetConnectW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD891460)

[Address] EAT @explorer.exe (InternetCrackUrlA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8AC300)

[Address] EAT @explorer.exe (InternetCrackUrlW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8E1DD0)

[Address] EAT @explorer.exe (InternetCreateUrlA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD97D4CC)

[Address] EAT @explorer.exe (InternetCreateUrlW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD884880)

[Address] EAT @explorer.exe (InternetDial) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD982018)

[Address] EAT @explorer.exe (InternetDialA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD982018)

[Address] EAT @explorer.exe (InternetDialW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9820D0)

[Address] EAT @explorer.exe (InternetEnumPerSiteCookieDecisionA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9A6804)

[Address] EAT @explorer.exe (InternetEnumPerSiteCookieDecisionW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9A686C)

[Address] EAT @explorer.exe (InternetErrorDlg) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9C349C)

[Address] EAT @explorer.exe (InternetFindNextFileA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD990DF0)

[Address] EAT @explorer.exe (InternetFindNextFileW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD993160)

[Address] EAT @explorer.exe (InternetFortezzaCommand) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD988A14)

[Address] EAT @explorer.exe (InternetFreeCookies) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8C1254)

[Address] EAT @explorer.exe (InternetFreeProxyInfoList) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8F3098)

[Address] EAT @explorer.exe (InternetGetCertByURL) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8621A8)

[Address] EAT @explorer.exe (InternetGetCertByURLA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8621A8)

[Address] EAT @explorer.exe (InternetGetConnectedState) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD883FF0)

[Address] EAT @explorer.exe (InternetGetConnectedStateEx) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9261B4)

[Address] EAT @explorer.exe (InternetGetConnectedStateExA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9261B4)

[Address] EAT @explorer.exe (InternetGetConnectedStateExW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8A12A4)

[Address] EAT @explorer.exe (InternetGetCookieA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9A7B40)

[Address] EAT @explorer.exe (InternetGetCookieEx2) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8C1224)

[Address] EAT @explorer.exe (InternetGetCookieExA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9A7B64)

[Address] EAT @explorer.exe (InternetGetCookieExW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8C126C)

[Address] EAT @explorer.exe (InternetGetCookieW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9A7E70)

[Address] EAT @explorer.exe (InternetGetLastResponseInfoA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD97D564)

[Address] EAT @explorer.exe (InternetGetLastResponseInfoW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD97E2D0)

[Address] EAT @explorer.exe (InternetGetPerSiteCookieDecisionA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9A6950)

[Address] EAT @explorer.exe (InternetGetPerSiteCookieDecisionW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9A69A0)

[Address] EAT @explorer.exe (InternetGetProxyForUrl) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8F2DE0)

[Address] EAT @explorer.exe (InternetGetSecurityInfoByURL) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD97D704)

[Address] EAT @explorer.exe (InternetGetSecurityInfoByURLA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD97D704)

[Address] EAT @explorer.exe (InternetGetSecurityInfoByURLW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD97E48C)

[Address] EAT @explorer.exe (InternetGoOnline) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD98217C)

[Address] EAT @explorer.exe (InternetGoOnlineA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD98217C)

[Address] EAT @explorer.exe (InternetGoOnlineW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD982220)

[Address] EAT @explorer.exe (InternetHangUp) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9822B8)

[Address] EAT @explorer.exe (InternetInitializeAutoProxyDll) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD87A100)

[Address] EAT @explorer.exe (InternetLockRequestFile) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8CB8D0)

[Address] EAT @explorer.exe (InternetOpenA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8A46D0)

[Address] EAT @explorer.exe (InternetOpenUrlA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD97D81C)

[Address] EAT @explorer.exe (InternetOpenUrlW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD97E590)

[Address] EAT @explorer.exe (InternetOpenW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8A4540)

[Address] EAT @explorer.exe (InternetQueryDataAvailable) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD880660)

[Address] EAT @explorer.exe (InternetQueryFortezzaStatus) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD988A74)

[Address] EAT @explorer.exe (InternetQueryOptionA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD886F40)

[Address] EAT @explorer.exe (InternetQueryOptionW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8874F0)

[Address] EAT @explorer.exe (InternetReadFile) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8A01F0)

[Address] EAT @explorer.exe (InternetReadFileExA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8D6D90)

[Address] EAT @explorer.exe (InternetReadFileExW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8D6D00)

[Address] EAT @explorer.exe (InternetSecurityProtocolToStringA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9C27F0)

[Address] EAT @explorer.exe (InternetSecurityProtocolToStringW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9C2960)

[Address] EAT @explorer.exe (InternetSetCookieA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9A7E90)

[Address] EAT @explorer.exe (InternetSetCookieEx2) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9A7EB8)

[Address] EAT @explorer.exe (InternetSetCookieExA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9A7F18)

[Address] EAT @explorer.exe (InternetSetCookieExW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8ABDA0)

[Address] EAT @explorer.exe (InternetSetCookieW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9A7FBC)

[Address] EAT @explorer.exe (InternetSetDialState) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD982338)

[Address] EAT @explorer.exe (InternetSetDialStateA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD982338)

[Address] EAT @explorer.exe (InternetSetDialStateW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD982390)

[Address] EAT @explorer.exe (InternetSetFilePointer) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD92763C)

[Address] EAT @explorer.exe (InternetSetOptionA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD885EB0)

[Address] EAT @explorer.exe (InternetSetOptionExA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD97EBA4)

[Address] EAT @explorer.exe (InternetSetOptionExW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD97ECA0)

[Address] EAT @explorer.exe (InternetSetOptionW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD886370)

[Address] EAT @explorer.exe (InternetSetPerSiteCookieDecisionA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9A6A38)

[Address] EAT @explorer.exe (InternetSetPerSiteCookieDecisionW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9A6AD0)

[Address] EAT @explorer.exe (InternetSetStatusCallback) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8A64B0)

[Address] EAT @explorer.exe (InternetSetStatusCallbackA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8A64B0)

[Address] EAT @explorer.exe (InternetSetStatusCallbackW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8EB9BC)

[Address] EAT @explorer.exe (InternetShowSecurityInfoByURL) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD97D8B0)

[Address] EAT @explorer.exe (InternetShowSecurityInfoByURLA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD97D8B0)

[Address] EAT @explorer.exe (InternetShowSecurityInfoByURLW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD97E73C)

[Address] EAT @explorer.exe (InternetTimeFromSystemTime) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8D7860)

[Address] EAT @explorer.exe (InternetTimeFromSystemTimeA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8D7860)

[Address] EAT @explorer.exe (InternetTimeFromSystemTimeW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD93D9A8)

[Address] EAT @explorer.exe (InternetTimeToSystemTime) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD923590)

[Address] EAT @explorer.exe (InternetTimeToSystemTimeA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD923590)

[Address] EAT @explorer.exe (InternetTimeToSystemTimeW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9234C0)

[Address] EAT @explorer.exe (InternetUnlockRequestFile) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8CB644)

[Address] EAT @explorer.exe (InternetWriteFile) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8C5760)

[Address] EAT @explorer.exe (InternetWriteFileExA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD99A424)

[Address] EAT @explorer.exe (InternetWriteFileExW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD99A424)

[Address] EAT @explorer.exe (IsHostInProxyBypassList) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8A9E94)

[Address] EAT @explorer.exe (IsUrlCacheEntryExpiredA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E43A0)

[Address] EAT @explorer.exe (IsUrlCacheEntryExpiredW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9273E4)

[Address] EAT @explorer.exe (LoadUrlCacheContent) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD99A424)

[Address] EAT @explorer.exe (ParseX509EncodedCertificateForListBoxEntry) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9C2AD0)

[Address] EAT @explorer.exe (PrivacyGetZonePreferenceW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8AD40C)

[Address] EAT @explorer.exe (PrivacySetZonePreferenceW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD91CF94)

[Address] EAT @explorer.exe (ReadUrlCacheEntryStream) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8C46E4)

[Address] EAT @explorer.exe (ReadUrlCacheEntryStreamEx) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E44F0)

[Address] EAT @explorer.exe (RegisterUrlCacheNotification) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD862A20)

[Address] EAT @explorer.exe (ResumeSuspendedDownload) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9813F8)

[Address] EAT @explorer.exe (RetrieveUrlCacheEntryFileA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E4600)

[Address] EAT @explorer.exe (RetrieveUrlCacheEntryFileW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E47DC)

[Address] EAT @explorer.exe (RetrieveUrlCacheEntryStreamA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E49B4)

[Address] EAT @explorer.exe (RetrieveUrlCacheEntryStreamW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD925FD0)

[Address] EAT @explorer.exe (RunOnceUrlCache) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8621A8)

[Address] EAT @explorer.exe (SetUrlCacheConfigInfoA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E4BB8)

[Address] EAT @explorer.exe (SetUrlCacheConfigInfoW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E4CEC)

[Address] EAT @explorer.exe (SetUrlCacheEntryGroup) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E4DEC)

[Address] EAT @explorer.exe (SetUrlCacheEntryGroupA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E4DEC)

[Address] EAT @explorer.exe (SetUrlCacheEntryGroupW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8A89B0)

[Address] EAT @explorer.exe (SetUrlCacheEntryInfoA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8B8EE8)

[Address] EAT @explorer.exe (SetUrlCacheEntryInfoW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E4FB8)

[Address] EAT @explorer.exe (SetUrlCacheGroupAttributeA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E5174)

[Address] EAT @explorer.exe (SetUrlCacheGroupAttributeW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E5364)

[Address] EAT @explorer.exe (SetUrlCacheHeaderData) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E5524)

[Address] EAT @explorer.exe (ShowCertificate) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9C2AD0)

[Address] EAT @explorer.exe (ShowClientAuthCerts) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9C2AD0)

[Address] EAT @explorer.exe (ShowSecurityInfo) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9C2AF0)

[Address] EAT @explorer.exe (ShowX509EncodedCertificate) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9C2C80)

[Address] EAT @explorer.exe (UnlockUrlCacheEntryFile) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E5644)

[Address] EAT @explorer.exe (UnlockUrlCacheEntryFileA) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E5644)

[Address] EAT @explorer.exe (UnlockUrlCacheEntryFileW) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E577C)

[Address] EAT @explorer.exe (UnlockUrlCacheEntryStream) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8EFA10)

[Address] EAT @explorer.exe (UpdateUrlCacheContentPath) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E58BC)

[Address] EAT @explorer.exe (UrlCacheCheckEntriesExist) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E59DC)

[Address] EAT @explorer.exe (UrlCacheCloseEntryHandle) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E5A34)

[Address] EAT @explorer.exe (UrlCacheContainerSetEntryMaximumAge) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E5A80)

[Address] EAT @explorer.exe (UrlCacheCreateContainer) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD86EC5C)

[Address] EAT @explorer.exe (UrlCacheFindFirstEntry) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8E8948)

[Address] EAT @explorer.exe (UrlCacheFindNextEntry) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD928A90)

[Address] EAT @explorer.exe (UrlCacheFreeEntryInfo) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8F0A60)

[Address] EAT @explorer.exe (UrlCacheGetContentPaths) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E5AD8)

[Address] EAT @explorer.exe (UrlCacheGetEntryInfo) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8DC358)

[Address] EAT @explorer.exe (UrlCacheGetGlobalLimit) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E5B30)

[Address] EAT @explorer.exe (UrlCacheReadEntryStream) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E5B88)

[Address] EAT @explorer.exe (UrlCacheReloadSettings) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E5BE8)

[Address] EAT @explorer.exe (UrlCacheRetrieveEntryFile) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E5C40)

[Address] EAT @explorer.exe (UrlCacheRetrieveEntryStream) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E5C98)

[Address] EAT @explorer.exe (UrlCacheSetGlobalLimit) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9E5CF8)

[Address] EAT @explorer.exe (UrlCacheUpdateEntryExtraData) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD8D2E78)

[Address] EAT @explorer.exe (UrlZonesDetach) : imagehlp.dll -> HOOKED (C:\Windows\system32\WININET.dll @ 0xFD9BD998)

¤¤¤ External Hives: ¤¤¤

-> E:\windows\system32\config\SYSTEM | DRVINFO [Drv - E:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]

-> E:\windows\system32\config\SOFTWARE | DRVINFO [Drv - E:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]

-> E:\windows\system32\config\SECURITY | DRVINFO [Drv - E:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]

-> E:\Users\bgik13\NTUSER.DAT | DRVINFO [Drv - E:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]

-> E:\Users\Default\NTUSER.DAT | DRVINFO [Drv - E:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - NOT_FOUND]

-> E:\Users\UpdatusUser\NTUSER.DAT | DRVINFO [Drv - E:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - NOT_FOUND]

-> E:\Documents and Settings\bgik12\NTUSER.DAT | DRVINFO [Drv - E:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - NOT_FOUND]

-> E:\Documents and Settings\Default\NTUSER.DAT | DRVINFO [Drv - E:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - NOT_FOUND]

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST31000528AS ATA Device +++++

--- User ---

[MBR] e3163025dcfdd794baf1286204c28963

[bSP] f489be60bc622fc1e5bf3ff6e06013a6 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 1670 MB

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 3421845 | Size: 952196 MB

User = LL1 ... OK!

User = LL2 ... OK!

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ IDE) ADATA SSD S599 64GB ATA Device +++++

--- User ---

[MBR] 9e8dc19433c8884b4bba07350662e967

[bSP] 007e86ec16c1006526d3b59ce3b194c1 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 57238 MB

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[0]_S_03272014_204404.txt >>

MrCharlie · March 28, 2014

Please run these 2 scans:

Make sure you have created that system restore point before you continue!

Please read the directions carefully so you don't end up deleting something that is good!!

If in doubt about an entry....please ask or choose Skip!!!!

Don't Delete anything unless instructed to!

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose

Skip and click on Continue

If a suspicious object is detected, the default action will be Skip, click on Continue

Please note that TDSSKiller can be run in safe mode if needed.

Please download the latest version of TDSSKiller from HERE and save it to your Desktop.

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters. (Leave the KSN box checked)
Put a checkmark beside loaded modules.
A reboot will be needed to apply the changes. Do it.
TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
Then click on Change parameters in TDSSKiller.
Check all boxes then click OK.
Click the Start Scan button.
The scan should take no longer than 2 minutes.
If a suspicious object is detected, the default action will be Skip, click on Continue.

Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.
If in doubt about an entry....please ask or choose Skip
If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.

Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here. There may be 3 logs > so post or attach all of them.
Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.

Here's a summary of what to do if you would like to print it out:

If in doubt about an entry....please ask or choose Skip

Don't Delete anything unless instructed to!

If a suspicious object is detected, the default action will be Skip, click on Continue

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose

Skip and click on Continue

Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

~~~~~~~~~~~~~~~~~~~~

You can attach the logs if they're too long:

Bottom right corner of this page.

New window that comes up.

Then...........

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

http://www.bleepingcomputer.com/download/combofix/dl/12/ <---ComboFix direct download

Please make sure you click download buttons that look similar to this, not "sponsored ad links":

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

bgik · March 29, 2014

Here are the Tdskiller logs in a zipped folder. i will now continue with the combofix portion of your instructions.

TDSSKiller logs.zip

bgik · March 29, 2014

here is the combofix report.

ComboFix 14-03-24.01 - bgik12 03/28/2014 19:25:15.1.6 - x64

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8190.5798 [GMT -6:00]

Running from: c:\users\bgik12\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}

AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}

SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}

SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\bgik12\AppData\Roaming\0ad

c:\users\bgik12\AppData\Roaming\0ad\config\user.cfg

c:\users\bgik12\AppData\Roaming\technic-launcher.jar

c:\windows\SysWow64\Packet.dll

c:\windows\SysWow64\wpcap.dll

.

((((((((((((((((((((((((( Files Created from 2014-02-28 to 2014-03-29 )))))))))))))))))))))))))))))))

.

2014-03-29 01:35 . 2014-03-29 01:35 -------- d-----w- c:\users\Default\AppData\Local\temp

2014-03-29 01:23 . 2014-03-29 01:23 -------- d-----w- c:\users\bgik12\AppData\Roaming\AVG2012

2014-03-29 00:44 . 2014-02-19 23:06 1031560 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{97CB8B23-C016-4D1B-9FFF-E4AB571E2EFD}\gapaengine.dll

2014-03-29 00:44 . 2014-03-07 04:43 10521840 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{01C642C2-3063-4C69-97AB-716DC00BF9D8}\mpengine.dll

2014-03-28 00:09 . 2014-03-28 00:09 -------- d-----w- c:\users\bgik12\AppData\Local\Sony Online Entertainment

2014-03-27 23:55 . 2014-03-28 00:56 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys

2014-03-27 22:41 . 2014-03-27 22:41 -------- d-----w- c:\program files (x86)\AGEIA Technologies

2014-03-27 22:41 . 2014-03-04 11:32 599840 ----a-w- c:\windows\SysWow64\nvStreaming.exe

2014-03-27 22:25 . 2013-12-19 03:09 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

2014-03-27 22:22 . 2013-12-27 18:42 39200 ----a-w- c:\windows\system32\drivers\nvvad64v.sys

2014-03-27 22:22 . 2013-12-27 18:42 33056 ----a-w- c:\windows\SysWow64\nvaudcap32v.dll

2014-03-27 22:03 . 2014-03-27 22:03 -------- d-----w- c:\program files (x86)\RivaTuner Statistics Server

2014-03-27 22:02 . 2014-03-27 22:23 -------- d-----w- c:\users\bgik12\AppData\Local\NVIDIA Corporation

2014-03-27 22:02 . 2014-03-27 22:03 -------- d-----w- c:\program files (x86)\EVGA Precision X

2014-03-27 21:58 . 2014-01-21 02:53 1048152 ----a-w- c:\windows\SysWow64\nvspcap.dll

2014-03-27 21:58 . 2014-01-21 02:53 1179576 ----a-w- c:\windows\system32\nvspcap64.dll

2014-03-27 21:56 . 2014-03-27 22:21 -------- d-----w- c:\users\bgik12\AppData\Local\NVIDIA

2014-03-27 21:44 . 2013-12-27 18:42 35104 ----a-w- c:\windows\system32\nvaudcap64v.dll

2014-03-27 21:44 . 2014-03-04 14:35 2715264 ----a-w- c:\windows\SysWow64\nvapi.dll

2014-03-27 21:44 . 2014-03-04 14:35 18302384 ----a-w- c:\windows\system32\nvwgf2umx.dll

2014-03-27 21:44 . 2014-03-04 14:35 17755424 ----a-w- c:\windows\system32\nvd3dumx.dll

2014-03-27 21:44 . 2014-03-04 14:35 14709720 ----a-w- c:\windows\SysWow64\nvd3dum.dll

2014-03-27 21:44 . 2013-12-19 20:33 1884448 ----a-w- c:\windows\system32\nvdispco6433221.dll

2014-03-27 21:44 . 2013-12-19 20:33 1511712 ----a-w- c:\windows\system32\nvdispgenco6433221.dll

2014-03-27 21:44 . 2013-11-28 13:38 31520 ----a-w- c:\windows\system32\nvhdap64.dll

2014-03-27 21:44 . 2013-11-28 13:38 197408 ----a-w- c:\windows\system32\drivers\nvhda64v.sys

2014-03-27 21:44 . 2013-11-22 08:36 1515296 ----a-w- c:\windows\system32\nvhdagenco6420103.dll

2014-03-27 21:42 . 2014-03-27 21:42 -------- d-----w- C:\NVIDIA

2014-03-27 17:36 . 2014-03-07 04:43 10521840 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2014-03-24 01:48 . 2014-03-24 01:48 -------- d-----w- c:\program files (x86)\Common Files\Skype

2014-03-24 01:48 . 2014-03-24 01:48 -------- d-----r- c:\program files (x86)\Skype

2014-03-24 01:46 . 2014-03-24 01:46 -------- d-----w- c:\windows\en

2014-03-24 01:39 . 2014-03-24 01:39 6072008 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\d64743211cf470101\onedrivesetup.exe

2014-03-17 00:13 . 2014-03-17 00:13 -------- d-----w- c:\users\bgik12\AppData\Local\Skype

2014-03-14 21:09 . 2014-03-14 21:39 -------- d-----w- c:\users\bgik12\AppData\Local\Ubisoft Game Launcher

2014-03-14 21:09 . 2014-03-14 21:09 -------- d-----w- c:\program files (x86)\Ubisoft

2014-03-13 21:01 . 2014-02-04 02:32 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll

2014-03-13 21:01 . 2014-02-04 02:32 624128 ----a-w- c:\windows\system32\qedit.dll

2014-03-13 21:01 . 2014-02-04 02:04 509440 ----a-w- c:\windows\SysWow64\qedit.dll

2014-03-13 21:01 . 2014-02-04 02:04 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll

2014-03-11 23:14 . 2014-03-11 23:21 -------- d-----w- c:\users\bgik12\AppData\Local\Savant_Ascent

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-03-19 09:00 . 2010-05-24 21:32 90015360 ----a-w- c:\windows\system32\MRT.exe

2014-03-12 02:03 . 2012-04-29 18:05 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2014-03-12 02:03 . 2011-06-12 00:45 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2014-03-04 14:35 . 2013-03-03 23:41 947808 ----a-w- c:\windows\system32\nvumdshimx.dll

2014-03-04 14:35 . 2013-03-03 23:41 3093280 ----a-w- c:\windows\system32\nvapi64.dll

2014-03-04 13:06 . 2013-03-03 23:40 6714312 ----a-w- c:\windows\system32\nvcpl.dll

2014-03-04 13:06 . 2013-03-03 23:40 3497816 ----a-w- c:\windows\system32\nvsvc64.dll

2014-03-04 13:05 . 2013-03-03 23:40 922968 ----a-w- c:\windows\system32\nvvsvc.exe

2014-03-04 13:05 . 2013-03-03 23:40 64968 ----a-w- c:\windows\system32\nvshext.dll

2014-03-04 13:05 . 2013-03-03 23:40 386336 ----a-w- c:\windows\system32\nvmctray.dll

2014-03-04 13:05 . 2013-03-03 23:40 3649185 ----a-w- c:\windows\system32\nvcoproc.bin

2014-02-19 23:06 . 2012-10-03 09:11 1031560 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll

2014-01-19 07:33 . 2010-05-24 21:23 270496 ------w- c:\windows\system32\MpSigStub.exe

2014-01-10 19:40 . 2014-01-10 19:40 58560 ----a-w- c:\windows\SysWow64\sirenacm.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]

2012-03-27 00:40 792864 ----a-w- c:\program files (x86)\Yontoo Layers Runtime\YontooIEClient.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]

@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"

[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]

2014-03-24 01:40 222920 ----a-w- c:\users\bgik12\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]

@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"

[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]

2014-03-24 01:40 222920 ----a-w- c:\users\bgik12\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]

@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"

[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]

2014-03-24 01:40 222920 ----a-w- c:\users\bgik12\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-10 23:54 131248 ----a-w- c:\users\bgik12\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-10 23:54 131248 ----a-w- c:\users\bgik12\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-10 23:54 131248 ----a-w- c:\users\bgik12\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-01-22 2363392]

"SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

"Steam"="c:\program files (x86)\Steam\steam.exe" [2014-02-25 1821888]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-03-01 18643560]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"NUSB3MON"="c:\program files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2009-11-20 106496]

"ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-05 311296]

"InstantBurn"="c:\progra~2\CYBERL~1\INSTAN~1\Win2K\IBurn.exe" [2010-02-10 697640]

"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720]

"RemoteControl9"="c:\program files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe" [2009-07-06 87336]

"BDRegion"="c:\program files (x86)\Cyberlink\Shared files\brs.exe" [2011-01-28 75048]

"UpdatePPShortCut"="c:\program files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]

"UpdatePSTShortCut"="c:\program files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe" [2010-03-03 222504]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]

"DiscWizardMonitor.exe"="c:\program files (x86)\Seagate\DiscWizard\DiscWizardMonitor.exe" [2009-10-17 1325936]

"AcronisTimounterMonitor"="c:\program files (x86)\Seagate\DiscWizard\TimounterMonitor.exe" [2009-10-17 904840]

"AVG_TRAY"="c:\program files (x86)\AVG\AVG2012\avgtray.exe" [2012-11-20 2598520]

"Razer Synapse"="c:\program files (x86)\Razer\Synapse\RzSynapse.exe" [2013-11-18 442712]

"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-06-25 1073352]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-12 59280]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-12-19 642808]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]

.

c:\users\bgik12\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\bgik12\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-1-2 30714328]

Hauppauge Device Properties.lnk - c:\program files (x86)\Hauppauge\DeviceCentral\HcwDCTrayTool.exe [2013-9-26 487248]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux1"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2012\avgidsagent.exe;c:\program files (x86)\AVG\AVG2012\avgidsagent.exe [x]

R2 CLKMSVC10_9EC60124;CyberLink Product - 2011/08/15 22:17;c:\program files (x86)\CyberLink\PowerDVD9\NavFilter\kmsvc.exe;c:\program files (x86)\CyberLink\PowerDVD9\NavFilter\kmsvc.exe [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]

R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys;c:\windows\SYSNATIVE\DRIVERS\motfilt.sys [x]

R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]

R3 GPCIDrv;GPCIDrv;c:\program files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GPCIDrv64.sys;c:\program files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GPCIDrv64.sys [x]

R3 HcwDevCentralService;HcwDevCentralService;c:\progra~2\HAUPPA~1\DEVICE~1\HCWDEV~1.EXE;c:\progra~2\HAUPPA~1\DEVICE~1\HCWDEV~1.EXE [x]

R3 hcwE5bda;Hauppauge Siena Video Capture;c:\windows\system32\drivers\hcwE5bda.sys;c:\windows\SYSNATIVE\drivers\hcwE5bda.sys [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 lvpepf64;Volume Adapter;c:\windows\system32\DRIVERS\lv302a64.sys;c:\windows\SYSNATIVE\DRIVERS\lv302a64.sys [x]

R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]

R3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys;c:\windows\SYSNATIVE\drivers\mbamchameleon.sys [x]

R3 Mo3Fltr;MMO Mouse;c:\windows\system32\drivers\Mo3Fltr.sys;c:\windows\SYSNATIVE\drivers\Mo3Fltr.sys [x]

R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys;c:\windows\SYSNATIVE\Drivers\motoandroid.sys [x]

R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys;c:\windows\SYSNATIVE\DRIVERS\motccgp.sys [x]

R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys;c:\windows\SYSNATIVE\DRIVERS\motccgpfl.sys [x]

R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys;c:\windows\SYSNATIVE\DRIVERS\Motousbnet.sys [x]

R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys;c:\windows\SYSNATIVE\DRIVERS\motusbdevice.sys [x]

R3 MSICDSetup;MSICDSetup;d:\cdriver64.sys;d:\CDriver64.sys [x]

R3 RzDxgk;RzDxgk;c:\windows\system32\drivers\RzDxgk.sys;c:\windows\SYSNATIVE\drivers\RzDxgk.sys [x]

R3 ssmirrdr;ssmirrdr;c:\windows\system32\DRIVERS\ssmirrdr.sys;c:\windows\SYSNATIVE\DRIVERS\ssmirrdr.sys [x]

R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]

R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys;c:\program files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys [x]

R3 xhunter1;xhunter1;c:\windows\xhunter1.sys;c:\windows\xhunter1.sys [x]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]

S0 RzFilter;RzFilter;c:\windows\system32\drivers\RzFilter.sys;c:\windows\SYSNATIVE\drivers\RzFilter.sys [x]

S1 CLBStor;InstantBurn Storage Helper Driver;c:\windows\system32\DRIVERS\CLBStor.sys;c:\windows\SYSNATIVE\DRIVERS\CLBStor.sys [x]

S2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2010/12/04 15:31];c:\program files (x86)\CyberLink\PowerDVD9\000.fcl;c:\program files (x86)\CyberLink\PowerDVD9\000.fcl [x]

S2 aksdf;aksdf;c:\windows\system32\drivers\aksdf.sys;c:\windows\SYSNATIVE\drivers\aksdf.sys [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]

S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]

S2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]

S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe;c:\program files (x86)\AVG\AVG2012\avgwdsvc.exe [x]

S2 CLBUDF;CyberLink InstantBurn UDF Filesystem; [x]

S2 hasplms;Sentinel Local License Manager;c:\windows\system32\hasplms.exe -run;c:\windows\SYSNATIVE\hasplms.exe -run [x]

S2 MotoHelper;MotoHelper Service;c:\program files (x86)\Motorola\MotoHelper\MotoHelperService.exe;c:\program files (x86)\Motorola\MotoHelper\MotoHelperService.exe [x]

S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]

S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]

S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]

S2 RichVideo64;Cyberlink RichVideo64 Service(CRVS);c:\program files\CyberLink\Shared files\RichVideo64.exe;c:\program files\CyberLink\Shared files\RichVideo64.exe [x]

S2 RzOvlMon;Razer Overlay Subsystem Emergency Service;c:\program files (x86)\Razer\Core\64bit\rzovlmon.exe;c:\program files (x86)\Razer\Core\64bit\rzovlmon.exe [x]

S2 SgtSch2Svc;Seagate Scheduler2 Service;c:\program files (x86)\Common Files\Seagate\Schedule2\schedul2.exe;c:\program files (x86)\Common Files\Seagate\Schedule2\schedul2.exe [x]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]

S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]

S3 LVUSBS64;Logitech USB Monitor Filter;c:\windows\system32\drivers\LVUSBS64.sys;c:\windows\SYSNATIVE\drivers\LVUSBS64.sys [x]

S3 netr28x;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]

S3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]

S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]

S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]

S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]

S3 rzendpt;rzendpt;c:\windows\system32\DRIVERS\rzendpt.sys;c:\windows\SYSNATIVE\DRIVERS\rzendpt.sys [x]

S3 rzudd;Razer Keyboard Driver;c:\windows\system32\DRIVERS\rzudd.sys;c:\windows\SYSNATIVE\DRIVERS\rzudd.sys [x]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - 73589519

*Deregistered* - 73589519

*Deregistered* - CLKMDRV10_9EC60124

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2010-01-22 19:06 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe

.

Contents of the 'Scheduled Tasks' folder

.

2014-03-29 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-29 02:03]

.

2014-03-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-10 03:07]

.

2014-03-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-12-10 03:07]

.

2014-03-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2826711760-1920560978-1410755264-1001Core.job

- c:\users\bgik12\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-10 03:07]

.

2014-03-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2826711760-1920560978-1410755264-1001UA.job

- c:\users\bgik12\AppData\Local\Google\Update\GoogleUpdate.exe [2010-12-10 03:07]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]

@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"

[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]

2014-03-24 01:40 261832 ----a-w- c:\users\bgik12\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]

@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"

[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]

2014-03-24 01:40 261832 ----a-w- c:\users\bgik12\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]

@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"

[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]

2014-03-24 01:40 261832 ----a-w- c:\users\bgik12\AppData\Local\Microsoft\SkyDrive\17.0.4024.1220\amd64\SkyDriveShell64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-10 23:54 164016 ----a-w- c:\users\bgik12\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-10 23:54 164016 ----a-w- c:\users\bgik12\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-10 23:54 164016 ----a-w- c:\users\bgik12\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2013-09-10 23:54 164016 ----a-w- c:\users\bgik12\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-04-06 10144288]

"Seagate Scheduler2 Service"="c:\program files (x86)\Common Files\Seagate\Schedule2\schedhlp.exe" [2009-10-17 136544]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-24 1266912]

"VX3000"="c:\windows\vVX3000.exe" [2009-07-01 762224]

"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-09-20 444904]

"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-01-21 2234144]

"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-01-21 1179576]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = about:blank

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local;<local>;192.168.*.*

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

TCP: DhcpNameServer = 75.75.75.75 75.75.76.76

.

- - - - ORPHANS REMOVED - - - -

.

URLSearchHooks-{37153479-1976-43c3-a1ee-557513977b64} - (no file)

URLSearchHooks-{9565115d-c7d6-46d3-bd63-b67b481a4368} - (no file)

URLSearchHooks-{51a86bb3-6602-4c85-92a5-130ee4864f13} - (no file)

URLSearchHooks-{687578b9-7132-4a7a-80e4-30ee31099e03} - (no file)

Toolbar-Locked - (no file)

Toolbar-{b278d9f8-0fa9-465e-9938-0c392605d8e3} - (no file)

Wow6432Node-HKCU-Run-DW6 - c:\program files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe

Wow6432Node-HKCU-Run-Desktop Software - c:\program files (x86)\Common Files\SupportSoft\bin\bcont.exe

Wow6432Node-HKCU-Run-Akamai NetSession Interface - c:\users\bgik12\AppData\Local\Akamai\netsession_win.exe

Wow6432Node-HKCU-Run-AdobeBridge - (no file)

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

c:\users\bgik12\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WOSync.lnk - c:\program files (x86)\WOSync\WOSync.exe

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\LOLRecorder.lnk - c:\program files (x86)\LOLReplay\LOLRecorder.exe

SafeBoot-73589519.sys

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

Toolbar-Locked - (no file)

WebBrowser-{37153479-1976-43C3-A1EE-557513977B64} - (no file)

WebBrowser-{9565115D-C7D6-46D3-BD63-B67B481A4368} - (no file)

AddRemove-SOE-PlanetSide 2 - c:\users\Public\Sony Online Entertainment\Installed Games\PlanetSide 2\Uninstaller.exe

.

"ImagePath"="\"c:\program files\CyberLink\Shared files\RichVideo64.exe\"\00Z

[\]^_¯\00\00¯\00\00\00\00HIJKLMNO\00\00\00\00\00\00\00\00\03\00\00\00|}~¯\00\00¯\00\00\00\00r\00\00\00\00\00\00\00\00‘’“"

.

[HKEY_LOCAL_MACHINE\system\ControlSet002\services\{B154377D-700F-42cc-9474-23858FBDF4BD}]

"ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD9\000.fcl"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-2826711760-1920560978-1410755264-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.Email.1"

.

[HKEY_USERS\S-1-5-21-2826711760-1920560978-1410755264-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.VCard.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.12"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2014-03-28 19:37:58

ComboFix-quarantined-files.txt 2014-03-29 01:37

.

Pre-Run: 672,688,218,112 bytes free

Post-Run: 683,340,599,296 bytes free

.

- - End Of File - - 0C3061EE40DB5BB9E5BD04492CAE18A7

A36C5E4F47E84449FF07ED3517B43A31

MrCharlie · March 29, 2014

AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

What are you using as your anti-virus program????

------------------------------------------

Please download AdwCleaner from HERE or HERE to your desktop.

Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator
Click on the Scan button.
AdwCleaner will begin...be patient as the scan may take some time to complete.
When it's done you'll see: Pending: Please uncheck elements you don't want removed.
Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
Look over the log especially under Files/Folders for any program you want to save.
If there's a program you may want to save, just uncheck it from AdwCleaner.
If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
If you're ready to clean it all up.....click the Clean button.
After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder.
Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
To restore an item that has been deleted:
Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

Next..................

Please run a Quick Scan with Malwarebytes like this:

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

If you're using Malwarebytes 2.0, please run a Threat Scan

Let me know how it is, MrC

bgik · March 29, 2014

Im currently using microsoft securty essentials i was going to put norton on once my computer was clean from the virus it currently has on it.

bgik · March 29, 2014

i have the adwcleaner log report here.

# AdwCleaner v3.022 - Report created 29/03/2014 at 12:13:24

# Updated 13/03/2014 by Xplode

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

# Username : bgik12 - BUTCH

# Running from : C:\Users\bgik12\Downloads\AdwCleaner.exe

# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Babylon

Folder Deleted : C:\ProgramData\boost_interprocess

Folder Deleted : C:\ProgramData\WeCareReminder

Folder Deleted : C:\Program Files (x86)\1ClickDownload

Folder Deleted : C:\Program Files (x86)\Conduit

Folder Deleted : C:\Program Files (x86)\Free Offers from Freeze.com

Folder Deleted : C:\Program Files (x86)\Perion

Folder Deleted : C:\Program Files (x86)\Playbryte

Folder Deleted : C:\Program Files (x86)\Yontoo Layers Runtime

Folder Deleted : C:\Program Files (x86)\Common Files\Spigot

Folder Deleted : C:\Windows\SysWOW64\AI_RecycleBin

Folder Deleted : C:\Users\bgik12\AppData\Local\Conduit

Folder Deleted : C:\Users\bgik12\AppData\LocalLow\Conduit

Folder Deleted : C:\Users\bgik12\AppData\LocalLow\Delta

Folder Deleted : C:\Users\bgik12\AppData\LocalLow\Playbryte

Folder Deleted : C:\Users\bgik12\AppData\LocalLow\ShopperReports3

Folder Deleted : C:\Users\bgik12\AppData\Roaming\BitLord

Folder Deleted : C:\Users\bgik12\AppData\Roaming\Mozilla\Firefox\Profiles\41cwbxew.default\Extensions\{5E5AB302-7F65-44CD-8211-C1D4CAACCEA3}

Folder Deleted : C:\Users\bgik12\AppData\Roaming\Mozilla\Firefox\Profiles\41cwbxew.default\Extensions\ffxtlbr@incredibar.com

Folder Deleted : C:\Users\bgik12\AppData\Roaming\Mozilla\Firefox\Profiles\41cwbxew.default\Extensions\playbryte@playbryte.com

Folder Deleted : C:\Users\bgik12\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\Extensions\playbryte@playbryte.com

Folder Deleted : C:\Users\bgik12\AppData\Roaming\Mozilla\Firefox\Profiles\41cwbxew.default\Extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}

Folder Deleted : C:\Users\bgik12\AppData\Roaming\Mozilla\Firefox\Profiles\41cwbxew.default\Extensions\{7473b6bd-4691-4744-a82b-7854eb3d70b6}

File Deleted : C:\Windows\SysWOW64\conduitEngine.tmp

File Deleted : C:\Users\bgik12\AppData\Roaming\Mozilla\Firefox\Profiles\41cwbxew.default\searchplugins\Babylon.xml

File Deleted : C:\Users\bgik12\AppData\Roaming\Mozilla\Firefox\Profiles\41cwbxew.default\searchplugins\babylon1.xml

File Deleted : C:\Users\bgik12\AppData\Roaming\Mozilla\Firefox\Profiles\41cwbxew.default\searchplugins\delta.xml

File Deleted : C:\Users\bgik12\AppData\Roaming\Mozilla\Firefox\Profiles\41cwbxew.default\user.js

***** [ Shortcuts ] *****

***** [ Registry ] *****

Value Deleted : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{336D0C35-8A85-403A-B9D2-65C292C39087}]

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\bcjagnifjocnddgeknajocbkkhlgibem

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd

Key Deleted : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd

Key Deleted : HKCU\Software\Google\Chrome\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\icdlfehblmklkikfigmjhbmmpmkmpooj

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jplinpmadfkdgipabgcdchbdikologlh

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc

Key Deleted : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL

Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine

Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap

Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api

Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ClickPotatoLiteSA_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ClickPotatoLiteSA_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_install_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_install_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_rasapi32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_rasmancs

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasapi32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasmancs

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\sweetpacksupdatemanager_rasapi32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Vid-Saver_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Vid-Saver_RASMANCS

Key Deleted : HKCU\Software\e68cdee53eed40

Key Deleted : HKLM\SOFTWARE\e68cdee53eed40

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2304157

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2418376

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2559647

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2776682

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3072253

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3220468

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3287822

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{99066096-8989-4612-841F-621A01D54AD7}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220022342291}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{33333333-3333-3333-3333-330033343391}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660066346691}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{77777777-7777-7777-7777-770077347791}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{13ABD093-D46F-40DF-A608-47E162EC799D}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{91607FA7-3C2F-4F90-93E3-D5337A6B0AC2}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{B278D9F8-0FA9-465E-9938-0C392605D8E3}]

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403A-B9D2-65C292C39087}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660066346691}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{77777777-7777-7777-7777-770077347791}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\IGearSettings

Key Deleted : HKCU\Software\IM

Key Deleted : HKCU\Software\ImInstaller

Key Deleted : HKCU\Software\pc optimizer pro

Key Deleted : HKCU\Software\Softonic

Key Deleted : HKCU\Software\StartSearch

Key Deleted : HKCU\Software\YahooPartnerToolbar

Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes

Key Deleted : HKCU\Software\AppDataLow\Software\Search Settings

Key Deleted : HKCU\Software\AppDataLow\Software\ShopperReports3

Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar

Key Deleted : HKCU\Software\AppDataLow\Software\Toolbar

Key Deleted : HKLM\Software\Babylon

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\Software\DataMngr

Key Deleted : HKLM\Software\Freeze.com

Key Deleted : HKLM\Software\IB Updater

Key Deleted : HKLM\Software\Playbryte

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A81A974F-8A22-43E6-9243-5198FF758DA1}

Key Deleted : [x64] HKLM\SOFTWARE\IB Updater

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A7BC02AF-1128-4A31-BCF8-1A3EE803D3B3}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A81A974F-8A22-43E6-9243-5198FF758DA1}

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16521

-\\ Mozilla Firefox v

[ File : C:\Users\bgik12\AppData\Roaming\Mozilla\Firefox\Profiles\41cwbxew.default\prefs.js ]

Line Deleted : user_pref("extensions.crossriderapp3491.adsOldValue", -1);

Line Deleted : user_pref("CT3072253.autoDisableScopes", 0);

Line Deleted : user_pref("extensions.crossriderapp3491.adsOldValue", 10);

Line Deleted : user_pref("CT3220468.autoDisableScopes", 0);

Line Deleted : user_pref("playbryte.defaultsearchprocessed", true);//Playbryte-fa-outbrowse_playbryteuser_pref("extensions.crossriderapp4352.adsOldValue", 10);

Line Deleted : user_pref("CT3220468.autoDisableScopes", 0);

[ File : C:\Users\bgik12\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\prefs.js ]

-\\ Google Chrome v

[ File : C:\Users\bgik12\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [14317 octets] - [29/03/2014 12:09:50]

AdwCleaner[s0].txt - [13701 octets] - [29/03/2014 12:13:24]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [13762 octets] ##########

bgik · March 29, 2014

And here is the lof report from the malewarebytes scan.

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org

Database version: v2014.03.29.04

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.16521

bgik12 :: BUTCH [administrator]

3/29/2014 12:25:06 PM

mbam-log-2014-03-29 (12-25-06).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 242510

Time elapsed: 9 minute(s), 40 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

MrCharlie · March 29, 2014

Im currently using microsoft securty essentials i was going to put norton on once my computer was clean from the virus it currently has on it.

Then you should uninstall AVG and run their cleaner:

http://www.avg.com/us-en/utilities

Update and run a scan with your MSE and then let me know how it is.

MrC

bgik · March 29, 2014

I have tried multipule times to uninstall avg and it will not actually be removed. I will run a scan on MSE, but i can tell you that conhost.exe is still running along with other malicious applications that i can not end or dissable in my task manager.

MrCharlie · March 29, 2014

Run the AVG uninstaller.

MrC

bgik · March 29, 2014

I ran the uninstaller and it apears to have worked thank you. i will now run a scan with MSE and post the resaults.

MrCharlie · March 29, 2014

OK......MrC

bgik · March 29, 2014

MSE said it detected no threats.

MrCharlie · March 29, 2014

OK, tell what files you think are malware and why.

also.......

Please download Farbar Recovery Scan Tool (FRST) and save it to a folder.

(use correct version for your system.....Which system am I using?)

FRST <----for 32 bit systems

FRST64 <----for 64 bit systems

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button. (make sure the Addition box is checked)
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

If the logs are large, you can attach them:

To attach a log:

Bottom right corner of this page.

New window that comes up.

MrC

bgik · March 29, 2014

I'm not sure exactly what files are malware but conhost.exe seems to be a known virus and is still running and when i try to end its process it says accsess is denied along with other processes such as winlogon.exe, nvvsvc.exe. They don't show any description. i'm obviously no expert but they don't seem friendly. Here are the 2 logs from the farbar recovedry tool.

FRST logs.zip

MrCharlie · March 29, 2014

No major malware found, lots of adware found though.

You can read about conhost.exe at the link below:
http://www.howtogeek.com/howto/4996/what-is-conhost.exe-and-why-is-it-running/

These are all going to be deleted:

HKLM-x32\...\Run: [] - [X]
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
FF Extension: Vid-Saver - C:\Users\bgik12\AppData\Roaming\Mozilla\Firefox\Profiles\41cwbxew.default\Extensions\crossriderapp3491@crossrider.com [2012-07-02]
FF HKLM-x32\...\Firefox\Extensions: [{e45a0de0-b4de-11de-8a39-0800200c9a66}] - C:\Users\bgik12\AppData\Roaming\Mozilla\FireFox\{e45a0de0-b4de-11de-8a39-0800200c9a66}
CHR HKCU\...\Chrome\Extension: [pacgpkgadgmibnhpdidcnfafllnmeomc] - C:\Users\bgik12\AppData\Local\CRE\pacgpkgadgmibnhpdidcnfafllnmeomc.crx [2013-02-20]
CHR HKLM-x32\...\Chrome\Extension: [cfpbbebonjiokndafpjhimhncilmgikc] - C:\Users\bgik12\AppData\Local\Temp\ccex.crx [2013-02-20]
CHR HKLM-x32\...\Chrome\Extension: [naipdapbimiiikbbgjcpbgmfhnlbagpj] - C:\Users\bgik12\AppData\Local\Temp\ccex.crx [2013-02-20]
CHR HKLM-x32\...\Chrome\Extension: [pacgpkgadgmibnhpdidcnfafllnmeomc] - C:\Users\bgik12\AppData\Local\CRE\pacgpkgadgmibnhpdidcnfafllnmeomc.crx [2013-02-20]
2014-03-28 19:23 - 2014-03-28 19:23 - 00000000 ____D () C:\Users\bgik12\AppData\Roaming\AVG2012
FF Extension: CouponDropDown - C:\Users\bgik12\AppData\Roaming\Mozilla\Firefox\Profiles\41cwbxew.default\Extensions\crossriderapp4352@crossrider.com [2012-09-29]
FF Extension: Coupon Companion - C:\Users\bgik12\AppData\Roaming\Mozilla\Firefox\Profiles\41cwbxew.default\Extensions\crossriderapp4493@crossrider.com [2012-12-08]
CHR HKLM-x32\...\Chrome\Extension: [lpkdgemjaoffcpddbaajkjapiiniefbj] - C:\Users\bgik12\AppData\LocalLow\Playbryte\Chrome.crx [2013-02-20]
CHR HKLM-x32\...\Chrome\Extension: [oajgghejjpgkmpgbchgjieahoefimdle] - C:\Users\bgik12\AppData\Local\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx [2013-02-20]
AlternateDataStreams: C:\ProgramData\Temp:D1B5B4F1
AlternateDataStreams: C:\Users\bgik12\Cookies:CfnxiaMnzBEsb9RucG5wXy
AlternateDataStreams: C:\Users\bgik12\AppData\Local\uhPrVQhYmmRX4:yMEj3A1cJWmV2VkHWxB

---------------------------------------------

Download the attached fixlist.txt to the same folder as FRST.
Run FRST.exe and click Fix only once and wait
The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

MrC

bgik · March 30, 2014

Thank you for informing me about conhost.exe i read the document and have the fixlog.txt.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-03-2014

Ran by bgik12 at 2014-03-30 16:26:44 Run:1

Running from C:\Users\bgik12\Desktop\security

Boot Mode: Normal

==============================================

Content of fixlist:

*****************

HKLM-x32\...\Run: [] - [X]

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

FF Extension: Vid-Saver - C:\Users\bgik12\AppData\Roaming\Mozilla\Firefox\Profiles\41cwbxew.default\Extensions\crossriderapp3491@crossrider.com [2012-07-02]

FF HKLM-x32\...\Firefox\Extensions: [{e45a0de0-b4de-11de-8a39-0800200c9a66}] - C:\Users\bgik12\AppData\Roaming\Mozilla\FireFox\{e45a0de0-b4de-11de-8a39-0800200c9a66}

CHR HKCU\...\Chrome\Extension: [pacgpkgadgmibnhpdidcnfafllnmeomc] - C:\Users\bgik12\AppData\Local\CRE\pacgpkgadgmibnhpdidcnfafllnmeomc.crx [2013-02-20]

CHR HKLM-x32\...\Chrome\Extension: [cfpbbebonjiokndafpjhimhncilmgikc] - C:\Users\bgik12\AppData\Local\Temp\ccex.crx [2013-02-20]

CHR HKLM-x32\...\Chrome\Extension: [naipdapbimiiikbbgjcpbgmfhnlbagpj] - C:\Users\bgik12\AppData\Local\Temp\ccex.crx [2013-02-20]

CHR HKLM-x32\...\Chrome\Extension: [pacgpkgadgmibnhpdidcnfafllnmeomc] - C:\Users\bgik12\AppData\Local\CRE\pacgpkgadgmibnhpdidcnfafllnmeomc.crx [2013-02-20]

2014-03-28 19:23 - 2014-03-28 19:23 - 00000000 ____D () C:\Users\bgik12\AppData\Roaming\AVG2012

FF Extension: CouponDropDown - C:\Users\bgik12\AppData\Roaming\Mozilla\Firefox\Profiles\41cwbxew.default\Extensions\crossriderapp4352@crossrider.com [2012-09-29]

FF Extension: Coupon Companion - C:\Users\bgik12\AppData\Roaming\Mozilla\Firefox\Profiles\41cwbxew.default\Extensions\crossriderapp4493@crossrider.com [2012-12-08]

CHR HKLM-x32\...\Chrome\Extension: [lpkdgemjaoffcpddbaajkjapiiniefbj] - C:\Users\bgik12\AppData\LocalLow\Playbryte\Chrome.crx [2013-02-20]

CHR HKLM-x32\...\Chrome\Extension: [oajgghejjpgkmpgbchgjieahoefimdle] - C:\Users\bgik12\AppData\Local\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx [2013-02-20]

AlternateDataStreams: C:\ProgramData\Temp:D1B5B4F1

AlternateDataStreams: C:\Users\bgik12\Cookies:CfnxiaMnzBEsb9RucG5wXy

AlternateDataStreams: C:\Users\bgik12\AppData\Local\uhPrVQhYmmRX4:yMEj3A1cJWmV2VkHWxB

*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully.

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key deleted successfully.

HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.

C:\Users\bgik12\AppData\Roaming\Mozilla\Firefox\Profiles\41cwbxew.default\Extensions\crossriderapp3491@crossrider.com => Moved successfully.

HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\{e45a0de0-b4de-11de-8a39-0800200c9a66} => Value deleted successfully.

HKCU\SOFTWARE\Google\Chrome\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc => Key deleted successfully.

"C:\Users\bgik12\AppData\Local\CRE\pacgpkgadgmibnhpdidcnfafllnmeomc.crx" => File/Directory not found.

HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\cfpbbebonjiokndafpjhimhncilmgikc => Key deleted successfully.

"C:\Users\bgik12\AppData\Local\Temp\ccex.crx" => File/Directory not found.

HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\naipdapbimiiikbbgjcpbgmfhnlbagpj => Key deleted successfully.

"C:\Users\bgik12\AppData\Local\Temp\ccex.crx" => File/Directory not found.

HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc => Key deleted successfully.

"C:\Users\bgik12\AppData\Local\CRE\pacgpkgadgmibnhpdidcnfafllnmeomc.crx" => File/Directory not found.

C:\Users\bgik12\AppData\Roaming\AVG2012 => Moved successfully.

C:\Users\bgik12\AppData\Roaming\Mozilla\Firefox\Profiles\41cwbxew.default\Extensions\crossriderapp4352@crossrider.com => Moved successfully.

C:\Users\bgik12\AppData\Roaming\Mozilla\Firefox\Profiles\41cwbxew.default\Extensions\crossriderapp4493@crossrider.com => Moved successfully.

HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\lpkdgemjaoffcpddbaajkjapiiniefbj => Key deleted successfully.

"C:\Users\bgik12\AppData\LocalLow\Playbryte\Chrome.crx" => File/Directory not found.

HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\oajgghejjpgkmpgbchgjieahoefimdle => Key deleted successfully.

C:\Users\bgik12\AppData\Local\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx => Moved successfully.

C:\ProgramData\Temp => ":D1B5B4F1" ADS removed successfully.

"C:\Users\bgik12\Cookies" => ":CfnxiaMnzBEsb9RucG5wXy" ADS not found.

C:\Users\bgik12\AppData\Local\uhPrVQhYmmRX4 => ":yMEj3A1cJWmV2VkHWxB" ADS removed successfully.

==== End of Fixlog ====

MrCharlie · March 30, 2014

If it's OK and there's no other problems.....

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
If you get Unsupported operating system. Aborting now, just reboot and try again.
A Notepad document should open automatically called checkup.txt.
Please Post the contents of that document.
Do Not Attach It!!!

MrC

bgik · March 30, 2014

here are the results from security check.

Results of screen317's Security Check version 0.99.81

Windows 7 Service Pack 1 x64 (UAC is enabled)

Internet Explorer 11

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Enabled!

Microsoft Security Essentials

Bitdefender Antivirus Free Edition

Antivirus up to date!

`````````Anti-malware/Other Utilities Check:`````````

Spybot - Search & Destroy

Call of Duty: Ghosts

Call of Duty: Ghosts - Multiplayer

Malwarebytes Anti-Malware version 1.75.0.1300

Java 6 Update 35

Java 7 Update 51

Adobe Flash Player 12.0.0.77

Adobe Reader 10.1.9 Adobe Reader out of Date!

Google Chrome 33.0.1750.146

Google Chrome 33.0.1750.154

Google Chrome plugins...

````````Process Check: objlist.exe by Laurent````````

Microsoft Security Essentials msseces.exe

Windows Defender MSMpEng.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C:

````````````````````End of Log``````````````````````

Conhost.exe and possible other threats are on my computer please help

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information