Help with some shady processes please!

Serb25 · April 15, 2014

*NOTE Sorry if this is in the wrong thread!*

My mum's laptop wass infected with something so her homepage on IE was a scam Bing 'Giveaway' and Chrome had pop-ups, I scanned with MBAM, found over 100 viruses, most of them being PUP Crossrider, babylon plus hd and Start Page. Hitman Pro found some leftovers, Ask.com toolbar, Couduit, SpeedUpMyPC and baby lon. AdwCleaner and junkware removal tool got rid of the rests, ESET online scanner found 2 trojans, 4 worms, 2 baby lon, 2 PUPs and 2 unsafe applications, TDSS killer found 1 virus. Emsisoft Emergecy Kit found 1 PUP and backdoor. Now, this got deleted and I don't get those stuff and the laptop is faster, but I still see 3 shady processes. Wuauclt.exe(Windows update is not even active!), wdfmgr.exe and wscntfy.exe. Is the laptop still infected?

Psychotic · April 15, 2014

Hi there,
my name is Marius and I will assist you with your malware related problems.

Before we move on, please read the following points carefully.

First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while following my instructions, Stop there and tell me the exact nature of your problem.
Do not run any other scans without instruction or add/remove software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
Post all logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

HijackThis is not the preferred initial scanning tool in this forum. With today's malware, a more comprehensive set of logs is required to determine the presence of malware.

Scan with FRST in normal mode

Please download Farbar's Recovery Scan Tool to your desktop: FRST 32bit or FRST 64bit (If not sure: Start --> Computer (right click) --> properties)

Run FRST.
Don´t change one of the checkboxes and hit Scan.
Logfiles are created on your desktop.
Poste the FRST.txt and (after the first scan only!) the Addition.txt.

Scan with TDSS-Killer

Please read and follow these instructions carefully. We do not want it to fix anything yet (if found), we need to see a report first.

Download TDSSKiller.zip and extract to your desktop

Execute TDSSKiller.exe by doubleclicking on it.
Press Start Scan
If Malicious objects are found, do NOT select Copy to quarantine. Change the action to Skip, and save the log.
Once complete, a log will be produced at the root drive which is typically C:\ ,for example, C:\TDSSKiller.<version_date_time>log.txt

Please attach this file to your next reply.

Serb25 · April 15, 2014

I will but I have some work to do so I will attach them as soon as I can

Psychotic · April 15, 2014

ok

Serb25 · April 15, 2014

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 14-04-2014

Ran by Nedjo Baslac (administrator) on HOME-AMILO on 15-04-2014 16:33:12

Running from C:\Documents and Settings\Nedjo Baslac\My Documents

Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English(US)

Internet Explorer Version 8

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version:

Download link for 64-Bit Version:

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Lexmark International, Inc.) C:\WINDOWS\system32\LEXBCES.EXE

(Lexmark International, Inc.) C:\WINDOWS\system32\LEXPPS.EXE

(Lexmark International, Inc.) C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe

(Adobe Systems Inc.) C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Lexmark International, Inc.) C:\Program Files\Lexmark X5100 Series\lxbabmon.exe

(Microsoft Corporation) C:\Program Files\Messenger\msmsgs.exe

(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe

(Adobe Systems Incorporated) C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Acrobat_sl.exe

(RaMMicHaeL) C:\Program Files\Unchecky\bin\unchecky_svc.exe

(Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe

(RaMMicHaeL) C:\Program Files\Unchecky\bin\unchecky_bg.exe

(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [] => [X]

HKLM\...\Run: [Lexmark X5100 Series] => C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe [86100 2003-03-04] (Lexmark International, Inc.)

HKLM\...\Run: [Acrobat Assistant 7.0] => C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe [483328 2008-04-23] (Adobe Systems Inc.)

HKLM\...\Run: [NeroFilterCheck] => C:\WINDOWS\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)

HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640 2014-04-05] (AVAST Software)

HKU\S-1-5-21-1801674531-507921405-1547161642-1003\...\Run: [ctfmon.exe] => C:\WINDOWS\system32\ctfmon.exe [15360 2008-03-07] (Microsoft Corporation)

HKU\S-1-5-21-1801674531-507921405-1547161642-1003\...\Run: [MSMSGS] => C:\Program Files\Messenger\msmsgs.exe [1695232 2008-03-07] (Microsoft Corporation)

HKU\S-1-5-21-1801674531-507921405-1547161642-1003\...\Run: [skype] => C:\Program Files\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.)

HKU\S-1-5-21-1801674531-507921405-1547161642-1003\...\MountPoints2: {8ab2e37e-185e-11e3-8615-00140b30d04c} - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL autorun.exe

Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk

ShortcutTarget: Adobe Acrobat Speed Launcher.lnk -> C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.rs/

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

SearchScopes: HKLM - DefaultScope value is missing.

BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKCU - &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)

Toolbar: HKCU - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab

Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:

========

FF ProfilePath: C:\Documents and Settings\Nedjo Baslac\Application Data\Mozilla\Firefox\Profiles\hfq8c0et.default

FF DefaultSearchEngine: Ask Search

FF SearchEngineOrder.1: Ask Search

FF SearchEngineOrder.3: Bing

FF SelectedSearchEngine: Ask Search

FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

FF Extension: KMP Media Toolbar - C:\Documents and Settings\Nedjo Baslac\Application Data\Mozilla\Firefox\Profiles\hfq8c0et.default\Extensions\toolbar_KMPV7@apn.ask.com.xpi [2013-10-09]

FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-04-05]

Chrome:

=======

CHR Extension: (Google документи) - C:\Documents and Settings\Nedjo Baslac\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-05]

CHR Extension: (avast! Online Security) - C:\Documents and Settings\Nedjo Baslac\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-04-05]

CHR Extension: (Google новчаник) - C:\Documents and Settings\Nedjo Baslac\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-05]

CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-04-05]

========================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-05] (AVAST Software)

R2 LexBceS; C:\WINDOWS\system32\LEXBCES.EXE [303104 2003-02-28] (Lexmark International, Inc.)

R2 Unchecky; C:\Program Files\Unchecky\bin\unchecky_svc.exe [107624 2014-04-14] (RaMMicHaeL)

S3 MozillaMaintenance; "C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe" [X]

==================== Drivers (Whitelisted) ====================

R3 AR5211; C:\WINDOWS\System32\DRIVERS\ar5211.sys [488992 2006-03-23] (Atheros Communications, Inc.)

R2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [67824 2014-04-05] (AVAST Software)

R1 aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [54832 2014-04-05] (AVAST Software)

R0 aswRvrt; C:\WINDOWS\system32\Drivers\aswRvrt.sys [49944 2014-04-05] ()

R1 aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [776976 2014-04-05] (AVAST Software)

R1 aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [411552 2014-04-05] (AVAST Software)

R1 aswTdi; C:\WINDOWS\system32\drivers\aswTdi.sys [57672 2014-04-05] (AVAST Software)

R0 aswVmm; C:\WINDOWS\system32\Drivers\aswVmm.sys [180760 2014-04-05] ()

R1 avgtp; C:\WINDOWS\system32\drivers\avgtpx86.sys [37664 2013-11-01] (AVG Technologies)

S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-03-06] (Microsoft Corporation)

S3 cleanhlp; C:\EEK\Run\cleanhlp32.sys [50200 2014-04-05] (Emsisoft GmbH)

R3 FETNDIS; C:\WINDOWS\System32\DRIVERS\fetnd5.sys [27165 2001-08-17] (VIA Technologies, Inc. )

R3 HdAudAddService; C:\WINDOWS\System32\drivers\CHDAud.sys [594432 2006-08-24] (Conexant Systems Inc.)

R3 HSFHWAZL; C:\WINDOWS\System32\DRIVERS\HSFHWAZL.sys [206976 2006-03-09] (Conexant Systems, Inc.)

R3 HSF_DPV; C:\WINDOWS\System32\DRIVERS\HSF_DPV.sys [995712 2006-03-09] (Conexant Systems, Inc.)

S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-03-06] (Microsoft Corporation)

R3 S3GIGP; C:\WINDOWS\System32\DRIVERS\S3gIGPm.sys [634880 2006-11-15] (S3 Graphics Co., Ltd.)

S3 tap0901; C:\WINDOWS\System32\DRIVERS\tap0901.sys [35088 2013-04-30] (The OpenVPN Project)

S1 wceusbsh; C:\WINDOWS\System32\DRIVERS\wceusbsh.sys [31744 2008-03-06] (Microsoft Corporation)

S4 IntelIde; No ImagePath

S3 UIUSys; system32\DRIVERS\UIUSYS.SYS [X]

U1 WS2IFSL;

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-04-15 16:33 - 2014-04-15 16:33 - 00009582 _____ () C:\Documents and Settings\Nedjo Baslac\My Documents\FRST.txt

2014-04-15 16:32 - 2014-04-15 16:33 - 00000000 ____D () C:\FRST

2014-04-15 16:31 - 2014-04-15 16:32 - 01042944 _____ (Farbar) C:\Documents and Settings\Nedjo Baslac\My Documents\FRST.exe

2014-04-14 20:41 - 2014-04-14 20:41 - 135748352 _____ () C:\Documents and Settings\Nedjo Baslac\Desktop\setup_11.0.1.1245.x01_2014_04_14_20_12.exe

2014-04-14 18:41 - 2014-04-14 18:52 - 00000000 ____D () C:\Documents and Settings\Nedjo Baslac\Local Settings\Application Data\NPE

2014-04-14 18:41 - 2014-04-14 18:41 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Norton

2014-04-14 18:40 - 2014-04-14 18:40 - 03053496 ____N (Symantec Corporation) C:\Documents and Settings\Nedjo Baslac\My Documents\NPE.exe

2014-04-14 16:12 - 2014-04-14 16:12 - 00000596 _____ () C:\Documents and Settings\Nedjo Baslac\Desktop\JRT.txt

2014-04-14 15:48 - 2014-04-14 15:48 - 01016261 _____ (Thisisu) C:\Documents and Settings\Nedjo Baslac\My Documents\JRT.exe

2014-04-14 15:48 - 2014-04-14 15:48 - 00000000 ____D () C:\WINDOWS\ERUNT

2014-04-14 14:28 - 2014-04-14 15:41 - 00065536 _____ () C:\WINDOWS\system32\config\Doctor Web.evt

2014-04-14 14:28 - 2014-04-14 15:39 - 00000000 ____D () C:\Documents and Settings\Nedjo Baslac\Doctor Web

2014-04-14 14:16 - 2014-04-14 14:25 - 146408624 _____ () C:\Documents and Settings\Nedjo Baslac\My Documents\h6z39t6y.exe

2014-04-14 14:02 - 2014-04-14 14:02 - 00000000 ____D () C:\TDSSKiller_Quarantine

2014-04-14 14:00 - 2014-04-14 14:00 - 02237968 _____ (Kaspersky Lab ZAO) C:\Documents and Settings\Nedjo Baslac\My Documents\tdsskiller.exe

2014-04-12 13:35 - 2014-04-12 13:35 - 00000000 _RSHD () C:\Win

2014-04-12 08:44 - 2014-04-12 08:44 - 00001688 _____ () C:\Documents and Settings\Nedjo Baslac\Desktop\Skype.lnk

2014-04-09 15:38 - 2014-04-09 15:38 - 00000000 ____D () C:\Program Files\ESET

2014-04-08 14:02 - 2014-04-08 14:32 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)

2014-04-08 14:00 - 2014-04-08 14:32 - 00000000 ____D () C:\Documents and Settings\Nedjo Baslac\Desktop\mbar

2014-04-05 19:37 - 2014-04-05 19:37 - 00000815 _____ () C:\Documents and Settings\Nedjo Baslac\Desktop\Launch Internet Explorer Browser.lnk

2014-04-05 19:33 - 2014-04-11 13:38 - 00001815 _____ () C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk

2014-04-05 19:33 - 2014-04-05 19:33 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome

2014-04-05 19:31 - 2014-04-15 16:29 - 00000928 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2014-04-05 19:31 - 2014-04-15 13:36 - 00000932 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2014-04-05 19:31 - 2014-04-05 19:31 - 00884680 _____ (Google Inc.) C:\Documents and Settings\Nedjo Baslac\My Documents\ChromeSetup.exe

2014-04-05 19:17 - 2014-04-05 19:17 - 00001733 _____ () C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk

2014-04-05 19:17 - 2014-04-05 19:17 - 00000000 ____D () C:\Documents and Settings\Nedjo Baslac\Application Data\AVAST Software

2014-04-05 19:17 - 2014-04-05 19:17 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Avast

2014-04-05 19:16 - 2014-04-15 16:30 - 00000376 ____H () C:\WINDOWS\Tasks\avast! Emergency Update.job

2014-04-05 19:16 - 2014-04-05 19:16 - 00776976 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys

2014-04-05 19:16 - 2014-04-05 19:16 - 00411552 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys

2014-04-05 19:16 - 2014-04-05 19:16 - 00180760 _____ () C:\WINDOWS\system32\Drivers\aswVmm.sys

2014-04-05 19:16 - 2014-04-05 19:16 - 00067824 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys

2014-04-05 19:16 - 2014-04-05 19:16 - 00057672 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswTdi.sys

2014-04-05 19:16 - 2014-04-05 19:16 - 00054832 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr.sys

2014-04-05 19:16 - 2014-04-05 19:16 - 00049944 _____ () C:\WINDOWS\system32\Drivers\aswRvrt.sys

2014-04-05 19:16 - 2014-04-05 19:16 - 00043152 _____ (AVAST Software) C:\WINDOWS\avastSS.scr

2014-04-05 19:12 - 2014-04-05 19:14 - 88551496 _____ (AVAST Software) C:\Documents and Settings\Nedjo Baslac\My Documents\avast_free_antivirus_setup.exe

2014-04-05 15:57 - 2014-04-05 15:57 - 00002388 _____ () C:\EamClean.log

2014-04-05 14:43 - 2014-04-05 14:43 - 00000462 _____ () C:\Documents and Settings\Nedjo Baslac\Desktop\Emsisoft Emergency Kit.lnk

2014-04-05 14:42 - 2014-04-05 14:43 - 00000000 ____D () C:\EEK

2014-04-05 14:34 - 2014-04-05 14:41 - 225609112 _____ () C:\Documents and Settings\Nedjo Baslac\My Documents\EmsisoftEmergencyKit.exe

2014-04-05 11:34 - 2014-04-05 11:34 - 18568328 _____ (SUPERAntiSpyware) C:\Documents and Settings\Nedjo Baslac\My Documents\SUPERAntiSpyware.exe

2014-04-05 11:25 - 2014-04-05 11:25 - 00154888 _____ (SurfRight B.V.) C:\WINDOWS\system32\LnkProtect.dll

2014-04-05 10:27 - 2014-04-08 14:20 - 00107224 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2014-04-05 10:27 - 2014-04-08 14:20 - 00052312 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2014-04-05 10:27 - 2014-04-05 10:27 - 00000777 _____ () C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk

2014-04-05 10:27 - 2014-04-05 10:27 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware

2014-04-05 10:27 - 2014-04-05 10:27 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Malware

2014-04-05 10:25 - 2014-04-05 10:26 - 17305616 _____ (Malwarebytes Corporation ) C:\Documents and Settings\Nedjo Baslac\My Documents\mbam-setup-2.0.1.1004.exe

2014-04-05 10:13 - 2014-04-05 10:13 - 00000706 _____ () C:\Documents and Settings\All Users\Desktop\Unchecky.lnk

2014-04-05 10:13 - 2014-04-05 10:13 - 00000000 ____D () C:\Program Files\Unchecky

2014-04-05 10:13 - 2014-04-05 10:13 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Unchecky

2014-04-05 10:12 - 2014-04-05 10:13 - 00690424 _____ (RaMMicHaeL) C:\Documents and Settings\Nedjo Baslac\My Documents\unchecky_setup.exe

2014-04-05 10:03 - 2014-04-05 10:18 - 00000000 ____D () C:\AdwCleaner

2014-04-05 10:02 - 2014-04-05 10:02 - 01426178 _____ () C:\Documents and Settings\Nedjo Baslac\My Documents\AdwCleaner.exe

2014-04-04 19:07 - 2014-04-05 19:08 - 00065536 _____ () C:\WINDOWS\system32\config\COMODO I.evt

2014-04-04 18:51 - 2014-04-04 19:03 - 230532272 _____ (COMODO) C:\Documents and Settings\Nedjo Baslac\My Documents\cispremium_installer_5764_af.exe

2014-04-04 16:19 - 2014-04-04 16:19 - 00000669 _____ () C:\Documents and Settings\All Users\Start Menu\Programs\Opera.lnk

2014-04-04 16:19 - 2014-04-04 16:19 - 00000669 _____ () C:\Documents and Settings\All Users\Desktop\Opera.lnk

2014-04-04 16:19 - 2014-04-04 16:19 - 00000000 ____D () C:\Program Files\Opera

2014-04-04 16:19 - 2014-04-04 16:19 - 00000000 ____D () C:\Documents and Settings\Nedjo Baslac\Local Settings\Application Data\Opera Software

2014-04-04 16:19 - 2014-04-04 16:19 - 00000000 ____D () C:\Documents and Settings\Nedjo Baslac\Application Data\Opera Software

2014-04-04 12:24 - 2014-04-04 12:24 - 00027912 _____ () C:\WINDOWS\system32\.crusader

2014-04-04 12:16 - 2014-04-04 12:16 - 00001610 _____ () C:\Documents and Settings\All Users\Desktop\HitmanPro.lnk

2014-04-04 12:16 - 2014-04-04 12:16 - 00000000 ____D () C:\Program Files\HitmanPro

2014-04-04 12:16 - 2014-04-04 12:16 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\HitmanPro

2014-04-04 12:15 - 2014-04-04 12:24 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\HitmanPro

2014-04-04 12:13 - 2014-04-04 12:13 - 00000000 ____D () C:\Program Files\Reason

==================== One Month Modified Files and Folders =======

2014-04-15 16:33 - 2014-04-15 16:33 - 00009582 _____ () C:\Documents and Settings\Nedjo Baslac\My Documents\FRST.txt

2014-04-15 16:33 - 2014-04-15 16:32 - 00000000 ____D () C:\FRST

2014-04-15 16:32 - 2014-04-15 16:31 - 01042944 _____ (Farbar) C:\Documents and Settings\Nedjo Baslac\My Documents\FRST.exe

2014-04-15 16:30 - 2014-04-05 19:16 - 00000376 ____H () C:\WINDOWS\Tasks\avast! Emergency Update.job

2014-04-15 16:30 - 2013-03-23 18:24 - 00000000 ____D () C:\Documents and Settings\Nedjo Baslac\Application Data\Skype

2014-04-15 16:30 - 2013-03-23 15:03 - 00000159 _____ () C:\WINDOWS\wiadebug.log

2014-04-15 16:30 - 2013-03-23 15:03 - 00000049 _____ () C:\WINDOWS\wiaservc.log

2014-04-15 16:30 - 2013-03-23 14:11 - 00399383 _____ () C:\WINDOWS\WindowsUpdate.log

2014-04-15 16:29 - 2014-04-05 19:31 - 00000928 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2014-04-15 16:29 - 2013-03-23 14:18 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2014-04-15 14:51 - 2013-03-23 14:19 - 00000278 ___SH () C:\Documents and Settings\Nedjo Baslac\ntuser.ini

2014-04-15 14:51 - 2013-03-23 14:18 - 00032454 _____ () C:\WINDOWS\SchedLgU.Txt

2014-04-15 13:56 - 2013-10-01 08:56 - 00000420 _____ () C:\WINDOWS\Tasks\At1.job

2014-04-15 13:36 - 2014-04-05 19:31 - 00000932 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2014-04-15 13:13 - 2013-03-23 14:59 - 00646895 _____ () C:\WINDOWS\setupapi.log

2014-04-14 20:41 - 2014-04-14 20:41 - 135748352 _____ () C:\Documents and Settings\Nedjo Baslac\Desktop\setup_11.0.1.1245.x01_2014_04_14_20_12.exe

2014-04-14 18:52 - 2014-04-14 18:41 - 00000000 ____D () C:\Documents and Settings\Nedjo Baslac\Local Settings\Application Data\NPE

2014-04-14 18:52 - 2013-03-23 14:56 - 00000211 _____ () C:\boot.ini

2014-04-14 18:43 - 2013-03-23 14:19 - 00000000 ____D () C:\Documents and Settings\Nedjo Baslac

2014-04-14 18:41 - 2014-04-14 18:41 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Norton

2014-04-14 18:40 - 2014-04-14 18:40 - 03053496 ____N (Symantec Corporation) C:\Documents and Settings\Nedjo Baslac\My Documents\NPE.exe

2014-04-14 16:12 - 2014-04-14 16:12 - 00000596 _____ () C:\Documents and Settings\Nedjo Baslac\Desktop\JRT.txt

2014-04-14 15:48 - 2014-04-14 15:48 - 01016261 _____ (Thisisu) C:\Documents and Settings\Nedjo Baslac\My Documents\JRT.exe

2014-04-14 15:48 - 2014-04-14 15:48 - 00000000 ____D () C:\WINDOWS\ERUNT

2014-04-14 15:41 - 2014-04-14 14:28 - 00065536 _____ () C:\WINDOWS\system32\config\Doctor Web.evt

2014-04-14 15:39 - 2014-04-14 14:28 - 00000000 ____D () C:\Documents and Settings\Nedjo Baslac\Doctor Web

2014-04-14 14:25 - 2014-04-14 14:16 - 146408624 _____ () C:\Documents and Settings\Nedjo Baslac\My Documents\h6z39t6y.exe

2014-04-14 14:02 - 2014-04-14 14:02 - 00000000 ____D () C:\TDSSKiller_Quarantine

2014-04-14 14:00 - 2014-04-14 14:00 - 02237968 _____ (Kaspersky Lab ZAO) C:\Documents and Settings\Nedjo Baslac\My Documents\tdsskiller.exe

2014-04-14 13:57 - 2004-08-04 20:00 - 00002206 _____ () C:\WINDOWS\system32\wpa.dbl

2014-04-12 13:35 - 2014-04-12 13:35 - 00000000 _RSHD () C:\Win

2014-04-12 08:44 - 2014-04-12 08:44 - 00001688 _____ () C:\Documents and Settings\Nedjo Baslac\Desktop\Skype.lnk

2014-04-11 13:38 - 2014-04-05 19:33 - 00001815 _____ () C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk

2014-04-09 20:59 - 2004-08-04 20:00 - 00000573 _____ () C:\WINDOWS\win.ini

2014-04-09 20:59 - 2004-08-04 20:00 - 00000227 _____ () C:\WINDOWS\system.ini

2014-04-09 18:54 - 2013-10-03 11:48 - 00000000 ____D () C:\Program Files\The KMPlayer

2014-04-09 15:38 - 2014-04-09 15:38 - 00000000 ____D () C:\Program Files\ESET

2014-04-08 14:32 - 2014-04-08 14:02 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)

2014-04-08 14:32 - 2014-04-08 14:00 - 00000000 ____D () C:\Documents and Settings\Nedjo Baslac\Desktop\mbar

2014-04-08 14:20 - 2014-04-05 10:27 - 00107224 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2014-04-08 14:20 - 2014-04-05 10:27 - 00052312 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys

2014-04-05 19:37 - 2014-04-05 19:37 - 00000815 _____ () C:\Documents and Settings\Nedjo Baslac\Desktop\Launch Internet Explorer Browser.lnk

2014-04-05 19:33 - 2014-04-05 19:33 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome

2014-04-05 19:33 - 2013-05-30 12:42 - 00000000 ____D () C:\Documents and Settings\Nedjo Baslac\Local Settings\Application Data\Google

2014-04-05 19:32 - 2013-05-30 12:42 - 00000000 ____D () C:\Program Files\Google