Wondershare Issue And General SweepOut

garyt53 · December 21, 2014

Hi Folks -

Win7 dualboot linux with symantecNIS and regular mbam and mbam-rootkit-beta scans. Nnot having anomalous behavior except Wondershare was installed unsolicited and doesn't show up in win7 or CCleaner uninstall list and within the /applications/wondershare install folder there is no uninstall.exe

So, going to do another long-overlooked backup and need expert eyes on my logs after getting rid of this Wondershare thing so I don't perpetuate any problems.

NIS rejected frst64.exe as WS.Reputation.1 so please advise. I know,I know....they're in charge of our national infrastructure. ssseesh

I think you folks are least likely to be creating after-hours malware and them as most. haha

gt

SymantecNISRejectedFRST64.doc

mbam1.txt

LiquidTension · December 21, 2014

Hello garyt53, welcome to Malwarebytes' Malware Removal forum!

My username is LiquidTension, but you can call me Adam. I will be assisting you with your malware-related problems.
If you would allow me to call you by your first name I would prefer that.

General P2P/Piracy Notice:

If you are using Peer to Peer (P2P) filesharing software such as uTorrent, BitTorrent or similar you must either fully uninstall or completely disable the programme(s) from running whilst receiving assistance at this forum.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked/keygen or similar software on the computer, please remove/uninstall the software now and read the policy on Piracy. Failure to do so will also result in your topic being closed.

======================================================

Please read through the points below to ensure this process moves as quickly and efficiently as possible.

Please ensure you read through my instructions thoroughly, and carry out each step in the order specified.
If you are unable to copy/paste your logs directly into your post, please attach the file.
Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in ascertaining the current situation and providing the best set of instructions for you.
Please backup important files before proceeding with my instructions. Malware removal can be unpredictable.
If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before proceeding.
Topics are locked if no response is made after 4 days. Please inform me if you will require additional time to complete my instructions.
Ensure you are following this topic. Click at the top of the page.

======================================================

Please temporarily disable Norton, and redownload FRST.

Alternatively, FRST can be downloaded onto a USB drive using a different computer, and transferred over.

Run a scan with FRST. Copy and paste the contents of both logs (FRST.txt and Addition.txt) in your next reply.

garyt53 · December 21, 2014

Hi Adam !

THis is Saturday night! Whaterwedoin doin this? ha

Attached the logs and have had p2p torrent stuff on here but not for years. Got a hi$ station of Rhino engineering software on this thing but it's legit. Oh yeah, and if I talk too much, I shut up easy. ha

If you're still up, will wait a half hr for your interpertation/instruction.

gt

FRST.txt

Addition.txt

garyt53 · December 21, 2014

oops, intended to send you this little bit of info on the curious wondershare issue

wondershare issue.doc

LiquidTension · December 21, 2014

Hello,

THis is Saturday night!

Not in the UK.

---------

Do you recognise the following?

C:\Program Files (x86)\zzAutoruns
C:\Program Files (x86)\SystemLook Finder.exe

Please consider the following suggestion, and proceed with the instructions below.

Registry Cleaner Warning

------------------------------

I see you have registry cleaner/optimization software (Free Registry Defrag) installed on your computer. Registry cleaners and optimization tools that claim to speed up your computer should be avoided, and are potentially dangerous. By running a registry cleaner you risk rendering your machine unbootable. There is no statistical evidence to back claims that cleaning the registry will improve performance. Advertisements to do so are borderline scams intended to goad users into using an unnecessary and potential dangerous product.
Some registry cleaners employ aggressive cleaning routines that may cause substantial damage to your system, and could render your machine unbootable.
Not all registry cleaners backup the registry. If an issue arises you may not have a backup to rely on.
The usefulness of cleaning the registry is disputable; there is no statistical evidence to support the claim that cleaning the registry will improve system performance.
Please refer to the following article on why you should not use registry cleaner software. I suggest reading why Microsoft does not support the use of registry cleaners as well.

STEP 1
Farbar Recovery Scan Tool (FRST) Script

Press the Windows Key + r on your keyboard at the same time. Type Notepad and click OK.

Copy the entire contents of the codebox below and paste into the Notepad document.

startStartup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ScanPanel.lnkShortcutTarget: ScanPanel.lnk -> C:\ScanPanel\ScnPanel.exe (No File)GroupPolicyUsers\S-1-5-21-2552641736-1398428658-1438833275-1010\User: Group Policy restriction detected <======= ATTENTIONGroupPolicyUsers\S-1-5-21-2552641736-1398428658-1438833275-1009\User: Group Policy restriction detected <======= ATTENTIONSearchScopes: HKLM -> {7808284F-F08E-47E2-92D4-99EDEF7672AA} URL = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpdSearchScopes: HKLM-x32 -> {7808284F-F08E-47E2-92D4-99EDEF7672AA} URL = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpdSearchScopes: HKU\.DEFAULT -> DefaultScope {B60E0077-79C2-4797-A3CB-25B6D2C8F222} URL = SearchScopes: HKU\.DEFAULT -> {7808284F-F08E-47E2-92D4-99EDEF7672AA} URL = SearchScopes: HKU\S-1-5-21-2552641736-1398428658-1438833275-500 -> {7808284F-F08E-47E2-92D4-99EDEF7672AA} URL = SearchScopes: HKU\S-1-5-21-2552641736-1398428658-1438833275-500 -> {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = http://nortonsafe.search.ask.com/web?q={SEARCHTERMS}&o=APN10506&l=dis&prt=NIS&chn=retail&geo=US&ver=20&locale=en_US&gct=kwd&qsrc=2869SearchScopes: HKU\S-1-5-21-2552641736-1398428658-1438833275-500 -> {B60E0077-79C2-4797-A3CB-25B6D2C8F222} URL = FF Keyword.URL: hxxp://nortonsafe.search.ask.com/web?o=APN10506&gct=kwd&qsrc=2869&l=dis&prt=NIS&chn=retail&geo=US&ver=21&q=FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPCrwPd.dll (Crawler, LLC)C:\Program Files (x86)\mozilla firefox\plugins\NPCrwPd.dllFF SearchPlugin: C:\Users\garytindall\AppData\Roaming\Mozilla\Firefox\Profiles\wqucbu05.default\searchplugins\safesearch.xmlFF SearchPlugin: C:\Users\garytindall\AppData\Roaming\Mozilla\Firefox\Profiles\wqucbu05.default\searchplugins\yahoo_ff.xmlCHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No PathCHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No PathCHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - No PathS2 LMIRescue; "C:\Users\CRESCE~1\AppData\Local\Temp\LMI32E3.tmp\lmi_rescue.exe" -service -sid 1bb98bc4-2a52-4d86-8496-aaf02e1d50aa [X]S1 ccHP; \SystemRoot\system32\drivers\NISx64\1107000.00C\ccHPx64.sys [X]S4 nvvad_WaveExtensible; system32\drivers\nvvad64v.sys [X]S3 PcdrNdisuio; syswow64\drivers\pcdrndisuio.sys [X]S0 PxHlpa64; System32\Drivers\PxHlpa64.sys [X]S3 RivaTuner32; \??\C:\Program Files (x86)\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner32.sys [X]C:\Users\Gary Tindall\AppData\Local\Temp\IMToolPackSetup.exeAlternateDataStreams: C:\ProgramData\Temp:3B71D0B4AlternateDataStreams: C:\ProgramData\Temp:7631EA83AlternateDataStreams: C:\ProgramData\Temp:7FAE3E0DAlternateDataStreams: C:\ProgramData\Temp:D1B5B4F1CMD: ipconfig /flushdnsCMD: netsh winsock reset allCMD: netsh int ipv4 resetCMD: netsh int ipv6 resetEmptyTemp:end

Click File, Save As and type fixlist.txt as the File Name.
Important: The file must be saved in the same location as FRST64.exe.

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

Right-Click FRST64.exe and select Run as administrator to run the programme.
Click Fix.
A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.

STEP 2
TDSSKiller Scan

Please download TDSSKiller and save the file to your Desktop.
Right-Click TDSSKiller.exe and select Run as administrator to run the programme.
Click Change parameters. Place a checkmark next to:
- Loaded Modules
- Detect TDLFS file system
- Verify file digital signatures
Note: If you receive the following message: Extended Monitoring Driver is required, click Reboot now, and continue from here following the reboot.
Click Start Scan. Do not use the computer during the scan.
If objects are found, change the action to skip.
Click Continue and close the window.
A log will be created and saved to the root directory (usually C:\). Attach the log in your next reply.

STEP 3
SystemLook

Please download SystemLook (x64) and save the file to your Desktop.
Right-Click SystemLook_x64.exe and select Run as administrator to run the programme.
Copy the entire contents of the codebox below and paste into the textfield.
```
:filefind*Wondershare*:folderfind*Wondershare*:regfindWondershare
```
Click the button to start the scan.
Upon completion, a log (SystemLook.txt) will open. Copy the contents of the log and paste in your next reply.
Click the button.

======================================================

STEP 4
xpfNZP4A.png.pagespeed.ic.bp5cRl1pJg.jpg Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

Do you recognise the file/folder?
Fixlog.txt
TDSSKiller log (attached!)
SystemLook.txt

garyt53 · December 21, 2014

RE Registry Cleaners:

I use CCleaner, both clean and registryclean, regularly utilizing the option to BU the reg. I run it in both limited account and admin acct. Sometimes I will just run ATF Cleaner though before running Puran defrag in bootdefrag mode with all options utilized. So shall I stop using the registry comb in CCleaner, and even the regdefrag utility? Hey, you’re the expert on this stuff…..I’ll drop these utilities in a heartbeat on your advice. I value your opinion, even though I’ve been bad burned by overseas Symantec and even domestic MS analysts who I made no effort to retribute. Revenge just makes me more of a victim.

RE The Other Utilities:

Have always used AutoRuns on and off to avoid using msconfig to edit startups. The other stuff is left over from a recent attempt to accomplish a general sweep at MajorGeeks. That session ended abruptly when I kiddingly stated that at my age I don’t need to be strictly held to forum protocol. Well, I don’t know if it was CYA or if he was afraid for his job, but he took that ball and ran with it. The guy even fixated on that non-issue that I closed the thread by snapping back with “no, I closed the thread”. Pretty petty crap so I came here. Mostly because of your as-good-as-Kaspersky developers…..who, like I said earlier, probably don’t spend their off time creating annoying – even criminally destructive malware. I’m a retired engineering support professional and this sysad stuff is very serious and stressful and requires a degree of levity to take off that edge, but some people….well enough said. Never been kicked off a forum of any kind and have only run from forums a few times, like on alternative unbelievable-but-true critical-current-events forums that get temporarily overrun by paid propagandizing trolls. Now too much said.

Please remove all this unnecessary info from this post. It’s only here cause you asked about leftover logs in STEP 4 of your last reply.

OK…..couldn’t sleep well either so will work on the “hoops” you have provided me to expedite this effort. Logs attached as per.

gt

HA! Am learning stuff from you in the first line already: “ScriptPress” No word from you regarding NIS so I left the Symantic firewall and active AV on for this stuff. Had to OK frst-scanner though. I also had hidden and system files set globally (God I hate that word….all the lies are globaloney, I made that up and it’s catchin on) to visible.

Also was not able to select “Detect TDLFS…..” or “Verify….” In tdssk as had to reboot at “extended monitoring….”.

SystemLook 30.07.11 by jpshortstuff
Log created at 06:53 on 21/12/2014 by garytindall
Administrator - Elevation successful

========== filefind ==========

Searching for "*Wondershare*"
C:\Documents and Settings\garytindall\AppData\Roaming\Microsoft\Office\Recent\wondershare issue.doc.LNK   --a---- 732 bytes   [22:21 12/12/2014]   [10:11 21/12/2014] CBF58BE346F0E97CE7675CE239555CB7
C:\Documents and Settings\garytindall\Desktop\wondershare issue.doc   --a---- 35840 bytes   [22:21 12/12/2014]   [03:16 15/12/2014] BA541DF1033C06B9B2687478FAC3281E
C:\Users\garytindall\AppData\Roaming\Microsoft\Office\Recent\wondershare issue.doc.LNK   --a---- 732 bytes   [22:21 12/12/2014]   [10:11 21/12/2014] CBF58BE346F0E97CE7675CE239555CB7
C:\Users\garytindall\Desktop\wondershare issue.doc   --a---- 35840 bytes   [22:21 12/12/2014]   [03:16 15/12/2014] BA541DF1033C06B9B2687478FAC3281E

========== folderfind ==========

Searching for "*Wondershare*"
C:\Documents and Settings\All Users\Wondershare Video Converter Ultimate   d------   [13:12 01/08/2013]
C:\Documents and Settings\garytindall\AppData\Local\Wondershare   d------   [13:13 01/08/2013]
C:\Documents and Settings\Public\Documents\Wondershare   d------   [13:06 01/08/2013]
C:\Program Files\Common Files\Wondershare   d------   [13:13 01/08/2013]
C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact   d------   [13:13 01/08/2013]
C:\ProgramData\Wondershare Video Converter Ultimate   d------   [13:12 01/08/2013]
C:\Users\All Users\Wondershare Video Converter Ultimate   d------   [13:12 01/08/2013]
C:\Users\garytindall\AppData\Local\Wondershare   d------   [13:13 01/08/2013]
C:\Users\Public\Documents\Wondershare   d------   [13:06 01/08/2013]

========== regfind ==========

Searching for "Wondershare"
[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\Open Find\Microsoft Office Word\Settings\Save As\File Name MRU]
"Value"="inst SymantecNISRejectedFRST64 instructions instructions2 BootRepair-GRUB wondershare issue"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List]
"File3"="C:\Users\garytindall\Desktop\WondershareIssueInfo.txt"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List]
"File4"="C:\Users\garytindall\Desktop\WondershareIssueInfo.rtf"
[HKEY_CURRENT_USER\Software\Wondershare]
[HKEY_CURRENT_USER\Software\Wondershare\Wondershare Helper Compact]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WondershareVideoConverterFileOpreation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3E8FFA07-07D5-4FA0-BB26-DAE0D0F8820C}\1.0\0\win32]
@="C:\Program Files (x86)\Wondershare\Video Converter Ultimate\VideoConverterUltimate.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3E8FFA07-07D5-4FA0-BB26-DAE0D0F8820C}\1.0\HELPDIR]
@="C:\Program Files (x86)\Wondershare\Video Converter Ultimate\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{455852CE-2BE3-42D5-9274-E26142778A8A}\1.0\0\win32]
@="C:\Program Files (x86)\Wondershare\Video Converter Ultimate\SVRDownloadButton.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{455852CE-2BE3-42D5-9274-E26142778A8A}\1.0\HELPDIR]
@="C:\Program Files (x86)\Wondershare\Video Converter Ultimate\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BA975139-E81E-415B-81E0-4F0A129172FC}\1.0\0\win32]
@="C:\Program Files (x86)\Wondershare\Video Converter Ultimate\URLReqService.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BA975139-E81E-415B-81E0-4F0A129172FC}\1.0\HELPDIR]
@="C:\Program Files (x86)\Wondershare\Video Converter Ultimate"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D85C6069-D628-4276-93C3-9A94E5338D8B}\1.1\0\win32]
@="C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D85C6069-D628-4276-93C3-9A94E5338D8B}\1.1\HELPDIR]
@="C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}\LocalServer32]
@="C:\PROGRA~1\COMMON~1\Wondershare\Wondershare Helper Compact\WSHelper.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{3E8FFA07-07D5-4FA0-BB26-DAE0D0F8820C}\1.0\0\win32]
@="C:\Program Files (x86)\Wondershare\Video Converter Ultimate\VideoConverterUltimate.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{3E8FFA07-07D5-4FA0-BB26-DAE0D0F8820C}\1.0\HELPDIR]
@="C:\Program Files (x86)\Wondershare\Video Converter Ultimate\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{455852CE-2BE3-42D5-9274-E26142778A8A}\1.0\0\win32]
@="C:\Program Files (x86)\Wondershare\Video Converter Ultimate\SVRDownloadButton.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{455852CE-2BE3-42D5-9274-E26142778A8A}\1.0\HELPDIR]
@="C:\Program Files (x86)\Wondershare\Video Converter Ultimate\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{BA975139-E81E-415B-81E0-4F0A129172FC}\1.0\0\win32]
@="C:\Program Files (x86)\Wondershare\Video Converter Ultimate\URLReqService.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{BA975139-E81E-415B-81E0-4F0A129172FC}\1.0\HELPDIR]
@="C:\Program Files (x86)\Wondershare\Video Converter Ultimate"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D85C6069-D628-4276-93C3-9A94E5338D8B}\1.1\0\win32]
@="C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D85C6069-D628-4276-93C3-9A94E5338D8B}\1.1\HELPDIR]
@="C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Wondershare]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Wondershare]
"ExePath"="C:\Program Files (x86)\Wondershare\Video Converter Ultimate\VideoConverterUltimate.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Wondershare\DownloadManager]
"InstallLocation"="C:\Program Files (x86)\Wondershare\Video Converter Ultimate\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Wondershare\Wondershare Helper Compact]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Wondershare\Wondershare Helper Compact]
"InstallPath"="C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Wondershare\Wondershare Helper Compact]
"Installexe"="C:\Program Files (x86)\Wondershare\Video Converter Ultimate\Wondershare Helper Compact.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Wondershare\Wondershare Helper Compact]
"Uninstallexe"="C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\unins000.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Wondershare\Wondershare Helper Compact]
"DataLastRoom"="C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\log\Data\RoomSwap\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Wondershare\Wondershare Helper Compact]
"DataCurrentRoom"="C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\log\Data\Room\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}\LocalServer32]
@="C:\PROGRA~1\COMMON~1\Wondershare\Wondershare Helper Compact\WSHelper.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{3E8FFA07-07D5-4FA0-BB26-DAE0D0F8820C}\1.0\0\win32]
@="C:\Program Files (x86)\Wondershare\Video Converter Ultimate\VideoConverterUltimate.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{3E8FFA07-07D5-4FA0-BB26-DAE0D0F8820C}\1.0\HELPDIR]
@="C:\Program Files (x86)\Wondershare\Video Converter Ultimate\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{455852CE-2BE3-42D5-9274-E26142778A8A}\1.0\0\win32]
@="C:\Program Files (x86)\Wondershare\Video Converter Ultimate\SVRDownloadButton.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{455852CE-2BE3-42D5-9274-E26142778A8A}\1.0\HELPDIR]
@="C:\Program Files (x86)\Wondershare\Video Converter Ultimate\"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{BA975139-E81E-415B-81E0-4F0A129172FC}\1.0\0\win32]
@="C:\Program Files (x86)\Wondershare\Video Converter Ultimate\URLReqService.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{BA975139-E81E-415B-81E0-4F0A129172FC}\1.0\HELPDIR]
@="C:\Program Files (x86)\Wondershare\Video Converter Ultimate"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{D85C6069-D628-4276-93C3-9A94E5338D8B}\1.1\0\win32]
@="C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{D85C6069-D628-4276-93C3-9A94E5338D8B}\1.1\HELPDIR]
@="C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\"
[HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Microsoft\Office\11.0\Common\Open Find\Microsoft Office Word\Settings\Save As\File Name MRU]
"Value"="inst SymantecNISRejectedFRST64 instructions instructions2 BootRepair-GRUB wondershare issue"
[HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List]
"File3"="C:\Users\garytindall\Desktop\WondershareIssueInfo.txt"
[HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List]
"File4"="C:\Users\garytindall\Desktop\WondershareIssueInfo.rtf"
[HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Wondershare]
[HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Wondershare\Wondershare Helper Compact]

-= EOF =-

~ WHEW ~

Sorry for throwing all this atcha.

TDSSKiller.3.0.0.42_21.12.2014_06.45.00_log.txt

Fixlog.txt

LiquidTension · December 22, 2014

Hello,

Sometimes I will just run ATF Cleaner

This tool has not be updated for a long time. Running CCleaner's cleaner would be the safer option.

So shall I stop using the registry comb in CCleaner, and even the regdefrag utility?

Any programme that purports to clean the registry should be avoided. In CCleaner's case, running the standard cleaner is OK (I use it myself). The built-in registry cleaner is better left.

No word from you regarding NIS so I left the Symantic firewall and active AV on for this stuff.

Yes, that's OK. If your security software needs to be disabled, I will let you know.

Also was not able to select “Detect TDLFS…..” or “Verify….” In tdssk as had to reboot at “extended monitoring….”.

That's OK.

Please do the following.

STEP 1
Farbar Recovery Scan Tool (FRST) Script

Press the Windows Key + r on your keyboard at the same time. Type Notepad and click OK.

Copy the entire contents of the codebox below and paste into the Notepad document.

startC:\Documents and Settings\All Users\Wondershare Video Converter UltimateC:\Documents and Settings\garytindall\AppData\Local\WondershareC:\Documents and Settings\Public\Documents\WondershareC:\Program Files\Common Files\WondershareC:\Program Files\Common Files\Wondershare\Wondershare Helper CompactC:\ProgramData\Wondershare Video Converter UltimateC:\Users\All Users\Wondershare Video Converter UltimateC:\Users\garytindall\AppData\Local\WondershareC:\Users\Public\Documents\WondershareEmptyTemp:end

Click File, Save As and type fixlist.txt as the File Name.
Important: The file must be saved in the same location as FRST64.exe.

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

Right-Click FRST64.exe and select Run as administrator to run the programme.
Click Fix.
A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.

STEP 2
DelFix

Please download DelFix and save the file to your Desktop.
Double-click DelFix.exe to run the programme.
Remove the checkmark next to the following items:
- Remove disinfection tools
Place a checkmark next to the following items:
- Create registry backup
Click the Run button.

STEP 3
Reg Fix

Press the Windows Key + r on your keyboard at the same time. Type Notepad and click OK.

Copy the entire contents of the codebox below and paste into the Notepad document.

Windows Registry Editor Version 5.00[-HKEY_CURRENT_USER\Software\Wondershare][-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WondershareVideoConverterFileOpreation][-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{3E8FFA07-07D5-4FA0-BB26-DAE0D0F8820C}][-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{455852CE-2BE3-42D5-9274-E26142778A8A}][-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{BA975139-E81E-415B-81E0-4F0A129172FC}][-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D85C6069-D628-4276-93C3-9A94E5338D8B}][-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}][-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{3E8FFA07-07D5-4FA0-BB26-DAE0D0F8820C}][-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{455852CE-2BE3-42D5-9274-E26142778A8A}][-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{BA975139-E81E-415B-81E0-4F0A129172FC}][-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D85C6069-D628-4276-93C3-9A94E5338D8B}][-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Wondershare][-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}][-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{3E8FFA07-07D5-4FA0-BB26-DAE0D0F8820C}][-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{455852CE-2BE3-42D5-9274-E26142778A8A}][-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{BA975139-E81E-415B-81E0-4F0A129172FC}][-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\TypeLib\{D85C6069-D628-4276-93C3-9A94E5338D8B}][-HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Wondershare]

Click Format. Ensure Wordwrap is unchecked.
Click File, Save As and name the file regfix.reg.
Select All Files as the Save as type.
Save the file to your Desktop.
Locate regfix.reg on your Desktop. Right-click the file and click Merge with the Registry.
Accept any prompts.
Reboot your computer for the changes to take effect.

======================================================

STEP 4
xpfNZP4A.png.pagespeed.ic.bp5cRl1pJg.jpg Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

Fixlog.txt
Did the reg fix merge successfully?

garyt53 · December 22, 2014

Hi Adam -

“Merge with registry” was not available on my rightclick so my workaround was to create a restore point > open with > registry editor, and that added it to the registry. Ah ha, got to correct the teach! That is, if what I did doesn’t require the restore point I created. And they are always iffy, huh. Except you BUd the reg, and THAT'S reliable. It’s great to have sys-backups too. Even if they're old. Of course, they’re always iffy.* So it was an exciting (scary really) reboot, but it worked. ha Being complicated is what makes stuff seem like magic. But then, that’s job security!

Removed ATCCleaner and will try to resist the temptation of using the CCleaner RegistryClean option, but that should be attainable cause I don’t intend to be adding and removing many programs as I have in the past.

How about the reg-defrag? I usually use it every few months and it “feels” like it’s doing it’s job. Like, I notice shorter reboots after. Or should I off that too.

And, I’ve got this dancer on my desktop…….just kidding. ha

So…..we’re done, huh.

gt

* I've started using Clonezilla for imaging my 2 dual-boot HDDs and system-incremental backups. Good idea? Or should I use dd (linux)? It also images multi-part HDDs by the 1s and zeros (more reliable and safer?). Also, any cool scripts you have for maintainence would be great! Except I should probably pay for that. Except hey! It's Christmas! haha Besides, I've always thought software oughta be free. It's the books they should charge for. Like AutoCAD was early on....what made em so big. Oh, and....Thanks for rewarding my trust.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 21-12-2014
Ran by garytindall at 2014-12-22 11:15:44 Run:2
Running from C:\Users\garytindall\Desktop
Loaded Profile: garytindall (Available profiles: Gary Tindall & Visitorer & Trusted Friend & garytindall & Guest)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
C:\Documents and Settings\All Users\Wondershare Video Converter Ultimate
C:\Documents and Settings\garytindall\AppData\Local\Wondershare
C:\Documents and Settings\Public\Documents\Wondershare
C:\Program Files\Common Files\Wondershare
C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact
C:\ProgramData\Wondershare Video Converter Ultimate
C:\Users\All Users\Wondershare Video Converter Ultimate
C:\Users\garytindall\AppData\Local\Wondershare
C:\Users\Public\Documents\Wondershare
EmptyTemp:
end
*****************

C:\Documents and Settings\All Users\Wondershare Video Converter Ultimate => Moved successfully.
C:\Documents and Settings\garytindall\AppData\Local\Wondershare => Moved successfully.
C:\Documents and Settings\Public\Documents\Wondershare => Moved successfully.
C:\Program Files\Common Files\Wondershare => Moved successfully.
"C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact" => File/Directory not found.
"C:\ProgramData\Wondershare Video Converter Ultimate" => File/Directory not found.
"C:\Users\All Users\Wondershare Video Converter Ultimate" => File/Directory not found.
"C:\Users\garytindall\AppData\Local\Wondershare" => File/Directory not found.
"C:\Users\Public\Documents\Wondershare" => File/Directory not found.
EmptyTemp: => Removed 17.8 MB temporary data.

The system needed a reboot.

==== End of Fixlog ====

ANd I noticed in red above that it sees my guest account. What's up with that? THought I had it turned off. Or am I exposing my ignorance.

LiquidTension · December 22, 2014

Hello,

“Merge with registry” was not available on my rightclick

Apologies. The instructions should only state "Merge".
Lets double-check the keys were removed.

Please rerun SystemLook with the same script, and post the log in your next reply.

How about the reg-defrag?

Ultimately, it's your decision.
But like I said - any software that purports to optimization by automatically removing items from the registry should be avoided in my opinion. Microsoft have stated this themselves.

* I've started using Clonezilla for imaging my 2 dual-boot HDDs and system-incremental backups. Good idea?

Sounds good to me. Clonezilla is a reputable programme.

Also, any cool scripts you have for maintainence would be great!

Practicing safe hex to keep the computer malware free (including keeping vulnerable Internet-facing software updated), regularly cleaning dust collected inside the machine and clearing out temp files is all I do to keep my computers well maintained. If a disc defrag is necessary, this will also be performed.

ANd I noticed in red above that it sees my guest account. What's up with that?

Yes, this is disabled. See your Addition.txt:
Guest (S-1-5-21-2552641736-1398428658-1438833275-501 - Limited - Disabled)

Lets run through a few general scans for adware and malware.

STEP 1
AdwCleaner

Please download AdwCleaner and save the file to your Desktop.
Right-Click AdwCleaner.exe and select Run as administrator to run the programme.
Follow the prompts.
Click Scan.
Upon completion, click Report. A log (AdwCleaner[R0].txt) will open. Briefly check the log for anything you know to be legitimate.
Ensure anything you know to be legitimate does not have a checkmark, and click Clean.
Follow the prompts and allow your computer to reboot.
After rebooting, a log (AdwCleaner[s0].txt) will open. Copy the contents of the log and paste in your next reply.

-- File and folder backups are made for anything removed using this tool. Should a legitimate file or folder be removed (otherwise known as a 'false-positive'), simple steps can be taken to restore the entry. Please do not overly concern yourself with the contents of AdwCleaner[R0].txt.

STEP 2
Malwarebytes Anti-Malware (MBAM)

Open Malwarebytes Anti-Malware and click Update Now.
Once updated, click the Settings tab, followed by Detection and Protection and tick Scan for rootkits.
Click the Scan tab, ensure Threat Scan is checked and click Scan Now.
Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards.
If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
Upon completion of the scan (or after the reboot), click the History tab.
Click Application Logs and double-click the Scan Log.
Click Copy to Clipboard and paste the log in your next reply.

STEP 3
RogueKiller

Please download RogueKiller (x64) and save the file to your Desktop.
Close any running programmes.
Right-Click RogueKiller.exe and select Run as administrator to run the programme.
Allow the Prescan to complete. Upon completion, a window will open. Click Accept.
A browser window may open. Close the browser window.
Click . Upon completion, click .
Close the programme. Do not fix anything!
A log (RKreport.txt) will be open. Copy the contents of the log and paste in your next reply.

STEP 4
ESET Online Scan
Note: This scan may take a long time to complete. Please do not browse the Internet whilst your Anti-Virus is disabled.

Please download ESET Online Scan and save the file to your Desktop.
Temporarily disable your anti-virus software. For instructions, please refer to the following link.
Double-click esetsmartinstaller_enu.exe to run the programme.
Agree to the EULA by placing a checkmark next to Yes, I accept the Terms of Use. Then click Start.
Agree to the Terms of Use once more and click Start. Allow components to download.
Place a checkmark next to Enable detection of potentially unwanted applications.
Click Hide advanced settings. Place a checkmark next to:
- Scan archives
- Scan for potentially unsafe applications
- Enable Anti-Stealth technology
Ensure Remove found threats is unchecked.
Click Start.
Wait for the scan to finish. Please be patient as this can take some time.
Upon completion, click . If no threats were found, skip the next two bullet points.
Click Export to text file... and save the file to your Desktop, naming it something such as "MyEsetScan".
Push the Back button.
Place a checkmark next to and click Finish.
Re-enable your anti-virus software.
Copy the contents of the log and paste in your next reply.

======================================================

STEP 5
Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

SystemLook.txt
AdwCleaner[s0].txt
MBAM Scan log
RKreport.txt
ESET Online Scan log

garyt53 · December 23, 2014

Hi Adam –

Funny, didn’t get a notification last time but did this time. Like I said…..magic Man. haha

And your misspelling of maintenance as maintainence is funny cause that’s one of the veryfew words I misspell, and I do it just like that. I don’t use spellcheck either. And you spell program like a Brit. Then you know this planet would be a utopia if not for that 1 sq mi called The City of London central banksters. We are in a dwindling minority because of how stupid they are trying to make us……to eliminate our innate capability for critical thinking cause it interferes with their fraud. OutcomeBased/CommonCore. Pleeeeease. Off subject….

Reran SysLook and looks (to me) like it quarantined the wondershare crap (attached logfile). Ya taught me how to use it this time! ha I don’t like indexing so this little utility will be useful. Think I’ll keep AdwareCleaner too, comparing future scans to screenshots of what was checked this time and unchecking accordingly. But the other utilities are over my head. I know…..path of least resistance. My only excuse is I’m oldalready. ha

Safe-hex? I What’s that? And thanks for reminding me to de-dust. Last time I had to reseat the CPU and GPU and bent and had to straighten pins on the former so have subconsciously neglected this issue. Whaddabitch. Now THAT was scary. Haha Used ArcticSilver paste though so won’t have to do that again.

Funny getting utilities from BleepingComputer. I was going to BleepingComputer with I chose your crew instead.

And should I continue using mbam AntiRootkit beta? I don’t like using “beta” stuff, but it is mbam. Boy the new mbam sure has a lotta options now. Getting scary out there, huh. Well, don’t be afraid cause that’s where they want cha…..GET MAD! (the gulf, fukushima, ebola, bailouts, bailins, the fed reserve scam, WWII….all the lies) Off topic again….It’s just that everything else pales in comparison. Like Congress just made us responsible for the over $2 quadrillion in mostly GoldmanSucks global “derivatives” fraud!

Man, I sure like the progress bar on the new mbam. Like Unix. If they could all be so accurate…..

Disabled NIS AV (not firewall) only for ESET scan but not before, as instructed.

RE eset: Didn’t “browse the web” but rather than stop the utility I ran vlc for 20min on a network stream about the financial collapse after an hour stuck on 3% if that’s an issue. BRICS is online in a few days and their aim is to kill the ponzipetrodollar. We’re in financial WWIII having made the whole world hate us now and the banksters want it to go hot cause they’re about to get caught like in Iceland. They’ve started all the wars unnecessarily on lies and for their compound-interest profit ya know. Bandwidth didn’t seem to be an issue though. Ran online scanners before…..like Kaspersky. But this one’s a pretty fine toothed comb. Stuck at 3% for like over an hour. Hope it’s not rife with false positives to evaluate. It found 18 in the first few minutes. Well, been another hour at 4% now and at this rate it will take months to run. Included the logfile of the 19 threats it found after 2hrs and only reaching 4%, Will rerun after your inspection of the log if necessary. Maybe you should suggest people run this tool overnight.

gt

Oh yeah....dumped regdefrag utility just now.

FIRST AdwCleaner[RO]

# AdwCleaner v4.106 - Report created 22/12/2014 at 13:43:55
# Updated 21/12/2014 by Xplode
# Database : 2014-12-21.4 [Live]
# Operating System : Windows 7 Professional Service Pack 1 (64 bits)
# Username : garytindall - GTLLC
# Running from : C:\Users\garytindall\Desktop\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

File Found : C:\Users\Gary Tindall\AppData\Roaming\Mozilla\Firefox\Profiles\0x9s7ch0.default\searchplugins\safesearch.xml
File Found : C:\Users\Gary Tindall\AppData\Roaming\Mozilla\Firefox\Profiles\6ss1mrq2.default\searchplugins\safesearch.xml
File Found : C:\Users\Visitorer\AppData\Roaming\Mozilla\Firefox\Profiles\dym9vw5s.default\searchplugins\safesearch.xml
Folder Found : C:\Program Files (x86)\Crawler
Folder Found : C:\ProgramData\~0
Folder Found : C:\ProgramData\Premium
Folder Found : C:\ProgramData\SoftSafe
Folder Found : C:\ProgramData\VideoConverter
Folder Found : C:\Users\Gary Tindall\AppData\Local\PackageAware
Folder Found : C:\Users\Gary Tindall\AppData\Local\Video Converter
Folder Found : C:\Users\garytindall\AppData\Local\PackageAware
Folder Found : C:\Users\garytindall\AppData\Local\Video Converter
Folder Found : C:\Users\garytindall\AppData\Roaming\Search Protection

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Found : HKCU\Software\CToolbar
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
Key Found : HKCU\Software\smarttweak
Key Found : HKCU\Software\YahooPartnerToolbar
Key Found : [x64] HKCU\Software\CToolbar
Key Found : [x64] HKCU\Software\smarttweak
Key Found : [x64] HKCU\Software\YahooPartnerToolbar
Key Found : HKLM\SOFTWARE\Classes\CLSID\{183643C8-EE67-4574-9A38-927852E34163}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{54ECA872-DB2A-4C6B-BBB2-F3777C6786CC}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{8736C681-37A0-40C6-A0F0-4C083409151C}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{DB35C569-5624-4CFC-8043-E5139F55A073}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Classes\CShared.TB4Client
Key Found : HKLM\SOFTWARE\Classes\CShared.TB4Script
Key Found : HKLM\SOFTWARE\Classes\CShared.TB4Server
Key Found : HKLM\SOFTWARE\Classes\CShared.TB4Server2
Key Found : HKLM\SOFTWARE\Classes\Interface\{01C78433-6FDF-4E5A-A82D-B535C32E03DF}
Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : HKLM\SOFTWARE\Classes\Interface\{41349826-5C7F-4BF0-8279-5DAF1DE6E9AE}
Key Found : HKLM\SOFTWARE\Classes\Interface\{604EA016-1EDE-41E6-A23E-76CF8F2A4808}
Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{B3BA5582-79A9-464D-A7FA-711C5888C6E9}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E9BBD270-4B87-4EE2-912F-6635674986C0}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{506F578A-91E1-46CE-830F-E2F4268E9966}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Found : HKLM\SOFTWARE\Conduit
Key Found : HKLM\SOFTWARE\CToolbar
Key Found : HKLM\SOFTWARE\Uniblue
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{01C78433-6FDF-4E5A-A82D-B535C32E03DF}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{41349826-5C7F-4BF0-8279-5DAF1DE6E9AE}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{604EA016-1EDE-41E6-A23E-76CF8F2A4808}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{B3BA5582-79A9-464D-A7FA-711C5888C6E9}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{E9BBD270-4B87-4EE2-912F-6635674986C0}
Value Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [updateMyDrivers]

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17496

-\\ Mozilla Firefox v34.0.5 (x86 en-US)

[0x9s7ch0.default] - Line Found : user_pref("extensions.mediaplayerconnectivity.activityViewPoint", false);
[0x9s7ch0.default] - Line Found : user_pref("extensions.mediaplayerconnectivity.enableAutoplayViewPoint", false);
[0x9s7ch0.default] - Line Found : user_pref("extensions.mediaplayerconnectivity.enableContextMenuViewPoint", true);
[0x9s7ch0.default] - Line Found : user_pref("extensions.mediaplayerconnectivity.enableEmbedViewPoint", true);
[0x9s7ch0.default] - Line Found : user_pref("extensions.mediaplayerconnectivity.enableFileViewPoint", true);
[0x9s7ch0.default] - Line Found : user_pref("extensions.mediaplayerconnectivity.playerparamsviewpoint", "%f");
[0x9s7ch0.default] - Line Found : user_pref("extensions.mediaplayerconnectivity.playerviewpoint", "");

*************************

AdwCleaner[R0].txt - [5074 octets] - [22/12/2014 13:43:55]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [5134 octets] ##########

SECOND of 2 AdwCleaner[sO]

# AdwCleaner v4.106 - Report created 22/12/2014 at 14:03:06
# Updated 21/12/2014 by Xplode
# Database : 2014-12-21.4 [Live]
# Operating System : Windows 7 Professional Service Pack 1 (64 bits)
# Username : garytindall - GTLLC
# Running from : C:\Users\garytindall\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\~0
Folder Deleted : C:\ProgramData\Premium
Folder Deleted : C:\ProgramData\SoftSafe
Folder Deleted : C:\ProgramData\VideoConverter
Folder Deleted : C:\Program Files (x86)\Crawler
Folder Deleted : C:\Users\Gary Tindall\AppData\Local\PackageAware
Folder Deleted : C:\Users\Gary Tindall\AppData\Local\Video Converter
Folder Deleted : C:\Users\garytindall\AppData\Local\PackageAware
Folder Deleted : C:\Users\garytindall\AppData\Local\Video Converter
Folder Deleted : C:\Users\garytindall\AppData\Roaming\Search Protection
File Deleted : C:\Users\Gary Tindall\AppData\Roaming\Mozilla\Firefox\Profiles\0x9s7ch0.default\searchplugins\safesearch.xml
File Deleted : C:\Users\Gary Tindall\AppData\Roaming\Mozilla\Firefox\Profiles\6ss1mrq2.default\searchplugins\safesearch.xml
File Deleted : C:\Users\Visitorer\AppData\Roaming\Mozilla\Firefox\Profiles\dym9vw5s.default\searchplugins\safesearch.xml

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [updateMyDrivers]
Key Deleted : HKLM\SOFTWARE\Classes\CShared.TB4Client
Key Deleted : HKLM\SOFTWARE\Classes\CShared.TB4Script
Key Deleted : HKLM\SOFTWARE\Classes\CShared.TB4Server
Key Deleted : HKLM\SOFTWARE\Classes\CShared.TB4Server2
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{183643C8-EE67-4574-9A38-927852E34163}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{54ECA872-DB2A-4C6B-BBB2-F3777C6786CC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{8736C681-37A0-40C6-A0F0-4C083409151C}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DB35C569-5624-4CFC-8043-E5139F55A073}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{01C78433-6FDF-4E5A-A82D-B535C32E03DF}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{41349826-5C7F-4BF0-8279-5DAF1DE6E9AE}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{604EA016-1EDE-41E6-A23E-76CF8F2A4808}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B3BA5582-79A9-464D-A7FA-711C5888C6E9}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E9BBD270-4B87-4EE2-912F-6635674986C0}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{506F578A-91E1-46CE-830F-E2F4268E9966}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{01C78433-6FDF-4E5A-A82D-B535C32E03DF}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{41349826-5C7F-4BF0-8279-5DAF1DE6E9AE}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{604EA016-1EDE-41E6-A23E-76CF8F2A4808}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{B3BA5582-79A9-464D-A7FA-711C5888C6E9}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{E9BBD270-4B87-4EE2-912F-6635674986C0}
Key Deleted : HKCU\Software\CToolbar
Key Deleted : HKCU\Software\smarttweak
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\CToolbar
Key Deleted : HKLM\SOFTWARE\Uniblue

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17496

-\\ Mozilla Firefox v34.0.5 (x86 en-US)

[0x9s7ch0.default\prefs.js] - Line Deleted : user_pref("extensions.mediaplayerconnectivity.activityViewPoint", false);
[0x9s7ch0.default\prefs.js] - Line Deleted : user_pref("extensions.mediaplayerconnectivity.enableAutoplayViewPoint", false);
[0x9s7ch0.default\prefs.js] - Line Deleted : user_pref("extensions.mediaplayerconnectivity.enableContextMenuViewPoint", true);
[0x9s7ch0.default\prefs.js] - Line Deleted : user_pref("extensions.mediaplayerconnectivity.enableEmbedViewPoint", true);
[0x9s7ch0.default\prefs.js] - Line Deleted : user_pref("extensions.mediaplayerconnectivity.enableFileViewPoint", true);
[0x9s7ch0.default\prefs.js] - Line Deleted : user_pref("extensions.mediaplayerconnectivity.playerparamsviewpoint", "%f");
[0x9s7ch0.default\prefs.js] - Line Deleted : user_pref("extensions.mediaplayerconnectivity.playerviewpoint", "");

*************************

AdwCleaner[R0].txt - [5262 octets] - [22/12/2014 13:43:55]
AdwCleaner[R1].txt - [5322 octets] - [22/12/2014 13:58:02]
AdwCleaner[s0].txt - [5243 octets] - [22/12/2014 14:03:06]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [5303 octets] ##########

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 12/22/2014
Scan Time: 2:12:55 PM
Logfile: mbamPASTE.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2014.12.22.09
Rootkit Database: v2014.12.14.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: garytindall

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 562807
Time Elapsed: 26 min, 20 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Warn
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

RogueKiller V10.1.0.0 (x64) [Dec 11 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : garytindall [Administrator]
Mode : Scan -- Date : 12/22/2014 14:54:00

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 23 ¤¤¤
[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Microsoft\Internet Explorer\Main | Start Page : www.google.com -> Found
[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Microsoft\Internet Explorer\Main | Start Page : www.google.com -> Found
[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Found
[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Found
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Found
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyMusic : 0 -> Found
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyPics : 0 -> Found
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_TrackProgs : 0 -> Found
[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowSetProgramAccessAndDefaults : 0 -> Found
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Found
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyMusic : 0 -> Found
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyPics : 0 -> Found
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_TrackProgs : 0 -> Found
[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowSetProgramAccessAndDefaults : 0 -> Found
[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found
[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found
[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found
[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found
[suspicious.Path] (X64) HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Control Panel\Desktop | SCRNSAVE.EXE : C:\Windows\MATRIX~1.SCR -> Found

¤¤¤ Tasks : 1 ¤¤¤
[suspicious.Path] \\{A5192E77-5AF0-4288-A007-6D16F86CB347} -- C:\Users\garytindall\Desktop\Guru3D.com\Setup\RivaTuner224MSIMOA2009Edition.exe -> Found

¤¤¤ Files : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

¤¤¤ Web browsers : 1 ¤¤¤
[PUM.HomePage][FIREFX:Config] wqucbu05.default : user_pref("browser.startup.homepage", "https://us-mg4.mail.yahoo.com/neo/launch?.rand=a9omccd1ji3hu#3761198123");-> Found

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: WDC WD64 00AAKS-65A7B SCSI Disk Device +++++
--- User ---
[MBR] d982adb044679a8f49b91f336a26f3fb
[bSP] fa94f06cff4543441f39121145c1860a : Linux MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB
1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 428772 MB
2 - [XXXXXX] LINUX (0x83) [VISIBLE] Offset (sectors): 878331904 | Size: 173427 MB
3 - [XXXXXX] LINUX-SWP (0x82) [VISIBLE] Offset (sectors): 1233510400 | Size: 8180 MB
User = LL1 ... OK
Error reading LL2 MBR! ([1] Incorrect function. )

+++++ PhysicalDrive1: Hitachi HDS721010CLA SCSI Disk Device +++++
--- User ---
[MBR] 4fcd9905132913cd6df784ebf684f53d
[bSP] baacab66f5d9585c880b617c6977da25 : Linux MBR Code
Partition table:
0 - [XXXXXX] LINUX-SWP (0x42) [VISIBLE] Offset (sectors): 63 | Size: 0 MB
1 - [ACTIVE] LINUX-SWP (0x42) [VISIBLE] Offset (sectors): 2048 | Size: 60307 MB
2 - [XXXXXX] LINUX-SWP (0x42) [VISIBLE] Offset (sectors): 123510784 | Size: 893560 MB
User = LL1 ... OK
Error reading LL2 MBR! ([1] Incorrect function. )

+++++ PhysicalDrive2: Generic- Compact Flash USB Device +++++
Error reading User MBR! ([15] The device is not ready. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] The request is not supported. )

+++++ PhysicalDrive3: Generic- SM/xD-Picture USB Device +++++
Error reading User MBR! ([15] The device is not ready. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] The request is not supported. )

+++++ PhysicalDrive4: Generic- SD/MMC USB Device +++++
Error reading User MBR! ([15] The device is not ready. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] The request is not supported. )

+++++ PhysicalDrive5: Generic- MS/MS-Pro USB Device +++++
Error reading User MBR! ([15] The device is not ready. )
Error reading LL1 MBR! NOT VALID!
Error reading LL2 MBR! ([32] The request is not supported. )

============================================
RKreport_SCN_12122014_153345.log - RKreport_SCN_12222014_144938.log

C:\Documents and Settings\All Users\InstallMate\{100E0CB3-4BD1-4966-AB8D-03F3CBED2E45}\Custom.dll   a variant of Win32/InstalleRex.T potentially unwanted application
C:\Documents and Settings\All Users\InstallMate\{17EB0527-1877-44BE-A655-5055CC0827D1}\Custom.dll   Win32/InstalleRex.T potentially unwanted application
C:\Documents and Settings\All Users\InstallMate\{38F866E2-8C55-4C8E-AE65-C477E31B4414}\Custom.dll   a variant of Win32/InstalleRex.T potentially unwanted application
C:\Documents and Settings\All Users\InstallMate\{536D27E9-7C69-4124-A3CF-344B888E051F}\Custom.dll   a variant of Win32/InstalleRex.T potentially unwanted application
C:\Documents and Settings\All Users\InstallMate\{5FB9CA2C-AB4F-4C51-AEBA-E36D845AE8DA}\Custom.dll   a variant of Win32/InstalleRex.T potentially unwanted application
C:\Documents and Settings\All Users\InstallMate\{6A83E855-02CA-4DA0-AF4B-4AE8B160CAA3}\Custom.dll   a variant of Win32/InstalleRex.T potentially unwanted application
C:\Documents and Settings\All Users\InstallMate\{70BC4F2E-1A55-48B3-AA58-5277AB5F6DD8}\Custom.dll   Win32/InstalleRex.T potentially unwanted application
C:\Documents and Settings\All Users\InstallMate\{7164A1CA-F979-3562-D789-B15BAA87833C}\_Setupx.dll   Win32/InstalleRex.T potentially unwanted application
C:\Documents and Settings\All Users\InstallMate\{72E896BB-1CC4-4B69-A982-54E6A90BB44D}\Custom.dll   a variant of Win32/InstalleRex.T potentially unwanted application
C:\Documents and Settings\All Users\InstallMate\{7E422431-3549-4AA8-A843-7D6BA5A106C7}\Custom.dll   a variant of Win32/InstalleRex.T potentially unwanted application
C:\Documents and Settings\All Users\InstallMate\{80881B22-0F1B-459B-A770-47395B6B39D4}\Custom.dll   Win32/InstalleRex.T potentially unwanted application
C:\Documents and Settings\All Users\InstallMate\{866743FB-8862-4FCD-AD26-C0405D84610D}\Custom.dll   Win32/InstalleRex.T potentially unwanted application
C:\Documents and Settings\All Users\InstallMate\{A9AF1A12-AB80-461B-A4F0-E3A2724C38E4}\Custom.dll   a variant of Win32/InstalleRex.T potentially unwanted application
C:\Documents and Settings\All Users\InstallMate\{C0EC6F14-DFF5-4302-A1E9-97D71B0F4DE2}\Custom.dll   a variant of Win32/InstalleRex.T potentially unwanted application
C:\Documents and Settings\All Users\InstallMate\{F127D05F-8494-4807-AAEC-CCB62AC4F2A9}\Custom.dll   a variant of Win32/InstalleRex.T potentially unwanted application
C:\Documents and Settings\All Users\InstallMate\{F9CA3017-71B2-4EFE-AC15-3990222912E1}\Custom.dll   a variant of Win32/InstalleRex.T potentially unwanted application
C:\Documents and Settings\Gary Tindall\Documents\SystemStuff\CoolComputerStuff\disk-defrag-setup.exe   a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application
C:\Documents and Settings\Gary Tindall\Downloads\NewUtilitiesToShareAcrossMachines\DuplicateCleaner_setup.exe   a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application
C:\Documents and Settings\garytindall\Documents\SystemStuff\SystemImages\Themes\first2\Carbon_Fiber\Extras\VistaGlazzSetup.exe   Win32/OpenCandy potentially unsafe application

garyt53 · December 23, 2014

Hey Adam....

What's with all the master boot record errors? Just an aritfact of dual-booting linux?

gt

LiquidTension · December 23, 2014

Hello,

Reran SysLook and looks (to me) like it quarantined the wondershare crap (attached logfile).

It doesn't look as if the SystemLook log attached.
Also bear in mind that the programme is a diagnostic tool - running the FRST script from earlier is what removed the folders associated with Wondershare.

Safe-hex? I What’s that?

Safe hex refers to the practice of safe Internet usage and surfing habits.

Refrain from aimlessly clicking links, opening unknown Email attachments, etc.

And should I continue using mbam AntiRootkit beta?

MBAR is a specalised ARK (Anti-Rootkit) programme; not intended for everyday use. Running the programme on a machine you believe to be clean is unnecessary. Furthermore, MBAM comes equipped with its own ARK module.

Hope it’s not rife with false positives to evaluate.

ESET is the most thorough and comprehensive online scan available to use. This also makes the programme prone to false-positives (like every programme). ESET is perhaps more prone than most; but there is no substitute for thoroughness. Having the option to remove found threats unchecked allows the items flagged to be evaluated before removal. Any false-positives here will be identified.

I recommend rerunning ESET and allowing the scan to complete. If the duration of the scan is too long, I can provide instructions for an alternative scan.

Maybe you should suggest people run this tool overnight.

Good point, thank you.

What's with all the master boot record errors? Just an aritfact of dual-booting linux?

At times, RogueKiller will encounter Low Level reading errors. Perhaps this is due to the presence of Linux.
There's no cause for concern here.

The other reading errors are due to the nature of the devices attached.

-------------------

Do you recognise these files?

[suspicious.Path] (X64) HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Control Panel\Desktop | SCRNSAVE.EXE : C:\Windows\MATRIX~1.SCR -> Found
[suspicious.Path] \\{A5192E77-5AF0-4288-A007-6D16F86CB347} -- C:\Users\garytindall\Desktop\Guru3D.com\Setup\RivaTuner224MSIMOA2009Edition.exe -> Found

Please attach the latest SystemLook log in your next reply, and let me know the situation in regards to ESET.
We can address the items detected once the scan is complete, or I can provide an alternative scan.

garyt53 · December 23, 2014

Hi Adam –

Tossed mbar beta as per your advice.

Regarding the two questionable files you asked about at the end of your post, the MATRIX path is my screensaver and it’s OK albeit dated. The second path RivaTuner is left over from a utility I used to use to better control a higher end NVIDIA GPU I once needed when I still had clients. Matrix? Keep. RivaTuner? Toss. The latter has remnants “Guru3D” that I have seen in past logs.

Here’s the old SystemLook log that didn’t make it to you…..somehow: ha

SystemLook 30.07.11 by jpshortstuff

Log created at 13:36 on 22/12/2014 by garytindall

Administrator - Elevation successful

========== filefind ==========

Searching for "*Wondershare*"

C:\Documents and Settings\garytindall\AppData\Roaming\Microsoft\Office\Recent\wondershare issue.doc.LNK --a---- 732 bytes [22:21 12/12/2014] [10:11 21/12/2014] CBF58BE346F0E97CE7675CE239555CB7

C:\Documents and Settings\garytindall\Desktop\wondershare issue.doc --a---- 35840 bytes [22:21 12/12/2014] [03:16 15/12/2014] BA541DF1033C06B9B2687478FAC3281E

C:\Users\garytindall\AppData\Roaming\Microsoft\Office\Recent\wondershare issue.doc.LNK --a---- 732 bytes [22:21 12/12/2014] [10:11 21/12/2014] CBF58BE346F0E97CE7675CE239555CB7

C:\Users\garytindall\Desktop\wondershare issue.doc --a---- 35840 bytes [22:21 12/12/2014] [03:16 15/12/2014] BA541DF1033C06B9B2687478FAC3281E

========== folderfind ==========

Searching for "*Wondershare*"

C:\FRST\Quarantine\C\Documents and Settings\All Users\Wondershare Video Converter Ultimate d------ [13:12 01/08/2013]

C:\FRST\Quarantine\C\Documents and Settings\garytindall\AppData\Local\Wondershare d------ [13:13 01/08/2013]

C:\FRST\Quarantine\C\Documents and Settings\Public\Documents\Wondershare d------ [13:06 01/08/2013]

C:\FRST\Quarantine\C\Program Files\Common Files\Wondershare d------ [13:13 01/08/2013]

C:\FRST\Quarantine\C\Program Files\Common Files\Wondershare\Wondershare Helper Compact d------ [13:13 01/08/2013]

========== regfind ==========

Searching for "Wondershare"

[HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\Open Find\Microsoft Office Word\Settings\Save As\File Name MRU]

"Value"="inst SymantecNISRejectedFRST64 instructions instructions2 BootRepair-GRUB wondershare issue"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List]

"File3"="C:\Users\garytindall\Desktop\WondershareIssueInfo.txt"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List]

"File4"="C:\Users\garytindall\Desktop\WondershareIssueInfo.rtf"

[HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Microsoft\Office\11.0\Common\Open Find\Microsoft Office Word\Settings\Save As\File Name MRU]

"Value"="inst SymantecNISRejectedFRST64 instructions instructions2 BootRepair-GRUB wondershare issue"

[HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List]

"File3"="C:\Users\garytindall\Desktop\WondershareIssueInfo.txt"

[HKEY_USERS\S-1-5-21-2552641736-1398428658-1438833275-500\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List]

"File4"="C:\Users\garytindall\Desktop\WondershareIssueInfo.rtf"

-= EOF =-

Will run the online scanner overnight and repost as per previous instruction.

gt

Oh yeah, odd that I didn't get notification again this time. No big deal but if happening elsewhere could be an issue for webmaster. And thanks for calming me down about the MBR issues. Just went thru a bunch of testdisk repair of overlapping partitions and GRUB bootloader repairs that were a result of win7 updates. I think Gates (it's obvious he's given marketing control, as most corps have now) is at war with open source. ha

LiquidTension · December 23, 2014

Hi Gary,

Thanks for the log; looks OK.

Will run the online scanner overnight and repost as per previous instruction.

Sounds good. I'll look out for your log shortly.

garyt53 · December 23, 2014

I like little posts. Don't you?

Hi Adam –

Scan ran over 6hrs and had left my system boot HDD containing both OS for my 2^nd of 2 HDD (G: in the log) that, depending on the characteristics of the variants found on C:, I see no need to scan.

My question is had the program completed it’s scan of C: before it started scanning G:? If not, should I reconfigure the scanner to not scan the secondary HDD? Or even disconnect it for the scan? Or, hopefully, do I even need to repeat the scan reconfigured? I suspect the types of genuine infections found on C: and their characteristics would determine that. But from what we’ve found so far, I suspect they are all false positives.

The 1TB secondary HDD had been automatically switched to dynamic by win7 against my wishes. Something I need to fix later. There’s mostly a bunch of backups on there that can now be tossed but a lot of stuff I need to move before reverting from dynamic disk or reconstructing partitions. If necessary I will disconnect the secondary and treat it like ebola. But I doubt any infection I may have would require that.

Your thoughts…..no matter how much it hurts? ha

gt

C:\Documents and Settings\All Users\InstallMate\{100E0CB3-4BD1-4966-AB8D-03F3CBED2E45}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Documents and Settings\All Users\InstallMate\{17EB0527-1877-44BE-A655-5055CC0827D1}\Custom.dll Win32/InstalleRex.T potentially unwanted application

C:\Documents and Settings\All Users\InstallMate\{38F866E2-8C55-4C8E-AE65-C477E31B4414}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Documents and Settings\All Users\InstallMate\{536D27E9-7C69-4124-A3CF-344B888E051F}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Documents and Settings\All Users\InstallMate\{5FB9CA2C-AB4F-4C51-AEBA-E36D845AE8DA}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Documents and Settings\All Users\InstallMate\{6A83E855-02CA-4DA0-AF4B-4AE8B160CAA3}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Documents and Settings\All Users\InstallMate\{70BC4F2E-1A55-48B3-AA58-5277AB5F6DD8}\Custom.dll Win32/InstalleRex.T potentially unwanted application

C:\Documents and Settings\All Users\InstallMate\{7164A1CA-F979-3562-D789-B15BAA87833C}\_Setupx.dll Win32/InstalleRex.T potentially unwanted application

C:\Documents and Settings\All Users\InstallMate\{72E896BB-1CC4-4B69-A982-54E6A90BB44D}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Documents and Settings\All Users\InstallMate\{7E422431-3549-4AA8-A843-7D6BA5A106C7}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Documents and Settings\All Users\InstallMate\{80881B22-0F1B-459B-A770-47395B6B39D4}\Custom.dll Win32/InstalleRex.T potentially unwanted application

C:\Documents and Settings\All Users\InstallMate\{866743FB-8862-4FCD-AD26-C0405D84610D}\Custom.dll Win32/InstalleRex.T potentially unwanted application

C:\Documents and Settings\All Users\InstallMate\{A9AF1A12-AB80-461B-A4F0-E3A2724C38E4}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Documents and Settings\All Users\InstallMate\{C0EC6F14-DFF5-4302-A1E9-97D71B0F4DE2}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Documents and Settings\All Users\InstallMate\{F127D05F-8494-4807-AAEC-CCB62AC4F2A9}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Documents and Settings\All Users\InstallMate\{F9CA3017-71B2-4EFE-AC15-3990222912E1}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Documents and Settings\Gary Tindall\Documents\SystemStuff\CoolComputerStuff\disk-defrag-setup.exe a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application

C:\Documents and Settings\Gary Tindall\Downloads\NewUtilitiesToShareAcrossMachines\DuplicateCleaner_setup.exe a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application

C:\Documents and Settings\garytindall\Documents\SystemStuff\SystemImages\Themes\first2\Carbon_Fiber\Extras\VistaGlazzSetup.exe Win32/OpenCandy potentially unsafe application

C:\MGtools\Process.exe Win32/PrcView potentially unsafe application

C:\ProgramData\InstallMate\{100E0CB3-4BD1-4966-AB8D-03F3CBED2E45}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\ProgramData\InstallMate\{17EB0527-1877-44BE-A655-5055CC0827D1}\Custom.dll Win32/InstalleRex.T potentially unwanted application

C:\ProgramData\InstallMate\{38F866E2-8C55-4C8E-AE65-C477E31B4414}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\ProgramData\InstallMate\{536D27E9-7C69-4124-A3CF-344B888E051F}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\ProgramData\InstallMate\{5FB9CA2C-AB4F-4C51-AEBA-E36D845AE8DA}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\ProgramData\InstallMate\{6A83E855-02CA-4DA0-AF4B-4AE8B160CAA3}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\ProgramData\InstallMate\{70BC4F2E-1A55-48B3-AA58-5277AB5F6DD8}\Custom.dll Win32/InstalleRex.T potentially unwanted application

C:\ProgramData\InstallMate\{7164A1CA-F979-3562-D789-B15BAA87833C}\_Setupx.dll Win32/InstalleRex.T potentially unwanted application

C:\ProgramData\InstallMate\{72E896BB-1CC4-4B69-A982-54E6A90BB44D}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\ProgramData\InstallMate\{7E422431-3549-4AA8-A843-7D6BA5A106C7}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\ProgramData\InstallMate\{80881B22-0F1B-459B-A770-47395B6B39D4}\Custom.dll Win32/InstalleRex.T potentially unwanted application

C:\ProgramData\InstallMate\{866743FB-8862-4FCD-AD26-C0405D84610D}\Custom.dll Win32/InstalleRex.T potentially unwanted application

C:\ProgramData\InstallMate\{A9AF1A12-AB80-461B-A4F0-E3A2724C38E4}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\ProgramData\InstallMate\{C0EC6F14-DFF5-4302-A1E9-97D71B0F4DE2}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\ProgramData\InstallMate\{F127D05F-8494-4807-AAEC-CCB62AC4F2A9}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\ProgramData\InstallMate\{F9CA3017-71B2-4EFE-AC15-3990222912E1}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Users\All Users\InstallMate\{100E0CB3-4BD1-4966-AB8D-03F3CBED2E45}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Users\All Users\InstallMate\{17EB0527-1877-44BE-A655-5055CC0827D1}\Custom.dll Win32/InstalleRex.T potentially unwanted application

C:\Users\All Users\InstallMate\{38F866E2-8C55-4C8E-AE65-C477E31B4414}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Users\All Users\InstallMate\{536D27E9-7C69-4124-A3CF-344B888E051F}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Users\All Users\InstallMate\{5FB9CA2C-AB4F-4C51-AEBA-E36D845AE8DA}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Users\All Users\InstallMate\{6A83E855-02CA-4DA0-AF4B-4AE8B160CAA3}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Users\All Users\InstallMate\{70BC4F2E-1A55-48B3-AA58-5277AB5F6DD8}\Custom.dll Win32/InstalleRex.T potentially unwanted application

C:\Users\All Users\InstallMate\{7164A1CA-F979-3562-D789-B15BAA87833C}\_Setupx.dll Win32/InstalleRex.T potentially unwanted application

C:\Users\All Users\InstallMate\{72E896BB-1CC4-4B69-A982-54E6A90BB44D}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Users\All Users\InstallMate\{7E422431-3549-4AA8-A843-7D6BA5A106C7}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Users\All Users\InstallMate\{80881B22-0F1B-459B-A770-47395B6B39D4}\Custom.dll Win32/InstalleRex.T potentially unwanted application

C:\Users\All Users\InstallMate\{866743FB-8862-4FCD-AD26-C0405D84610D}\Custom.dll Win32/InstalleRex.T potentially unwanted application

C:\Users\All Users\InstallMate\{A9AF1A12-AB80-461B-A4F0-E3A2724C38E4}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Users\All Users\InstallMate\{C0EC6F14-DFF5-4302-A1E9-97D71B0F4DE2}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Users\All Users\InstallMate\{F127D05F-8494-4807-AAEC-CCB62AC4F2A9}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Users\All Users\InstallMate\{F9CA3017-71B2-4EFE-AC15-3990222912E1}\Custom.dll a variant of Win32/InstalleRex.T potentially unwanted application

C:\Users\Gary Tindall\Documents\SystemStuff\CoolComputerStuff\disk-defrag-setup.exe a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application

C:\Users\Gary Tindall\Downloads\NewUtilitiesToShareAcrossMachines\DuplicateCleaner_setup.exe a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application

C:\Users\garytindall\Documents\SystemStuff\SystemImages\Themes\first2\Carbon_Fiber\Extras\VistaGlazzSetup.exe Win32/OpenCandy potentially unsafe application

G:\GTLLC\Backup Set 2014-09-21 050342\Backup Files 2014-09-21 050342\Backup files 14.zip a variant of Win32/InstalleRex.T potentially unwanted application

G:\GTLLC\Backup Set 2014-09-21 050342\Backup Files 2014-09-21 050342\Backup files 20.zip a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application

G:\GTLLC\Backup Set 2014-09-21 050342\Backup Files 2014-09-21 050342\Backup files 27.zip a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application

G:\GTLLC\Backup Set 2014-09-21 050342\Backup Files 2014-09-21 050342\Backup files 30.zip Win32/OpenCandy potentially unsafe application

LiquidTension · December 24, 2014

Hello Gary,

Or, hopefully, do I even need to repeat the scan reconfigured?

It's your choice. I can't guarantee the scan won't flag anything residing on other drives. You may wish to scan your other drives to be on the safe side.

But from what we’ve found so far, I suspect they are all false positives.

Not exactly.

Delete these folders:

C:\Documents and Settings\All Users\InstallMateC:\ProgramData\InstallMateC:\Users\All Users\InstallMate

These are installers for software on your computer. They bundle potentially unwanted programmes. There's no harm in deleting or leaving the files; it won't make a difference.

C:\Documents and Settings\Gary Tindall\Documents\SystemStuff\CoolComputerStuff\disk-defrag-setup.exe    a variant of Win32/Bundled.Toolbar.Ask potentially unsafe applicationC:\Documents and Settings\Gary Tindall\Downloads\NewUtilitiesToShareAcrossMachines\DuplicateCleaner_setup.exe          a variant of Win32/Bundled.Toolbar.Ask potentially unsafe applicationC:\Documents and Settings\garytindall\Documents\SystemStuff\SystemImages\Themes\first2\Carbon_Fiber\Extras\VistaGlazzSetup.exe  Win32/OpenCandy potentially unsafe applicationC:\Users\Gary Tindall\Documents\SystemStuff\CoolComputerStuff\disk-defrag-setup.exe    a variant of Win32/Bundled.Toolbar.Ask potentially unsafe applicationC:\Users\Gary Tindall\Downloads\NewUtilitiesToShareAcrossMachines\DuplicateCleaner_setup.exe          a variant of Win32/Bundled.Toolbar.Ask potentially unsafe applicationC:\Users\garytindall\Documents\SystemStuff\SystemImages\Themes\first2\Carbon_Fiber\Extras\VistaGlazzSetup.exe  Win32/OpenCandy potentially unsafe application

MGtools is from MajorGeeks. Security programmes are often flagged as unsafe for a viariety of reasons, including whether files are compressed or packed, what behavior (routines, scripts, etc) it performs, certain registry strings it may contain and the type of security engine that was used during the scan.

C:\MGtools\Process.exe   Win32/PrcView potentially unsafe application

These are backup files. I'll let you decide how you wish to proceed in regards to the files below.

G:\GTLLC\Backup Set 2014-09-21 050342\Backup Files 2014-09-21 050342\Backup files 14.zip       a variant of Win32/InstalleRex.T potentially unwanted applicationG:\GTLLC\Backup Set 2014-09-21 050342\Backup Files 2014-09-21 050342\Backup files 20.zip       a variant of Win32/Bundled.Toolbar.Ask potentially unsafe applicationG:\GTLLC\Backup Set 2014-09-21 050342\Backup Files 2014-09-21 050342\Backup files 27.zip       a variant of Win32/Bundled.Toolbar.Ask potentially unsafe applicationG:\GTLLC\Backup Set 2014-09-21 050342\Backup Files 2014-09-21 050342\Backup files 30.zip       Win32/OpenCandy potentially unsafe application

Please provide an update on your computer. Are there any outstanding issues?

garyt53 · December 24, 2014

HA! What a coincidence.....even though as a conspiracy "theorist" I can't believe in that. ha You shouldn't be working the holiday ya know.

OK…..here’s what I did. I moved the pagefile back to the C: boot drive and set the scanner to only scan C:. It still took over 4hrs to run, but it jumped to 30% in just the first 2 minutes. Strange. And the freakin bar stuck on 94 % for like 2hrs. Somebody outa tell them to just get rid of that poorly developed misleading progress bar.

Will be dumping 300GB of win7 NT backups on the 1TB secondary HDD that probably have the stuff we’re removing in em. Probably will just reformat after removing 300GB of other stuff I want to keep first. Easy, safe and reliable solution to undoing the MS dynamic partitions that were forced upon me huh.

Hey…..Merry Christmas Eve! No…..Happy Christmas and A Way Too Merry New Years!