Infections blocks Malwarebytes program

AlexPoland · February 24, 2015

Hello,

problems started when Windows did not shut down properly.

I tried to start Malwarebytes to check for malware, but the program did not start.

Now the are errors popping up so I guess my computer is infected.

I paste FRST.txt and Addition.txt.

Thanks in advance for any help!

Best

Alex

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-02-2015
Ran by qwerty at 2015-02-24 18:26:53
Running from C:\Users\qwerty\Downloads
Boot Mode: Normal
==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Anti-Virus (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Anti-Virus (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Comodo Defense+ (Disabled - Up to date) {4BDD6856-AF0D-06BD-38AB-8A0FE39860CC}
FW: COMODO Firewall (Enabled) {C8870897-C358-086B-2944-184866CC6D0A}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 13.0.0.111 - Adobe Systems Incorporated)
Adobe Flash Player 11 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 11.8.800.175 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Polish (HKLM-x32\...\{AC76BA86-7AD7-1045-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Brother MFL-Pro Suite DCP-J125 (HKLM-x32\...\{FB83EAC4-E3F6-4666-B45B-44522F2344B6}) (Version: 1.0.3.0 - Brother Industries, Ltd.)
Comodo Dragon (HKLM-x32\...\Comodo Dragon) (Version: 36.1.1.21 - Comodo)
COMODO Firewall (HKLM\...\{7B1A9CD1-B552-4FA7-BBC1-EDDEAB8855A7}) (Version: 8.0.0.4337 - COMODO Security Solutions Inc.)
Dropbox (HKU\S-1-5-21-2854055979-1752971058-360577513-1000\...\Dropbox) (Version: 3.2.6 - Dropbox, Inc.)
DRUKI Gofin 2.2.19.0 (HKLM-x32\...\{852B928B-042E-4555-B59B-3473734906FF}) (Version: 2.2.19.0 - Wydawnictwo Podatkowe GOFIN sp. z o.o.)
e-Deklaracje Desktop (HKLM-x32\...\e-Deklaracje.A1909296681C7ACEFE45687D3A64758C8659BF46.1) (Version: 6.0.1 - Ministerstwo Finansow)
e-Deklaracje Desktop (x32 Version: 6.0.1 - Ministerstwo Finansow) Hidden
GeekBuddy (HKLM\...\{E98902C5-09AF-487A-AFAE-D4C386F506C0}) (Version: 4.18.121 - Comodo Security Solutions Inc)
Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1281 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2932 - Intel Corporation)
Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)
Intel® SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.5.235 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Kaspersky Anti-Virus (HKLM-x32\...\InstallWIX_{6F6873E3-5C92-4049-B511-231A138DD090}) (Version: 14.0.0.4651 - Kaspersky Lab)
Kaspersky Anti-Virus (x32 Version: 14.0.0.4651 - Kaspersky Lab) Hidden
Mała Księgowość Rzeczpospolitej (HKLM-x32\...\Mała Księgowość Rzeczpospolitej) (Version: 23.08 - Usługi Informatyczne Andrzej Ciupiński)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (Polski) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1045) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2013 dla Użytkowników Domowych i Uczniów - pl-pl (HKLM\...\HomeStudentRetail - pl-pl) (Version: 15.0.4675.1003 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-2854055979-1752971058-360577513-1000\...\SkyDriveSetup.exe) (Version: 17.0.2003.1112 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mozilla Firefox 35.0.1 (x86 pl) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 pl)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.1.1 - Mozilla)
Mozilla Thunderbird 31.4.0 (x86 pl) (HKLM-x32\...\Mozilla Thunderbird 31.4.0 (x86 pl)) (Version: 31.4.0 - Mozilla)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
PDF24 Creator 6.0.1 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.61.612.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6657 - Realtek Semiconductor Corp.)
Revo Uninstaller Pro 3.1.1 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.1.1 - VS Revo Group, Ltd.)
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
TP-LINK Wireless Configuration Utility (HKLM-x32\...\{319D91C6-3D44-436C-9F79-36C0D22372DC}) (Version: 1.3.1 - TP-LINK)
Wtyczka e-Deklaracje (HKLM-x32\...\{81BF6353-3C5B-4E6E-A566-7E162A00BF72}_is1) (Version: 4.0.0 - Ministerstwo Finansów)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2854055979-1752971058-360577513-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\qwerty\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2854055979-1752971058-360577513-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\qwerty\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2854055979-1752971058-360577513-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\qwerty\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2854055979-1752971058-360577513-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\qwerty\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2854055979-1752971058-360577513-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\qwerty\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2854055979-1752971058-360577513-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\qwerty\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2854055979-1752971058-360577513-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\qwerty\AppData\Local\Microsoft\SkyDrive\17.0.2003.1112\amd64\FileSyncApi64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2854055979-1752971058-360577513-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\qwerty\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2854055979-1752971058-360577513-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\qwerty\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2854055979-1752971058-360577513-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\qwerty\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2854055979-1752971058-360577513-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\qwerty\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2854055979-1752971058-360577513-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\qwerty\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2854055979-1752971058-360577513-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\qwerty\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2854055979-1752971058-360577513-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\qwerty\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2854055979-1752971058-360577513-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\qwerty\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

==================== Restore Points =========================

14-02-2015 19:35:35 Installed TP-LINK Wireless Configuration Utility
14-02-2015 19:38:12 Removed TP-LINK Wireless Configuration Utility
14-02-2015 19:38:52 Removed TP-LINK Wireless Configuration Utility and Driver
17-02-2015 13:44:42 Windows Update
17-02-2015 13:46:56 Installed TP-LINK Wireless Configuration Utility
22-02-2015 16:10:05 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {09BE1830-36B9-4E8D-8838-253DF3A7A6F4} - System32\Tasks\Microsoft Office 15 Sync Maintenance for qwerty-Komputer-qwerty qwerty-Komputer => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2014-12-30] (Microsoft Corporation)
Task: {141B05E4-A46B-44DA-899B-4CF34EA49D31} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-30] (Adobe Systems Incorporated)
Task: {5DA44F58-EB19-4666-A5ED-6E6D0B771BBD} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-12-30] (Microsoft Corporation)
Task: {60B3F1BF-F4B5-4D4D-93FA-A191445B871C} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {671C4AF0-AEEB-4C90-98E3-827AD571AB53} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2015-02-04] (COMODO)
Task: {A2E61514-4492-4660-A037-EDB59A2BA287} - System32\Tasks\{502FE9E4-1E25-4390-B064-7E63F23406A1} => pcalua.exe -a E:\TL-WN821N_V4.0_TL-WN822N_V3.0_TL-WN823N_V1.0\Setup.exe -d E:\TL-WN821N_V4.0_TL-WN822N_V3.0_TL-WN823N_V1.0
Task: {AC564C0D-6C95-49F1-A075-7E269EB8BA8C} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-02-04] (COMODO)
Task: {C55F22D8-984C-4B88-A584-7815E8975BE1} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-02-04] (COMODO)

==================== Loaded Modules (whitelisted) ==============

2014-03-26 07:17 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2013-10-03 20:22 - 2012-08-03 02:34 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Windows\system32\adtschema.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aeinv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aepdu.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aepic.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\aitstatic.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\appraiser.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\auditpol.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\credssp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\crypt32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\devinv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dxtmsft.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\dxtrans.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\generaltel.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ie4uinit.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ieapfltr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iedkcs32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ieetwcollector.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ieetwcollectorres.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ieetwproxystub.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ieframe.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iernonce.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iertutil.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\iesetup.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ieui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ieUnatt.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\inetcpl.cpl:$CmdTcID
AlternateDataStreams: C:\Windows\system32\invagent.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\JavaScriptCollectionAgent.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\jscript9.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\jscript9diag.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\jsproxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\kerberos.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\lsasrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\lsass.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mf.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MRT.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msaudite.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msfeeds.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mshtml.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MshtmlDac.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mshtmled.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\mshtmlmedia.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msobjs.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msrating.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\MsSpellCheckingFacility.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\msv1_0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ncrypt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\ntoskrnl.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\oleaut32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\perftrack.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\powertracker.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\profsvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\rstrui.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\scesrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\schannel.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\secur32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\srclient.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\srcore.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\sspicli.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\sspisrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\TSpkg.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\tzres.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\urlmon.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\vbscript.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wdi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wdigest.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\win32k.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\WindowsCodecs.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\wininet.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\WSManHTTPConfig.exe:$CmdTcID
AlternateDataStreams: C:\Windows\system32\WSManMigrationPlugin.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\WsmAuto.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\WsmSvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\WsmWmiPl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\adtschema.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\auditpol.exe:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\charmap.exe:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\credssp.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\crypt32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\dxtmsft.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\dxtrans.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\FlashPlayerApp.exe:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\ieapfltr.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\iedkcs32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\ieetwproxystub.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\ieframe.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\iernonce.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\iertutil.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\iesetup.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\ieui.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\ieUnatt.exe:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\inetcpl.cpl:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\java.exe:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\javaw.exe:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\javaws.exe:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\jscript9.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\jscript9diag.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\jsproxy.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\kerberos.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\mf.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\msaudite.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\msfeeds.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\mshtml.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\MshtmlDac.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\mshtmled.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\mshtmlmedia.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\msobjs.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\msrating.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\msv1_0.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\ncrypt.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\ntkrnlpa.exe:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\ntoskrnl.exe:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\oleaut32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\scesrv.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\schannel.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\secur32.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\srclient.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\sspicli.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\TSpkg.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\tzres.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\urlmon.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\vbscript.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\wdi.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\wdigest.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\WindowsCodecs.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\wininet.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\WSManHTTPConfig.exe:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\WSManMigrationPlugin.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\WsmAuto.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\WsmSvc.dll:$CmdTcID
AlternateDataStreams: C:\Windows\SysWOW64\WsmWmiPl.dll:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\cng.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\ksecdd.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\ksecpkg.sys:$CmdTcID
AlternateDataStreams: C:\Windows\system32\Drivers\RTL8192cu.sys:$CmdTcID
AlternateDataStreams: C:\Users\qwerty\Desktop\kalytko_02.docx:$CmdZnID
AlternateDataStreams: C:\Users\qwerty\Desktop\Kateryna Kałytko_01.doc:$CmdTcID
AlternateDataStreams: C:\Users\qwerty\Desktop\Sketch.docx:$CmdTcID
AlternateDataStreams: C:\Users\qwerty\Downloads\FRST64.exe:$CmdTcID
AlternateDataStreams: C:\Users\qwerty\Downloads\FRST64.exe:$CmdZnID
AlternateDataStreams: C:\Users\qwerty\Downloads\Mała Księgowość (MK) 2015.exe:$CmdZnID
AlternateDataStreams: C:\Users\qwerty\Downloads\TFC.exe:$CmdZnID
AlternateDataStreams: C:\Users\qwerty\Downloads\zajawki.rtf:$CmdTcID

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2854055979-1752971058-360577513-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\qwerty\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: Media is not connected to internet.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: GeekBuddyRSP => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TP-LINK Wireless Configuration Utility.lnk => C:\Windows\pss\TP-LINK Wireless Configuration Utility.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^qwerty^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Wysyłanie do programu OneNote.lnk => C:\Windows\pss\Wysyłanie do programu OneNote.lnk.Startup
MSCONFIG\startupreg: BrStsMon00 => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN
MSCONFIG\startupreg: ControlCenter3 => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe /autorun
MSCONFIG\startupreg: tvncontrol => "C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe" -controlservice -slave

==================== Accounts: =============================

Administrator (S-1-5-21-2854055979-1752971058-360577513-500 - Administrator - Disabled)
Gość (S-1-5-21-2854055979-1752971058-360577513-501 - Limited - Disabled)
qwerty (S-1-5-21-2854055979-1752971058-360577513-1000 - Administrator - Enabled) => C:\Users\qwerty

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (02/24/2015 03:46:19 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/24/2015 02:59:56 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/24/2015 02:44:53 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/24/2015 02:33:45 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/24/2015 02:10:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/24/2015 00:24:51 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/24/2015 00:19:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/23/2015 09:06:31 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/23/2015 08:02:44 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/23/2015 05:24:24 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

System errors:
=============
Error: (02/24/2015 03:43:44 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Usługa Windows Update nie została poprawnie zamknięta po odebraniu kodu sterującego przed zamknięciem.

Error: (02/24/2015 02:56:29 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Usługa Windows Update nie została poprawnie zamknięta po odebraniu kodu sterującego przed zamknięciem.

Error: (02/24/2015 02:43:06 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Poprzednie zamknięcie systemu przy 14:41:49 na ‎2015-‎02-‎24 było nieoczekiwane.

Error: (02/24/2015 02:31:57 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Poprzednie zamknięcie systemu przy 14:30:49 na ‎2015-‎02-‎24 było nieoczekiwane.

Error: (02/24/2015 00:38:18 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Usługa Windows Update nie została poprawnie zamknięta po odebraniu kodu sterującego przed zamknięciem.

Error: (02/24/2015 00:22:16 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Usługa Windows Update nie została poprawnie zamknięta po odebraniu kodu sterującego przed zamknięciem.

Error: (02/23/2015 09:46:46 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Usługa Windows Update nie została poprawnie zamknięta po odebraniu kodu sterującego przed zamknięciem.

Error: (02/23/2015 08:34:58 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Usługa Windows Update nie została poprawnie zamknięta po odebraniu kodu sterującego przed zamknięciem.

Error: (02/23/2015 08:00:57 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Poprzednie zamknięcie systemu przy 19:55:14 na ‎2015-‎02-‎23 było nieoczekiwane.

Error: (02/17/2015 03:47:50 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Usługa COMODO Dragon Update Service niespodziewanie zakończyła pracę. Wystąpiło to razy: 1.

Microsoft Office Sessions:
=========================
Error: (02/24/2015 03:46:19 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/24/2015 02:59:56 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/24/2015 02:44:53 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/24/2015 02:33:45 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/24/2015 02:10:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/24/2015 00:24:51 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/24/2015 00:19:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/23/2015 09:06:31 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/23/2015 08:02:44 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/23/2015 05:24:24 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

CodeIntegrity Errors:
===================================
Date: 2014-10-13 14:31:27.763
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-10-13 14:31:27.763
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-10-13 14:31:27.763
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-10-13 14:31:27.748
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-10-13 14:31:27.748
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-10-13 14:31:27.748
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-10-10 20:15:05.346
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-10-10 20:15:05.346
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-10-10 20:15:05.346
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-10-10 20:15:05.331
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Processor: Intel® Core i3-3240 CPU @ 3.40GHz
Percentage of memory in use: 45%
Total physical RAM: 3772.25 MB
Available physical RAM: 2049.79 MB
Total Pagefile: 7542.7 MB
Available Pagefile: 5071.12 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:73.14 GB) (Free:29.81 GB) NTFS
Drive d: () (Fixed) (Total:392.52 GB) (Free:392.42 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: B4986758)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=73.1 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=392.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================

kevinf80 · February 26, 2015

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Download Malwarebytes Anti-Malware to your desktop.

Double-click mbam-setup and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
Launch Malwarebytes Anti-Malware
A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
Click Finish.
On the Dashboard, click the 'Update Now >>' link
After the update completes Select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.
Now select > Scan > Threat scan > Scan now
When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
In most cases, a restart will be required.
Wait for the prompt to restart the computer to appear, then click on Yes.

When the scan is completed from the main GUI click on History > Application Logs. Find your scan log, the date when run will identify it. Checkmark "select" box > then hit the "view" button. The history log window will open. At the bottom of that window are two options, "Copy to clipboard" and "Export"

Select > "Copy to clipboard" that copies the full log to the windows clipboard, so at your reply you right click into the text field and select "Paste" the log is pasted (copied) to your reply.

Next,

Download AdwCleaner by Xplode onto your Desktop.

Double click on Adwcleaner.exe to run the tool.
Click on Scan
Once the scan is done, click on the Clean button.
You will get a prompt asking to close all programs. Click OK.
Click OK again to reboot your computer.
A text file will open after the restart. Please post the content of that logfile in your reply.
You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number

Next,

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts. (re-enable when done)
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Next,

Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/

Quit all running programs.
For Windows XP, double-click to start.
For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
Read and accept the EULA (End User Licene Agreement)
Click Scan to scan the system.
When the scan completes select "Report", log will open. Close the program > Don't Fix anything!
Post back the report which should also be located here:

C:\Programdata\RogueKiller\Logs <-------- W7/8

C:\Documents and Settings\All Users\Application Data\RogueKiller\Logs <------XP

Let me see those logs in your next reply, also give an update on any remaining issues or concerns...

Thanks,

Kevin....

Fixlist.txt

AlexPoland · February 27, 2015

Hi Kevin,

thanks for your advice!

After running FRST, MBAM worked properly, but it didnt find infections.

The same ist true for AdwCleaner.

But JRT and RogueKiller didnt work, JRT: Access denied,

RogueKiller: just didnt start.

Now the problem seemed to reappear: MBAM is not running, so I dont know

how to poste the log...

Another remaining problem is that the rebooting doesnt work properly.

I post the remaining logs below...

# AdwCleaner v4.111 - Logfile created 27/02/2015 at 07:46:03
# Updated 18/02/2015 by Xplode
# Database : 2015-02-18.3 [server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : qwerty - QWERTY-KOMPUTER
# Running from : C:\Users\qwerty\Downloads\AdwCleaner.exe
# Option : Cleaning

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Scheduled tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17631

-\\ Mozilla Firefox v35.0.1 (x86 pl)

-\\ Comodo Dragon v36.1.1.21

*************************

AdwCleaner[R0].txt - [793 bytes] - [27/02/2015 07:44:46]
AdwCleaner[s0].txt - [721 bytes] - [27/02/2015 07:46:03]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [779 bytes] ##########

kevinf80 · February 27, 2015

Run the following, see if maybe we have a well hidden infection.....

Please read carefully and follow these steps.

Download TDSSKiller from here http://support.kaspersky.com/downloads/utils/tdsskiller.exe and save it to your Desktop.
Doubleclick on to run the application.
The "Ready to scan" window will open, Click on "Change parameters"
Place a checkmark next to Verify Driver Digital Signature and Detect TDLFS file system, (Leave "Service & Drivers" and "Boot Sectors" ticked. Click OK.
Select "Start Scan"
If an infected file is detected, the default action will be Cure, click on Continue.
If a suspicious file is detected, the default action will be Skip, click on Continue.
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Thanks,

Kevin...

AlexPoland · February 27, 2015

Thanks Kevin,

in the meantime MBMA works again, and I was also able to the start RogueKiller.

I attach the logs from TDSS and others (too long).

RKreport_SCN_02272015_132204.log

MBMA.txt

TDSSKiller.3.0.0.44_27.02.2015_13.27.25_log.txt

kevinf80 · February 27, 2015

Download AVPTool from Here to your desktop.

Run the programme you have just downloaded to your desktop (it will be randomly named)

Click the cog in the upper right corner

Select down to and including your main drive, once done select the Automatic scan tab and press Start Scan

Allow AVP to delete all infections found
Once it has finished select report tab (last tab)
Select Detected threads report from the left and press Save button
Save it to your desktop and post it in your next reply.

Post that log, also give an update on any remaining issues or concerns....

Thanks Kevin...

AlexPoland · February 28, 2015

Hi Kevin,

thanks for your advice.

I launched KVRT, its the 2015 version and looks slightly different.

First it did not work at all, today it scaned and didnt find anything!

As I said its a different version and I dont know how to copy the log...

Remaining issues:

Rebooting is still not working properly as well as shutting down – Windows start the shut down and then stops. I usually reboot manually and afterwards shutting down works.

I also get alerts that Firefox has crashed, although I didnt run it before.

Today I also got a strange „camera“ on my desktop that looks like a program, but I cant close it…

What to do next?

kevinf80 · February 28, 2015

I don`t believe we have a nalware/infection problem, run the following Windows repair tool as listed, it will take a couple of hours to complete:

Download Portable Windows Repair (all in one) from one of the following:

http://www.tweaking.com/content/page/windows_repair_all_in_one.html
http://www.majorgeeks.com/Tweaking.com_-_Windows_Repair_Portable_d7222.html
http://www.bleepingcomputer.com/download/windows-repair-all-in-one-portable/

Unzip the contents into a newly created folder on your desktop.

Open the folder, run the tool by right click on Repair_Windows (icon with red briefcase) select "Run as Administrator"

From the main GUI do the following:

Select Tab 3 and allow it to run Disk check

Select Tab 4 and allow it to run SFC

Select Tab 5 and Create System Restore Point

Select Repairs tab => Click the Open repairs tab

The repairs window will open, Check the boxes as indicated, also the "Restart" option, then select Start...

DON'T use the computer while each scan is in progress.

Post the log, to access select "settings" tab > "open log folder" tab, log will be named _Windows_Repair_Log

Let me see that log, Also attach a screen shot of the camera icon that is on your Desktop.

Thanks,

Kevin....

AlexPoland · March 1, 2015

Hi Kevin,

thanks a lot for your great help!

I ran Windows Repair in Safe mode (before that it stopped after 4 steps) and that worked well.

Can I run Windows Repair from time to time to keep Windows running smothly?

Now it seems that there are no problems anymore! Rebooting and shutting down works normally.

That camera has disapperead as well.

I paste the log below.

Tweaking.com - Windows Repair v2.11.2
--------------------------------------------------------------------------------

System Variables
--------------------------------------------------------------------------------
OS: Windows 7 Home Premium
OS Architecture: 64-bit
OS Version: 6.1.7601
OS Service Pack: Service Pack 1
Computer Name: QWERTY-KOMPUTER
Windows Drive: C:\
Windows Path: C:\Windows
Program Files: C:\Program Files
Program Files (x86): C:\Program Files (x86)
Current Profile: C:\Users\qwerty
Current Profile SID: S-1-5-21-2854055979-1752971058-360577513-1000
Current Profile Classes: S-1-5-21-2854055979-1752971058-360577513-1000_Classes
Profiles Location: C:\Users
Profiles Location 2: C:\Windows\ServiceProfiles
Local Settings AppData: C:\Users\qwerty\AppData\Local
--------------------------------------------------------------------------------

System Information
--------------------------------------------------------------------------------
System Up Time: 0 Days 00:01:28

Process Count: 18
Commit Total: 982,61 MB
Commit Limit: 7,37 GB
Commit Peak: 995,23 MB
Handle Count: 3867
Kernel Total: 230,74 MB
Kernel Paged: 162,40 MB
Kernel Non Paged: 68,34 MB
System Cache: 313,65 MB
Thread Count: 254
--------------------------------------------------------------------------------

Memory Before Cleaning with CleanMem
--------------------------------------------------------------------------------
Memory Total: 3,68 GB
Memory Used: 1 003,30 MB(26,5967%)
Memory Avail.: 2,70 GB
--------------------------------------------------------------------------------

Cleaning Memory Before Starting Repairs...

Memory After Cleaning with CleanMem
--------------------------------------------------------------------------------
Memory Total: 3,68 GB
Memory Used: 933,98 MB(24,7591%)
Memory Avail.: 2,77 GB
--------------------------------------------------------------------------------

Starting Repairs...
   Started at (2015-03-01 17:50:01)

Setting Any Missing 'InstallDate' From Uninstall Sections Before Running Repair...
Total Missing 'InstallDate' Fixed: 0

01 - Reset Registry Permissions 01/03
   HKEY_CURRENT_USER & Sub Keys
   Start (2015-03-01 17:50:02)

   You can tell the repair is working as SetACL_32.exe or SetACL_64.exe will be running.

   Running Repair Under Current User Account
   Done (2015-03-01 17:50:08)

01 - Reset Registry Permissions 02/03
   HKEY_LOCAL_MACHINE & Sub Keys
   Start (2015-03-01 17:50:08)

   You can tell the repair is working as SetACL_32.exe or SetACL_64.exe will be running.

Decompressing & Updating Windows Permission File services.txt
Done, 0,19 seconds.

   Running Repair Under System Account
   Done (2015-03-01 17:52:01)

01 - Reset Registry Permissions 03/03
   HKEY_CLASSES_ROOT & Sub Keys
   Start (2015-03-01 17:52:01)

   You can tell the repair is working as SetACL_32.exe or SetACL_64.exe will be running.

   Running Repair Under System Account
   Done (2015-03-01 17:52:28)

02 - Reset File Permissions: C:
   C: & Sub Folders
   Start (2015-03-01 17:52:28)

   You can tell the repair is working as SetACL_32.exe or SetACL_64.exe will be running.

   Trying To Run Repair As Trusted Installer.
   This Repair Is Hidden By Windows Itself.
   You Can See The Repair Working In The Task Manager.
   Running Repair As Trusted Installer
   Done (2015-03-01 17:57:41)

02 - Reset File Permissions: D:
   D: & Sub Folders
   Start (2015-03-01 17:57:41)

   You can tell the repair is working as SetACL_32.exe or SetACL_64.exe will be running.

   Trying To Run Repair As Trusted Installer.
   This Repair Is Hidden By Windows Itself.
   You Can See The Repair Working In The Task Manager.
   Running Repair As Trusted Installer
   Done (2015-03-01 17:57:42)

02 - Reset File Permissions: All Profiles
   C:\Users & Sub Folders
   Start (2015-03-01 17:57:42)

   You can tell the repair is working as SetACL_32.exe or SetACL_64.exe will be running.

   Running Repair Under System Account
   Done (2015-03-01 17:58:19)

02 - Reset File Permissions: Current Profile
   C:\Users\qwerty & Sub Folders
   Start (2015-03-01 17:58:19)

   You can tell the repair is working as SetACL_32.exe or SetACL_64.exe will be running.

   Running Repair Under System Account
   Done (2015-03-01 17:58:39)

02 - Reset File Permissions: Cleanup
   Repairing Restricted Folders Permissions To Avoid Infinite Loops
   Start (2015-03-01 17:58:39)

   You can tell the repair is working as SetACL_32.exe or SetACL_64.exe will be running.

   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2015-03-01 17:58:41)

03 - Reset Service Permissions
   Start (2015-03-01 17:58:41)

   You can tell the repair is working as SetACL_32.exe or SetACL_64.exe will be running.

   Running Repair Under System Account
   Done (2015-03-01 17:58:47)

04 - Register System Files
   Start (2015-03-01 17:58:47)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2015-03-01 17:59:04)

05 - Repair WMI
   Start (2015-03-01 17:59:04)

   Starting Security Center So We Can Export The Security Info.

   Exporting Antivirus Info...
   Kaspersky Anti-Virus Exported.

   Exporting AntiSpyware Info...
   Kaspersky Anti-Virus Exported.
   Windows Defender Exported.
   Comodo Defense+ Exported.

   Exporting 3rd Party Firewall Info...
   COMODO Firewall Exported.

   Running Repair Under Current User Account
   Done (2015-03-01 18:00:00)

06 - Repair Windows Firewall
   Start (2015-03-01 18:00:00)
   Running Repair Under Current User Account

Decompressing & Updating Windows Permission File services.txt
Done, 0,13 seconds.

   Running Repair Under System Account
   Done (2015-03-01 18:00:17)

07 - Repair Internet Explorer
   Start (2015-03-01 18:00:17)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2015-03-01 18:00:31)

08 - Repair MDAC/MS Jet
   Start (2015-03-01 18:00:31)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2015-03-01 18:00:35)

09 - Repair Hosts File
   Start (2015-03-01 18:00:35)
   Running Repair Under System Account
   Done (2015-03-01 18:00:36)

10 - Remove Policies Set By Infections
   Start (2015-03-01 18:00:36)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2015-03-01 18:00:40)

11 - Repair Start Menu Icons Removed By Infections
   Start (2015-03-01 18:00:40)
   Running Repair Under System Account
   Done (2015-03-01 18:00:41)

12 - Repair Icons
   Start (2015-03-01 18:00:41)
   Running Repair Under Current User Account
   Done (2015-03-01 18:00:42)

13 - Repair Winsock & DNS Cache
   Start (2015-03-01 18:00:43)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2015-03-01 18:00:46)

15 - Repair Proxy Settings
   Start (2015-03-01 18:00:46)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2015-03-01 18:00:48)

17 - Repair Windows Updates
   Start (2015-03-01 18:00:48)
   Running Repair Under Current User Account

Decompressing & Updating Windows Permission File services.txt
Done, 0,13 seconds.

   Running Repair Under System Account
   Setting Windows Updates Files That Are In Use To Be Removed At Next Boot.
   Done (2015-03-01 18:01:22)

18 - Repair CD/DVD Missing/Not Working
   Start (2015-03-01 18:01:22)
   iTunes not found, not applying UpperFilters iTunes Reg Key
   Done (2015-03-01 18:01:22)

19 - Repair Volume Shadow Copy Service
   Start (2015-03-01 18:01:22)
   Running Repair Under Current User Account

Decompressing & Updating Windows Permission File services.txt
Done, 0,13 seconds.

   Running Repair Under System Account
   Done (2015-03-01 18:01:46)

21 - Repair MSI (Windows Installer)
   Start (2015-03-01 18:01:46)
   Running Repair Under Current User Account

Decompressing & Updating Windows Permission File services.txt
Done, 0,13 seconds.

   Running Repair Under System Account
   Done (2015-03-01 18:02:00)

23.01 - Repair bat Association
   Start (2015-03-01 18:02:00)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2015-03-01 18:02:02)

23.02 - Repair cmd Association
   Start (2015-03-01 18:02:02)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2015-03-01 18:02:04)

23.03 - Repair com Association
   Start (2015-03-01 18:02:04)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2015-03-01 18:02:06)

23.04 - Repair Directory Association
   Start (2015-03-01 18:02:06)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2015-03-01 18:02:09)

23.05 - Repair Drive Association
   Start (2015-03-01 18:02:09)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2015-03-01 18:02:11)

23.06 - Repair exe Association
   Start (2015-03-01 18:02:11)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2015-03-01 18:02:13)

23.07 - Repair Folder Association
   Start (2015-03-01 18:02:13)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2015-03-01 18:02:15)

23.08 - Repair inf Association
   Start (2015-03-01 18:02:15)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2015-03-01 18:02:17)

23.09 - Repair lnk (Shortcuts) Association
   Start (2015-03-01 18:02:17)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2015-03-01 18:02:19)

23.10 - Repair msc Association
   Start (2015-03-01 18:02:19)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2015-03-01 18:02:21)

23.11 - Repair reg Association
   Start (2015-03-01 18:02:21)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2015-03-01 18:02:23)

23.12 - Repair scr Association
   Start (2015-03-01 18:02:23)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2015-03-01 18:02:25)

24 - Repair Windows Safe Mode
   Start (2015-03-01 18:02:25)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2015-03-01 18:02:27)

25 - Repair Print Spooler
   Start (2015-03-01 18:02:27)
   Running Repair Under Current User Account

Decompressing & Updating Windows Permission File services.txt
Done, 0,14 seconds.

   Running Repair Under System Account
   Done (2015-03-01 18:02:36)

26 - Restore Important Windows Services
   Start (2015-03-01 18:02:36)
   Running Repair Under Current User Account

Decompressing & Updating Windows Permission File services.txt
Done, 0,13 seconds.

   Running Repair Under System Account
   Done (2015-03-01 18:02:46)

27 - Set Windows Services To Default Startup
   Start (2015-03-01 18:02:46)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2015-03-01 18:02:51)

   Skipping Repair.
   Repair is for Windows v6.2 (Windows 8 & Newer) or higher.
   Current version: 6.1

   Skipping Repair.
   Repair is for Windows v6.2 (Windows 8 & Newer) or higher.
   Current version: 6.1

   Skipping Repair.
   Repair is for Windows v6.2 (Windows 8 & Newer) or higher.
   Current version: 6.1

31 - Repair Windows 'New' Submenu
   Start (2015-03-01 18:02:51)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (2015-03-01 18:02:53)

Cleaning up empty logs...

All Selected Repairs Done.
   Done at (2015-03-01 18:02:53)
   Total Repair Time: 00:12:54

...YOU MUST RESTART YOUR SYSTEM...

kevinf80 · March 1, 2015

Yes is ok to keep the repair tool, it can be run as required. What is the current status now, are there any remaining issues or concerns?

Download Security Check by screen317 from either of the following:

http://screen317.spywareinfoforum.org/SecurityCheck.exe or http://screen317.changelog.fr/SecurityCheck.exe

Save it to your Desktop. (If your security alerts either accept the alert, or turn the security off while Secuirity Check runs)
Double click SecurityCheck.exe (Vista or Windows 7/8 users right click and select "Run as Administrator") and follow the onscreen instructions inside of the black box. Press any key when asked.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

If Security Check will not run or you get an alert saying it is not supported, Re-boot your PC then try again...

Thanks,

Kevin...

AlexPoland · March 2, 2015

Even after reebooting, Security Check did not run, error: Windows does not have the right to get access to a certain file...

I ran Security Check in Safe Mode, here is the log:

Results of screen317's Security Check version 0.99.97
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Security Center service is not running! This report may not be accurate!
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Java 8 Update 31
Java version 32-bit out of Date!
Java 64-bit 8 Update 31
Adobe Flash Player 16.0.0.305
Adobe Reader XI
Mozilla Firefox (36.0)
Mozilla Thunderbird (31.5.0)
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````

Besides, the PC seems to be running ok.

kevinf80 · March 2, 2015

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:

Go to http://java.com/en/ and click on "Do I have Java"

It will check your current version and then offer to update to the latest version

Watch for and make sure you untick the box next to whatever free program they prompt you to install during the installation, unless you want it.

***Note: Check in Programs and Features (or Add/Remove Programs if you are an XP user) to make certain there are no old versions of Java still installed, if so - remove them. <<-- Very Important

Next,

Download "Delfix by Xplode" and save it to your desktop.

Or use the following if first link is down:

"Delfix link mirror"

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

Make Sure the following items are checked:

    Remove disinfection tools
    Purge System Restore
    Reset system settings

Now click on "Run" and wait patiently until the tool has completed.

The tool will create a log when it has completed. We don't need you to post this.

Any remnant files/logs from tools we have used can be deleted…

If no remaining issues or concerns are we ok to close out...

Thanks,

Kevin

AlexPoland · March 2, 2015

Hi Kevin,

thanks again for your great advice.

Concerning Java, I checked on the http://java.com/en/ and it said that I have the latest version.

How can I delete the Java version 32-bit out of Date?

Because I dont find another older version of Java...

I also attach the screenshot of my error popping of Firefox. Its polish, but it says that Firefox has crashed

due to an error. But that is strange because the message came after I normally closed Firefox and everything

was fine... Do you know what that means?

Besides, we are ok to close out.

Thanks again!

Alex

AlexPoland · March 2, 2015

Sorry, I forgot the screenshot...

Screenshot - Firefox Problem.pdf

kevinf80 · March 2, 2015

The Java alert by secuirty checks is an error, there is nothing to delete as your versions are upto date, maybe this happen because Java 7 is still available....

Regarding Firefox, not really sure. Firefox does send reports to Mozilla if there has been any crashes, maybe a crash has occured when you are not at the screen, it would automatically re-start and would not be seen... Select > Tools > Options > Advanced. In that window select "Data Choices" tab. Disable the the three option boxes to stop reports if you wish. I have only the middle box checkmarked...

If no other issues are we ok to close out...

Thank you,

Kevin

AlexPoland · March 3, 2015

Hi Kevin,

thanks for the advice and for your great help!

We are ok to close out.

Alex

kevinf80 · March 3, 2015

Excellent, take care and surf safe,

Kevin

AdvancedSetup · March 4, 2015

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Infections blocks Malwarebytes program

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information