Big malware problem

[Easy29]

Hi there, I have a malware issue, if I turn on my internet it keeps installing heaps and heaps of virus programs. I can uninstall all of them apart from "our surfing uninstall" once I connect my internet it happens again.

Can you please help, thanks heaps

[kevinf80]

Hello and welcome to Malwarebytes.org

 

P2P/Piracy Warning:

 

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here. Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

Next,

 

Change the download folder setting in the default Browser so all tools we may use are saved to the Desktop:

 

Google Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser.

Choose Settings. at the bottom of the screen click the

"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK.

 

Mozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser. Choose Options. In the downloads section, click the Browse button, click on the Desktop folder and the click the "Select Folder" button. Click OK to get out of the Options menu.

 

Internet Explorer - Click the Tools menu in the upper right-corner of the browser. Select View downloads. Select the Options link in the lower left of the window. Click Browse and select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen.

NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.

 

Next,

 

Follow the instructions in the following link to show hidden files:

 

http://www.bleepingcomputer.com/tutorials/how-to-see-hidden-files-in-windows/

 

Next,

 

Please open Malwarebytes Anti-Malware.

 

• 
  

On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits".
Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
A Threat Scan will begin.
With some infections, you may see this message box.
 
        'Could not load DDA driver'
 
Click 'Yes' to this message, to allow the driver to load after a restart.
Allow the computer to restart. Continue with the rest of these instructions.
When the scan is complete, click Apply Actions.
Wait for the prompt to restart the computer to appear, then click on Yes.
After the restart once you are back at your desktop, open MBAM once more.

 

To get the log from Malwarebytes do the following:

 

• 
  

Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click Export > From export you have three options:
 
  Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
  Text file (*.txt)        - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
  XML file (*.xml)      - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
 
Recommend you use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…

 

 

If Malwarebytes is not installed follow these instructions first:

 

Download Malwarebytes Anti-Malware to your desktop.

• 
  

Double-click mbam-setup and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
Launch Malwarebytes Anti-Malware
A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
Click Finish. Follow the instructions above....

 

Next,

 

Download Farbar Recovery Scan Tool and save it to your desktop.

 

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

 

• 
  

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

Let me see those logs in your reply....

 

Thank you,

 

Kevin...

 

[Easy29]

Here is the farbar.

 

Farbar Service Scanner Version: 17-01-2015
Ran by Eric (administrator) on 17-05-2015 at 13:22:20
Running from "C:\Users\Eric\Desktop"
Microsoft Windows 7 Home Premium  Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Other Services:
==============


File Check:
========
C:\windows\system32\nsisvc.dll => File is digitally signed
C:\windows\system32\Drivers\nsiproxy.sys => File is digitally signed
C:\windows\system32\dhcpcore.dll => File is digitally signed
C:\windows\system32\Drivers\afd.sys => File is digitally signed
C:\windows\system32\Drivers\tdx.sys => File is digitally signed
C:\windows\system32\Drivers\tcpip.sys => File is digitally signed
C:\windows\system32\dnsrslvr.dll => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed


**** End of log ****

[Easy29]

Malwarebytes keeps coming up with this,

 

Malwarebytes Anti-Malware
www.malwarebytes.org


Update, 17/05/2015 12:09:11 PM, SYSTEM, ERIC-PC, Manual, Failed, Unable to access update server,
Update, 17/05/2015 12:10:31 PM, SYSTEM, ERIC-PC, Manual, Failed, Unable to access update server,
Update, 17/05/2015 1:14:09 PM, SYSTEM, ERIC-PC, Manual, Failed, Unable to access update server,
Update, 17/05/2015 1:18:08 PM, SYSTEM, ERIC-PC, Manual, Remediation Database, 2015.3.9.1, 2015.5.13.1,
Update, 17/05/2015 1:18:08 PM, SYSTEM, ERIC-PC, Manual, Rootkit Database, 2015.2.25.1, 2015.5.16.1,
Update, 17/05/2015 1:18:19 PM, SYSTEM, ERIC-PC, Manual, Malware Database, 2015.3.9.5, 2015.5.16.6,

(end)

[Easy29]

sorry here it is

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-05-2015 02
Ran by Eric (administrator) on ERIC-PC on 17-05-2015 13:38:45
Running from C:\Users\Eric\Desktop
Loaded Profiles: Eric &  (Available profiles: Eric)
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(SysTool PasSame LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Users\Eric\AppData\Roaming\FFFFFFFF-1431778396-FFFF-FFFF-FFFFFFFFFFFF\nsi7117.tmpfs
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
(Absolute Software Corp.) C:\Windows\System32\rpcnet.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
() C:\Program Files\Coupoon\UpdateCheck.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
() C:\Users\Eric\AppData\Roaming\FFFFFFFF-1431778396-FFFF-FFFF-FFFFFFFFFFFF\jnsdA1BE.tmp
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
() C:\Users\Eric\AppData\Roaming\FFFFFFFF-1431778396-FFFF-FFFF-FFFFFFFFFFFF\hnsdBA20.tmp
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
() C:\Program Files\MaxComputerCleaner_v17.437\MaxComputerCleaner_Maintenance.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Hawker) C:\Program Files\Hawker\VersionControl.exe
(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe
(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
() C:\Users\Eric\AppData\Local\4673D464-9926-164E-B346-B660612DC46A\Runner.exe
(SoftBrain Technologies Ltd.) C:\Users\Eric\AppData\Local\SmartWeb\SmartWebHelper.exe
(SoftBrain Technologies Ltd.) C:\Users\Eric\AppData\Local\SmartWeb\SmartWebApp.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
() C:\Program Files\gmsd_au_278\gmsd_au_278.exe
() C:\Users\Eric\AppData\Local\gmsd_au_278\upgmsd_au_278.exe
(XTab system) C:\Program Files\XTab\ProtectService.exe
(SearchProtect) C:\Program Files\XTab\CmdShell.exe
(XTab system) C:\Program Files\XTab\HPNotify.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(The Chromium Authors) C:\Users\Eric\AppData\Local\4673D464-9926-164E-B346-B660612DC46A\Navigate\Navigate.exe
(The Chromium Authors) C:\Users\Eric\AppData\Local\4673D464-9926-164E-B346-B660612DC46A\Navigate\Navigate.exe
(The Chromium Authors) C:\Users\Eric\AppData\Local\4673D464-9926-164E-B346-B660612DC46A\Navigate\Navigate.exe
(The Chromium Authors) C:\Users\Eric\AppData\Local\4673D464-9926-164E-B346-B660612DC46A\Navigate\Navigate.exe
(The Chromium Authors) C:\Users\Eric\AppData\Local\4673D464-9926-164E-B346-B660612DC46A\Navigate\Navigate.exe
(The Chromium Authors) C:\Users\Eric\AppData\Local\4673D464-9926-164E-B346-B660612DC46A\Navigate\Navigate.exe
(The Chromium Authors) C:\Users\Eric\AppData\Local\4673D464-9926-164E-B346-B660612DC46A\Navigate\Navigate.exe
(The Chromium Authors) C:\Users\Eric\AppData\Local\4673D464-9926-164E-B346-B660612DC46A\Navigate\Navigate.exe
(The Chromium Authors) C:\Users\Eric\AppData\Local\4673D464-9926-164E-B346-B660612DC46A\Navigate\Navigate.exe
(The Chromium Authors) C:\Users\Eric\AppData\Local\4673D464-9926-164E-B346-B660612DC46A\Navigate\Navigate.exe
(The Chromium Authors) C:\Users\Eric\AppData\Local\4673D464-9926-164E-B346-B660612DC46A\Navigate\Navigate.exe
(The Chromium Authors) C:\Users\Eric\AppData\Local\4673D464-9926-164E-B346-B660612DC46A\Navigate\Navigate.exe
(Farbar) C:\Users\Eric\Desktop\FRST(1).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1697064 2010-03-11] (Synaptics Incorporated)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [151952 2012-11-28] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation)
HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [616632 2014-01-28] (Nico Mak Computing)
HKLM\...\Run: [Hawker] => C:\Program Files\Hawker\VersionControl.exe [3187520 2015-05-11] (Hawker)
HKLM\...\Run: [gmsd_au_278] => C:\Program Files\gmsd_au_278\gmsd_au_278.exe [3980744 2015-05-15] ()
HKLM\...\Run: [smartWeb] => C:\Users\Eric\AppData\Local\SmartWeb\SmartWebHelper.exe [270368 2015-02-17] (SoftBrain Technologies Ltd.)
HKLM\...\RunOnce: [MaxComputerCleaner_v17.437] => C:\Program Files\MaxComputerCleaner_v17.437\MaxComputerCleaner_Maintenance.exe [30920 2015-05-15] ()
HKLM\...\RunOnce: [upgmsd_au_278.exe] => C:\Users\Eric\AppData\Local\gmsd_au_278\upgmsd_au_278.exe [3287496 2015-05-15] ()
HKLM\...\RunOnce: [insbgf32] => C:\windows\system32\insbgf32.exe [106224 2014-06-19] (Absolute Software Corp.)
HKU\S-1-5-21-3390684805-3501667938-2072976212-1001\...\Run: [skype] => C:\Program Files\Skype\Phone\Skype.exe [31282304 2015-04-17] (Skype Technologies S.A.)
HKU\S-1-5-21-3390684805-3501667938-2072976212-1001\...\Run: [Hawker] => C:\Program Files\Hawker\VersionControl.exe [3187520 2015-05-11] (Hawker)
HKU\S-1-5-21-3390684805-3501667938-2072976212-1001\...\Run: [PCPrivacyDock] => "C:\Program Files\PC Privacy Dock\PCPrivacyDock.exe" /minimized
HKU\S-1-5-21-3390684805-3501667938-2072976212-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [skype] => C:\Program Files\Skype\Phone\Skype.exe [31282304 2015-04-17] (Skype Technologies S.A.)
HKU\S-1-5-21-3390684805-3501667938-2072976212-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Hawker] => C:\Program Files\Hawker\VersionControl.exe [3187520 2015-05-11] (Hawker)
HKU\S-1-5-21-3390684805-3501667938-2072976212-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [PCPrivacyDock] => "C:\Program Files\PC Privacy Dock\PCPrivacyDock.exe" /minimized
Startup: C:\Users\Eric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartWeb.lnk [2015-05-17]
ShortcutTarget: SmartWeb.lnk -> C:\Users\Eric\AppData\Local\SmartWeb\SmartWebHelper.exe (SoftBrain Technologies Ltd.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3390684805-3501667938-2072976212-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3390684805-3501667938-2072976212-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.oursurfing.com/?type=hp&ts=1431778411&z=c811d91cf2851f7a1e2fd6eg6z3ccg4m5m5b7z2efq&from=amt&uid=TOSHIBAXMK6475GSX_61HIS49GSXX61HIS49GS
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.oursurfing.com/web/?type=ds&ts=1431832208&z=5f9701bd6f3cdc40edbd895gfzdc9g6bec8o4o6e8m&from=cmi&uid=TOSHIBAXMK6475GSX_61HIS49GSXX61HIS49GS&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.oursurfing.com/?type=hp&ts=1431778411&z=c811d91cf2851f7a1e2fd6eg6z3ccg4m5m5b7z2efq&from=amt&uid=TOSHIBAXMK6475GSX_61HIS49GSXX61HIS49GS
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.oursurfing.com/web/?type=ds&ts=1431832208&z=5f9701bd6f3cdc40edbd895gfzdc9g6bec8o4o6e8m&from=cmi&uid=TOSHIBAXMK6475GSX_61HIS49GSXX61HIS49GS&q={searchTerms}
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3390684805-3501667938-2072976212-1001\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3390684805-3501667938-2072976212-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.ninemsn.com.au/?ocid=iehp
HKU\S-1-5-21-3390684805-3501667938-2072976212-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3390684805-3501667938-2072976212-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.ninemsn.com.au/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.oursurfing.com/web/?type=ds&ts=1431832208&z=5f9701bd6f3cdc40edbd895gfzdc9g6bec8o4o6e8m&from=cmi&uid=TOSHIBAXMK6475GSX_61HIS49GSXX61HIS49GS&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.oursurfing.com/web/?type=ds&ts=1431832208&z=5f9701bd6f3cdc40edbd895gfzdc9g6bec8o4o6e8m&from=cmi&uid=TOSHIBAXMK6475GSX_61HIS49GSXX61HIS49GS&q={searchTerms}
SearchScopes: HKLM -> {F4ED0519-C584-4DDA-BE93-FA0B93D040F6} URL = http://www.bing.com/search?q={searchTerms}&form=TSHPDF&pc=MATP&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-3390684805-3501667938-2072976212-1001 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.oursurfing.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=TOSHIBAXMK6475GSX_61HIS49GSXX61HIS49GS&ts=1431832281&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3390684805-3501667938-2072976212-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.oursurfing.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=TOSHIBAXMK6475GSX_61HIS49GSXX61HIS49GS&ts=1431832281&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3390684805-3501667938-2072976212-1001 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.oursurfing.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=TOSHIBAXMK6475GSX_61HIS49GSXX61HIS49GS&ts=1431832281&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3390684805-3501667938-2072976212-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.oursurfing.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=TOSHIBAXMK6475GSX_61HIS49GSXX61HIS49GS&ts=1431832281&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3390684805-3501667938-2072976212-1001 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://www.oursurfing.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=TOSHIBAXMK6475GSX_61HIS49GSXX61HIS49GS&ts=1431832281&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3390684805-3501667938-2072976212-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.oursurfing.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=TOSHIBAXMK6475GSX_61HIS49GSXX61HIS49GS&ts=1431832281&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3390684805-3501667938-2072976212-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.oursurfing.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=TOSHIBAXMK6475GSX_61HIS49GSXX61HIS49GS&ts=1431832281&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3390684805-3501667938-2072976212-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.oursurfing.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=TOSHIBAXMK6475GSX_61HIS49GSXX61HIS49GS&ts=1431832281&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3390684805-3501667938-2072976212-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.oursurfing.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=TOSHIBAXMK6475GSX_61HIS49GSXX61HIS49GS&ts=1431832281&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3390684805-3501667938-2072976212-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://www.oursurfing.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=TOSHIBAXMK6475GSX_61HIS49GSXX61HIS49GS&ts=1431832281&type=default&q={searchTerms}
BHO: LuckyTab Class -> {51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F} -> C:\Program Files\XTab\SupTab.dll [2015-05-15] (Thinknice Co. Limited)
BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-02-13] (Oracle Corporation)
BHO: Hawker -> {853130B6-1A29-4D9D-9513-2A461287651E} -> C:\Program Files\Hawker\Hawker.dll [2015-05-11] (Hawker)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-02-13] (Oracle Corporation)
BHO: TOSHIBA Media Controller Plug-in -> {F3C88694-EFFA-4d78-B409-54B7B2535B14} -> C:\Program Files\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll [2010-12-06] (<TOSHIBA>)
DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.oursurfing.com/?type=sc&ts=1431832208&z=5f9701bd6f3cdc40edbd895gfzdc9g6bec8o4o6e8m&from=cmi&uid=TOSHIBAXMK6475GSX_61HIS49GSXX61HIS49GS

FireFox:
========
FF ProfilePath: C:\Users\Eric\AppData\Roaming\Mozilla\Firefox\Profiles\4zm2i6dd.default-1431780591179
FF NewTab: chrome://quick_start/content/index.html
FF DefaultSearchEngine: oursurfing
FF SelectedSearchEngine: oursurfing
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll [2014-05-15] ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\windows\system32\Adobe\Director\np32dsw_1209149.dll [2014-01-29] (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2012-10-31] ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-08] (Google)
FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-02-13] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-02-13] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-08] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3390684805-3501667938-2072976212-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Eric\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2013-03-25] (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-3390684805-3501667938-2072976212-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Eric\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2013-03-25] (Unity Technologies ApS)
FF user.js: detected! => C:\Users\Eric\AppData\Roaming\Mozilla\Firefox\Profiles\4zm2i6dd.default-1431780591179\user.js [2015-05-17]
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL [2006-10-26] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2014-06-29] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2014-06-29] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2014-06-29] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2014-06-29] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2014-06-29] (Apple Inc.)
FF SearchPlugin: C:\Users\Eric\AppData\Roaming\Mozilla\Firefox\Profiles\4zm2i6dd.default-1431780591179\searchplugins\oursurfing.xml [2015-05-17]
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\avg-secure-search.xml [2014-01-10]
FF Extension: Fast Start - C:\Users\Eric\AppData\Roaming\Mozilla\Firefox\Profiles\4zm2i6dd.default-1431780591179\Extensions\searchffv2@gmail.com [2015-05-17]
FF Extension: Search Enginer - C:\Users\Eric\AppData\Roaming\Mozilla\Firefox\Profiles\4zm2i6dd.default-1431780591179\Extensions\sweetsearch@gmail.com [2015-05-17]
FF Extension: Hawker - C:\Program Files\Mozilla Firefox\distribution\bundles\{B5643E87-4502-60E2-A32A-6E126145609B} [2015-05-16]
FF HKLM\...\Firefox\Extensions: [searchffv2@gmail.com] - C:\Users\Eric\AppData\Roaming\Mozilla\Firefox\Profiles\4zm2i6dd.default-1431780591179\extensions\searchffv2@gmail.com
FF HKLM\...\Firefox\Extensions: [sweetsearch@gmail.com] - C:\Users\Eric\AppData\Roaming\Mozilla\Firefox\Profiles\4zm2i6dd.default-1431780591179\extensions\sweetsearch@gmail.com
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\itms.js [2015-04-25]

Chrome:
=======
CHR Profile: C:\Users\Eric\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Wallet) - C:\Users\Eric\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-13]
CHR HKLM\...\Chrome\Extension: [bejbohlohkkgompgecdcbbglkpjfjgdj] - C:\Users\Eric\AppData\Local\Temp\crx9F60.tmp [Not Found]
CHR HKLM\...\Chrome\Extension: [cgpnojibjokpoghebklhkdeijehkohhb] - C:\Users\Eric\AppData\Local\Temp\tbch.crx [Not Found]
StartMenuInternet: Google Chrome - C:\Program Files\Google\Chrome\Application\chrome.exe http://www.oursurfing.com/?type=sc&ts=1431832208&z=5f9701bd6f3cdc40edbd895gfzdc9g6bec8o4o6e8m&from=cmi&uid=TOSHIBAXMK6475GSX_61HIS49GSXX61HIS49GS

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 cfWiMAXService; C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe [185712 2010-01-29] (TOSHIBA CORPORATION)
R2 ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [46448 2009-03-11] (TOSHIBA CORPORATION)
S2 CoupoonService; C:\Program Files\coupoon\iiwjljrnpc.exe [151864 2015-04-03] ()
S3 GameConsoleService; C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe [246520 2010-04-04] (WildTangent, Inc.)
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 IHProtect Service; C:\Program Files\XTab\ProtectService.exe [157824 2015-05-15] (XTab system)
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation)
R2 NIHardwareService; C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [3791872 2010-10-20] (Native Instruments GmbH) [File not signed]
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [280288 2013-10-23] (Microsoft Corporation)
R2 rpcnet; C:\windows\system32\rpcnet.exe [78032 2015-04-17] (Absolute Software Corp.)
S3 SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
S3 TMachInfo; C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [54136 2010-11-30] (TOSHIBA Corporation)
S3 TOSHIBA HDD SSD Alert Service; C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [112032 2010-12-09] (TOSHIBA Corporation)
R2 UpdateCheck; C:\Program Files\Coupoon\UpdateCheck.exe [53040 2015-05-16] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
R4 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [337064 2015-05-16] (SysTool PasSame LIMITED) <==== ATTENTION
R2 xixynyko; C:\Users\Eric\AppData\Roaming\FFFFFFFF-1431778396-FFFF-FFFF-FFFFFFFFFFFF\jnsdA1BE.tmp [235520 2015-05-16] () [File not signed]
R2 xygefuzu; C:\Users\Eric\AppData\Roaming\FFFFFFFF-1431778396-FFFF-FFFF-FFFFFFFFFFFF\hnsdBA20.tmp [396288 2015-05-16] () [File not signed]
R2 lupucylu; C:\Users\Eric\AppData\Roaming\FFFFFFFF-1431778396-FFFF-FFFF-FFFFFFFFFFFF\nsi7117.tmpfs [X]
S2 vToolbarUpdater17.3.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.3.0\ToolbarUpdater.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 athr; C:\windows\System32\DRIVERS\athr.sys [2239488 2012-04-19] (Qualcomm Atheros Communications, Inc.)
R1 avgtp; C:\windows\system32\drivers\avgtpx86.sys [37664 2013-11-11] (AVG Technologies)
S3 BtFilter; C:\windows\System32\DRIVERS\btfilter.sys [33640 2010-10-19] (Atheros)
S3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [119512 2015-05-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation)
R3 MEI; C:\windows\System32\DRIVERS\HECI.sys [41088 2010-10-20] (Intel Corporation)
R0 MpFilter; C:\windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation)
R1 MpKsla96a0e17; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{5BE7B0D8-4C60-45EE-9ADE-54A38FA2B91A}\MpKsla96a0e17.sys [39464 2015-05-17] (Microsoft Corporation)
R1 netfilter; C:\windows\System32\drivers\netfilter.sys [31744 2015-04-03] (NetFilterSDK.com) [File not signed]
S3 NUMARK_NS7II_MIDI; C:\windows\System32\drivers\ns7ii_midi.sys [28928 2013-05-15] (Numark)
S3 NUMARK_NS7II_USB; C:\windows\System32\Drivers\ns7ii_usb.sys [380672 2013-05-15] (Ploytec GmbH)
S3 NUMARK_NS7II_WDM; C:\windows\System32\drivers\ns7ii_wdm.sys [45312 2013-05-15] (Numark)
S3 rspLLL; C:\windows\System32\DRIVERS\rspLLL32.sys [21920 2013-02-07] (Resplendence Software Projects Sp.)
U5 AppMgmt; C:\windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Eric\AppData\Local\Temp\catchme.sys [X]
S3 cpuz134; \??\C:\Users\Eric\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [X]
S1 innfd_1_10_0_14; system32\drivers\innfd_1_10_0_14.sys [X]
S1 scfd_1_10_0_16; system32\drivers\scfd_1_10_0_16.sys [X]
S3 Tosrfcom; No ImagePath
U3 TrueSight; \??\C:\windows\system32\TrueSight.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-17 13:38 - 2015-05-17 13:39 - 00027155 _____ () C:\Users\Eric\Desktop\FRST.txt
2015-05-17 13:38 - 2015-05-17 13:38 - 00000000 ____D () C:\FRST
2015-05-17 13:37 - 2015-05-17 13:37 - 01146368 _____ (Farbar) C:\Users\Eric\Desktop\FRST(1).exe
2015-05-17 13:22 - 2015-05-17 13:22 - 00001132 _____ () C:\Users\Eric\Desktop\FSS.txt
2015-05-17 13:20 - 2015-05-17 13:20 - 00415232 _____ (Farbar) C:\Users\Eric\Desktop\FSS.exe
2015-05-17 13:11 - 2015-05-17 13:11 - 00001099 _____ () C:\Users\Eric\Desktop\Continue Live Installation.lnk
2015-05-17 13:11 - 2015-05-17 13:11 - 00000000 ____D () C:\Program Files\XTab
2015-05-17 13:10 - 2015-05-17 13:14 - 00000000 ____D () C:\Users\Eric\AppData\Local\gmsd_au_278
2015-05-17 13:10 - 2015-05-17 13:10 - 00000000 ____D () C:\Program Files\gmsd_au_278
2015-05-17 12:09 - 2015-05-17 13:18 - 00119512 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-17 12:08 - 2015-05-17 12:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-05-17 12:08 - 2015-05-17 12:08 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2015-05-17 12:08 - 2015-04-14 09:37 - 00092888 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-05-17 12:08 - 2015-04-14 09:37 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-05-16 23:02 - 2015-05-16 23:02 - 00000000 ____D () C:\Program Files\predm
2015-05-16 22:58 - 2015-05-16 22:59 - 00000000 ____D () C:\Users\Eric\Documents\MaxComputerCleaner
2015-05-16 22:58 - 2015-05-16 22:58 - 00000000 ____D () C:\Users\Eric\AppData\Local\Max_Computer_Cleaner
2015-05-16 22:57 - 2015-05-16 22:57 - 00000008 _____ () C:\END
2015-05-16 22:57 - 2015-05-16 22:57 - 00000000 ____D () C:\Users\Eric\AppData\Local\Crossbrowse
2015-05-16 22:57 - 2015-05-16 22:57 - 00000000 ____D () C:\Program Files\MaxComputerCleaner_v17.437
2015-05-16 22:57 - 2015-05-16 22:57 - 00000000 ____D () C:\Program Files\MaxComputerCleaner
2015-05-16 22:55 - 2015-05-17 13:36 - 00000181 _____ () C:\windows\verson_hawker.txt
2015-05-16 22:55 - 2015-05-17 13:10 - 00000000 ____D () C:\Users\Eric\AppData\Local\SmartWeb
2015-05-16 22:49 - 2015-05-16 22:49 - 00000000 ____D () C:\Users\Eric\Desktop\Old Firefox Data
2015-05-16 22:34 - 2015-05-16 22:34 - 00000000 ____D () C:\ProgramData\eef53b2200001ec6
2015-05-16 22:31 - 2015-05-16 22:31 - 00000000 ____D () C:\Program Files\mbot_au_411
2015-05-16 22:20 - 2015-05-16 22:21 - 00000000 ____D () C:\Users\Eric\Documents\PCPrivacyDock
2015-05-16 22:20 - 2015-05-16 22:20 - 00000000 ____D () C:\Users\Eric\AppData\Local\PC_Privacy_Dock
2015-05-16 22:20 - 2015-05-16 22:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hawker
2015-05-16 22:20 - 2015-05-16 22:20 - 00000000 ____D () C:\Program Files\Hawker
2015-05-16 22:17 - 2015-05-16 22:18 - 00000000 ____D () C:\Users\Eric\AppData\Local\FFFFFFFF-1431814641-FFFF-FFFF-FFFFFFFFFFFF
2015-05-16 22:16 - 2015-05-16 22:17 - 00000000 ____D () C:\Program Files\PCP
2015-05-16 22:14 - 2015-05-16 23:10 - 00000000 ____D () C:\ProgramData\abc
2015-05-16 22:14 - 2015-05-16 22:23 - 00000000 ____D () C:\Users\Eric\AppData\Local\4673D464-9926-164E-B346-B660612DC46A
2015-05-16 22:14 - 2015-05-16 22:14 - 00000000 __RSH () C:\MSDOS.SYS
2015-05-16 22:14 - 2015-05-16 22:14 - 00000000 __RSH () C:\IO.SYS
2015-05-16 22:14 - 2015-05-16 22:14 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2015-05-16 22:14 - 2015-05-16 22:14 - 00000000 ____D () C:\ProgramData\IHProtectUpDate
2015-05-16 22:13 - 2015-05-17 13:11 - 00000000 ____D () C:\Users\Eric\AppData\Roaming\oursurfing
2015-05-16 22:13 - 2015-05-16 22:13 - 00000000 ____D () C:\Users\Eric\AppData\Roaming\FFFFFFFF-1431778396-FFFF-FFFF-FFFFFFFFFFFF
2015-05-16 22:13 - 2012-12-18 12:36 - 00000027 _____ () C:\windows\system32\Drivers\etc\hp.bak
2015-05-16 22:12 - 2015-05-16 22:16 - 00000000 ____D () C:\Program Files\Coupoon
2015-05-16 22:11 - 2015-05-16 22:11 - 01611792 _____ (Dummy, Ltd.) C:\Users\Eric\Downloads\game.of.thrones.s05e05.720p.hdtv.x264.0sec.rarbg_10924_i8832905_il345.exe
2015-05-16 09:49 - 2015-05-16 09:52 - 00000000 ____D () C:\Users\Eric\AppData\Roaming\NCH Software
2015-05-16 09:49 - 2015-05-16 09:49 - 00001963 _____ () C:\Users\Public\Desktop\NCH Suite.lnk
2015-05-16 09:49 - 2015-05-16 09:49 - 00001067 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Debut Video Capture Software.lnk
2015-05-16 09:49 - 2015-05-16 09:49 - 00001055 _____ () C:\Users\Public\Desktop\Debut Video Capture Software.lnk
2015-05-16 09:49 - 2015-05-16 09:49 - 00000000 ____D () C:\ProgramData\NCH Software
2015-05-16 09:49 - 2015-05-16 09:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite
2015-05-16 09:49 - 2015-05-16 09:49 - 00000000 ____D () C:\Program Files\NCH Software
2015-05-16 09:48 - 2015-05-16 09:48 - 01621568 _____ (NCH Software) C:\Users\Eric\Downloads\debutpsetup.exe
2015-05-10 14:45 - 2015-05-11 21:08 - 00000000 ____D () C:\Users\Eric\Desktop\Ebay
2015-04-25 11:52 - 2015-04-25 11:52 - 62984900 _____ () C:\Users\Eric\Downloads\Blondie.rar
2015-04-25 11:51 - 2015-04-25 11:52 - 16234186 _____ () C:\Users\Eric\Downloads\DildoFunMoaner.rar
2015-04-25 11:20 - 2015-05-16 22:20 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-04-22 09:12 - 2015-04-22 09:12 - 67549755 _____ () C:\Users\Eric\Downloads\pink hole.zip
2015-04-18 18:55 - 2015-04-18 19:03 - 232800637 _____ () C:\Users\Eric\Downloads\Kieran Billen.rar
2015-04-18 00:17 - 2015-04-18 00:17 - 45721988 _____ () C:\Users\Eric\Downloads\I want it all.rar
2015-04-17 23:58 - 2015-04-18 00:03 - 115195328 _____ () C:\Users\Eric\Downloads\FromJessie11.rar

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-17 13:38 - 2012-01-04 22:55 - 00000000 ____D () C:\Users\Eric\AppData\Roaming\Skype
2015-05-17 13:35 - 2011-07-04 18:14 - 01529658 _____ () C:\windows\WindowsUpdate.log
2015-05-17 13:20 - 2014-02-18 09:25 - 00000000 ____D () C:\Users\Eric\AppData\Local\CrashDumps
2015-05-17 13:10 - 2011-11-20 17:47 - 00001411 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-05-17 13:10 - 2011-10-12 18:23 - 00001720 _____ () C:\Users\Eric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-05-17 13:09 - 2009-07-14 14:34 - 00024720 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-17 13:09 - 2009-07-14 14:34 - 00024720 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-17 12:44 - 2012-07-28 00:07 - 00000886 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-17 12:08 - 2014-02-01 21:36 - 00001035 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-05-17 12:08 - 2012-12-05 17:52 - 00000000 ____D () C:\Users\Eric\AppData\Roaming\Malwarebytes
2015-05-17 12:08 - 2012-12-05 17:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-17 12:08 - 2012-12-05 17:52 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2015-05-17 11:56 - 2014-04-18 09:27 - 00078032 _____ (Absolute Software Corp.) C:\windows\system32\rpcnet.dll
2015-05-17 11:56 - 2014-04-18 09:23 - 00017920 _____ () C:\windows\system32\rpcnetp.exe
2015-05-17 11:56 - 2012-07-28 00:07 - 00000882 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-17 11:56 - 2010-11-21 07:48 - 00379502 _____ () C:\windows\PFRO.log
2015-05-17 11:56 - 2009-07-14 14:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-05-17 11:56 - 2009-07-14 14:39 - 00235360 _____ () C:\windows\setupact.log
2015-05-16 22:44 - 2014-07-06 19:35 - 00000000 ____D () C:\Users\Eric\AppData\Roaming\uTorrent
2015-05-16 22:28 - 2014-06-29 16:36 - 00000000 ____D () C:\ProgramData\Package Cache
2015-05-16 22:25 - 2009-07-14 12:37 - 00000000 ____D () C:\windows\system32\NDF
2015-05-16 22:15 - 2012-05-06 01:00 - 00000000 ____D () C:\Users\Eric\Desktop\ipod cache
2015-05-16 22:12 - 2011-11-10 09:47 - 00000000 ____D () C:\Users\Eric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Image-Line
2015-05-16 22:12 - 2011-11-10 09:44 - 00000000 ____D () C:\Program Files\Image-Line
2015-05-16 13:55 - 2012-01-06 21:44 - 00000000 ____D () C:\Users\Eric\AppData\Roaming\vlc
2015-05-16 09:39 - 2010-11-21 07:01 - 00782470 _____ () C:\windows\system32\PerfStringBackup.INI
2015-05-12 23:38 - 2012-01-12 15:32 - 00000000 ____D () C:\Users\Eric\AppData\Local\Screencast-O-Matic
2015-05-03 11:07 - 2011-07-04 18:49 - 00000000 ____D () C:\ProgramData\Skype
2015-04-26 11:11 - 2012-04-26 01:24 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-04-22 09:12 - 2015-04-07 19:48 - 00000000 ____D () C:\Users\Eric\AppData\Local\WinZip
2015-04-17 17:17 - 2014-04-18 09:27 - 00078032 ____N (Absolute Software Corp.) C:\windows\system32\rpcnet.exe

==================== Files in the root of some directories =======

2013-06-28 01:48 - 2014-01-10 23:01 - 0003728 _____ () C:\Program Files\Mozilla Firefoxavg-secure-search.xml
2012-04-30 20:42 - 2012-05-26 15:11 - 0000132 _____ () C:\Users\Eric\AppData\Roaming\Adobe GIF Format CS5 Prefs
2012-05-13 13:50 - 2012-05-18 01:19 - 0000132 _____ () C:\Users\Eric\AppData\Roaming\Adobe PNG Format CS5 Prefs
2012-07-30 20:33 - 2012-07-30 20:33 - 0033134 _____ () C:\Users\Eric\AppData\Roaming\UserTile.png

Some content of TEMP:
====================
C:\Users\Eric\AppData\Local\Temp\6477.exe
C:\Users\Eric\AppData\Local\Temp\9694.exe
C:\Users\Eric\AppData\Local\Temp\CloudBackup426.exe
C:\Users\Eric\AppData\Local\Temp\CloudBackup5376.exe
C:\Users\Eric\AppData\Local\Temp\crashguard.exe
C:\Users\Eric\AppData\Local\Temp\game.of.thrones.s05e05.720p.hdtv.x264.0sec.rarbg__10924_i1516763436_il1283721.exe
C:\Users\Eric\AppData\Local\Temp\optprosetup.exe
C:\Users\Eric\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Eric\AppData\Local\Temp\SPSetup.exe
C:\Users\Eric\AppData\Local\Temp\Uninstall.exe
C:\Users\Eric\AppData\Local\Temp\utt15A6.tmp.exe
C:\Users\Eric\AppData\Local\Temp\uttAED9.tmp.exe
C:\Users\Eric\AppData\Local\Temp\VirtualDJ New Version.exe
C:\Users\Eric\AppData\Local\Temp\virtualdj.exe
C:\Users\Eric\AppData\Local\Temp\vlc-2.1.5-win32.exe
C:\Users\Eric\AppData\Local\Temp\_unps.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-16 12:06

==================== End Of Log ============================

[Easy29]

attatched

Addition.txt

[kevinf80]

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

 

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

 

Next,

 

Please open Malwarebytes Anti-Malware.

 

• 
  

On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits".
Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
A Threat Scan will begin.
With some infections, you may see this message box.
 
        'Could not load DDA driver'
 
Click 'Yes' to this message, to allow the driver to load after a restart.
Allow the computer to restart. Continue with the rest of these instructions.
When the scan is complete, click Apply Actions.
Wait for the prompt to restart the computer to appear, then click on Yes.
After the restart once you are back at your desktop, open MBAM once more.

 

To get the log from Malwarebytes do the following:

 

• 
  

Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click Export > From export you have three options:
 
  Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
  Text file (*.txt)        - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
  XML file (*.xml)      - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
 
Recommend you use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…

 

Next,

 

Download AdwCleaner by Xplode onto your Desktop.

• 
  

Double click on Adwcleaner.exe to run the tool.
Click on Scan
Once the scan is done, click on the Clean button. <<<--- Ensure this option is completed
You will get a prompt asking to close all programs. Click OK.
Click OK again to reboot your computer.
A text file will open after the restart. Please post the content of that logfile in your reply.
You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number

 

Next,

 

Please download Junkware Removal Tool to your desktop.

• 
  

Shut down your protection software now to avoid potential conflicts. (re-enable when done)
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

 

Next,

 

Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop

Ensure to get the correct version for your system....

32 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

64 Bit version:

https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en

 

Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window

In the "Scan Type" window, select Quick Scan

Perform a scan and  Click Finish when the scan is done.

Retrieve the MSRT log as follows, and post it in your next reply:

 

1) Select the Windows key and R key together to open the "Run" function

2) Type or Copy/Paste the following command to the "Run Line" and Press Enter:

 

notepad c:\windows\debug\mrt.log

 

Let me see those logs, also give an update on any remaining issues or concerns...

 

Thanks,

 

Kevin..

 

 

 

 

Fixlist.txt

[Easy29]

attatched, thanks heaps for your help

[kevinf80]

mmm, nothing atached?

[Easy29]

attatched now sorry

Fixlog.txt

[Easy29]

Thanks heaps for your help with this kevin, I have malware bytes scanning now, ill try post a log after its completed (if it lets me this time).

[kevinf80]

Thanks for the update, post the logs whenever you`re ready. Also let me know if there are any remaining issues or concerns...

 

Thank you,

 

Kevin...

[Easy29]

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 19/05/2015
Scan Time: 10:42:44 PM
Logfile:
Administrator: Yes

Version: 2.01.6.1022
Malware Database: v2015.05.19.02
Rootkit Database: v2015.05.16.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x86
File System: NTFS
User: Eric

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 369198
Time Elapsed: 1 hr, 9 min, 7 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

 

Malwarebytes Anti-Malware
www.malwarebytes.org


Error, 19/05/2015 10:13:50 AM, SYSTEM, ERIC-PC, Protection, IsLicensed, 13,
Protection, 19/05/2015 10:13:50 AM, SYSTEM, ERIC-PC, Protection, Malware Protection, Stopping,
Protection, 19/05/2015 10:13:50 AM, SYSTEM, ERIC-PC, Protection, Malware Protection, Stopped,
Error, 19/05/2015 6:13:11 PM, SYSTEM, ERIC-PC, Protection, IsLicensed, 13,
Protection, 19/05/2015 6:13:11 PM, SYSTEM, ERIC-PC, Protection, Malware Protection, Stopping,
Protection, 19/05/2015 6:13:11 PM, SYSTEM, ERIC-PC, Protection, Malware Protection, Stopped,
Error, 19/05/2015 10:27:30 PM, SYSTEM, ERIC-PC, Protection, IsLicensed, 13,
Protection, 19/05/2015 10:27:30 PM, SYSTEM, ERIC-PC, Protection, Malware Protection, Stopping,
Protection, 19/05/2015 10:27:30 PM, SYSTEM, ERIC-PC, Protection, Malware Protection, Stopped,
Error, 19/05/2015 10:34:34 PM, SYSTEM, ERIC-PC, Protection, IsLicensed, 13,
Protection, 19/05/2015 10:34:34 PM, SYSTEM, ERIC-PC, Protection, Malware Protection, Stopping,
Protection, 19/05/2015 10:34:34 PM, SYSTEM, ERIC-PC, Protection, Malware Protection, Stopped,
Update, 19/05/2015 10:42:44 PM, SYSTEM, ERIC-PC, Manual, Malware Database, 2015.5.16.6, 2015.5.19.2,
Scan, 19/05/2015 11:51:51 PM, SYSTEM, ERIC-PC, Manual, Start:19/05/2015 10:42:44 PM, Duration:1 hr 9 min 7 sec, Threat Scan, Completed, 0 Malware Detections, 0 Non-Malware Detections,

(end)

[Easy29]

# AdwCleaner v4.204 - Logfile created 20/05/2015 at 00:44:52
# Updated 12/05/2015 by Xplode
# Database : 2015-05-12.2 [server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x86)
# Username : Eric - ERIC-PC
# Running from : C:\Users\Eric\Desktop\AdwCleaner.exe
# Option : Cleaning

***** [ Services ] *****

Service Deleted : netfilter

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\BoostSoftware
Folder Deleted : C:\ProgramData\eef53b2200001ec6
Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FLV Player
Folder Deleted : C:\Program Files\predm
Folder Deleted : C:\Program Files\FLV Player
Folder Deleted : C:\Program Files\MaxComputerCleaner
Folder Deleted : C:\windows\FLV Player
Folder Deleted : C:\Users\Eric\AppData\Local\Reimage
Folder Deleted : C:\Users\Eric\AppData\Local\Max_Computer_Cleaner
Folder Deleted : C:\Users\Eric\AppData\LocalLow\SmartWeb
Folder Deleted : C:\Users\Eric\Documents\MaxComputerCleaner
File Deleted : C:\END
File Deleted : C:\windows\Reimage.ini
File Deleted : C:\windows\system32\drivers\netfilter.sys
File Deleted : C:\Users\Eric\Desktop\Continue Live Installation.lnk
File Deleted : C:\Program Files\Mozilla Firefox\browser\searchplugins\avg-secure-search.xml
File Deleted : C:\Users\Eric\AppData\Roaming\Mozilla\Firefox\Profiles\4zm2i6dd.default-1431780591179\user.js

***** [ Scheduled tasks ] *****

Task Deleted : MaxComputerCleaner_Start

***** [ Shortcuts ] *****

Shortcut Disinfected : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Shortcut Disinfected : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
Shortcut Disinfected : C:\Users\Eric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Shortcut Disinfected : C:\Users\Eric\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Shortcut Disinfected : C:\Users\Eric\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Shortcut Disinfected : C:\Users\Eric\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk
Shortcut Disinfected : C:\Users\Eric\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Mozilla Firefox (2).lnk

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\4673D464-9926-164E-B346-B660612DC46A
Key Deleted : HKLM\SOFTWARE\cd2a301f-1401-eca5-9dcc-0af150d7427b
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}
Key Deleted : HKCU\Software\APN PIP
Key Deleted : HKCU\Software\simplytech
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\Tutorials
Key Deleted : HKCU\Software\Reimage
Key Deleted : HKCU\Software\Linkey
Key Deleted : HKCU\Software\MaxComputerCleanerLanguage
Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKCU\Software\AppDataLow\Software\SmartWeb
Key Deleted : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Key Deleted : HKLM\SOFTWARE\AskPartnerNetwork
Key Deleted : HKLM\SOFTWARE\Conduit
Key Deleted : HKLM\SOFTWARE\SearchProtect
Key Deleted : HKLM\SOFTWARE\SupDp
Key Deleted : HKLM\SOFTWARE\SpeedBit
Key Deleted : HKLM\SOFTWARE\BoostSoftware
Key Deleted : HKLM\SOFTWARE\AIM Toolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Linkey
Data Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17126


-\\ Mozilla Firefox v37.0.2 (x86 en-GB)

[4zm2i6dd.default-1431780591179\prefs.js] - Line Deleted : user_pref("browser.search.searchengine.alias", "oursurfing");
[4zm2i6dd.default-1431780591179\prefs.js] - Line Deleted : user_pref("browser.search.searchengine.iconURL", "hxxp://www.oursurfing.com/favicon.ico");
[4zm2i6dd.default-1431780591179\prefs.js] - Line Deleted : user_pref("browser.search.searchengine.name", "oursurfing");
[4zm2i6dd.default-1431780591179\prefs.js] - Line Deleted : user_pref("browser.search.searchengine.url", "hxxp://www.oursurfing.com/web/?type=ds&ts=1431832208&z=5f9701bd6f3cdc40edbd895gfzdc9g6bec8o4o6e8m&from=cmi&uid=TOSHIBAXMK6475GSX_61HIS49GSXX61HIS49GS&q={s[...]
[4zm2i6dd.default-1431780591179\prefs.js] - Line Deleted : user_pref("extensions.quick_start.enable_search1", false);
[4zm2i6dd.default-1431780591179\prefs.js] - Line Deleted : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);

-\\ Google Chrome v42.0.2311.152

[C:\Users\Eric\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://search.conduit.com/Results.aspx?q={searchTerms}&hl=en&SelfSearch=1&SearchSource=49&ctid=CT3106777
[C:\Users\Eric\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://isearch.avg.com/search?cid={CB24A6FD-1A35-468F-BEEE-D7DC44409698}&mid=2c3dda9937e14839af1099ad8a5a1c3c-b48f4f7af7bb03543b1bb8bacbd4a61dd5eba50b〈=en&ds=hk011&pr=&d=2012-10-31 23:23:25&v=15.3.0.11&pid=avg&sg=0&sap=dsp&q={searchTerms}
[C:\Users\Eric\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://search.conduit.com/Results.aspx?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP6CF5C735-6998-41FA-AC5D-F82623F5CF0A&q={searchTerms}&SSPV=
[C:\Users\Eric\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://search.conduit.com/Results.aspx?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPB13D3528-2032-4331-9E05-9BEE658D4044&q={searchTerms}&SSPV=

*************************

AdwCleaner[R0].txt - [6035 bytes] - [20/05/2015 00:42:41]
AdwCleaner[R1].txt - [6094 bytes] - [20/05/2015 00:44:19]
AdwCleaner[s0].txt - [6204 bytes] - [20/05/2015 00:44:52]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [6263  bytes] ##########
 

[Easy29]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.7.4 (05.19.2015:1)
OS: Windows 7 Home Premium x86
Ran by Eric on Wed 20/05/2015 at  0:51:27.84
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-3390684805-3501667938-2072976212-1001\Software\Microsoft\Internet Explorer\Main\\Start Page



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{853130B6-1A29-4D9D-9513-2A461287651E}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{853130B6-1A29-4D9D-9513-2A461287651E}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] C:\ProgramData\pchealthboost



~~~ FireFox

Successfully deleted the following from C:\Users\Eric\AppData\Roaming\mozilla\firefox\profiles\4zm2i6dd.default-1431780591179\prefs.js

user_pref(browser.search.searchengine.desc, this is my first firefox searchEngine);
user_pref(browser.search.searchengine.ptid, cmi);
user_pref(browser.search.searchengine.uid, TOSHIBAXMK6475GSX_61HIS49GSXX61HIS49GS);





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Wed 20/05/2015 at  0:53:06.35
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

[Easy29]

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.9, February 2014 (build 5.9.9902.0)
Started On Thu Feb 13 03:36:13 2014

Engine: 1.1.10201.0
Signatures: 1.165.3163.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 13 03:38:19 2014


Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.13, June 2014 (build 5.13.10300.0)
Started On Tue Jul 01 01:34:54 2014

Engine: 1.1.10600.0
Signatures: 1.175.1113.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Tue Jul 01 01:36:49 2014


Return code: 0 (0x0)

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.24, May 2015 (build 5.24.11401.0)
Started On Wed May 20 00:56:02 2015

Engine: 1.1.11602.0
Signatures: 1.197.1100.0

Results Summary:
----------------
No infection found.
Microsoft Windows Malicious Software Removal Tool Finished On Wed May 20 01:00:44 2015


Return code: 0 (0x0)
 

[Easy29]

thank you for your help once again Kevin. What should i do next? Do you think I'm clear of this malware now?

[kevinf80]

Lets see what shows in fresh logs from FRST....

 

Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the two logs....

 

Also let me know if your system is running ok or if there are any remaining issues or concernns....

 

Thanks,

 

Kevin...

[AdvancedSetup]

Are you still with us?

This topic will be closed soon if we do not hear back from you.

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!