Solved windows 7 boots to black screen with CMD boxed window

[Resolved] windows 7 boots to black screen with CMD boxed window

G'day Folks,

I have a Windows 7 HP which WAS heavily infected with multiple viruses which I managed to clean.

Among these were,
2433f433 (Trojan.Agent.TPL)
ctqglvk (Rootkit.0Access)
msimg32.dll (Rootkit.0Access)
4e491558.dll (Trojan.Winlock)
4e491558.exe (Trojan.Winlock)
Funshion.exe (PUP.Funshion)
funshionplugin2.dll (PUP.Funshion)
RouterSetting.dll (PUP.Funshion)
Gen:Varient.Kazy.176355
Trojan:GenericKVD.1002917
Gen:Varient.Kazy.179448
Gen:Varient.Kazy.176337
Backdoor.Generic.781994
Gen:VarientSemmi.7284
- Just to name a few.

All MalwareBytes, SuperantiSpyware, SpyBot S&D, Microsoft Security Essentials and Hitman Pro v3.7.5 #199 now give the system a clean bill of health with no viruses detected.

Obviously only Microsoft Security Essentials runs as a resident program in the system tray and all others are used as secondary NON resident parasite (virus) scanners.

The problem now is that the system will not boot normally to the desktop and instead boots to a black screen with a CMD boxed window titled Administrator: cmd.exe
with the content text,
Line 1 = Microsoft Windows [Version 6.1.7601]
Line 2 = Copyright <c> 2009 Microsoft Corporation. All rights reserved.
Line 3 = (blank line
Line 4 = C:\Windows-system32>
I have checked the run parameters and in fact had disable all except windows via "msconfig" and it still boots to the CMD boxed window.

Any help to fix this boot problem would be appreciated.

Regards

 

FRST Report

Thanks Broni for rep[ly and clear instruction, here is the frst.txt report.

--------------------------------------------------------
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 02-06-2013 03
Ran by SYSTEM on 03-06-2013 23:11:30
Running from E:\
Windows 7 Home Premium (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Recovery
The current controlset is ControlSet002
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and Addition.txt log.
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\mssecex.exe" -hide -runkey [x]
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [] [x]
HKLM\...\Run: [ApnUpdater] "C:\Program Files\Ask.com\Updater\Updater.exe" [x]
HKLM\...\runonceex: [] [x]
HKU\Guest\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [x]
HKU\ralph\...\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [x]
HKU\ralph\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [ 2013-02-28] (Skype Technologies S.A.)
HKU\ralph\...\Run: [Google Update] "C:\Users\ralph\AppData\Local\Google\Update\GoogleUpdate.exe" /c [ 2010-09-20] (Google Inc.)
HKU\ralph\...\Run: [] [x]
HKU\ralph\...\Winlogon: [Shell] cmd.exe [ 2010-11-20] (Microsoft Corporation) <==== ATTENTION
========================== Services (Whitelisted) =================
S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-03] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-03] (Malwarebytes Corporation)
S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-26] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295232 2013-01-26] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-03] (Malwarebytes Corporation)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-19] (Microsoft Corporation)
S3 catchme; \??\C:\Users\ralph\AppData\Local\Temp\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========
2013-06-03 23:11 - 2013-06-03 23:11 - 00000000 ____D C:\FRST
2013-06-02 17:05 - 2013-05-28 02:44 - 00009723 ____A C:\Users\ralph\Desktop\1369733210_1_02.xml
2013-06-02 17:05 - 2013-02-13 17:32 - 00000805 ____A C:\Users\ralph\Desktop\hosts.txt
2013-06-02 17:04 - 2013-06-02 17:49 - 00000000 ____D C:\Users\ralph\Desktop\RalphTaylor
2013-06-02 06:46 - 2013-06-02 06:53 - 09465395 ____A C:\Users\ralph\Desktop\scan05.odt
2013-06-02 06:44 - 2013-06-02 06:53 - 00235553 ____A C:\Users\ralph\AppData\Local\census.cache
2013-06-02 06:43 - 2013-06-02 06:53 - 00105661 ____A C:\Users\ralph\AppData\Local\ars.cache
2013-06-02 06:31 - 2013-06-02 06:31 - 00000036 ____A C:\Users\ralph\AppData\Local\housecall.guid.cache
2013-06-02 06:05 - 2013-06-02 06:07 - 00000469 ____A C:\Users\ralph\Desktop\Win7HPkeys.txt
2013-06-02 06:03 - 2013-06-02 06:03 - 00002070 ____A C:\Users\Public\Desktop\Belarc Advisor.lnk
2013-06-02 06:03 - 2013-06-02 06:03 - 00000000 ____D C:\Program Files\Belarc
2013-06-01 06:15 - 2013-06-01 06:15 - 00001246 ____A C:\Users\ralph\Desktop\System Restore.lnk
2013-05-31 15:54 - 2013-05-31 15:54 - 00012872 ____A (SurfRight B.V.) C:\Windows\System32\bootdelete.exe
2013-05-31 15:25 - 2013-05-31 15:25 - 00001897 ____A C:\Users\Public\Desktop\HitmanPro.lnk
2013-05-31 15:24 - 2013-05-31 15:55 - 00000000 ____D C:\ProgramData\HitmanPro
2013-05-31 15:24 - 2013-05-31 15:25 - 00000000 ____D C:\Program Files\HitmanPro
2013-05-30 21:49 - 2011-05-25 22:05 - 00000372 ____A C:\Users\ralph\Desktop\microsoft.txt
2013-05-30 06:36 - 2013-05-30 06:34 - 00000210 ____A C:\Users\ralph\Desktop\Boot.ini
2013-05-30 06:36 - 2013-05-30 06:34 - 00000210 ____A C:\Boot.ini
2013-05-29 03:04 - 2013-05-29 03:04 - 00000696 ____A C:\Users\ralph\Desktop\Registry Crawler.lnk
2013-05-29 03:04 - 2013-05-29 03:04 - 00000000 ____D C:\OSD
2013-05-29 03:02 - 2013-05-29 03:03 - 00000039 ____A C:\Users\ralph\Desktop\RegCrawKey.txt
2013-05-29 02:59 - 2013-05-29 06:57 - 00000343 ____A C:\Users\ralph\AppData\Roaming\Drives Meter_Settings.ini
2013-05-29 02:48 - 2013-05-29 02:48 - 00000000 ____D C:\Users\ralph\AppData\Roaming\Windows SideBar
2013-05-29 02:43 - 2013-05-29 02:45 - 00001214 ____A C:\Users\ralph\Desktop\Windows Explorer.lnk
2013-05-29 02:38 - 2013-05-29 02:39 - 00000034 ____A C:\Users\ralph\Desktop\MalWareKey.txt
2013-05-29 02:22 - 2013-06-02 06:28 - 00000979 ____A C:\Users\ralph\Desktop\cmd error.txt
2013-05-29 02:08 - 2009-07-13 20:42 - 00001322 ____A C:\Users\ralph\Desktop\Wordpad.lnk
2013-05-29 00:14 - 2013-05-29 00:14 - 00002117 ____A C:\Users\ralph\Desktop\Microsoft Security Essentials.lnk
2013-05-29 00:14 - 2013-05-29 00:14 - 00001330 ____A C:\Users\ralph\Desktop\Sidebar.lnk
2013-05-29 00:14 - 2013-05-29 00:14 - 00001294 ____A C:\Users\ralph\Desktop\Computer Management.lnk
2013-05-29 00:12 - 2013-05-29 00:12 - 00000505 ____A C:\Users\ralph\Desktop\Programs and Features - Shortcut.lnk
2013-05-28 23:55 - 2013-05-28 23:55 - 00001071 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-05-28 23:54 - 2013-05-28 23:54 - 00000000 ____D C:\Program Files\Common Files\Java
2013-05-28 23:52 - 2013-05-28 23:52 - 00263584 ____A (Oracle Corporation) C:\Windows\System32\javaws.exe
2013-05-28 23:52 - 2013-05-28 23:52 - 00094112 ____A (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge.dll
2013-05-20 02:08 - 2013-05-27 21:33 - 00000000 ____D C:\Users\ralph\AppData\Roaming\Ihony
2013-05-20 02:08 - 2013-05-20 02:08 - 00000000 ____D C:\Users\ralph\AppData\Roaming\Nuri
2013-05-20 02:08 - 2013-05-20 02:08 - 00000000 ____D C:\Users\ralph\AppData\Roaming\Dyzoim
2013-05-19 16:15 - 2013-05-25 15:34 - 00000000 ____D C:\Users\ralph\AppData\Roaming\Oxhe
2013-05-19 16:15 - 2013-05-21 16:13 - 00000000 ____D C:\Users\ralph\AppData\Roaming\Axobt
2013-05-19 16:15 - 2013-05-19 16:15 - 00000000 ____D C:\Users\ralph\AppData\Roaming\Edkona
2013-05-15 04:09 - 2013-05-05 11:25 - 12324864 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-15 04:09 - 2013-05-05 11:12 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-05-15 04:09 - 2013-04-04 14:11 - 01800704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-05-15 04:09 - 2013-04-04 14:09 - 09738752 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-05-15 04:09 - 2013-04-04 14:02 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-05-15 04:09 - 2013-04-04 14:02 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-05-15 04:09 - 2013-04-04 14:02 - 01104384 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-05-15 04:09 - 2013-04-04 14:01 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-05-15 04:09 - 2013-04-04 13:59 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-05-15 04:09 - 2013-04-04 13:58 - 00717824 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-05-15 04:09 - 2013-04-04 13:58 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-05-15 04:09 - 2013-04-04 13:57 - 00420864 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-05-15 04:09 - 2013-04-04 13:56 - 00607744 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-05-15 04:09 - 2013-04-04 13:55 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-05-15 04:09 - 2013-04-04 13:54 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-05-15 04:09 - 2013-04-04 13:50 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-05-15 03:02 - 2013-04-09 21:18 - 00728424 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-05-15 03:02 - 2013-04-09 21:18 - 00218984 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys
2013-05-15 03:02 - 2013-04-09 19:14 - 02347520 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-05-15 03:01 - 2013-02-26 21:05 - 00101720 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe
2013-05-15 03:01 - 2013-02-26 20:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-05-15 03:01 - 2013-02-26 20:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-05-15 03:01 - 2013-02-26 20:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll
2013-05-15 03:01 - 2013-02-26 20:49 - 00047104 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll
==================== One Month Modified Files and Folders ========
2013-06-03 23:11 - 2013-06-03 23:11 - 00000000 ____D C:\FRST
2013-06-03 04:58 - 2010-08-23 22:31 - 01911395 ____A C:\Windows\WindowsUpdate.log
2013-06-03 04:51 - 2010-08-23 22:41 - 00754458 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-03 04:45 - 2010-10-04 02:23 - 00000000 ____D C:\Users\ralph\Downloads\Farbar Recovery Scan Tool 32-Bit
2013-06-03 04:33 - 2010-09-20 15:25 - 00000884 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-03 04:32 - 2013-03-01 21:32 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-03 04:03 - 2010-09-23 22:55 - 00000908 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2917188583-2753293597-2095739363-1000UA.job
2013-06-03 03:03 - 2010-09-23 22:55 - 00000856 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2917188583-2753293597-2095739363-1000Core.job
2013-06-02 17:49 - 2013-06-02 17:04 - 00000000 ____D C:\Users\ralph\Desktop\RalphTaylor
2013-06-02 17:07 - 2010-09-20 15:25 - 00000000 ____D C:\Users\ralph\AppData\Local\Google
2013-06-02 17:06 - 2010-09-23 22:06 - 00000000 ____D C:\Users\ralph\AppData\Roaming\Skype
2013-06-02 16:20 - 2009-07-13 20:34 - 00022576 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-02 16:20 - 2009-07-13 20:34 - 00022576 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-02 16:13 - 2010-09-20 15:25 - 00000880 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-02 16:13 - 2009-07-13 20:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-02 16:13 - 2009-07-13 20:39 - 00220648 ____A C:\Windows\setupact.log
2013-06-02 07:11 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\System32\NDF
2013-06-02 06:53 - 2013-06-02 06:46 - 09465395 ____A C:\Users\ralph\Desktop\scan05.odt
2013-06-02 06:53 - 2013-06-02 06:44 - 00235553 ____A C:\Users\ralph\AppData\Local\census.cache
2013-06-02 06:53 - 2013-06-02 06:43 - 00105661 ____A C:\Users\ralph\AppData\Local\ars.cache
2013-06-02 06:31 - 2013-06-02 06:31 - 00000036 ____A C:\Users\ralph\AppData\Local\housecall.guid.cache
2013-06-02 06:31 - 2010-09-28 19:58 - 00000000 ____D C:\Users\ralph\Downloads\TrendMicro-HouseCall
2013-06-02 06:28 - 2013-05-29 02:22 - 00000979 ____A C:\Users\ralph\Desktop\cmd error.txt
2013-06-02 06:07 - 2013-06-02 06:05 - 00000469 ____A C:\Users\ralph\Desktop\Win7HPkeys.txt
2013-06-02 06:03 - 2013-06-02 06:03 - 00002070 ____A C:\Users\Public\Desktop\Belarc Advisor.lnk
2013-06-02 06:03 - 2013-06-02 06:03 - 00000000 ____D C:\Program Files\Belarc
2013-06-02 06:03 - 2010-09-02 19:36 - 00000000 ____D C:\Users\ralph\Downloads\Belar 8.3b
2013-06-01 06:15 - 2013-06-01 06:15 - 00001246 ____A C:\Users\ralph\Desktop\System Restore.lnk
2013-05-31 15:55 - 2013-05-31 15:24 - 00000000 ____D C:\ProgramData\HitmanPro
2013-05-31 15:54 - 2013-05-31 15:54 - 00012872 ____A (SurfRight B.V.) C:\Windows\System32\bootdelete.exe
2013-05-31 15:25 - 2013-05-31 15:25 - 00001897 ____A C:\Users\Public\Desktop\HitmanPro.lnk
2013-05-31 15:25 - 2013-05-31 15:24 - 00000000 ____D C:\Program Files\HitmanPro
2013-05-30 23:38 - 2010-09-24 14:56 - 00000000 ____D C:\Users\ralph\AppData\Local\LogMeIn Rescue Calling Card
2013-05-30 06:35 - 2009-04-28 06:28 - 00000354 __ASH C:\Boot.ini.saved
2013-05-30 06:34 - 2013-05-30 06:36 - 00000210 ____A C:\Users\ralph\Desktop\Boot.ini
2013-05-30 06:34 - 2013-05-30 06:36 - 00000210 ____A C:\Boot.ini
2013-05-30 06:34 - 2010-08-24 16:22 - 00000210 ____A C:\Boot.BAK
2013-05-29 06:57 - 2013-05-29 02:59 - 00000343 ____A C:\Users\ralph\AppData\Roaming\Drives Meter_Settings.ini
2013-05-29 03:04 - 2013-05-29 03:04 - 00000696 ____A C:\Users\ralph\Desktop\Registry Crawler.lnk
2013-05-29 03:04 - 2013-05-29 03:04 - 00000000 ____D C:\OSD
2013-05-29 03:03 - 2013-05-29 03:02 - 00000039 ____A C:\Users\ralph\Desktop\RegCrawKey.txt
2013-05-29 02:48 - 2013-05-29 02:48 - 00000000 ____D C:\Users\ralph\AppData\Roaming\Windows SideBar
2013-05-29 02:45 - 2013-05-29 02:43 - 00001214 ____A C:\Users\ralph\Desktop\Windows Explorer.lnk
2013-05-29 02:39 - 2013-05-29 02:38 - 00000034 ____A C:\Users\ralph\Desktop\MalWareKey.txt
2013-05-29 02:38 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\System32\DriverStore
2013-05-29 02:20 - 2011-04-14 22:23 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-05-29 02:20 - 2010-09-14 15:41 - 00031912 ____A C:\Windows\PFRO.log
2013-05-29 00:16 - 2012-03-03 19:07 - 00000000 ____D C:\Program Files\Java
2013-05-29 00:14 - 2013-05-29 00:14 - 00002117 ____A C:\Users\ralph\Desktop\Microsoft Security Essentials.lnk
2013-05-29 00:14 - 2013-05-29 00:14 - 00001330 ____A C:\Users\ralph\Desktop\Sidebar.lnk
2013-05-29 00:14 - 2013-05-29 00:14 - 00001294 ____A C:\Users\ralph\Desktop\Computer Management.lnk
2013-05-29 00:12 - 2013-05-29 00:12 - 00000505 ____A C:\Users\ralph\Desktop\Programs and Features - Shortcut.lnk
2013-05-29 00:04 - 2010-09-23 22:58 - 00002368 ____A C:\Users\ralph\Desktop\Google Chrome.lnk
2013-05-28 23:55 - 2013-05-28 23:55 - 00001071 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-05-28 23:54 - 2013-05-28 23:54 - 00000000 ____D C:\Program Files\Common Files\Java
2013-05-28 23:52 - 2013-05-28 23:52 - 00263584 ____A (Oracle Corporation) C:\Windows\System32\javaws.exe
2013-05-28 23:52 - 2013-05-28 23:52 - 00094112 ____A (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge.dll
2013-05-28 23:52 - 2012-10-23 13:17 - 00174496 ____A (Oracle Corporation) C:\Windows\System32\javaw.exe
2013-05-28 23:52 - 2012-10-23 13:17 - 00174496 ____A (Oracle Corporation) C:\Windows\System32\java.exe
2013-05-28 23:52 - 2012-07-11 22:04 - 00866720 ____A (Oracle Corporation) C:\Windows\System32\npdeployJava1.dll
2013-05-28 23:52 - 2010-09-06 19:47 - 00788896 ____A (Oracle Corporation) C:\Windows\System32\deployJava1.dll
2013-05-28 05:00 - 2012-04-13 04:04 - 00000000 ____D C:\users\Guest
2013-05-28 05:00 - 2010-08-23 22:40 - 00000000 ____D C:\users\ralph
2013-05-28 02:44 - 2013-06-02 17:05 - 00009723 ____A C:\Users\ralph\Desktop\1369733210_1_02.xml
2013-05-27 21:33 - 2013-05-20 02:08 - 00000000 ____D C:\Users\ralph\AppData\Roaming\Ihony
2013-05-25 15:34 - 2013-05-19 16:15 - 00000000 ____D C:\Users\ralph\AppData\Roaming\Oxhe
2013-05-21 16:13 - 2013-05-19 16:15 - 00000000 ____D C:\Users\ralph\AppData\Roaming\Axobt
2013-05-20 02:08 - 2013-05-20 02:08 - 00000000 ____D C:\Users\ralph\AppData\Roaming\Nuri
2013-05-20 02:08 - 2013-05-20 02:08 - 00000000 ____D C:\Users\ralph\AppData\Roaming\Dyzoim
2013-05-19 16:15 - 2013-05-19 16:15 - 00000000 ____D C:\Users\ralph\AppData\Roaming\Edkona
2013-05-18 17:33 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\rescache
2013-05-15 22:00 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-05-15 14:43 - 2009-07-13 20:33 - 00295936 ____A C:\Windows\System32\FNTCACHE.DAT
2013-05-15 04:08 - 2010-09-13 22:22 - 72607752 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-05-15 03:33 - 2013-03-01 21:32 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-05-15 03:33 - 2011-07-03 16:04 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-05-15 02:44 - 2011-06-30 16:21 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-05-05 11:25 - 2013-05-15 04:09 - 12324864 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-05 11:12 - 2013-05-15 04:09 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
==================== Known DLLs (Whitelisted) ============

==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
Restore point made on: 2013-05-28 23:51:39
Restore point made on: 2013-05-28 23:52:09
Restore point made on: 2013-05-29 00:15:45
Restore point made on: 2013-05-30 06:34:25
Restore point made on: 2013-06-02 05:51:21
==================== Memory info ===========================
Percentage of memory in use: 18%
Total physical RAM: 2037.49 MB
Available physical RAM: 1661.91 MB
Total Pagefile: 2037.49 MB
Available Pagefile: 1663.68 MB
Total Virtual: 2047.88 MB
Available Virtual: 1932.91 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:465.75 GB) (Free:423.78 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Repair disc Windows 7 32-bit) (CDROM) (Total:0.14 GB) (Free:0 GB) UDF
Drive e: () (Removable) (Total:1.89 GB) (Free:0.44 GB) FAT
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: B25DB25D)
Partition 1: (Active) - (Size=466 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 2 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=2 GB) - (Type=06)

Last Boot: 2013-06-02 16:43
==================== End Of Log ============================

Regards

 

Problem fixed - Thanks broni

Problem fixed - Thanks broni

fixlog.txt report as requested
--------------------------------------------
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 02-06-2013 03
Ran by SYSTEM at 2013-06-04 16:28:36 Run:1
Running from E:\
Boot Mode: Recovery
==============================================
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater => Value not found.
HKLM\Software\Microsoft\Windows\CurrentVersion\runonceex\\ => Value deleted successfully.
HKEY_USERS\ralph\Software\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully.
HKEY_USERS\ralph\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
catchme => Service deleted successfully.
==== End of Fixlog ====
--------------------------------------------

Thanks again broni

Regards
Roger H.

 

Thread Tools drop down menu does not shop option to "Mark Topic as Resolved" any ideas why ?

 

dds and attach reports

dds report
---------------------------------------------------------
DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 10.0.9200.16576 BrowserJavaVersion: 10.21.2
Run by ralph at 21:49:54 on 2013-06-05
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.61.1033.18.2037.845 [GMT 10:00]
.
AV: AVG Internet Security 2011 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Internet Security 2011 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: AVG Firewall *Enabled* {621CC794-9486-F902-D092-0484E8EA828B}
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Windows\system32\CISVC.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\System32\snmp.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchIndexer.exe
c:\Program Files\Microsoft Security Client\NisSrv.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k apphost
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k iissvcs
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uWindow Title = Internet Explorer, optimized for Bing and MSN
uDefault_Page_URL = hxxp://www.ninemsn.com.au/?ocid=OIE9HP
uProxyServer = localhost:21320
BHO: FindLyrics: {44C9CC91-6A4A-4579-B4B5-899ECDC18DC6} - c:\program files\findlyrics\FindLyrics.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - c:\program files\windows live\companion\companioncore.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe "
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /minimized /regrun
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [Google Update] "c:\users\ralph\appdata\local\google\update\GoogleUpdate.exe" /c
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [SDTray] "c:\program files\spybot - search & destroy 2\SDTray.exe "
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft security client\msseces.exe
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 192.168.0.254
TCP: Interfaces\{C74850B9-22DD-43DB-B1D1-36C960682058} : DHCPNameServer = 192.168.0.254
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\belarcadvisor\system\BAVoilaX.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
Notify: igfxcui - igfxdev.dll
Notify: SDWinLogon - SDWinLogon.dll
SEH: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\superantispyware\SASSEH.DLL
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2013-1-20 195296]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-23 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-13 67664]
R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2013-5-24 119056]
R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2013-5-29 418376]
R2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2013-1-20 100328]
R2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files\spybot - search & destroy 2\SDFSSvc.exe [2013-6-5 1817560]
R2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files\spybot - search & destroy 2\SDUpdSvc.exe [2013-6-5 1033688]
R2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files\spybot - search & destroy 2\SDWSCSvc.exe [2013-6-5 171928]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-4-15 22856]
R3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\NisSrv.exe [2013-1-27 295232]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2009-3-1 139776]
S2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-4-15 701512]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-3-1 161384]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2013-6-3 14920]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2013-6-3 9160]
S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2012-4-9 39272]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2012-3-8 1492840]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-5-27 52224]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-8-26 1343400]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-5-6 11520]
S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]
.
=============== Created Last 30 ================
.
2013-06-05 04:42:54 60872 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{88c36bbf-7d4f-4b86-9b9a-be89d4bea799}\offreg.dll
2013-06-05 04:00:27 69632 ----a-r- c:\users\ralph\appdata\roaming\microsoft\installer\{89505a66-35f0-4401-b3ad-d077051f8698}\ARPPRODUCTICON.exe
2013-06-05 04:00:27 49152 ----a-r- c:\users\ralph\appdata\roaming\microsoft\installer\{89505a66-35f0-4401-b3ad-d077051f8698}\UNINST_Uninstall_Q_336D8C9DB2424DE5BC518E574B25652F.exe
2013-06-05 04:00:22 -------- d-----w- c:\users\ralph\appdata\local\Downloaded Installations
2013-06-05 03:59:59 -------- d-----w- c:\users\ralph\appdata\roaming\2V2Z1C1P1H1P1Q1F2W1G1I1F1T1QtAtB
2013-06-05 03:58:39 -------- d-----w- c:\program files\FindLyrics
2013-06-05 03:45:01 724464 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{65db9c01-7729-4654-a399-5525ab243bc5}\gapaengine.dll
2013-06-05 03:44:54 7016152 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{88c36bbf-7d4f-4b86-9b9a-be89d4bea799}\mpengine.dll
2013-06-05 03:43:26 -------- d-----w- c:\program files\Microsoft Security Client
2013-06-05 02:58:23 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2013-06-05 02:57:25 15224 ----a-w- c:\windows\system32\sdnclean.exe
2013-06-05 02:57:20 -------- d-----w- c:\program files\Spybot - Search & Destroy 2
2013-06-05 02:48:01 -------- d-----w- c:\users\ralph\appdata\roaming\SUPERAntiSpyware.com
2013-06-05 02:47:52 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2013-06-05 02:47:52 -------- d-----w- c:\program files\SUPERAntiSpyware
2013-06-04 14:34:47 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-06-04 07:11:08 -------- d-----w- C:\FRST
2013-06-04 06:18:04 73728 ----a-w- c:\windows\system32\RtNicProp32.dll
2013-06-04 06:18:04 43008 ----a-w- c:\windows\system32\drivers\Rtnicxp.sys
2013-06-04 05:48:25 70912 ----a-w- c:\windows\system32\drivers\Rtlnicxp.sys
2013-06-03 14:19:30 -------- d-----w- c:\program files\CCleaner
2013-06-03 13:58:37 19840 ----a-w- c:\windows\system32\EuEpmGdi.dll
2013-06-03 13:58:36 9160 ----a-w- c:\windows\system32\EuGdiDrv.sys
2013-06-03 13:58:36 87112 ----a-w- c:\windows\system32\setupempdrv03.exe
2013-06-03 13:58:36 2468520 ----a-w- c:\windows\system32\BootMan.exe
2013-06-03 13:58:36 14920 ----a-w- c:\windows\system32\epmntdrv.sys
2013-06-03 13:58:22 -------- d-----w- c:\program files\EaseUS
2013-06-02 14:03:43 -------- d-----w- c:\program files\Belarc
2013-05-31 23:54:37 12872 ----a-w- c:\windows\system32\bootdelete.exe
2013-05-31 23:24:25 -------- d-----w- c:\program files\HitmanPro
2013-05-31 23:24:06 -------- d-----w- c:\programdata\HitmanPro
2013-05-31 15:53:44 7016152 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{b10d63cb-1f34-400d-837d-a67a57a30979}\mpengine.dll
2013-05-29 11:04:17 -------- d-----w- C:\OSD
2013-05-29 10:48:42 -------- d-----w- c:\users\ralph\appdata\roaming\Windows SideBar
2013-05-29 07:55:00 -------- d-----w- c:\users\ralph\appdata\local\Programs
2013-05-29 07:52:30 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-05-20 10:08:55 -------- d-----w- c:\users\ralph\appdata\roaming\Nuri
2013-05-20 10:08:55 -------- d-----w- c:\users\ralph\appdata\roaming\Ihony
2013-05-20 10:08:55 -------- d-----w- c:\users\ralph\appdata\roaming\Dyzoim
2013-05-20 00:15:47 -------- d-----w- c:\users\ralph\appdata\roaming\Oxhe
2013-05-20 00:15:47 -------- d-----w- c:\users\ralph\appdata\roaming\Edkona
2013-05-20 00:15:47 -------- d-----w- c:\users\ralph\appdata\roaming\Axobt
2013-05-15 11:02:16 2347520 ----a-w- c:\windows\system32\win32k.sys
2013-05-15 11:02:07 728424 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-05-15 11:02:06 218984 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-05-15 11:01:39 101720 ----a-w- c:\windows\system32\consent.exe
2013-05-15 11:01:38 47104 ----a-w- c:\windows\system32\appinfo.dll
2013-05-15 11:01:38 1796096 ----a-w- c:\windows\system32\authui.dll
.
==================== Find3M ====================
.
2013-06-04 14:34:47 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-05-29 07:52:18 866720 ----a-w- c:\windows\system32\npdeployJava1.dll
2013-05-29 07:52:18 788896 ----a-w- c:\windows\system32\deployJava1.dll
2013-05-15 11:33:10 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-05-15 11:33:09 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-01 16:06:08 238872 ------w- c:\windows\system32\MpSigStub.exe
2013-04-12 13:45:29 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-04 04:50:32 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-03-19 05:04:13 3968856 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-03-19 05:04:10 3913560 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-19 04:48:45 38912 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-19 02:49:16 69632 ----a-w- c:\windows\system32\smss.exe
.
============= FINISH: 21:55:16.85 ===============
-------------------------------------------------------------

attach report
--------------------------------------------------------------
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 24/08/2010 4:40:18 PM
System Uptime: 5/06/2013 2:24:52 PM (7 hours ago)
.
Motherboard: Gigabyte Technology Co., Ltd. | | G31M-S2L
Processor: Pentium(R) Dual-Core CPU E5200 @ 2.50GHz | Socket 775 | 1900/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 466 GiB total, 421.692 GiB free.
D: is CDROM (UDF)
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP380: 29/05/2013 5:51:28 PM - Removed Java(TM) 6 Update 37
RP381: 29/05/2013 5:52:04 PM - Installed Java 7 Update 21
RP382: 29/05/2013 6:15:41 PM - Removed Java(TM) 6 Update 22
RP383: 31/05/2013 12:34:14 AM - Windows Update
RP384: 2/06/2013 11:51:06 PM - pcbf 02062013
RP385: 4/06/2013 12:39:16 AM - Windows Update
RP386: 4/06/2013 3:54:35 PM - Device Driver Package Install: TP-LINK TECHNOLOGIES CO., LTD. Network adapters
RP387: 4/06/2013 4:22:34 PM - Device Driver Package Install: TP-LINK TECHNOLOGIES CO., LTD. Network adapters
RP388: 5/06/2013 12:31:24 AM - Windows Update
.
==== Installed Programs ======================
.
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.7)
Belarc Advisor 8.3
CCleaner
D3DX10
DraftSight
EaseUS Partition Master 9.2.1 Professional
FindLyrics
Google Chrome
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
HitmanPro 3.7
Intel(R) Graphics Media Accelerator Driver
Intel(R) TV Wizard
Java 7 Update 21
Java Auto Updater
Junk Mail filter update
Malwarebytes Anti-Malware version 1.75.0.1300
Mesh Runtime
Messenger Companion
Microsoft Application Error Reporting
Microsoft Security Client
Microsoft Security Essentials
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
MSVCRT
OpenOffice Packages
OpenOffice.org 3.4.1
Registry Crawler
Skypeâ„¢ 6.3
Spybot - Search & Destroy
SUPERAntiSpyware
Telstra Plus Premium Support
Times Reader
VLC media player 1.0.1-fec1
Windows 7 Upgrade Advisor
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WinRAR 4.20 (32-bit)
.
==== Event Viewer Messages From Past Week ========
.
5/06/2013 2:28:00 PM, Error: Microsoft-Windows-DNS-Client [1012] - There was an error while attempting to read the local hosts file.
5/06/2013 2:26:24 PM, Error: Service Control Manager [7023] - The Peer Name Resolution Protocol service terminated with the following error: %%-2140993535
5/06/2013 2:26:24 PM, Error: Service Control Manager [7001] - The Peer Networking Grouping service depends on the Peer Name Resolution Protocol service which failed to start because of the following error: %%-2140993535
5/06/2013 2:26:24 PM, Error: Microsoft-Windows-PNRPSvc [102] - The Peer Name Resolution Protocol cloud did not start because the creation of the default identity failed with error code: 0x80630801.
5/06/2013 2:26:01 PM, Error: SNMP [1500] - The SNMP Service encountered an error while accessing the registry key SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration.
5/06/2013 12:58:01 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Spybot-S&D 2 Scanner Service service to connect.
5/06/2013 12:58:01 PM, Error: Service Control Manager [7000] - The Spybot-S&D 2 Scanner Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
5/06/2013 12:22:20 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
5/06/2013 12:22:20 AM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
5/06/2013 12:22:20 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments " " in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
5/06/2013 12:21:58 AM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
5/06/2013 12:21:58 AM, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error %%-1073473535.
5/06/2013 10:50:03 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.151.1570.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.9506.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
5/06/2013 10:49:13 AM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.151.1570.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.9506.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
5/06/2013 1:32:08 PM, Error: Service Control Manager [7031] - The Spybot-S&D 2 Updating Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
3/06/2013 11:07:59 AM, Error: Microsoft-Windows-DistributedCOM [10000] - Unable to start a DCOM Server: {ABC01078-F197-4B0B-ADBC-CFE684B39C82}. The error: "2" Happened while starting this command: "C:\Program Files\Google\Update\1.3.21.135\GoogleUpdateOnDemand.exe" -Embedding
3/06/2013 10:47:09 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.
.
==== End Of File ===========================
----------------------------------------------------------------

Final verdict please
regards
Roger H.

 

Malwarebytes Anti-Malware (PRO) 1.75.0.1300 report

Malwarebytes Anti-Malware (PRO) 1.75.0.1300
www.malwarebytes.org
Database version: v2013.06.05.01
Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16576
ralph :: RALPH-PC [administrator]
Protection: Disabled
5/06/2013 3:57:30 PM
mbam-log-2013-06-05 (15-57-30).txt
Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 389256
Time elapsed: 43 minute(s), 41 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)

 

Reports

RogueKiller Report

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : ralph [Admin rights]
Mode : Scan -- Date : 06/06/2013 11:25:44
| ARK || FAK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 7 ¤¤¤
[TASK][SUSP PATH] {E9D81C7C-DADF-43C3-B123-4683C0E4BA65} : C:\Users\ralph\Desktop\mflpro\DCP-116C\Setup.exe [-] -> FOUND
[PROXY IE] HKCU\[...]\Internet Settings : ProxyServer (localhost:21320) -> FOUND
[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND
[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [LOADED] ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: ST3500418AS ATA Device +++++
--- User ---
[MBR] e18cc14d8eeef6cc45503aae3561a6ad
[BSP] 48c07458d9241a47563bce740d306371 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 476929 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[1]_S_06062013_02d1125.txt >>
RKreport[1]_S_06062013_02d1125.txt

======================

MalwareByte Anti Rootkit Report

Malwarebytes Anti-Rootkit BETA 1.06.0.1003
www.malwarebytes.org
Database version: v2013.06.05.11
Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16576
ralph :: RALPH-PC [administrator]
6/06/2013 11:31:06 AM
mbar-log-2013-06-06 (11-31-06).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2P
Scan options disabled: Deep Anti-Rootkit Scan | PUP
Objects scanned: 252063
Time elapsed: 8 minute(s), 17 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)

--------------------------------------

System-Log

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.06.0.1003
(c) Malwarebytes Corporation 2011-2012
OS version: 6.1.7601 Windows 7 Service Pack 1 x86
Account is Administrative
Internet Explorer version: 10.0.9200.16576
File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 2.500000 GHz
Memory total: 2136465408, free: 1098203136
Downloaded database version: v2013.06.05.11
Downloaded database version: v2013.05.22.01
Initializing...
------------ Kernel report ------------
06/06/2013 11:30:59
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\halmacpi.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\intelide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\MpFilter.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\system32\drivers\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\termdd.sys
\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
\??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\igdkmd32.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\drivers\HDAudBus.sys
\SystemRoot\system32\DRIVERS\Rt86win7.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\drivers\CompositeBus.sys
\SystemRoot\System32\Drivers\RootMdm.sys
\SystemRoot\system32\drivers\modem.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\drivers\swenum.sys
\SystemRoot\system32\drivers\ks.sys
\SystemRoot\system32\drivers\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\HdAudio.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\drivers\luafv.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\DRIVERS\parvdm.sys
\SystemRoot\system32\DRIVERS\NisDrvWFP.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\asyncmac.sys
\??\C:\Windows\system32\drivers\TrueSight.sys
\??\c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{88C36BBF-7D4F-4B86-9B9A-BE89D4BEA799}\MpKsl944cbcd0.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff85e18a38
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\
Lower Device Object: 0xffffffff8596e0b0
Lower Device Driver Name: \Driver\atapi\
<<<2>>>
Device number: 0, partition: 1
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff85e18a38, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff85e18670, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff85e18a38, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff8596c900, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffffff8596e0b0, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
Device number: 0, partition: 1
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\Windows\system32\drivers...
<<<2>>>
Device number: 0, partition: 1
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: B25DB25D
Partition information:
Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 63 Numsec = 976751937
Partition file system is NTFS
Partition is bootable
Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Disk Size: 500106780160 bytes
Sector size: 512 bytes
Scanning physical sectors of unpartitioned space on drive 0 (1-62-976751055-976771055)...
Done!
Scan finished
=======================================

Removal queue found; removal started
Removing c:\programdata\malwarebytes' anti-malware (portable)\mbr_0_i.mbam...
Removing c:\programdata\malwarebytes' anti-malware (portable)\bootstrap_0_0_63_i.mbam...
Removing c:\programdata\malwarebytes' anti-malware (portable)\mbr_0_r.mbam...
Removal finished

-----------------------------------
End Reports

Regards
Roger H.

 

2nd Report

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : ralph [Admin rights]
Mode : Remove -- Date : 06/06/2013 11:27:17
| ARK || FAK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 7 ¤¤¤
[TASK][SUSP PATH] {E9D81C7C-DADF-43C3-B123-4683C0E4BA65} : C:\Users\ralph\Desktop\mflpro\DCP-116C\Setup.exe [-] -> DELETED
[PROXY IE] HKCU\[...]\Internet Settings : ProxyServer (localhost:21320) -> NOT REMOVED, USE PROXYFIX
[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> DELETED
[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2)
[HJ] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1)
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [LOADED] ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: ST3500418AS ATA Device +++++
--- User ---
[MBR] e18cc14d8eeef6cc45503aae3561a6ad
[BSP] 48c07458d9241a47563bce740d306371 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 476929 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[2]_D_06062013_02d1127.txt >>
RKreport[1]_S_06062013_02d1125.txt ; RKreport[2]_D_06062013_02d1127.txt

 

G'day Broni,

So far so good
I had just finished downloading and running the AVG 2011 remover and run it before I ran ComboFix

There were only Legacy remnants of AVG which I did not delete !
However ComboFix suggested that i still had AVG 2011 running. knowing that his may have been a false positive, I continued with ComboFix which is running currently on the "ralph" machine.
- currently on the Preparing Log Report
- will continue to post from there

Regards
Roger H.

 

ComboFix Report

ComboFix Report

ComboFix 13-06-05.05 - ralph 06/06/2013 13:15:38.2.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.61.1033.18.2037.1205 [GMT 10:00]
Running from: c:\users\ralph\Desktop\ComboFix.exe
AV: AVG Internet Security 2011 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
FW: AVG Firewall *Enabled* {621CC794-9486-F902-D092-0484E8EA828B}
SP: AVG Internet Security 2011 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\alotappbar
c:\program files\alotappbar\bin\BHO\ALOTHelperBHO.dll
c:\program files\FindLyrics\FiNDlyrics.dll
c:\users\ralph\AppData\Roaming\Dyzoim
c:\users\ralph\AppData\Roaming\Dyzoim\woah.hyz
c:\users\ralph\AppData\Roaming\Microsoft\Windows\Recent\DECKEL FP1 HORIZONTAL ARBOUR 3-4 - MILLING MACHINE eBay.url
c:\users\ralph\AppData\Roaming\Nuri
c:\users\ralph\AppData\Roaming\Nuri\oterq.inq
.
.
((((((((((((((((((((((((( Files Created from 2013-05-06 to 2013-06-06 )))))))))))))))))))))))))))))))
.
.
2013-06-06 03:21 . 2013-06-06 03:21 -------- d-----w- c:\users\ralph\AppData\Local\temp
2013-06-06 03:21 . 2013-06-06 03:21 -------- d-----w- c:\users\Public\AppData\Local\temp
2013-06-06 03:21 . 2013-06-06 03:21 -------- d-----w- c:\users\Guest\AppData\Local\temp
2013-06-06 03:21 . 2013-06-06 03:21 -------- d-----w- c:\users\DefaultAppPool\AppData\Local\temp
2013-06-06 03:21 . 2013-06-06 03:21 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-06-06 01:31 . 2013-06-06 01:47 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2013-06-05 04:00 . 2013-06-05 04:00 69632 ----a-r- c:\users\ralph\AppData\Roaming\Microsoft\Installer\{89505A66-35F0-4401-B3AD-D077051F8698}\ARPPRODUCTICON.exe
2013-06-05 04:00 . 2013-06-05 04:00 49152 ----a-r- c:\users\ralph\AppData\Roaming\Microsoft\Installer\{89505A66-35F0-4401-B3AD-D077051F8698}\UNINST_Uninstall_Q_336D8C9DB2424DE5BC518E574B25652F.exe
2013-06-05 04:00 . 2013-06-05 04:00 -------- d-----w- c:\users\ralph\AppData\Local\Downloaded Installations
2013-06-05 03:59 . 2013-06-05 03:59 -------- d-----w- c:\users\ralph\AppData\Roaming\2V2Z1C1P1H1P1Q1F2W1G1I1F1T1QtAtB
2013-06-05 03:58 . 2013-06-06 03:21 -------- d-----w- c:\program files\FindLyrics
2013-06-05 03:45 . 2013-06-05 03:44 724464 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{65DB9C01-7729-4654-A399-5525AB243BC5}\gapaengine.dll
2013-06-05 03:44 . 2013-05-12 13:19 7016152 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{88C36BBF-7D4F-4B86-9B9A-BE89D4BEA799}\mpengine.dll
2013-06-05 03:43 . 2013-06-05 03:43 -------- d-----w- c:\program files\Microsoft Security Client
2013-06-05 02:58 . 2013-06-05 14:44 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2013-06-05 02:57 . 2009-01-25 03:14 15224 ----a-w- c:\windows\system32\sdnclean.exe
2013-06-05 02:57 . 2013-06-05 02:57 -------- d-----w- c:\program files\Spybot - Search & Destroy 2
2013-06-05 02:48 . 2013-06-05 02:48 -------- d-----w- c:\users\ralph\AppData\Roaming\SUPERAntiSpyware.com
2013-06-05 02:47 . 2013-06-05 02:48 -------- d-----w- c:\program files\SUPERAntiSpyware
2013-06-05 02:47 . 2013-06-05 02:47 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2013-06-04 14:34 . 2013-06-04 14:34 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-06-04 07:11 . 2013-06-04 07:11 -------- d-----w- C:\FRST
2013-06-04 06:18 . 2009-07-23 20:02 43008 ----a-w- c:\windows\system32\drivers\Rtnicxp.sys
2013-06-04 06:18 . 2009-07-20 18:07 73728 ----a-w- c:\windows\system32\RtNicProp32.dll
2013-06-04 05:48 . 2004-12-02 06:36 70912 ----a-w- c:\windows\system32\drivers\Rtlnicxp.sys
2013-06-03 14:19 . 2013-06-03 14:25 -------- d-----w- c:\program files\CCleaner
2013-06-03 13:58 . 2011-07-29 03:54 19840 ----a-w- c:\windows\system32\EuEpmGdi.dll
2013-06-03 13:58 . 2013-01-06 04:52 2468520 ----a-w- c:\windows\system32\BootMan.exe
2013-06-03 13:58 . 2012-12-21 03:54 14920 ----a-w- c:\windows\system32\epmntdrv.sys
2013-06-03 13:58 . 2012-12-21 03:53 9160 ----a-w- c:\windows\system32\EuGdiDrv.sys
2013-06-03 13:58 . 2012-12-21 03:53 87112 ----a-w- c:\windows\system32\setupempdrv03.exe
2013-06-03 13:58 . 2013-06-03 13:58 -------- d-----w- c:\program files\EaseUS
2013-06-02 14:03 . 2013-06-02 14:03 -------- d-----w- c:\program files\Belarc
2013-05-31 23:54 . 2013-05-31 23:54 12872 ----a-w- c:\windows\system32\bootdelete.exe
2013-05-31 23:24 . 2013-05-31 23:25 -------- d-----w- c:\program files\HitmanPro
2013-05-31 23:24 . 2013-05-31 23:55 -------- d-----w- c:\programdata\HitmanPro
2013-05-31 15:53 . 2013-05-13 15:49 7016152 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{B10D63CB-1F34-400D-837D-A67A57A30979}\mpengine.dll
2013-05-29 11:04 . 2013-06-06 03:10 -------- d-----w- C:\OSD
2013-05-29 10:48 . 2013-05-29 10:48 -------- d-----w- c:\users\ralph\AppData\Roaming\Windows SideBar
2013-05-29 07:55 . 2013-05-29 07:55 -------- d-----w- c:\users\ralph\AppData\Local\Programs
2013-05-29 07:54 . 2013-05-29 07:54 -------- d-----w- c:\program files\Common Files\Java
2013-05-29 07:52 . 2013-05-29 07:52 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-05-20 10:08 . 2013-05-28 05:33 -------- d-----w- c:\users\ralph\AppData\Roaming\Ihony
2013-05-20 00:15 . 2013-05-25 23:34 -------- d-----w- c:\users\ralph\AppData\Roaming\Oxhe
2013-05-20 00:15 . 2013-05-22 00:13 -------- d-----w- c:\users\ralph\AppData\Roaming\Axobt
2013-05-20 00:15 . 2013-05-20 00:15 -------- d-----w- c:\users\ralph\AppData\Roaming\Edkona
2013-05-15 11:02 . 2013-04-10 03:14 2347520 ----a-w- c:\windows\system32\win32k.sys
2013-05-15 11:02 . 2013-04-10 05:18 728424 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-05-15 11:02 . 2013-04-10 05:18 218984 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-05-15 11:01 . 2013-02-27 05:05 101720 ----a-w- c:\windows\system32\consent.exe
2013-05-15 11:01 . 2013-02-27 04:49 1796096 ----a-w- c:\windows\system32\authui.dll
2013-05-15 11:01 . 2013-02-27 04:49 47104 ----a-w- c:\windows\system32\appinfo.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-29 07:52 . 2012-07-12 06:04 866720 ----a-w- c:\windows\system32\npdeployJava1.dll
2013-05-29 07:52 . 2010-09-07 03:47 788896 ----a-w- c:\windows\system32\deployJava1.dll
2013-05-15 11:33 . 2013-03-02 05:32 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-05-15 11:33 . 2011-07-04 00:04 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-10 11:36 . 2010-06-24 00:33 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-01 16:06 . 2010-08-26 01:49 238872 ------w- c:\windows\system32\MpSigStub.exe
2013-04-12 13:45 . 2013-04-23 21:44 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-04 04:50 . 2011-04-15 06:23 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-03-19 05:04 . 2013-04-13 00:16 3968856 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-03-19 05:04 . 2013-04-13 00:16 3913560 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-03-19 04:48 . 2013-04-13 00:16 38912 ----a-w- c:\windows\system32\csrsrv.dll
2013-03-19 02:49 . 2013-04-13 00:16 69632 ----a-w- c:\windows\system32\smss.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-09-20 39408]
"Skype "= "c:\program files\Skype\Phone\Skype.exe" [2013-03-01 18643560]
"Sidebar "= "c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2009-09-23 150552]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2009-09-23 141848]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2009-09-23 173592]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"SDTray "= "c:\program files\Spybot - Search & Destroy 2\SDTray.exe" [2013-05-16 3830224]
"MSC "= "c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 947152]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Security Essentials.lnk - c:\program files\Microsoft Security Client\msseces.exe [2013-1-27 947152]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 0 (0x0)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableLUA "= 0 (0x0)
"EnableUIADesktopToggle "= 0 (0x0)
"PromptOnSecureDesktop "= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2013-05-07 115440]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux "=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=" "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=" "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=" "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]
@=" "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]
@=" "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@= "Service "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "
.
R1 MpKsl1c1c6aa3;MpKsl1c1c6aa3;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{88C36BBF-7D4F-4B86-9B9A-BE89D4BEA799}\MpKsl1c1c6aa3.sys [2013-06-05 29904]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-03-01 161384]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2012-12-21 14920]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2012-12-21 9160]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 100328]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 295232]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-08-26 1343400]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2008-05-06 11520]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2011-07-22 12880]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2011-07-12 67664]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [2013-05-23 119056]
S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]
S2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files\Spybot - Search & Destroy 2\SDFSSvc.exe [2013-05-16 1817560]
S2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files\Spybot - Search & Destroy 2\SDUpdSvc.exe [2013-05-16 1033688]
S2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files\Spybot - Search & Destroy 2\SDWSCSvc.exe [2013-05-15 171928]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 22856]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-03-01 139776]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
.
Contents of the 'Scheduled Tasks' folder
.
2013-06-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-02 11:33]
.
2013-06-06 c:\windows\Tasks\FindLyrics Update.job
- c:\program files\FindLyrics\flcsur.exe [2013-04-22 09:38]
.
2013-06-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-20 23:25]
.
2013-06-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-20 23:25]
.
2013-06-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2917188583-2753293597-2095739363-1000Core.job
- c:\users\ralph\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-24 23:25]
.
2013-06-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2917188583-2753293597-2095739363-1000UA.job
- c:\users\ralph\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-24 23:25]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyServer = localhost:21320
TCP: DhcpNameServer = 192.168.0.254
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-RunServices-<NO NAME> - (no file)
HKCU-RunServicesOnce-<NO NAME> - (no file)
Notify-SDWinLogon - SDWinLogon.dll
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@= "c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker5 "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000001
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-06-06 13:23:57
ComboFix-quarantined-files.txt 2013-06-06 03:23
ComboFix2.txt 2011-06-29 04:38
.
Pre-Run: 454,384,828,416 bytes free
Post-Run: 454,193,459,200 bytes free
.
- - End Of File - - 760C32576DC7B10425E27794FEC127C6


Regards
Roger H.

 

Working

G'day Broni,
Back soon
Regards
Roger H.

 

AdwCleaner[S1] - JRT - OTL - Extras / Reports

AdwCleaner[S1] - JRT - OTL - Extras / Reports

# AdwCleaner v2.301 - Logfile created 06/06/2013 at 14:22:17
# Updated 16/05/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (32 bits)
# User : ralph - RALPH-PC
# Boot Mode : Normal
# Running from : C:\Users\ralph\Desktop\adwcleaner.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****
Folder Deleted : C:\ProgramData\Ask
Folder Deleted : C:\ProgramData\ParetoLogic
Folder Deleted : C:\Users\ralph\AppData\Roaming\ParetoLogic
***** [Registry] *****
Key Deleted : HKCU\Software\InstallCore
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKLM\Software\Conduit
***** [Internet Browsers] *****
-\\ Internet Explorer v10.0.9200.16576
[OK] Registry is clean.
-\\ Google Chrome v27.0.1453.110
File : C:\Users\ralph\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] File is clean.
*************************
AdwCleaner[S1].txt - [1167 octets] - [06/06/2013 14:22:17]
########## EOF - C:\AdwCleaner[S1].txt - [1227 octets] ##########

=================================================

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Home Premium x86
Ran by ralph on Thu 06/06/2013 at 14:27:40.57
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


~~~ Services

~~~ Registry Values

~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{151CB3D5-DD71-48AE-90B7-7F2815182882}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{274daec0-c4e8-4f30-9e5c-9424990769b9}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{274daec0-c4e8-4f30-9e5c-9424990769b9}

~~~ Files

~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\pc1data "
Successfully deleted: [Folder] "C:\Users\ralph\AppData\Roaming\drivercure "
Successfully deleted: [Folder] "C:\Users\ralph\AppData\Roaming\pc cleaners "
Successfully deleted: [Folder] "C:\Users\ralph\AppData\Roaming\pcpro "
Successfully deleted: [Folder] "C:\Users\ralph\appdata\locallow\alotappbar "
Successfully deleted: [Folder] "C:\Users\ralph\appdata\locallow\alotservice "

~~~ Event Viewer Logs were cleared


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Thu 06/06/2013 at 14:28:54.89
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


=================================================

continued on next post (too long)