1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
  2. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved possible malware

Discussion in 'Malware and Virus Removal Archive' started by gpb59, 2014/11/04.

  1. 2014/11/04
    gpb59

    gpb59 Well-Known Member Thread Starter

    Joined:
    2012/01/28
    Messages:
    282
    Likes Received:
    0
    Trophy Points:
    231
    Computer Experience:
    intermediate
    [Solved] possible malware

    Malwarebytes Anti-Malware
    www.malwarebytes.org


    Update, 11/4/2014 1:42:05 AM, SYSTEM, GARY-PC, Scheduler, Malware Database, 2014.11.4.1, 2014.11.4.2,
    Protection, 11/4/2014 1:42:16 AM, SYSTEM, GARY-PC, Protection, Refresh, Starting,
    Protection, 11/4/2014 1:42:16 AM, SYSTEM, GARY-PC, Protection, Malicious Website Protection, Stopping,
    Protection, 11/4/2014 1:42:16 AM, SYSTEM, GARY-PC, Protection, Malicious Website Protection, Stopped,
    Protection, 11/4/2014 1:44:54 AM, SYSTEM, GARY-PC, Protection, Refresh, Success,
    Protection, 11/4/2014 1:44:54 AM, SYSTEM, GARY-PC, Protection, Malicious Website Protection, Starting,
    Protection, 11/4/2014 1:44:57 AM, SYSTEM, GARY-PC, Protection, Malicious Website Protection, Started,
    Update, 11/4/2014 3:37:01 AM, SYSTEM, GARY-PC, Scheduler, Malware Database, 2014.11.4.2, 2014.11.4.3,
    Protection, 11/4/2014 3:37:02 AM, SYSTEM, GARY-PC, Protection, Refresh, Starting,
    Protection, 11/4/2014 3:37:02 AM, SYSTEM, GARY-PC, Protection, Malicious Website Protection, Stopping,
    Protection, 11/4/2014 3:37:03 AM, SYSTEM, GARY-PC, Protection, Malicious Website Protection, Stopped,
    Protection, 11/4/2014 3:39:45 AM, SYSTEM, GARY-PC, Protection, Refresh, Success,
    Protection, 11/4/2014 3:39:45 AM, SYSTEM, GARY-PC, Protection, Malicious Website Protection, Starting,
    Protection, 11/4/2014 3:39:48 AM, SYSTEM, GARY-PC, Protection, Malicious Website Protection, Started,
    Protection, 11/4/2014 5:55:58 AM, SYSTEM, GARY-PC, Protection, Malware Protection, Starting,
    Protection, 11/4/2014 5:55:58 AM, SYSTEM, GARY-PC, Protection, Malware Protection, Started,
    Protection, 11/4/2014 5:55:58 AM, SYSTEM, GARY-PC, Protection, Malicious Website Protection, Starting,
    Protection, 11/4/2014 5:56:02 AM, SYSTEM, GARY-PC, Protection, Malicious Website Protection, Started,

    (end)

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2012-11-20.01)
    .
    Microsoft® Windows Vistaâ„¢ Home Premium
    Boot Device: \Device\HarddiskVolume1
    Install Date: 3/24/2009 3:31:59 PM
    System Uptime: 11/4/2014 5:50:26 AM (1 hours ago)
    .
    Motherboard: PEGATRON CORPORATION | | Acacia
    Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 5000+ | Socket AM2 | 2600/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 286 GiB total, 64.961 GiB free.
    D: is FIXED (NTFS) - 12 GiB total, 1.587 GiB free.
    E: is CDROM ()
    F: is FIXED (NTFS) - 932 GiB total, 265.449 GiB free.
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
    Description: Microsoft 6to4 Adapter
    Device ID: ROOT\*6TO4MP\0075
    Manufacturer: Microsoft
    Name: 6TO4 Adapter
    PNP Device ID: ROOT\*6TO4MP\0075
    Service: tunnel
    .
    ==== System Restore Points ===================
    .
    .
    ==== Installed Programs ======================
    .
    µTorrent
    4Media iPod to PC Transfer
    Acrobat.com
    ActiveCheck component for HP Active Support Library
    Adobe AIR
    Adobe Download Assistant
    Adobe Flash Player 15 ActiveX
    Adobe Flash Player 15 Plugin
    Adobe Photoshop Elements 12
    Adobe Reader X (10.1.12)
    AIM 7
    AnswerWorks 5.0 English Runtime
    Any Video Converter 5.5.9
    AOL Uninstaller (Choose which Products to Remove)
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    AusLogics BoostSpeed 6.3.0.0
    avast! Free Antivirus
    Belkin Setup and Router Monitor
    Belkin USB Print and Storage Center
    BitTorrent
    Bonjour
    CCleaner
    Citrix Authentication Manager
    Citrix Receiver
    Citrix Receiver (HDX Flash Redirection)
    Citrix Receiver Inside
    Citrix Receiver Updater
    Citrix Receiver(Aero)
    Citrix Receiver(DV)
    Citrix Receiver(USB)
    Clone Tools version 2.0.2.0
    Compatibility Pack for the 2007 Office system
    D3DX10
    dBpoweramp AAC Encoder
    dBpoweramp DSP Effects
    dBpoweramp FLAC Codec
    dBpoweramp m4a Codec
    dBpoweramp m4a FDK (AAC) Encoder
    dBpoweramp m4a Utilities
    dBpoweramp m4b Audio book Encoder
    dBpoweramp Monkeys Audio Codec
    dBpoweramp Music Converter
    dBpoweramp Shorten Codec
    Dell Touchpad
    DING!
    Dropbox
    DVDFab 8.2.2.0 (16/11/2012) Qt
    DVDFab 9.1.1.9 (18/12/2013)
    EasyDuplicateFinder v4.3
    Elements 12 Organizer
    Enhanced Multimedia Keyboard Solution
    ESET Online Scanner v3
    Exact Audio Copy 1.0beta3
    Express Zip
    FLAC Frontend
    Google Chrome
    Google Update Helper
    Hardware Diagnostic Tools
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    HP Active Support Library
    HP Customer Experience Enhancements
    HP Demo
    HP MediaSmart DVD
    HP MediaSmart Music/Photo/Video
    HP MediaSmart SmartMenu
    HP Picasso Media Center Add-In
    HP Recovery Manager RSS
    HP Total Care Setup
    HP Update
    HPAsset component for HP Active Support Library
    ImagXpress
    ImgBurn
    iPod PC Transfer Suit 4.2
    iSEEK AnswerWorks English Runtime
    iTunes
    iTunes Library Toolkit
    iTunesFolderWatch
    Java 7 Update 67
    Java Auto Updater
    Junk Mail filter update
    Juno Preloader
    K-Lite Codec Pack 8.1.0 (Basic)
    LockHunter 3.0, 32/64 bit
    M3U2iTunes
    magicJack
    magicJack Recovery Tool 1.0
    Malwarebytes Anti-Malware version 2.0.3.1025
    Mesh Runtime
    Messenger Companion
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4.5.1
    Microsoft Application Error Reporting
    Microsoft Live Search Toolbar
    Microsoft Office File Validation Add-In
    Microsoft Office Home and Student 60 day trial
    Microsoft Office Live Add-in 1.5
    Microsoft Office Outlook Connector
    Microsoft Office PowerPoint Viewer 2007 (English)
    Microsoft Office Professional Edition 2003
    Microsoft Search Enhancement Pack
    Microsoft Silverlight
    Microsoft SkyDrive
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft VC9 runtime libraries
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    Microsoft Works
    mkw Audio Compression Toolkit
    mkw Runtime Libraries
    Mozilla Firefox 33.0.2 (x86 en-US)
    Mozilla Maintenance Service
    MSVCRT
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    muvee Reveal
    My HP Games
    MyFreeCodec
    Nero 12
    Nero 8 Essentials
    Nero Audio Pack 1
    Nero BackItUp
    Nero BackItUp Help (CHM)
    Nero Blu-ray Player
    Nero Blu-ray Player Help (CHM)
    Nero Burning ROM
    Nero Burning ROM Help (CHM)
    Nero ControlCenter
    Nero ControlCenter Help (CHM)
    Nero Core Components
    Nero Disc Menus Basic
    Nero Effects Basic
    Nero Express
    Nero Express Help (CHM)
    Nero Kwik Media
    Nero Kwik Media Help (CHM)
    Nero Kwik Themes Basic
    Nero Online Upgrade
    Nero PiP Effects Basic
    Nero Recode
    Nero Recode Help (CHM)
    Nero RescueAgent
    Nero RescueAgent Help (CHM)
    Nero SharedVideoCodecs
    Nero StartSmart OEM
    Nero Update
    Nero Video
    Nero Video Help (CHM)
    neroxml
    NVIDIA Control Panel 307.83
    NVIDIA Drivers
    NVIDIA Graphics Driver 307.83
    NVIDIA Install Application
    NVIDIA Update 1.10.8
    NVIDIA Update Components
    OGA Notifier 2.0.0048.0
    Online Plug-in
    PictureMover
    PowerDirector
    PowerISO
    Prerequisite installer
    Prism Video File Converter
    PSE12 STI Installer
    Python 2.5.2
    Quicken 2011
    QuickTime
    R-Studio 4.2
    Realtek High Definition Audio Driver
    Revo Uninstaller Pro 2.5.8
    Samsung Kies
    SAMSUNG USB Driver for Mobile Phones
    Seagate Dashboard 2.0
    Secunia PSI (2.0.0.4003)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2840629)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2861697)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2894854v2)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2931368)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2972107)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2972216)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2979578v2)
    Segoe UI
    Self-service Plug-in
    Serial Key Generator version 5.0
    Skype web features
    Skypeâ„¢ 6.18
    Soft Data Fax Modem with SmartCP
    Switch Sound File Converter
    The Rosetta Stone
    Trader's Little Helper 2.7.0
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Video Mover
    Visual C++ 2008 x86 Runtime - (v9.0.30729)
    Visual C++ 2008 x86 Runtime - v9.0.30729.01
    VLC media player 2.0.5
    Welcome App (Start-up experience)
    Winamp
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Family Safety
    Windows Live ID Sign-in Assistant
    Windows Live Installer
    Windows Live Mail
    Windows Live Mesh
    Windows Live Mesh ActiveX Control for Remote Connections
    Windows Live Messenger
    Windows Live Messenger Companion Core
    Windows Live MIME IFilter
    Windows Live Movie Maker
    Windows Live Photo Common
    Windows Live Photo Gallery
    Windows Live PIMT Platform
    Windows Live Remote Client
    Windows Live Remote Client Resources
    Windows Live Remote Service
    Windows Live Remote Service Resources
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live Sync
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Live Writer
    Windows Live Writer Resources
    WinRAR archiver
    Xilisoft AVI to DVD Converter
    Xilisoft FLAC Converter
    Xilisoft ISO Pro
    Xilisoft Video Converter Ultimate
    Yahoo! Messenger
    Yahoo! Software Update
    Yahoo! Toolbar
    .
    ==== End Of File ===========================
    DDS (Ver_2012-11-20.01) - NTFS_x86
    Internet Explorer: 9.0.8112.16584 BrowserJavaVersion: 10.67.2
    Run by Gary at 6:39:43 on 2014-11-04
    Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6002.2.1252.1.1033.18.2942.1176 [GMT -8:00]
    .
    AV: avast! Antivirus *Disabled/Outdated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: avast! Antivirus *Disabled/Outdated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
    .
    ============== Running Processes ================
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\SLsvc.exe
    C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe
    C:\Program Files\AVAST Software\Avast\avastui.exe
    C:\Program Files\Citrix\ICA Client\concentr.exe
    C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
    C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe
    C:\Users\Gary\AppData\Roaming\Dropbox\bin\Dropbox.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe
    C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
    C:\Program Files\Nero\Update\NASvc.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\Windows\system32\IoctlSvc.exe
    C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe
    C:\Program Files\Citrix\Receiver\Receiver.exe
    C:\Program Files\Belkin\Belkin USB Print and Storage Center\connect.exe
    C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe
    C:\Program Files\Belkin\Router Setup and Monitor\dlnaPlugin.exe
    C:\Program Files\Secunia\PSI\sua.exe
    C:\Windows\system32\UTSCSI.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Windows\system32\DRIVERS\xaudio.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Program Files\Citrix\SelfServicePlugin\SelfServicePlugin.exe
    C:\Program Files\Citrix\ICA Client\wfcrun32.exe
    C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
    C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
    C:\Program Files\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe
    c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    C:\Windows\system32\wuauclt.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxps://www.yahoo.com?fr=hp-avast&type=avastbcl
    uSearch Bar = hxxps://www.yahoo.com?fr=hp-avast&type=avastbcl
    uSearch Page = hxxp://us.yhs4.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}
    mStart Page = hxxps://www.yahoo.com?fr=hp-avast&type=avastbcl
    mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
    uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
    BHO: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
    BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
    BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll
    BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - c:\program files\windows live\companion\companioncore.dll
    BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
    BHO: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - c:\program files\yahoo!\companion\installs\cpn4\YTSingleInstance.dll
    TB: Microsoft Live Search Toolbar: {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll
    uRun: [Uploader] c:\program files\seagate\seagate dashboard 2.0\Seagate.Dashboard.Uploader.exe
    mRun: [InstaLAN] "c:\program files\belkin\router setup and monitor\BelkinRouterMonitor.exe" startup
    mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe "
    mRun: [AvastUI.exe] "c:\program files\avast software\avast\AvastUI.exe" /nogui
    mRun: [ConnectionCenter] "c:\program files\citrix\ica client\concentr.exe" /startup
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
    StartupFolder: c:\users\gary\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\gary\appdata\roaming\dropbox\bin\Dropbox.exe
    uPolicies-Explorer: NoDrives = dword:0
    mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0
    mPolicies-Explorer: NoDriveTypeAutoRun = dword:255
    mPolicies-Explorer: NoDrives = dword:0
    mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
    mPolicies-System: ConsentPromptBehaviorUser = dword:3
    mPolicies-System: EnableUIADesktopToggle = dword:0
    mPolicies-System: DisableStartupSound = dword:1
    mPolicies-System: DisableStatusMessages = dword:1
    mPolicies-System: EnableSecureUIAPath = dword:1
    IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
    Trusted Zone: va.gov
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
    DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
    TCP: NameServer = 192.168.2.1
    TCP: Interfaces\{DEFE736B-C868-43F1-8A26-556BABDE9FA1} : DHCPNameServer = 192.168.2.1
    Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - c:\program files\citrix\ica client\IcaMimeFilter.dll
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
    LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg
    mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\38.0.2125.111\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\users\gary\appdata\roaming\mozilla\firefox\profiles\mhqvnyoa.default-1398863969359\
    FF - prefs.js: browser.search.defaulturl - hxxp://us.yhs4.search.yahoo.com/yhs/search
    FF - prefs.js: browser.startup.homepage - hxxps://finance.yahoo.com/portfolio/pf_5/view/v1
    FF - prefs.js: keyword.URL - hxxp://us.yhs4.search.yahoo.com/yhs/search
    FF - plugin: c:\progra~1\common~1\nero\browse~1\npBrowserPlugin.dll
    FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
    FF - plugin: c:\program files\citrix\ica client\npicaN.dll
    FF - plugin: c:\program files\google\update\1.3.25.5\npGoogleUpdate3.dll
    FF - plugin: c:\program files\java\jre7\bin\dtplugin\npdeployJava1.dll
    FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
    FF - plugin: c:\program files\microsoft silverlight\5.1.30514.0\npctrlui.dll
    FF - plugin: c:\program files\microsoft\office live\npOLW.dll
    FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
    FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_15_0_0_189.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 aswRvrt;avast! Revert;c:\windows\system32\drivers\aswRvrt.sys [2013-3-6 49944]
    R0 aswVmm;avast! VM Monitor;c:\windows\system32\drivers\aswVmm.sys [2013-3-6 192352]
    R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswsnx.sys [2012-1-30 779536]
    R1 aswSP;aswSP;c:\windows\system32\drivers\aswsp.sys [2012-1-30 414520]
    R1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\drivers\ctxusbm.sys [2014-1-8 69544]
    R2 AdobeActiveFileMonitor12.0;Adobe Active File Monitor V12;c:\program files\adobe\elements 12 organizer\PhotoshopElementsFileAgent.exe [2013-9-25 181152]
    R2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [2014-4-26 24184]
    R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-1-30 67824]
    R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2012-1-30 50344]
    R2 Belkin Local Backup Service;Belkin Local Backup Service;c:\program files\belkin\belkin usb print and storage center\BkBackupScheduler.exe [2012-5-20 152064]
    R2 Belkin Network USB Helper;Belkin Network USB Helper;c:\program files\belkin\belkin usb print and storage center\Bkapcs.exe [2012-5-20 49152]
    R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
    R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes anti-malware\mbamscheduler.exe [2014-5-9 1871160]
    R2 MBAMService;MBAMService;c:\program files\malwarebytes anti-malware\mbamservice.exe [2014-5-9 968504]
    R2 NAUpdate;Nero Update;c:\program files\nero\update\NASvc.exe [2012-7-13 769432]
    R2 Seagate Dashboard Services;Seagate Dashboard Services;c:\program files\seagate\seagate dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe [2013-5-30 16000]
    R2 Secunia Update Agent;Secunia Update Agent;c:\program files\secunia\psi\sua.exe [2011-10-13 399416]
    R2 sxuptp;SXUPTP Driver;c:\windows\system32\drivers\sxuptp.sys [2012-5-20 247320]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-1-28 23256]
    R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2014-5-9 114904]
    R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2014-5-9 51928]
    R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [2012-1-1 197224]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
    S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2014-4-3 315008]
    S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\drivers\ssadadb.sys [2013-9-21 32064]
    S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2012-8-1 39272]
    S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2012-3-8 1492840]
    S3 PCD5SRVC{BD6912E3-AC9D80E8-05040000};PCD5SRVC{BD6912E3-AC9D80E8-05040000} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\pc-doc~1\PCD5SRVC.pkms [2008-9-9 20640]
    S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-9-1 15544]
    S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2012-1-30 27192]
    S3 Secunia PSI Agent;Secunia PSI Agent;c:\program files\secunia\psi\psia.exe [2011-10-13 994360]
    S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [2013-9-21 136904]
    S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\drivers\ssadmdfl.sys [2013-9-21 17864]
    S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\drivers\ssadmdm.sys [2013-9-21 153672]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2013-9-11 770168]
    S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]
    .
    =============== File Associations ===============
    .
    ShellExec: switch.exe: open= "c:\program files\nch software\switch\switch" "%L "
    .
    =============== Created Last 30 ================
    .
    2014-11-02 13:59:39 220784 ----a-w- c:\program files\mozilla firefox\sandboxbroker.dll
    2014-10-31 11:23:51 8901368 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{8e0c71c2-ac2e-4b20-8d96-c3144a90b655}\mpengine.dll
    2014-10-19 16:27:20 -------- d-----w- c:\program files\iPod
    2014-10-19 16:27:08 -------- d-----w- c:\programdata\B0FFCDD9-5261-4e59-B29A-17A4FABDEBAB
    2014-10-17 13:21:09 96680 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
    2014-10-16 10:16:49 156824 ----a-w- c:\windows\system32\mscorier.dll
    2014-10-16 10:16:48 81560 ----a-w- c:\windows\system32\mscories.dll
    2014-10-16 10:16:48 1131664 ----a-w- c:\windows\system32\dfshim.dll
    2014-10-16 10:13:52 2054656 ----a-w- c:\windows\system32\win32k.sys
    2014-10-16 10:02:46 143360 ----a-w- c:\windows\system32\drivers\fastfat.sys
    2014-10-16 10:00:36 66560 ----a-w- c:\windows\system32\packager.dll
    .
    ==================== Find3M ====================
    .
    2014-11-04 13:55:51 114904 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2014-10-28 13:35:00 229000 ------w- c:\windows\system32\MpSigStub.exe
    2014-10-17 12:47:48 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2014-10-17 12:47:48 701104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2014-10-01 18:11:20 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
    2014-10-01 18:11:14 75480 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
    2014-10-01 18:11:10 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
    2014-09-19 22:44:32 1810432 ----a-w- c:\windows\system32\jscript9.dll
    2014-09-19 22:38:15 1129472 ----a-w- c:\windows\system32\wininet.dll
    2014-09-19 22:37:34 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
    2014-09-19 22:36:04 142848 ----a-w- c:\windows\system32\ieUnatt.exe
    2014-09-19 22:35:46 421376 ----a-w- c:\windows\system32\vbscript.dll
    2014-09-19 22:34:25 2382848 ----a-w- c:\windows\system32\mshtml.tlb
    2014-09-19 22:34:22 11776 ----a-w- c:\windows\system32\mshta.exe
    2014-09-09 06:24:46 2048 ----a-w- c:\windows\system32\tzres.dll
    2014-08-23 01:03:46 297984 ----a-w- c:\windows\system32\gdi32.dll
    .
    ============= FINISH: 6:42:24.73 ===============
     
  2. 2014/11/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,483
    Likes Received:
    103
    Trophy Points:
    843
    Location:
    Daly City, CA
    Computer Experience:
    Experienced
    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ==================================

    [​IMG] You're not saying what your computer issues are.

    [​IMG] You posted "protection" log from MBAM instead of "scan" log.
     

  3. to hide this advert.

  4. 2014/11/04
    gpb59

    gpb59 Well-Known Member Thread Starter

    Joined:
    2012/01/28
    Messages:
    282
    Likes Received:
    0
    Trophy Points:
    231
    Computer Experience:
    intermediate
    I'll start again with a MBAM scan, the last few days it's found alot of "pups ". I also have been getting a popup that says "windows needs to be re-installed, I'll fun the DDS again also
     
  5. 2014/11/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,483
    Likes Received:
    103
    Trophy Points:
    843
    Location:
    Daly City, CA
    Computer Experience:
    Experienced
    No need to run DDS again.
     
  6. 2014/11/04
    gpb59

    gpb59 Well-Known Member Thread Starter

    Joined:
    2012/01/28
    Messages:
    282
    Likes Received:
    0
    Trophy Points:
    231
    Computer Experience:
    intermediate
    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 11/4/2014
    Scan Time: 4:03:39 PM
    Logfile: mlb.txt
    Administrator: Yes

    Version: 2.00.3.1025
    Malware Database: v2014.11.04.07
    Rootkit Database: v2014.11.01.02
    License: Premium
    Malware Protection: Enabled
    Malicious Website Protection: Enabled
    Self-protection: Disabled

    OS: Windows Vista Service Pack 2
    CPU: x86
    File System: NTFS
    User: Gary

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 430905
    Time Elapsed: 22 min, 44 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Enabled
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 0
    (No malicious items detected)

    Registry Keys: 0
    (No malicious items detected)

    Registry Values: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Folders: 23
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk, , [8c3be7500a72d0660d20907d28db8f71],
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.3_0, , [8c3be7500a72d0660d20907d28db8f71],
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.3_0\_locales, , [8c3be7500a72d0660d20907d28db8f71],
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.3_0\_locales\lt, , [8c3be7500a72d0660d20907d28db8f71],
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.3_0\_locales\lv, , [8c3be7500a72d0660d20907d28db8f71],
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.3_0\_locales\nl, , [8c3be7500a72d0660d20907d28db8f71],
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.3_0\_locales\no, , [8c3be7500a72d0660d20907d28db8f71],
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.3_0\_locales\pl, , [8c3be7500a72d0660d20907d28db8f71],
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.3_0\_locales\pt_BR, , [8c3be7500a72d0660d20907d28db8f71],
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.3_0\_locales\pt_PT, , [8c3be7500a72d0660d20907d28db8f71],
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.3_0\_locales\ro, , [8c3be7500a72d0660d20907d28db8f71],
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.3_0\_locales\ru, , [8c3be7500a72d0660d20907d28db8f71],
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.3_0\_locales\se, , [8c3be7500a72d0660d20907d28db8f71],
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.3_0\_locales\sk, , [8c3be7500a72d0660d20907d28db8f71],
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.3_0\_locales\sl, , [8c3be7500a72d0660d20907d28db8f71],
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.3_0\_locales\sr, , [8c3be7500a72d0660d20907d28db8f71],
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.3_0\_locales\th, , [8c3be7500a72d0660d20907d28db8f71],
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.3_0\_locales\tr, , [8c3be7500a72d0660d20907d28db8f71],
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.3_0\_locales\uk, , [8c3be7500a72d0660d20907d28db8f71],
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.3_0\_locales\vi, , [8c3be7500a72d0660d20907d28db8f71],
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.3_0\_locales\zh_CN, , [8c3be7500a72d0660d20907d28db8f71],
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.3_0\_locales\zh_TW, , [8c3be7500a72d0660d20907d28db8f71],
    PUP.Optional.BrowseCoupon.A, C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihjbpjahiibmjdlcgodcnmpelpmilamk\2.3_0\_metadata, , [8c3be7500a72d0660d20907d28db8f71],

    Files: 0
    (No malicious items detected)

    Physical Sectors: 0
    (No malicious items detected)


    (end)
     
  7. 2014/11/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,483
    Likes Received:
    103
    Trophy Points:
    843
    Location:
    Daly City, CA
    Computer Experience:
    Experienced
    [​IMG] Download RogueKiller from one of the following links and save it to your Desktop:

    Link 1
    Link 2

    • Close all the running programs
    • Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

    [​IMG] Create new restore point before proceeding with the next step....
    How to: http://www.smartestcomputing.us.com/topic/63983-how-to-create-new-restore-point-all-windows/

    Download [​IMG] Malwarebytes Anti-Rootkit to your desktop.
    • Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
    • Double click on downloaded file. OK self extracting prompt.
    • MBAR will start. Click "Next" to continue.
    • Click in the following screen "Update" to obtain the latest malware definitions.
    • Once the update is complete select "Next" and click "Scan ".
    • When the scan is finished and no malware has been found select "Exit ".
    • If malware was detected, make sure to check all the items and click "Cleanup ". Reboot your computer.
    • Open the MBAR folder located on your Desktop and paste the content of the following files in your next reply:
      • "mbar-log-{date} (xx-xx-xx).txt "
      • "system-log.txt "
     
  8. 2014/11/04
    gpb59

    gpb59 Well-Known Member Thread Starter

    Joined:
    2012/01/28
    Messages:
    282
    Likes Received:
    0
    Trophy Points:
    231
    Computer Experience:
    intermediate
    RogueKiller V10.0.4.0 [Oct 29 2014] by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : http://forum.adlice.com
    Website : http://www.adlice.com/softwares/roguekiller/
    Blog : http://www.adlice.com

    Operating System : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
    Started in : Normal mode
    User : Gary [Administrator]
    Mode : Delete -- Date : 11/04/2014 18:27:31

    ¤¤¤ Processes : 0 ¤¤¤

    ¤¤¤ Registry : 10 ¤¤¤
    [Hidden.From.SCM] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\AFD (\SystemRoot\system32\drivers\afd.sys) -> Not selected
    [Suspicious.Path] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\mbr (\??\C:\Users\Gary\AppData\Local\Temp\mbr.sys) -> Not selected
    [Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mbr (\??\C:\Users\Gary\AppData\Local\Temp\mbr.sys) -> Not selected
    [PUM.HomePage] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : https://www.yahoo.com?fr=hp-avast&type=avastbcl -> Not selected
    [PUM.HomePage] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome -> Not selected
    [PUM.HomePage] HKEY_USERS\S-1-5-21-2060793998-228504606-3227568861-1000\Software\Microsoft\Internet Explorer\Main | Start Page : https://www.yahoo.com?fr=hp-avast&type=avastbcl -> Not selected
    [PUM.HomePage] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome -> Not selected
    [PUM.SearchPage] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Not selected
    [PUM.SearchPage] HKEY_USERS\S-1-5-21-2060793998-228504606-3227568861-1000\Software\Microsoft\Internet Explorer\Main | Search Page : http://us.yhs4.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms} -> Not selected
    [PUM.SearchPage] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Not selected

    ¤¤¤ Tasks : 0 ¤¤¤

    ¤¤¤ Files : 0 ¤¤¤

    ¤¤¤ Hosts File : 1 ¤¤¤
    [C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 localhost

    ¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

    ¤¤¤ Web browsers : 1 ¤¤¤
    [PUM.HomePage][FIREFX:Config] 05lzepug.default : user_pref( "browser.startup.homepage ", "https://www.yahoo.com?fr=hp-avast&type=avastbcl "); -> Not selected

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: WDC WD32 00AAJS-65M0A SCSI Disk Device +++++
    --- User ---
    [MBR] 015dad17540dd8e88d802c3ff600815b
    [BSP] cbe1a3892920c024e3e7b9efc684338e : HP MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 293303 MB
    2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 600686415 | Size: 11938 MB
    User = LL1 ... OK
    Error reading LL2 MBR! ([1] Incorrect function. )

    +++++ PhysicalDrive1: Seagate Backup+ BK USB Device +++++
    --- User ---
    [MBR] fdfdae42b2b88a5f195ba8fa967c96ae
    [BSP] 872d49b3cd04d36de14da8caf4b829b2 : Empty MBR Code
    Partition table:
    0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 953867 MB
    User = LL1 ... OK
    Error reading LL2 MBR! ([32] The request is not supported. )


    ============================================
    RKreport_SCN_11042014_182656.log
     
  9. 2014/11/04
    gpb59

    gpb59 Well-Known Member Thread Starter

    Joined:
    2012/01/28
    Messages:
    282
    Likes Received:
    0
    Trophy Points:
    231
    Computer Experience:
    intermediate
    Malwarebytes Anti-Rootkit BETA 1.07.0.1012
    www.malwarebytes.org

    Database version: v2014.11.05.02

    Windows Vista Service Pack 2 x86 NTFS
    Internet Explorer 9.0.8112.16421
    Gary :: GARY-PC [administrator]

    11/4/2014 6:33:11 PM
    mbar-log-2014-11-04 (18-33-11).txt

    Scan type: Quick scan
    Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
    Scan options disabled:
    Objects scanned: 432528
    Time elapsed: 26 minute(s), 3 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    Physical Sectors Detected: 0
    (No malicious items detected)

    (end)
    ---------------------------------------
    Malwarebytes Anti-Rootkit BETA 1.07.0.1012

    (c) Malwarebytes Corporation 2011-2012

    OS version: 6.0.6002 Windows Vista Service Pack 2 x86

    Account is Administrative

    Internet Explorer version: 9.0.8112.16421

    File system is: NTFS
    Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, F:\ DRIVE_FIXED
    CPU speed: 2.600000 GHz
    Memory total: 3084730368, free: 782958592

    Downloaded database version: v2014.11.05.02
    Downloaded database version: v2014.11.01.02
    =======================================
    Initializing...
    Done!
    Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
    Done!
    Drive 0
    This is a System drive
    Scanning MBR on drive 0...
    Inspecting partition table:
    MBR Signature: 55AA
    Disk Signature: 1549F232

    Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 63 Numsec = 600686352
    Partition file system is NTFS
    Partition is bootable

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 2 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 600686415 Numsec = 24450930

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Disk Size: 320072933376 bytes
    Sector size: 512 bytes

    Scanning physical sectors of unpartitioned space on drive 0 (1-62-625122448-625142448)...
    Done!
    Drive 1
    Scanning MBR on drive 1...
    Inspecting partition table:
    MBR Signature: 55AA
    Disk Signature: EB3631AB

    Partition information:

    Partition 0 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 2048 Numsec = 1953519616

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Disk Size: 1000204885504 bytes
    Sector size: 512 bytes

    Done!
    Scan finished
    =======================================


    Removal queue found; removal started
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-63-i.mbam...
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-i.mbam...
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-r.mbam...
    Removal finished
     
  10. 2014/11/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,483
    Likes Received:
    103
    Trophy Points:
    843
    Location:
    Daly City, CA
    Computer Experience:
    Experienced
    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
    iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
     
  11. 2014/11/04
    gpb59

    gpb59 Well-Known Member Thread Starter

    Joined:
    2012/01/28
    Messages:
    282
    Likes Received:
    0
    Trophy Points:
    231
    Computer Experience:
    intermediate
    ComboFix 14-10-29.01 - Gary 11/04/2014 19:49:34.1.2 - x86
    Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6002.2.1252.1.1033.18.2942.1330 [GMT -8:00]
    Running from: c:\users\Gary\Desktop\ComboFix.exe
    AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
    SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\users\Gary\AppData\Local\temp\1.tmp\F_IN_BOX.dll
    .
    .
    ((((((((((((((((((((((((( Files Created from 2014-10-05 to 2014-11-05 )))))))))))))))))))))))))))))))
    .
    .
    2014-11-05 04:04 . 2014-11-05 04:04 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
    2014-11-05 04:04 . 2014-11-05 04:04 -------- d-----w- c:\users\yfl\AppData\Local\temp
    2014-11-05 04:04 . 2014-11-05 04:04 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
    2014-11-05 04:04 . 2014-11-05 04:04 -------- d-----w- c:\users\Public\AppData\Local\temp
    2014-11-05 04:04 . 2014-11-05 04:04 -------- d-----w- c:\users\Default\AppData\Local\temp
    2014-11-05 04:04 . 2014-11-05 04:04 -------- d-----w- c:\users\Administrator\AppData\Local\temp
    2014-11-05 02:12 . 2014-11-05 02:12 34808 ----a-w- c:\windows\system32\drivers\TrueSight.sys
    2014-11-05 02:12 . 2014-11-05 02:12 -------- d-----w- c:\programdata\RogueKiller
    2014-11-02 13:59 . 2014-11-02 13:59 220784 ----a-w- c:\program files\Mozilla Firefox\sandboxbroker.dll
    2014-10-31 11:23 . 2014-10-14 20:13 8901368 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8E0C71C2-AC2E-4B20-8D96-C3144A90B655}\mpengine.dll
    2014-10-19 16:27 . 2014-10-19 16:27 -------- d-----w- c:\program files\iPod
    2014-10-19 16:27 . 2014-10-19 16:28 -------- d-----w- c:\programdata\B0FFCDD9-5261-4e59-B29A-17A4FABDEBAB
    2014-10-17 13:21 . 2014-10-17 13:20 96680 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
    2014-10-16 10:16 . 2014-06-13 18:22 156824 ----a-w- c:\windows\system32\mscorier.dll
    2014-10-16 10:16 . 2014-06-15 22:18 1131664 ----a-w- c:\windows\system32\dfshim.dll
    2014-10-16 10:16 . 2014-06-13 18:22 81560 ----a-w- c:\windows\system32\mscories.dll
    2014-10-16 10:13 . 2014-09-27 23:29 2054656 ----a-w- c:\windows\system32\win32k.sys
    2014-10-16 10:02 . 2014-09-04 23:27 143360 ----a-w- c:\windows\system32\drivers\fastfat.sys
    2014-10-16 10:00 . 2014-09-16 16:56 66560 ----a-w- c:\windows\system32\packager.dll
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2014-11-05 02:32 . 2014-05-10 02:18 75480 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
    2014-11-05 02:24 . 2014-05-09 23:46 114904 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2014-10-28 13:35 . 2009-10-02 20:58 229000 ------w- c:\windows\system32\MpSigStub.exe
    2014-10-17 12:47 . 2012-05-06 20:06 701104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2014-10-17 12:47 . 2011-07-25 12:23 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2014-10-01 18:11 . 2014-05-10 02:18 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
    2014-10-01 18:11 . 2012-01-29 02:15 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
    2014-09-09 06:24 . 2014-09-24 10:02 2048 ----a-w- c:\windows\system32\tzres.dll
    2014-08-28 10:24 . 2010-06-24 19:33 23256 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
    2014-08-23 01:03 . 2014-08-28 10:03 297984 ----a-w- c:\windows\system32\gdi32.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
    @= "{F241C880-6982-4CE5-8CF7-7085BA96DA5A} "
    [HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
    2013-12-15 19:32 222832 ----a-w- c:\users\Gary\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
    @= "{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} "
    [HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
    2013-12-15 19:32 222832 ----a-w- c:\users\Gary\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
    @= "{BBACC218-34EA-4666-9D7A-C78F2274A524} "
    [HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
    2013-12-15 19:32 222832 ----a-w- c:\users\Gary\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt1"]
    @= "{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04 131480 ----a-w- c:\users\Gary\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt2"]
    @= "{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04 131480 ----a-w- c:\users\Gary\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt3"]
    @= "{FB314EDD-A251-47B7-93E1-CDD82E34AF8B} "
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04 131480 ----a-w- c:\users\Gary\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt4"]
    @= "{FB314EDE-A251-47B7-93E1-CDD82E34AF8B} "
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04 131480 ----a-w- c:\users\Gary\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt5"]
    @= "{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04 131480 ----a-w- c:\users\Gary\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt6"]
    @= "{FB314EDF-A251-47B7-93E1-CDD82E34AF8B} "
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04 131480 ----a-w- c:\users\Gary\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt7"]
    @= "{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04 131480 ----a-w- c:\users\Gary\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ "DropboxExt8"]
    @= "{FB314EE0-A251-47B7-93E1-CDD82E34AF8B} "
    [HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
    2014-06-24 22:04 131480 ----a-w- c:\users\Gary\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
    @= "{472083B0-C522-11CF-8763-00608CC02F24} "
    [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
    2014-07-07 12:02 578240 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Uploader "= "c:\program files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe" [2013-05-30 122984]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "InstaLAN "= "c:\program files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" [2011-02-25 1770400]
    "APSDaemon "= "c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-10-11 60712]
    "AvastUI.exe "= "c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-07-29 4085896]
    "ConnectionCenter "= "c:\program files\Citrix\ICA Client\concentr.exe" [2014-01-09 383368]
    "Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 959176]
    "SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2014-07-25 256896]
    "iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2014-10-15 157480]
    .
    c:\users\Gary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Dropbox.lnk - c:\users\Gary\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-9-12 36414624]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin "= 5 (0x5)
    "ConsentPromptBehaviorUser "= 3 (0x3)
    "EnableUIADesktopToggle "= 0 (0x0)
    "DisableStartupSound "= 1 (0x1)
    "DisableStatusMessages "= 1 (0x1)
    "EnableLinkedConnections "= 1 (0x1)
    "EnableSecureUIAPath "= 1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @= "Driver "
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
    @= "Service "
    .
    [HKLM\~\startupfolder\C:^Users^Gary^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox (1).lnk]
    path=c:\users\Gary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox (1).lnk
    backup=c:\windows\pss\Dropbox (1).lnk.Startup
    backupExtension=.Startup
    .
    [HKLM\~\startupfolder\C:^Users^Gary^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
    path=c:\users\Gary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
    backup=c:\windows\pss\Dropbox.lnk.Startup
    backupExtension=.Startup
    .
    [HKLM\~\startupfolder\C:^Users^Gary^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MyPC Backup.lnk]
    path=c:\users\Gary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
    backup=c:\windows\pss\MyPC Backup.lnk.Startup
    backupExtension=.Startup
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
    2014-08-21 16:30 959176 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
    2013-06-03 13:06 472984 ----a-w- c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL]
    2013-09-07 17:19 72760 ----a-w- c:\progra~1\AOLDES~1.7A\aol.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
    2013-09-07 17:19 72760 ----a-w- c:\program files\AOL Desktop 9.7a\aol.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
    2011-10-02 13:04 292208 ----a-w- c:\program files\DellTPad\Apoint.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
    2014-10-11 20:05 60712 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cdloader]
    2012-02-01 17:36 50592 ----a-w- c:\users\Gary\AppData\Roaming\mjusbsp\cdloader2.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DBAgent]
    2013-05-30 18:19 1517640 ----a-w- c:\program files\Seagate\Seagate Dashboard 2.0\DBAgent.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDAgent]
    2009-09-09 21:26 1148200 ------w- c:\program files\Hewlett-Packard\Media\DVD\DVDAgent.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
    2010-03-08 07:27 41800 ----a-w- c:\program files\Common Files\AOL\1325011021\ee\aolsoftware.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
    2008-10-09 15:58 75008 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2014-10-15 12:42 157480 ----a-w- c:\program files\iTunes\iTunesHelper.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
    2008-07-21 13:30 12288 ----a-w- c:\program files\Hewlett-Packard\KBD\KbdStub.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesPreload]
    2014-02-15 04:55 1564992 ----a-w- c:\program files\Samsung\Kies\Kies.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KiesTrayAgent]
    2014-02-15 04:55 311616 ----a-w- c:\program files\Samsung\Kies\KiesTrayAgent.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
    2012-01-04 10:47 6497592 ----a-w- c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2013-05-01 10:59 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyDrive]
    2013-12-15 19:32 257136 ----a-w- c:\users\Gary\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    2014-07-25 19:29 256896 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uploader]
    2013-05-30 18:23 122984 ----a-w- c:\program files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
    "AntiSpywareOverride "=dword:00000001
    .
    S2 AdobeActiveFileMonitor12.0;Adobe Active File Monitor V12;c:\program files\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe [2013-09-25 181152]
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
    2014-10-28 15:54 1089352 ----a-w- c:\program files\Google\Chrome\Application\38.0.2125.111\Installer\chrmstp.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2014-11-05 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-06 12:47]
    .
    2014-11-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2011-09-28 21:49]
    .
    2014-11-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2011-09-28 21:49]
    .
    2014-10-15 c:\windows\Tasks\HPCeeScheduleForGary.job
    - c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2008-11-10 19:12]
    .
    2014-10-28 c:\windows\Tasks\PCDRScheduledMaintenance.job
    - c:\program files\PC-Doctor for Windows\pcdr5cuiw32.exe [2008-09-10 14:43]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = https://www.yahoo.com?fr=hp-avast&type=avastbcl
    mStart Page = https://www.yahoo.com?fr=hp-avast&type=avastbcl
    mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
    Trusted Zone: va.gov
    TCP: DhcpNameServer = 192.168.2.1
    FF - ProfilePath - c:\users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\mhqvnyoa.default-1398863969359\
    FF - prefs.js: browser.search.defaulturl - hxxp://us.yhs4.search.yahoo.com/yhs/search
    FF - prefs.js: browser.startup.homepage - hxxps://finance.yahoo.com/portfolio/pf_5/view/v1
    FF - prefs.js: keyword.URL - hxxp://us.yhs4.search.yahoo.com/yhs/search
    .
    - - - - ORPHANS REMOVED - - - -
    .
    SafeBoot-WudfPf
    SafeBoot-WudfRd
    MSConfigStartUp-BitTorrent - c:\users\Gary\Music\BitTorrent.exe
    AddRemove-MyFreeCodec - c:\program files\MyFree Codec\1.0b beta\uninstall.exe
    .
    .
    .
    **************************************************************************
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files:
    .
    **************************************************************************
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\PCD5SRVC{BD6912E3-AC9D80E8-05040000}]
    "ImagePath "= "\??\c:\progra~1\PC-DOC~1\PCD5SRVC.pkms "
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial "=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial "=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial "=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial "=dword:00000000
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\AVAST Software\Avast\AvastSvc.exe
    c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
    c:\program files\Belkin\Router Setup and Monitor\BelkinService.exe
    c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    c:\program files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe
    c:\program files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Malwarebytes Anti-Malware\mbamscheduler.exe
    c:\program files\Nero\Update\NASvc.exe
    c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
    c:\windows\system32\IoctlSvc.exe
    c:\program files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe
    c:\program files\Secunia\PSI\sua.exe
    c:\windows\system32\UTSCSI.EXE
    c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    c:\windows\system32\DRIVERS\xaudio.exe
    c:\program files\Windows Media Player\wmpnscfg.exe
    c:\users\Gary\AppData\Roaming\Dropbox\bin\Dropbox.exe
    c:\program files\Belkin\Belkin USB Print and Storage Center\connect.exe
    c:\program files\Belkin\Router Setup and Monitor\BelkinSetup.exe
    c:\program files\Citrix\Receiver\Receiver.exe
    c:\program files\Belkin\Router Setup and Monitor\dlnaPlugin.exe
    c:\program files\iPod\bin\iPodService.exe
    c:\windows\system32\wbem\unsecapp.exe
    c:\program files\Citrix\SelfServicePlugin\SelfServicePlugin.exe
    c:\program files\Citrix\ICA Client\wfcrun32.exe
    c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
    c:\windows\servicing\TrustedInstaller.exe
    .
    **************************************************************************
    .
    Completion time: 2014-11-04 20:16:54 - machine was rebooted
    ComboFix-quarantined-files.txt 2014-11-05 04:16
    .
    Pre-Run: 87,589,986,304 bytes free
    Post-Run: 87,572,602,880 bytes free
    .
    - - End Of File - - 2544C4E6905E3BB111869C5A5CCC9AD7
    81CD5EC01DB0CE57EDD853F82462EF27
     
  12. 2014/11/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,483
    Likes Received:
    103
    Trophy Points:
    843
    Location:
    Daly City, CA
    Computer Experience:
    Experienced
    Looks good.

    [​IMG] Please download AdwCleaner by Xplode onto your desktop.
    • Close all open programs and internet browsers.
    • Double click on adwcleaner.exe to run the tool.
    • Click on Scan button.
    • When the scan has finished click on Clean button.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the contents of that logfile with your next reply.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.
    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator ".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.
    [​IMG] Please download Farbar Recovery Scan Tool and save it to your Desktop.

    Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
    • Double-click to run it. When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
    • The first time the tool is run, it makes also another log (Addition.txt). Please copy and paste it to your reply.
     
  13. 2014/11/05
    gpb59

    gpb59 Well-Known Member Thread Starter

    Joined:
    2012/01/28
    Messages:
    282
    Likes Received:
    0
    Trophy Points:
    231
    Computer Experience:
    intermediate
    # AdwCleaner v3.311 - Report created 05/11/2014 at 00:43:51
    # Updated 30/09/2014 by Xplode
    # Operating System : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
    # Username : Gary - GARY-PC
    # Running from : C:\Users\Gary\Desktop\adwcleaner_3.311.exe
    # Option : Clean

    ***** [ Services ] *****


    ***** [ Files / Folders ] *****

    Folder Deleted : C:\ProgramData\NCH Software
    Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Performer
    Folder Deleted : C:\Program Files\NCH Software
    Folder Deleted : C:\Users\Gary\AppData\Roaming\NCH Software
    Folder Deleted : C:\Users\Gary\AppData\Roaming\Search Protection

    ***** [ Scheduled Tasks ] *****


    ***** [ Shortcuts ] *****


    ***** [ Registry ] *****

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\SelectionLinks.DLL
    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9CB96984-43C3-4D44-90EF-01466EFCF7BB}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9CB96984-43C3-4D44-90EF-01466EFCF7BB}

    ***** [ Browsers ] *****

    -\\ Internet Explorer v9.0.8112.16584


    -\\ Mozilla Firefox v33.0.2 (x86 en-US)

    [ File : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\5sd3l8cc.default\prefs.js ]


    [ File : C:\Users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\05lzepug.default\prefs.js ]


    [ File : C:\Users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\mhqvnyoa.default-1398863969359\prefs.js ]


    -\\ Google Chrome v38.0.2125.111

    [ File : C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\preferences ]

    Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}
    Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}

    *************************

    AdwCleaner[R0].txt - [1936 octets] - [05/11/2014 00:41:03]
    AdwCleaner[S0].txt - [1823 octets] - [05/11/2014 00:43:51]

    ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1883 octets] ##########
     
  14. 2014/11/05
    gpb59

    gpb59 Well-Known Member Thread Starter

    Joined:
    2012/01/28
    Messages:
    282
    Likes Received:
    0
    Trophy Points:
    231
    Computer Experience:
    intermediate
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Thisisu
    Version: 6.3.5 (10.31.2014:1)
    OS: Windows Vista (TM) Home Premium x86
    Ran by Gary on Wed 11/05/2014 at 1:31:54.24
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    ~~~ Services



    ~~~ Registry Values



    ~~~ Registry Keys

    Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{8809A334-604B-472E-BC73-02DBFE49AAC8}
    Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{8809A334-604B-472E-BC73-02DBFE49AAC8}



    ~~~ Files



    ~~~ Folders

    Successfully deleted: [Empty Folder] C:\Users\Gary\appdata\local\{017E2A70-6F5E-4A56-B697-BE2260C1E27D}
    Successfully deleted: [Empty Folder] C:\Users\Gary\appdata\local\{196DD5D6-A627-4175-9AA4-9E5C617E07B3}
    Successfully deleted: [Empty Folder] C:\Users\Gary\appdata\local\{2FF9D8B8-8ECF-4D58-A272-679E6CEE9DD2}
    Successfully deleted: [Empty Folder] C:\Users\Gary\appdata\local\{30B11F74-1DB7-4296-B8A4-99349CEF8A7A}
    Successfully deleted: [Empty Folder] C:\Users\Gary\appdata\local\{5AF72B86-BBCE-439E-B889-C6B2EB5315B4}
    Successfully deleted: [Empty Folder] C:\Users\Gary\appdata\local\{DD89F04F-A97B-4965-8F2B-AF634B65B33D}
    Successfully deleted: [Empty Folder] C:\Users\Gary\appdata\local\{F9EB4803-2201-4012-BB87-097528126E49}



    ~~~ FireFox

    Successfully deleted the following from C:\Users\Gary\AppData\Roaming\mozilla\firefox\profiles\05lzepug.default\prefs.js

    user_pref( "browser.search.defaulturl ", "hxxp://us.yhs4.search.yahoo.com/yhs/search ");
    user_pref( "keyword.URL ", "hxxp://us.yhs4.search.yahoo.com/yhs/search ");
    Successfully deleted the following from C:\Users\Gary\AppData\Roaming\mozilla\firefox\profiles\mhqvnyoa.default-1398863969359\prefs.js

    user_pref( "browser.search.defaulturl ", "hxxp://us.yhs4.search.yahoo.com/yhs/search ");
    user_pref( "keyword.URL ", "hxxp://us.yhs4.search.yahoo.com/yhs/search ");
    Emptied folder: C:\Users\Gary\AppData\Roaming\mozilla\firefox\profiles\mhqvnyoa.default-1398863969359\minidumps [36 files]



    ~~~ Event Viewer Logs were cleared





    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Wed 11/05/2014 at 1:35:19.72
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
  15. 2014/11/05
    gpb59

    gpb59 Well-Known Member Thread Starter

    Joined:
    2012/01/28
    Messages:
    282
    Likes Received:
    0
    Trophy Points:
    231
    Computer Experience:
    intermediate
    Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 04-11-2014
    Ran by Gary (administrator) on GARY-PC on 05-11-2014 01:47:44
    Running from C:\Users\Gary\Desktop
    Loaded Profile: Gary (Available profiles: Gary & UpdatusUser & Administrator)
    Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: English (United States)
    Internet Explorer Version 9
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (Microsoft Corporation) C:\Windows\System32\SLsvc.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    (Affinegy, Inc.) C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
    (Citrix Systems, Inc.) C:\Program Files\Citrix\ICA Client\concentr.exe
    (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
    (Affinegy, Inc.) C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe
    (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
    (Seagate Technology LLC) C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe
    (Dropbox, Inc.) C:\Users\Gary\AppData\Roaming\Dropbox\bin\Dropbox.exe
    (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    () C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe
    () C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe
    (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (Nero AG) C:\Program Files\Nero\Update\NASvc.exe
    (Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    (Prolific Technology Inc.) C:\Windows\System32\IoctlSvc.exe
    (Belkin International, Inc.) C:\Program Files\Belkin\Belkin USB Print and Storage Center\Connect.exe
    (Citrix Systems, Inc.) C:\Program Files\Citrix\Receiver\Receiver.exe
    (Affinegy, Inc.) C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe
    (Affinegy, Inc.) C:\Program Files\Belkin\Router Setup and Monitor\dlnaPlugin.exe
    (Secunia) C:\Program Files\Secunia\PSI\sua.exe
    () C:\Windows\System32\UTSCSI.EXE
    (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
    (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
    (Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe
    (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
    (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
    (Citrix Systems, Inc.) C:\Program Files\Citrix\SelfServicePlugin\SelfServicePlugin.exe
    (Citrix Systems, Inc.) C:\Program Files\Citrix\ICA Client\wfcrun32.exe
    (Adobe Systems Incorporated) C:\Program Files\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe
    (Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
    (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
    (Thisisu) C:\Users\Gary\Desktop\JRT.exe
    (Microsoft Corporation) C:\Windows\System32\cmd.exe
    (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
    (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


    ==================== Registry (Whitelisted) ==================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM\...\Run: [InstaLAN] => C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe [1770400 2011-02-24] (Affinegy, Inc.)
    HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)
    HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-07-29] (AVAST Software)
    HKLM\...\Run: [ConnectionCenter] => C:\Program Files\Citrix\ICA Client\concentr.exe [383368 2014-01-08] (Citrix Systems, Inc.)
    HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
    HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
    HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
    HKU\S-1-5-21-2060793998-228504606-3227568861-1000\...\Run: [Uploader] => C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe [122984 2013-05-30] (Seagate Technology LLC)
    HKU\S-1-5-21-2060793998-228504606-3227568861-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0xFF000000
    HKU\S-1-5-18\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000
    Startup: C:\Users\Gary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
    ShortcutTarget: Dropbox.lnk -> C:\Users\Gary\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)
    BootExecute: autocheck autochk * lsdelete
    CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.yahoo.com?fr=hp-avast&type=avastbcl
    HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.yahoo.com?fr=hp-avast&type=avastbcl
    HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
    HKU\S-1-5-21-2060793998-228504606-3227568861-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
    SearchScopes: HKCU - {63140ECF-C629-BE59-8F0E-90B4FF340C03} URL = http://www.bing.com/search?q={searchTerms}&pc=Z128&form=ZGAIDF&install_date=20111231&iesrc={referrer:source}
    SearchScopes: HKCU - {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=994519&p={searchTerms}
    BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
    BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
    BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
    BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
    BHO: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
    BHO: Microsoft Live Search Toolbar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> c:\Program Files\MSN\Toolbar\3.0.0541.0\msneshellx.dll (Microsoft Corp.)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    BHO: SingleInstance Class -> {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} -> C:\Program Files\Yahoo!\Companion\Installs\cpn4\YTSingleInstance.dll (Yahoo! Inc)
    Toolbar: HKLM - Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files\MSN\Toolbar\3.0.0541.0\msneshellx.dll (Microsoft Corp.)
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
    DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
    Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File
    Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
    Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File
    Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
    Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
    Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

    FireFox:
    ========
    FF ProfilePath: C:\Users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\mhqvnyoa.default-1398863969359
    FF SearchEngineOrder.1: Yahoo! (Avast)
    FF Homepage: https://finance.yahoo.com/portfolio/pf_5/view/v1
    FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
    FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
    FF Plugin: @Citrix.com/npican -> C:\Program Files\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)
    FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF Plugin: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
    FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
    FF Plugin: @Nero.com/KM -> C:\PROGRA~1\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
    FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
    FF SearchPlugin: C:\Users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\05lzepug.default\searchplugins\yahoo-avast.xml
    FF SearchPlugin: C:\Users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\mhqvnyoa.default-1398863969359\searchplugins\yahoo-avast.xml
    FF Extension: Microsoft .NET Framework Assistant - C:\Users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\05lzepug.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-04-28]
    FF Extension: WOT - C:\Users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\05lzepug.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2012-05-18]
    FF Extension: Greasemonkey - C:\Users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\05lzepug.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781} [2012-08-03]
    FF Extension: Adblock Plus - C:\Users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\05lzepug.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-04-08]
    FF Extension: WOT - C:\Users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\mhqvnyoa.default-1398863969359\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-05-19]
    FF Extension: Adblock Plus - C:\Users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\mhqvnyoa.default-1398863969359\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-26]
    FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-21]
    FF HKLM\...\Firefox\Extensions: [{1E73965B-8B48-48be-9C8D-68B920ABC1C4}] - C:\Program Files\AVG\AVG2012\Firefox4
    FF HKLM\...\Firefox\Extensions: [avg@igeared] - C:\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared
    FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
    FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2012-01-30]

    Chrome:
    =======
    CHR HomePage: Default -> https://www.yahoo.com?fr=hp-avast&type=avastbcl
    CHR StartupUrls: Default -> "https://www.yahoo.com?fr=hp-avast&type=avastbcl "
    CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
    CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\38.0.2125.111\PepperFlash\pepflashplayer.dll ()
    CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
    CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\38.0.2125.111\ppGoogleNaClPluginChrome.dll No File
    CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\38.0.2125.111\pdf.dll ()
    CHR Plugin: (Conduit Chrome Plugin) - C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\oajgghejjpgkmpgbchgjieahoefimdle\10.15.2.23_0\plugins/ConduitChromeApiPlugin.dll No File
    CHR Plugin: (Conduit Radio Plugin) - C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\oajgghejjpgkmpgbchgjieahoefimdle\10.15.2.23_0\plugins/np-cwmp.dll No File
    CHR Plugin: (Conduit Chrome Approve TB Plugin) - C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\oajgghejjpgkmpgbchgjieahoefimdle\10.15.2.23_0\plugins/ChromeApproveTBPlugin.dll No File
    CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
    CHR Plugin: (ActiveTouch General Plugin Container) - C:\Program Files\Mozilla Firefox\plugins\npatgpc.dll No File
    CHR Plugin: (CouponNetwork Coupon Activator Netscape Plugin v. 5.0.0.0) - C:\Program Files\Mozilla Firefox\plugins\NPcol400.dll No File
    CHR Plugin: (downloadUpdater) - C:\Program Files\Mozilla Firefox\plugins\npdnu.dll No File
    CHR Plugin: (downloadUpdater2) - C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll No File
    CHR Plugin: (Microsoft Office 2003) - C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL No File
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll No File
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll No File
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll No File
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll No File
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll No File
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
    CHR Plugin: (Winamp Application Detector) - C:\Program Files\Mozilla Firefox\plugins\npwachk.dll No File
    CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
    CHR Plugin: (Java(TM) Platform SE 7 U17) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
    CHR Plugin: (MetaStream 3 Plugin) - C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll No File
    CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
    CHR Plugin: (Windows Presentation Foundation) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
    CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll No File
    CHR Plugin: (Java Deployment Toolkit 7.0.170.2) - C:\Windows\system32\npDeployJava1.dll No File
    CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
    CHR Profile: C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default
    CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-06-01]
    CHR Extension: (Google Wallet) - C:\Users\Gary\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]
    CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-07-07]
    CHR HKLM\...\Chrome\Extension: [oajgghejjpgkmpgbchgjieahoefimdle] - C:\Users\Gary\AppData\Local\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx [2014-07-07]
    CHR HKCU\...\Chrome\Extension: [oajgghejjpgkmpgbchgjieahoefimdle] - C:\Users\Gary\AppData\Local\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx [2014-07-07]

    ========================== Services (Whitelisted) =================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 AdobeActiveFileMonitor12.0; C:\Program Files\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe [181152 2013-09-25] (Adobe Systems Incorporated)
    R2 AffinegyService; C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe [566688 2011-02-24] (Affinegy, Inc.)
    S3 AOL ACS; C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe [46640 2006-10-23] (AOL LLC)
    R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-07] (AVAST Software)
    R2 Belkin Local Backup Service; C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe [152064 2010-02-17] () [File not signed]
    R2 Belkin Network USB Helper; C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe [49152 2010-02-09] () [File not signed]
    R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-10-09] (Hewlett-Packard) [File not signed]
    S2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
    S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
    R2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [769432 2012-07-13] (Nero AG)
    R2 PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed]
    S2 Seagate Dashboard Services; C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe [16000 2013-05-30] (Seagate Technology LLC)
    S3 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [994360 2011-10-13] (Secunia)
    R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [399416 2011-10-13] (Secunia)
    R2 UTSCSI; C:\Windows\system32\UTSCSI.EXE [45056 2009-12-10] () [File not signed]

    ==================== Drivers (Whitelisted) ====================

    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

    R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-07-07] ()
    R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-07-07] (AVAST Software)
    R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [55112 2014-07-07] (AVAST Software)
    R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-07-07] ()
    R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [779536 2014-07-07] (AVAST Software)
    R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [414520 2014-07-07] (AVAST Software)
    R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57800 2014-07-07] (AVAST Software)
    R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [192352 2014-07-07] ()
    S3 Dot4Scan; C:\Windows\System32\DRIVERS\Dot4Scan.sys [10752 2008-01-20] (Microsoft Corporation)
    S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-10-01] (Malwarebytes Corporation)
    S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-10-01] (Malwarebytes Corporation)
    S3 PSI; C:\Windows\System32\DRIVERS\psi_mf.sys [15544 2010-09-01] (Secunia)
    R0 PxHelp20; C:\Windows\System32\drivers\PxHelp20.sys [46096 2013-07-19] (Corel Corporation)
    S3 QCDonner; C:\Windows\System32\DRIVERS\LVCD.sys [474304 2004-04-26] (Logitech Inc.)
    R1 SCDEmu; C:\Windows\system32\Drivers\SCDEmu.sys [59388 2009-11-08] (PowerISO Computing, Inc.) [File not signed]
    R2 sxuptp; C:\Windows\System32\DRIVERS\sxuptp.sys [247320 2009-06-22] (silex technology, Inc.)
    R3 wanatw; C:\Windows\System32\DRIVERS\wanatw4.sys [33588 2006-11-29] (America Online, Inc.)
    U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-20] (Microsoft Corporation)
    S3 catchme; \??\C:\ComboFix\catchme.sys [X]
    S3 PCD5SRVC{BD6912E3-AC9D80E8-05040000}; \??\C:\PROGRA~1\PC-DOC~1\PCD5SRVC.pkms [X]

    ==================== NetSvcs (Whitelisted) ===================


    (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


    ==================== One Month Created Files and Folders ========

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2014-11-05 01:47 - 2014-11-05 01:48 - 00025110 _____ () C:\Users\Gary\Desktop\FRST.txt
    2014-11-05 01:47 - 2014-11-05 01:47 - 01106432 _____ (Farbar) C:\Users\Gary\Desktop\FRST.exe
    2014-11-05 01:47 - 2014-11-05 01:47 - 00000000 ____D () C:\FRST
    2014-11-05 01:35 - 2014-11-05 01:35 - 00002398 _____ () C:\Users\Gary\Desktop\JRT.txt
    2014-11-05 00:40 - 2014-11-05 00:44 - 00000000 ____D () C:\AdwCleaner
    2014-11-05 00:40 - 2014-11-05 00:40 - 01706359 _____ (Thisisu) C:\Users\Gary\Desktop\JRT.exe
    2014-11-05 00:39 - 2014-11-05 00:39 - 01375089 _____ () C:\Users\Gary\Desktop\adwcleaner_3.311.exe
    2014-11-04 20:16 - 2014-11-04 20:16 - 00019731 _____ () C:\ComboFix.txt
    2014-11-04 19:46 - 2014-11-04 20:17 - 00000000 ____D () C:\Qoobox
    2014-11-04 19:46 - 2011-06-25 22:45 - 00256000 _____ () C:\Windows\PEV.exe
    2014-11-04 19:46 - 2010-11-07 09:20 - 00208896 _____ () C:\Windows\MBR.exe
    2014-11-04 19:46 - 2009-04-19 20:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
    2014-11-04 19:46 - 2000-08-30 16:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
    2014-11-04 19:46 - 2000-08-30 16:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
    2014-11-04 19:46 - 2000-08-30 16:00 - 00098816 _____ () C:\Windows\sed.exe
    2014-11-04 19:46 - 2000-08-30 16:00 - 00080412 _____ () C:\Windows\grep.exe
    2014-11-04 19:46 - 2000-08-30 16:00 - 00068096 _____ () C:\Windows\zip.exe
    2014-11-04 19:40 - 2014-11-04 19:40 - 05591672 ____R (Swearware) C:\Users\Gary\Desktop\ComboFix.exe
    2014-11-04 18:32 - 2014-11-04 19:05 - 00000000 ____D () C:\Users\Gary\Desktop\mbar
    2014-11-04 18:31 - 2014-11-04 18:31 - 14349744 _____ (Malwarebytes Corp.) C:\Users\Gary\Desktop\mbar-1.07.0.1012.exe
    2014-11-04 18:12 - 2014-11-04 18:12 - 00034808 _____ () C:\Windows\system32\Drivers\TrueSight.sys
    2014-11-04 18:12 - 2014-11-04 18:12 - 00000000 ____D () C:\ProgramData\RogueKiller
    2014-11-04 16:26 - 2014-11-04 16:26 - 00005423 _____ () C:\mlb.txt
    2014-11-04 06:47 - 2014-11-04 06:47 - 00008016 _____ () C:\Users\Gary\Desktop\attach.txt
    2014-11-04 06:47 - 2014-11-04 06:42 - 00017816 _____ () C:\Users\Gary\Desktop\dds.txt
    2014-11-04 06:35 - 2014-11-04 16:27 - 00005423 _____ () C:\Users\Gary\Desktop\mlb.txt
    2014-10-26 07:00 - 2014-10-26 07:00 - 00007083 _____ () C:\Users\Gary\Desktop\Thankyou - San Diego Collision Repair.htm
    2014-10-26 07:00 - 2014-10-26 07:00 - 00000000 ____D () C:\Users\Gary\Desktop\Thankyou - San Diego Collision Repair_files
    2014-10-19 08:28 - 2014-10-19 08:28 - 00001626 _____ () C:\Users\Public\Desktop\iTunes.lnk
    2014-10-19 08:28 - 2014-10-19 08:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
    2014-10-19 08:27 - 2014-10-19 08:28 - 00000000 ____D () C:\ProgramData\B0FFCDD9-5261-4e59-B29A-17A4FABDEBAB
    2014-10-19 08:27 - 2014-10-19 08:27 - 00000000 ____D () C:\Program Files\iPod
    2014-10-19 05:45 - 2014-10-19 05:45 - 00000089 _____ () C:\Users\Gary\Desktop\cx flights.txt
    2014-10-17 05:22 - 2014-10-17 05:20 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
    2014-10-17 05:21 - 2014-10-17 05:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
    2014-10-17 05:21 - 2014-10-17 05:20 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
    2014-10-17 05:21 - 2014-10-17 05:20 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
    2014-10-17 05:21 - 2014-10-17 05:20 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
    2014-10-17 04:39 - 2014-11-05 00:46 - 00002046 _____ () C:\Windows\PFRO.log
    2014-10-16 02:16 - 2014-06-15 14:18 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
    2014-10-16 02:16 - 2014-06-13 10:22 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
    2014-10-16 02:16 - 2014-06-13 10:22 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
    2014-10-16 02:13 - 2014-09-27 15:29 - 02054656 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
    2014-10-16 02:02 - 2014-09-04 15:27 - 00143360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys
    2014-10-16 02:00 - 2014-09-16 08:56 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
    2014-10-15 22:33 - 2014-09-19 14:53 - 12364288 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2014-10-15 22:33 - 2014-09-19 14:44 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2014-10-15 22:33 - 2014-09-19 14:41 - 09739776 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2014-10-15 22:33 - 2014-09-19 14:39 - 01138688 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2014-10-15 22:33 - 2014-09-19 14:38 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2014-10-15 22:33 - 2014-09-19 14:37 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
    2014-10-15 22:33 - 2014-09-19 14:36 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
    2014-10-15 22:33 - 2014-09-19 14:36 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
    2014-10-15 22:33 - 2014-09-19 14:36 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2014-10-15 22:33 - 2014-09-19 14:35 - 01802752 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2014-10-15 22:33 - 2014-09-19 14:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
    2014-10-15 22:33 - 2014-09-19 14:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2014-10-15 22:33 - 2014-09-19 14:35 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
    2014-10-15 22:33 - 2014-09-19 14:35 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
    2014-10-15 22:33 - 2014-09-19 14:34 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2014-10-15 22:33 - 2014-09-19 14:34 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
    2014-10-15 22:33 - 2014-09-19 14:34 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
    2014-10-15 22:33 - 2014-09-19 14:34 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
    2014-10-15 22:33 - 2014-09-19 14:34 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
    2014-10-15 22:33 - 2014-09-19 14:34 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
    2014-10-15 22:33 - 2014-09-19 14:33 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

    ==================== One Month Modified Files and Folders =======

    (If an entry is included in the fixlist, the file\folder will be moved.)

    2014-11-05 01:24 - 2014-05-09 15:46 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys
    2014-11-05 01:02 - 2012-05-06 12:06 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
    2014-11-05 00:54 - 2011-09-28 04:34 - 00000886 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2014-11-05 00:53 - 2009-03-24 14:35 - 01674243 _____ () C:\Windows\WindowsUpdate.log
    2014-11-05 00:50 - 2006-11-02 04:47 - 00003616 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
    2014-11-05 00:50 - 2006-11-02 04:47 - 00003616 _____ () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
    2014-11-05 00:49 - 2013-03-06 16:41 - 00000000 ___RD () C:\Users\Gary\Dropbox
    2014-11-05 00:49 - 2013-03-06 16:38 - 00000000 ____D () C:\Users\Gary\AppData\Roaming\Dropbox
    2014-11-05 00:47 - 2011-09-28 04:34 - 00000882 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2014-11-05 00:47 - 2006-11-02 05:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
    2014-11-05 00:44 - 2006-11-02 05:01 - 00032616 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
    2014-11-04 20:15 - 2006-11-02 02:33 - 00763586 _____ () C:\Windows\system32\PerfStringBackup.INI
    2014-11-04 20:09 - 2006-11-02 02:23 - 00000215 _____ () C:\Windows\system.ini
    2014-11-04 19:05 - 2014-05-15 15:55 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
    2014-11-04 18:32 - 2014-05-09 18:18 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
    2014-11-04 04:57 - 2012-07-31 04:52 - 00000000 ____D () C:\Users\Gary\bali
    2014-11-04 04:57 - 2009-05-31 12:40 - 00002000 _____ () C:\Users\Gary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\E-TRADE MarketTrader.lnk
    2014-11-04 02:00 - 2009-06-06 09:48 - 00000000 ____D () C:\Users\Gary\AppData\Local\Adobe
    2014-11-03 06:48 - 2012-04-25 15:27 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
    2014-11-03 06:09 - 2009-05-31 14:26 - 00000000 ____D () C:\Users\Gary\AppData\Roaming\uTorrent
    2014-11-02 05:59 - 2014-09-24 15:13 - 00000000 ____D () C:\Program Files\Mozilla Firefox
    2014-11-01 15:52 - 2009-06-06 15:44 - 00000052 _____ () C:\Windows\system32\DOErrors.log
    2014-10-29 03:59 - 2014-07-20 06:35 - 00000000 ____D () C:\Users\Gary\AppData\Local\CrashDumps
    2014-10-28 05:35 - 2009-10-02 12:58 - 00229000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
    2014-10-28 03:46 - 2009-05-31 12:07 - 00000456 _____ () C:\Windows\Tasks\PCDRScheduledMaintenance.job
    2014-10-23 19:04 - 2009-08-09 17:03 - 00000000 ____D () C:\Users\Gary\Documents\dvd
    2014-10-22 19:10 - 2009-07-31 05:36 - 00041984 _____ () C:\Users\Gary\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    2014-10-20 15:38 - 2014-05-09 18:18 - 00000861 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    2014-10-20 15:38 - 2014-05-09 18:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
    2014-10-20 15:38 - 2014-05-09 18:18 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
    2014-10-19 08:28 - 2011-08-28 05:55 - 00000000 ____D () C:\Program Files\iTunes
    2014-10-19 08:27 - 2011-04-10 16:49 - 00000000 ____D () C:\Program Files\Common Files\Apple
    2014-10-19 08:26 - 2014-09-14 06:19 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
    2014-10-17 05:48 - 2013-03-06 16:41 - 00000918 _____ () C:\Users\Gary\Desktop\Dropbox.lnk
    2014-10-17 05:48 - 2013-03-06 16:39 - 00000000 ____D () C:\Users\Gary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
    2014-10-17 05:22 - 2008-11-09 22:04 - 00000000 ____D () C:\Program Files\Common Files\Java
    2014-10-17 04:47 - 2012-05-06 12:06 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
    2014-10-17 04:47 - 2011-07-25 04:23 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
    2014-10-17 02:11 - 2006-11-02 03:18 - 00000000 ____D () C:\Windows\Microsoft.NET
    2014-10-16 04:26 - 2013-10-18 03:58 - 00000000 ____D () C:\ProgramData\Oracle
    2014-10-16 04:22 - 2012-03-21 21:57 - 00000000 ____D () C:\Program Files\Java
    2014-10-16 02:35 - 2006-11-02 04:47 - 00438944 _____ () C:\Windows\system32\FNTCACHE.DAT
    2014-10-16 02:11 - 2013-08-14 02:12 - 00000000 ____D () C:\Windows\system32\MRT
    2014-10-16 02:03 - 2006-11-02 02:24 - 100290944 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
    2014-10-15 13:44 - 2009-05-31 11:53 - 00000318 _____ () C:\Windows\Tasks\HPCeeScheduleForGary.job

    Files to move or delete:
    ====================
    C:\Users\Gary\webphonecfg.dat


    Some content of TEMP:
    ====================
    C:\Users\Gary\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpttlswf.dll
    C:\Users\Gary\AppData\Local\temp\Quarantine.exe


    ==================== Bamital & volsnap Check =================

    (There is no automatic fix for files that do not pass verification.)

    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\system32\winlogon.exe => File is digitally signed
    C:\Windows\system32\wininit.exe => File is digitally signed
    C:\Windows\system32\svchost.exe => File is digitally signed
    C:\Windows\system32\services.exe => File is digitally signed
    C:\Windows\system32\User32.dll => File is digitally signed
    C:\Windows\system32\userinit.exe => File is digitally signed
    C:\Windows\system32\rpcss.dll => File is digitally signed
    C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2014-11-05 00:57

    ==================== End Of Log ============================
     
  16. 2014/11/05
    gpb59

    gpb59 Well-Known Member Thread Starter

    Joined:
    2012/01/28
    Messages:
    282
    Likes Received:
    0
    Trophy Points:
    231
    Computer Experience:
    intermediate
    Additional scan result of Farbar Recovery Scan Tool (x86) Version: 04-11-2014
    Ran by Gary at 2014-11-05 01:48:51
    Running from C:\Users\Gary\Desktop
    Boot Mode: Normal
    ==========================================================


    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
    AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

    ==================== Installed Programs ======================

    (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    µTorrent (HKCU\...\uTorrent) (Version: 3.4.2.34944 - BitTorrent Inc.)
    4Media iPod to PC Transfer (HKLM\...\4Media iPod to PC Transfer) (Version: 5.2.1.20120308 - 4Media)
    Acrobat.com (HKLM\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 2.0.0.0 - Adobe Systems Incorporated)
    Acrobat.com (Version: 2.0.0 - Adobe Systems Incorporated) Hidden
    ActiveCheck component for HP Active Support Library (Version: 3.0.0.2 - Hewlett-Packard) Hidden
    Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.8.0.1430 - Adobe Systems Incorporated)
    Adobe Download Assistant (HKLM\...\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.2.6 - Adobe Systems Incorporated)
    Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
    Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.189 - Adobe Systems Incorporated)
    Adobe Photoshop Elements 12 (HKLM\...\Adobe Photoshop Elements 12) (Version: 12.0 - Adobe Systems Incorporated)
    Adobe Reader X (10.1.12) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
    AIM 7 (HKLM\...\AIM_7) (Version: - )
    AnswerWorks 5.0 English Runtime (HKLM\...\{DBCC73BA-C69A-4BF5-B4BF-F07501EE7039}) (Version: 5.0.7 - Vantage Software Technologies)
    Any Video Converter 5.5.9 (HKLM\...\Any Video Converter_is1) (Version: - Any-Video-Converter.com)
    AOL Uninstaller (Choose which Products to Remove) (HKLM\...\AOL Uninstaller) (Version: - AOL Inc.)
    Apple Application Support (HKLM\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
    Apple Mobile Device Support (HKLM\...\{235EBB33-3DA1-46DF-AADE-9955123409CB}) (Version: 8.0.5.6 - Apple Inc.)
    Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
    AusLogics BoostSpeed 6.3.0.0 (HKLM\...\AusLogics BoostSpeed) (Version: - )
    avast! Free Antivirus (HKLM\...\avast) (Version: 9.0.2021 - AVAST Software)
    Belkin Setup and Router Monitor (HKLM\...\Belkin Setup and Router Monitor_is1) (Version: - )
    Belkin USB Print and Storage Center (HKLM\...\Belkin USB Print and Storage Center) (Version: 1.1.2 - Belkin International, Inc.)
    BitTorrent (HKCU\...\BitTorrent) (Version: 7.9.2.32355 - BitTorrent Inc.)
    Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
    CCleaner (HKLM\...\CCleaner) (Version: 4.09 - Piriform)
    Citrix Receiver (HKLM\...\CitrixOnlinePluginPackWeb) (Version: 13.4.300.10 - Citrix Systems, Inc.)
    Clone Tools version 2.0.2.0 (HKLM\...\{44CD39FC-AC58-4F03-AA32-331BA086B49D}_is1) (Version: 2.0.2.0 - Control Engineering Sweden AB)
    Compatibility Pack for the 2007 Office system (HKLM\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
    D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
    dBpoweramp AAC Encoder (HKLM\...\dBpoweramp AAC Encoder) (Version: - )
    dBpoweramp DSP Effects (HKLM\...\dBpoweramp DSP Effects) (Version: Release 10 - Illustrate)
    dBpoweramp FLAC Codec (HKLM\...\dBpoweramp FLAC Codec) (Version: Release 13.1 (FLAC 1.2.1) - Illustrate)
    dBpoweramp m4a Codec (HKLM\...\dBpoweramp m4a Codec) (Version: Release 8 - Illustrate)
    dBpoweramp m4a FDK (AAC) Encoder (HKLM\...\dBpoweramp m4a FDK (AAC) Encoder) (Version: Release 1 (FDK 3.3.3) - Illustrate)
    dBpoweramp m4a Utilities (HKLM\...\dBpoweramp m4a Utilities) (Version: - )
    dBpoweramp m4b Audio book Encoder (HKLM\...\dBpoweramp m4b Audio book Encoder) (Version: - )
    dBpoweramp Monkeys Audio Codec (HKLM\...\dBpoweramp Monkeys Audio Codec) (Version: - )
    dBpoweramp Music Converter (HKLM\...\dBpoweramp Music Converter) (Version: Release 15 - Illustrate)
    dBpoweramp Shorten Codec (HKLM\...\dBpoweramp Shorten Codec) (Version: - )
    Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.1007.101.210 - ALPS ELECTRIC CO., LTD.)
    DING! (HKLM\...\{84031A18-BA9A-4156-A74F-E05B52DDFCE2}) (Version: 1.05.005 - Southwest Airlines)
    Dropbox (HKCU\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)
    DVDFab 8.2.2.0 (16/11/2012) Qt (HKLM\...\DVDFab 8 Qt_is1) (Version: - Fengtao Software Inc.)
    DVDFab 9.1.1.9 (18/12/2013) (HKLM\...\DVDFab 9_is1) (Version: - Fengtao Software Inc.)
    EasyDuplicateFinder v4.3 (HKLM\...\Easy Duplicate Finder 4_is1) (Version: - WebMinds, Inc.)
    Elements 12 Organizer (Version: 12.0 - Adobe Systems Incorporated) Hidden
    Enhanced Multimedia Keyboard Solution (HKLM\...\KBD) (Version: 1.0.9.2 - Hewlett-Packard)
    ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version: - )
    Exact Audio Copy 1.0beta3 (HKLM\...\Exact Audio Copy) (Version: 1.0beta3 - Andre Wiethoff)
    Express Zip (HKLM\...\ExpressZip) (Version: - NCH Software)
    FLAC Frontend (HKLM\...\{B1615F2A-105F-48FD-AA3E-0BDF8B3EE644}) (Version: 2.0.6 - Xiph.org)
    Google Chrome (HKLM\...\Google Chrome) (Version: 38.0.2125.111 - Google Inc.)
    Google Update Helper (Version: 1.3.25.5 - Google Inc.) Hidden
    Hardware Diagnostic Tools (HKLM\...\PC-Doctor for Windows) (Version: 5.1.4976.17 - PC-Doctor, Inc.)
    HP Active Support Library (HKLM\...\{CE7E3BE0-2DD3-4416-A690-F9E4A99A8CFF}) (Version: 3.1.9.1 - Hewlett-Packard)
    HP Customer Experience Enhancements (HKLM\...\{64B9E2F5-558E-4C56-B419-A1679518F6E7}) (Version: 5.7.0.2784 - Hewlett-Packard)
    HP Demo (HKLM\...\{A2016015-8323-4AF8-8B3E-F56239D7D59D}) (Version: 1.00.0000 - Hewlett-Packard)
    HP MediaSmart DVD (HKLM\...\InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}) (Version: 2.2.3309 - Hewlett-Packard)
    HP MediaSmart Music/Photo/Video (HKLM\...\InstallShield_{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}) (Version: 2.0.2217 - Hewlett-Packard)
    HP MediaSmart SmartMenu (HKLM\...\{EFC5939F-470F-454E-B3DA-F51FDD83F6CE}) (Version: 2.0.8 - Hewlett-Packard)
    HP Total Care Setup (HKLM\...\{38058455-8C21-4C2F-B2F6-14ED166039CB}) (Version: 1.1.1983.2818 - Hewlett-Packard Company)
    HP Update (HKLM\...\{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}) (Version: 5.003.001.001 - Hewlett-Packard)
    HPAsset component for HP Active Support Library (Version: 3.0.2.2 - Hewlett-Packard) Hidden
    ImagXpress (Version: 7.0.74.0 - Nero AG) Hidden
    ImgBurn (HKLM\...\ImgBurn) (Version: 2.5.6.0 - LIGHTNING UK!)
    iPod PC Transfer Suit 4.2 (HKLM\...\iPod PC Transfer Suit_is1) (Version: 4.2 - iPod PC Transfer)
    iSEEK AnswerWorks English Runtime (HKLM\...\{18A8E78B-9EF2-496E-B310-BCD8E4C1DAB3}) (Version: 010.000.0101 - Vantage Linguistics)
    iTunes (HKLM\...\{5D928931-D1D2-4A93-A82D-BF60D0E7CFA5}) (Version: 12.0.1.26 - Apple Inc.)
    iTunes Library Toolkit (HKLM\...\{BE19A54F-8291-417A-82C1-B22B19339927}) (Version: 1.0.0702 - klarita.net)
    iTunesFolderWatch (HKLM\...\{450C790A-8C60-4B3D-887E-2124AC823D6D}) (Version: 2.1.09 - JezSoft)
    Java 7 Update 67 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
    Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Juno Preloader (HKLM\...\{6423EF83-6E1D-4D22-A36F-689CD19FD4D2}) (Version: 1.0.0 - Juno, Inc.)
    K-Lite Codec Pack 8.1.0 (Basic) (HKLM\...\KLiteCodecPack_is1) (Version: 8.1.0 - )
    LockHunter 3.0, 32/64 bit (HKLM\...\LockHunter_is1) (Version: - Crystal Rich Ltd)
    M3U2iTunes (HKLM\...\{D9F58859-61BA-44A2-9E56-7DC7E8970AE3}) (Version: 1.0.0 - otherslikeyou.com Inc.)
    magicJack (HKCU\...\magicJack) (Version: 2.0.6073.4413 - magicJack L.P.)
    magicJack Recovery Tool 1.0 (HKLM\...\magicJack Recovery Tool_is1) (Version: - magicJack, L.P.)
    Malwarebytes Anti-Malware version 2.0.3.1025 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
    Mesh Runtime (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
    Messenger Companion (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
    Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
    Microsoft Live Search Toolbar (HKLM\...\{4FAB5122-775E-4418-B8D9-E2873BC93570}) (Version: 3.0.541.0 - Microsoft Corporation)
    Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
    Microsoft Office Home and Student 60 day trial (HKLM\...\OfficeTrial) (Version: - )
    Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
    Microsoft Office Outlook Connector (HKLM\...\{95140000-0081-0409-0000-0000000FF1CE}) (Version: 14.0.6123.5001 - Microsoft Corporation)
    Microsoft Office PowerPoint Viewer 2007 (English) (HKLM\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
    Microsoft Office Professional Edition 2003 (HKLM\...\{90110409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
    Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 17.0.2015.0811 - Microsoft Corporation)
    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Works (HKLM\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)
    mkw Audio Compression Toolkit (HKLM\...\mkwACT) (Version: - )
    mkw Runtime Libraries (HKLM\...\mkwMFCRTL) (Version: - )
    Mozilla Firefox 33.0.2 (x86 en-US) (HKLM\...\Mozilla Firefox 33.0.2 (x86 en-US)) (Version: 33.0.2 - Mozilla)
    Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
    MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
    MSXML 4.0 SP2 (KB927978) (HKLM\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
    MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
    muvee Reveal (HKLM\...\{19506BDB-4EA7-491F-E8AB-E97109FDB296}) (Version: 7.0.35.7315 - muvee Technologies Pte Ltd)
    My HP Games (HKLM\...\WildTangent hp Master Uninstall) (Version: 1.0.0.62 - WildTangent)
    Nero 12 (HKLM\...\{80836C86-1305-40C9-B7C9-F3A75266070D}) (Version: 12.5.01900 - Nero AG)
    Nero 8 Essentials (HKLM\...\{8651784F-123E-4E8F-A5AD-60B8BE121033}) (Version: 8.3.350 - Nero AG)
    NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.57.35 - NVIDIA Corporation)
    NVIDIA Graphics Driver 307.83 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 307.83 - NVIDIA Corporation)
    NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
    OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
    Online Plug-in (Version: 13.4.300.10 - Citrix Systems, Inc.) Hidden
    PictureMover (HKLM\...\{1896E712-2B3D-45eb-BCE9-542742A51032}) (Version: 3.3.1.7 - Hewlett-Packard Company)
    PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.2202 - CyberLink Corp.)
    PowerDirector (Version: 7.0.2202 - CyberLink Corp.) Hidden
    PowerISO (HKLM\...\PowerISO) (Version: 4.6 - PowerISO Computing, Inc.)
    Prerequisite installer (Version: 12.0.0003 - Nero AG) Hidden
    Prism Video File Converter (HKLM\...\Prism) (Version: - NCH Software)
    PSE12 STI Installer (Version: 12.0 - Adobe Systems Incorporated) Hidden
    Python 2.5.2 (HKLM\...\{6B976ADF-8AE8-434E-B282-A06C7F624D2F}) (Version: 2.5.2150 - Python Software Foundation)
    Quicken 2011 (HKLM\...\{5FE545A1-D215-4216-9189-E7B39C9D1CC1}) (Version: 20.1.8.6 - Intuit)
    QuickTime (HKLM\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
    Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5789 - Realtek Semiconductor Corp.)
    Revo Uninstaller Pro 2.5.8 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 2.5.8 - VS Revo Group, Ltd.)
    R-Studio 4.2 (HKLM\...\R-Studio 4.2NSIS) (Version: 4.2.125063 - R-Tools Technology Inc.)
    Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.2.14014_7 - Samsung Electronics Co., Ltd.)
    Samsung Kies (Version: 2.6.2.14014_7 - Samsung Electronics Co., Ltd.) Hidden
    SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.34.0 - SAMSUNG Electronics Co., Ltd.)
    Seagate Dashboard 2.0 (HKLM\...\{43C423D9-E6D6-4607-ADC9-EBB54F690C57}) (Version: 2.2.29.0 - Seagate)
    Secunia PSI (2.0.0.4003) (HKLM\...\Secunia PSI) (Version: 2.0.0.4003 - Secunia)
    Segoe UI (Version: 15.4.2271.0615 - Microsoft Corp) Hidden
    Self-service Plug-in (Version: 3.4.300.43589 - Citrix Systems, Inc.) Hidden
    Serial Key Generator version 5.0 (HKLM\...\{93E9D2A0-8C35-4E79-99F3-8325443EC10B}_is1) (Version: 5.0 - VCL Examples)
    Skype web features (HKLM\...\{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}) (Version: 1.0.3971 - Skype Technologies S.A.)
    Skype™ 6.18 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
    Soft Data Fax Modem with SmartCP (HKLM\...\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1) (Version: 7.80.0.0 - Conexant Systems)
    Switch Sound File Converter (HKLM\...\Switch) (Version: - NCH Software)
    The Rosetta Stone (HKLM\...\The Rosetta Stone) (Version: - )
    Trader's Little Helper 2.7.0 (HKLM\...\TradersLittleHelper_is1) (Version: 2.7.0 - Robert Hoffmann)
    Video Mover (HKLM\...\Video Mover_is1) (Version: - )
    Visual C++ 2008 x86 Runtime - v9.0.30729.01 (HKLM\...\{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01) (Version: 9.0.30729.01 - Microsoft Corporation)
    VLC media player 2.0.5 (HKLM\...\VLC media player) (Version: 2.0.5 - VideoLAN)
    Welcome App (Start-up experience) (Version: 12.0.15000 - Nero AG) Hidden
    Winamp (HKLM\...\Winamp) (Version: 5.666 - Nullsoft, Inc)
    Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
    Windows Live Mesh ActiveX Control for Remote Connections (HKLM\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
    Windows Live Sync (HKLM\...\{B10914FD-8812-47A4-85A1-50FCDE7F1F33}) (Version: 14.0.8117.416 - Microsoft Corporation)
    WinRAR archiver (HKLM\...\WinRAR archiver) (Version: - )
    Xilisoft AVI to DVD Converter (HKLM\...\Xilisoft AVI to DVD Converter) (Version: 3.0.45.0807 - Xilisoft)
    Xilisoft FLAC Converter (HKLM\...\Xilisoft FLAC Converter) (Version: 6.3.0.0805 - Xilisoft)
    Xilisoft ISO Pro (HKLM\...\Xilisoft ISO Pro) (Version: 1.0.8.0724 - Xilisoft)
    Xilisoft Video Converter Ultimate (HKLM\...\Xilisoft Video Converter Ultimate) (Version: 5.1.26.0624 - Xilisoft)
    Yahoo! Messenger (HKLM\...\Yahoo! Messenger) (Version: - Yahoo! Inc.)
    Yahoo! Software Update (HKLM\...\Yahoo! Software Update) (Version: - )
    Yahoo! Toolbar (HKLM\...\Yahoo! Companion) (Version: - Yahoo! Inc.)

    ==================== Custom CLSID (selected items): ==========================

    (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

    CustomCLSID: HKU\S-1-5-21-2060793998-228504606-3227568861-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Gary\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-2060793998-228504606-3227568861-1000_Classes\CLSID\{1853e19a-4e54-4190-8deb-2e1cc947cd60}\InprocServer32 -> C:\Program Files\AOL Desktop 9.7a\axtrack.dll (AOL Inc.)
    CustomCLSID: HKU\S-1-5-21-2060793998-228504606-3227568861-1000_Classes\CLSID\{7629C9DE-2E38-4963-A01C-02FFAC203D87}\InprocServer32 -> C:\Program Files\AOL Desktop 9.7a\axtrack.dll (AOL Inc.)
    CustomCLSID: HKU\S-1-5-21-2060793998-228504606-3227568861-1000_Classes\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\localserver32 -> C:\Users\Gary\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-2060793998-228504606-3227568861-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Gary\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-2060793998-228504606-3227568861-1000_Classes\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\localserver32 -> C:\Users\Gary\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-2060793998-228504606-3227568861-1000_Classes\CLSID\{B9F3009B-976B-41C4-A992-229DCCF3367C}\InprocServer32 -> C:\Program Files\AOL Desktop 9.7a\axtrack.dll (AOL Inc.)
    CustomCLSID: HKU\S-1-5-21-2060793998-228504606-3227568861-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Gary\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-2060793998-228504606-3227568861-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Gary\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-2060793998-228504606-3227568861-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Gary\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-2060793998-228504606-3227568861-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Gary\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\FileSyncApi.dll (Microsoft Corporation)
    CustomCLSID: HKU\S-1-5-21-2060793998-228504606-3227568861-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Gary\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-2060793998-228504606-3227568861-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Gary\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-2060793998-228504606-3227568861-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Gary\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-2060793998-228504606-3227568861-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Gary\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-2060793998-228504606-3227568861-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Gary\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-2060793998-228504606-3227568861-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Gary\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-2060793998-228504606-3227568861-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Gary\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
    CustomCLSID: HKU\S-1-5-21-2060793998-228504606-3227568861-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Gary\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

    ==================== Restore Points =========================

    27-10-2014 10:00:27 Windows Update
    28-10-2014 05:46:35 Scheduled Checkpoint
    28-10-2014 10:00:18 Windows Update
    29-10-2014 07:00:05 Scheduled Checkpoint
    29-10-2014 10:00:13 Windows Update
    30-10-2014 10:00:12 Windows Update
    31-10-2014 10:00:13 Windows Update
    01-11-2014 10:00:20 Windows Update
    01-11-2014 23:26:17 Scheduled Checkpoint
    02-11-2014 10:00:31 Windows Update
    02-11-2014 11:00:13 Windows Update
    03-11-2014 11:00:19 Windows Update
    04-11-2014 08:00:03 Scheduled Checkpoint
    04-11-2014 11:00:13 Windows Update
    05-11-2014 02:30:15 nov4

    ==================== Hosts content: ==========================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2006-11-02 02:23 - 2014-11-04 20:09 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
    127.0.0.1 localhost

    ==================== Scheduled Tasks (whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

    Task: {0953F32D-4F07-429A-B423-ABC5FA428779} - System32\Tasks\d3620930 => C:\Users\Gary\AppData\Local\Temp\\setup3226017456.exe <==== ATTENTION
    Task: {0E6AF67F-94A9-4644-B962-CFD693E5E8FA} - System32\Tasks\{805DA6D6-FE62-40BF-8C26-A2AF470BA4C9} => C:\Program Files\Skype\Phone\Skype.exe [2014-07-24] (Skype Technologies S.A.)
    Task: {13E597FC-D290-43AC-ACE7-D4BB2581BBAB} - System32\Tasks\497a9bb0 => C:\Users\Gary\AppData\Local\Temp\\setup4182059312.exe <==== ATTENTION
    Task: {1B14DE28-4A0F-45E9-A86F-EA47FA00CFBA} - System32\Tasks\Ad-Aware Update (Weekly) => C:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe
    Task: {227D3D9F-8397-411B-8048-006CA2CFF8D4} - System32\Tasks\53ea8ab0 => C:\Users\Gary\AppData\Local\Temp\\setup4036767152.exe <==== ATTENTION
    Task: {2C68BFA9-5B21-4C77-A6D6-FB6030BDF813} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-12-17] (Piriform Ltd)
    Task: {2E4C0698-C8B1-4CB6-A224-07194A13CDC6} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Gary => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-10] (Microsoft Corporation)
    Task: {2E6C2426-3DC8-45F3-A50B-1208AC0A363C} - System32\Tasks\9ff5cd30 => C:\Users\Gary\AppData\Local\Temp\\setup1594326192.exe <==== ATTENTION
    Task: {3DAC952C-346E-4E3D-9D81-57516B232C1E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-17] (Google Inc.)
    Task: {3F7FAF9E-3E98-4C5D-836A-8F46A7E02EBE} - System32\Tasks\PCDRScheduledMaintenance => C:\Program Files\PC-Doctor for Windows\pcdr5cuiw32.exe [2008-09-10] (PC-Doctor, Inc.)
    Task: {41E915B2-3B57-4F93-8BC6-31619F7BEF9B} - System32\Tasks\HPCeeScheduleForGary => C:\Program Files\hewlett-packard\sdp\ceement\HPCEE.exe [2008-09-16] (Hewlett-Packard)
    Task: {479C3E6C-F2A7-4116-8D57-1ED179BB7256} - System32\Tasks\{C8C10CCB-0030-4032-8487-25DA3A6E66C8} => Firefox.exe http://ui.skype.com/ui/0/4.1.0.179....google-chrome:notoffered;ienotdefaultbrowser2
    Task: {53EB8A2D-C558-4AAB-8D38-A72A264DA013} - System32\Tasks\HP Health Check => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-10-09] (Hewlett-Packard)
    Task: {5778EDE1-87C5-4581-8D16-77C8C2F858A6} - System32\Tasks\bdaf2330 => C:\Users\Gary\AppData\Local\Temp\\setup2477491632.exe <==== ATTENTION
    Task: {5C02E0D2-7A87-4BB8-919F-1D19257790B3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-17] (Google Inc.)
    Task: {687207C0-9B2A-43EC-891B-A219AAC59077} - System32\Tasks\ef87ef30 => C:\Users\Gary\AppData\Local\Temp\\setup3441943216.exe <==== ATTENTION
    Task: {72B2A310-0524-4A1D-BE4C-53E8885EDEAC} - System32\Tasks\Gary DBAgent 2 0 => C:\Program Files\Seagate\Seagate Dashboard 2.0\DBAgent.exe [2013-05-30] (Seagate Technology LLC)
    Task: {7528991D-ACD5-4001-970E-29154098AE36} - System32\Tasks\56d5e630 => C:\Users\Gary\AppData\Local\Temp\\setup1136458672.exe <==== ATTENTION
    Task: {80C534AE-BA1D-4224-A526-A302E89CE971} - System32\Tasks\686cdfb0 => C:\Users\Gary\AppData\Local\Temp\\setup983005616.exe <==== ATTENTION
    Task: {80E6E6FB-6D92-4311-84DB-776BF10442E8} - System32\Tasks\AdobeAAMUpdater-1.0-Gary-PC-Gary => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2013-06-03] (Adobe Systems Incorporated)
    Task: {83190BAA-3B4D-4E0B-B7D6-5296567C0832} - System32\Tasks\b8ad5a30 => C:\Users\Gary\AppData\Local\Temp\\setup407008560.exe <==== ATTENTION
    Task: {87F26F3C-34C1-441C-86D7-08DCFD2BFB69} - System32\Tasks\69cc97b0 => C:\Users\Gary\AppData\Local\Temp\\setup1134215856.exe <==== ATTENTION
    Task: {8C273203-6035-4F22-9E57-8F68CC9DCEF0} - System32\Tasks\705e9530 => C:\Users\Gary\AppData\Local\Temp\\setup1564846768.exe <==== ATTENTION
    Task: {8D4B31E7-385F-4259-813C-9856887A1209} - System32\Tasks\4bb006b0 => C:\Users\Gary\AppData\Local\Temp\\setup757187248.exe <==== ATTENTION
    Task: {97633A62-1E9D-40AC-BD9A-62BD1AC6C979} - System32\Tasks\3d805eb0 => C:\Users\Gary\AppData\Local\Temp\\setup4046797616.exe <==== ATTENTION
    Task: {B1E06C40-3787-48A3-BB34-6B2FF2AF79FA} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-07-07] (AVAST Software)
    Task: {C6088343-84CF-43F2-8AC3-215790BD6CF0} - System32\Tasks\5ab7d830 => C:\Users\Gary\AppData\Local\Temp\\setup304477872.exe <==== ATTENTION
    Task: {C6379117-6E37-4BDE-8218-6AB512B92D2C} - System32\Tasks\9cdfdbb0 => C:\Users\Gary\AppData\Local\Temp\\setup2119276464.exe <==== ATTENTION
    Task: {D9FB473F-4550-4879-B9C2-5B26758B794E} - System32\Tasks\RecoveryCD => C:\Program Files\Hewlett-Packard\HP TCS\RemEngine.exe [2008-10-20] ()
    Task: {E28CDFA5-79D3-48B4-93F8-95F5DF69BDDB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-17] (Adobe Systems Incorporated)
    Task: {EC27CE74-B2E7-4B5B-B317-7FA7BD5E7B7D} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
    Task: {F85B045D-CA65-4FE4-B422-6BB55304AC8A} - System32\Tasks\cef4bcb0 => C:\Users\Gary\AppData\Local\Temp\\setup2895425584.exe <==== ATTENTION
    Task: {FF4294B7-E448-4B2B-89AD-F2E739585972} - System32\Tasks\Seagate_Install_Launch => C:\Program Files\Seagate\Seagate Dashboard 2.0\Dashboard.exe [2013-05-30] (Seagate Technology LLC)

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\HPCeeScheduleForGary.job => C:\Program Files\hewlett-packard\sdp\ceement\HPCEE.exe
    Task: C:\Windows\Tasks\PCDRScheduledMaintenance.job => C:\Program Files\PC-Doctor for Windows\pcdr5cuiw32.exe

    ==================== Loaded Modules (whitelisted) =============

    2012-01-30 20:55 - 2014-07-07 04:02 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll
    2014-11-04 14:40 - 2014-11-04 14:40 - 02899456 _____ () C:\Program Files\AVAST Software\Avast\defs\14110401\algo.dll
    2012-05-20 11:44 - 2011-02-15 12:15 - 00325632 _____ () C:\Program Files\Belkin\Router Setup and Monitor\QtXml4.dll
    2012-05-20 11:44 - 2011-02-15 12:15 - 01954304 _____ () C:\Program Files\Belkin\Router Setup and Monitor\QtCore4.dll
    2012-05-20 11:44 - 2011-02-15 12:16 - 07187456 _____ () C:\Program Files\Belkin\Router Setup and Monitor\QtGui4.dll
    2012-05-20 11:44 - 2011-02-15 12:15 - 00847360 _____ () C:\Program Files\Belkin\Router Setup and Monitor\QtNetwork4.dll
    2012-05-20 11:44 - 2011-02-15 11:25 - 00119808 _____ () C:\Program Files\Belkin\Router Setup and Monitor\imageformats\qjpeg4.dll
    2013-11-22 05:24 - 2014-07-07 04:02 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
    2012-05-20 11:44 - 2011-02-24 20:08 - 00022944 _____ () C:\Program Files\Belkin\Router Setup and Monitor\BelkinServicePS.dll
    2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
    2014-10-11 12:05 - 2014-10-11 12:05 - 01044776 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
    2014-11-05 00:49 - 2014-11-05 00:49 - 00043008 _____ () c:\users\gary\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpttlswf.dll
    2013-08-23 11:01 - 2013-08-23 11:01 - 25100288 _____ () C:\Users\Gary\AppData\Roaming\Dropbox\bin\libcef.dll
    2012-05-20 11:46 - 2010-02-17 17:25 - 00152064 ____N () C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe
    2012-05-20 11:46 - 2010-02-09 14:55 - 00049152 ____N () C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe
    2012-05-20 11:46 - 2010-02-17 17:25 - 00132096 ____N () C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkLocalBackup.dll
    2012-05-20 11:44 - 2011-02-24 19:39 - 00658432 _____ () C:\Program Files\Belkin\Router Setup and Monitor\gateways\GenericBelkinGatewayLOC.dll
    2009-12-10 08:27 - 2009-12-10 08:27 - 00045056 _____ () C:\Windows\system32\UTSCSI.EXE
    2014-09-24 15:13 - 2014-11-02 05:59 - 03649648 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

    ==================== Alternate Data Streams (whitelisted) =========

    (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


    ==================== Safe Mode (whitelisted) ===================

    (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => " "= "Driver "
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => " "= "Driver "

    ==================== EXE Association (whitelisted) =============

    (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


    ==================== MSCONFIG/TASK MANAGER disabled items =========

    (Currently there is no automatic fix for this section.)

    MSCONFIG\Services: nvsvc => 2
    MSCONFIG\Services: nvUpdatusService => 2
    MSCONFIG\Services: WMPNetworkSvc => 3
    MSCONFIG\Services: YahooAUService => 2
    MSCONFIG\startupfolder: C:^Users^Gary^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox (1).lnk => C:\Windows\pss\Dropbox (1).lnk.Startup
    MSCONFIG\startupfolder: C:^Users^Gary^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
    MSCONFIG\startupfolder: C:^Users^Gary^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MyPC Backup.lnk => C:\Windows\pss\MyPC Backup.lnk.Startup
    MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
    MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe "
    MSCONFIG\startupreg: AOL => C:\PROGRA~1\AOLDES~1.7A\aol.exe
    MSCONFIG\startupreg: AOL Fast Start => "C:\Program Files\AOL Desktop 9.7a\AOL.EXE" -b
    MSCONFIG\startupreg: Apoint => C:\Program Files\DellTPad\Apoint.exe
    MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe "
    MSCONFIG\startupreg: cdloader => "C:\Users\Gary\AppData\Roaming\mjusbsp\cdloader2.exe" MAGICJACK
    MSCONFIG\startupreg: DBAgent => "C:\Program Files\Seagate\Seagate Dashboard 2.0\DBAgent.exe" /WinStart
    MSCONFIG\startupreg: DVDAgent => "c:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe "
    MSCONFIG\startupreg: HostManager => C:\Program Files\Common Files\AOL\1325011021\ee\AOLSoftware.exe
    MSCONFIG\startupreg: HP Health Check Scheduler => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
    MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe "
    MSCONFIG\startupreg: KBD => C:\Program Files\Hewlett-Packard\KBD\KbdStub.EXE
    MSCONFIG\startupreg: KiesPreload => C:\Program Files\Samsung\Kies\Kies.exe /preload
    MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
    MSCONFIG\startupreg: Messenger (Yahoo!) => "C:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe" -quiet
    MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    MSCONFIG\startupreg: SkyDrive => "C:\Users\Gary\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe" /background
    MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe "
    MSCONFIG\startupreg: Uploader => C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.Uploader.exe

    ========================= Accounts: ==========================

    Administrator (S-1-5-21-2060793998-228504606-3227568861-500 - Administrator - Enabled) => C:\Users\Administrator
    Gary (S-1-5-21-2060793998-228504606-3227568861-1000 - Administrator - Enabled) => C:\Users\Gary
    Guest (S-1-5-21-2060793998-228504606-3227568861-501 - Limited - Disabled)
    UpdatusUser (S-1-5-21-2060793998-228504606-3227568861-1001 - Limited - Enabled) => C:\Users\UpdatusUser

    ==================== Faulty Device Manager Devices =============

    Name: 6TO4 Adapter
    Description: Microsoft 6to4 Adapter
    Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
    Manufacturer: Microsoft
    Service: tunnel
    Problem: : This device cannot start. (Code10)
    Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
    On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


    ==================== Event log errors: =========================

    Application errors:
    ==================

    System errors:
    =============

    Microsoft Office Sessions:
    =========================

    CodeIntegrity Errors:
    ===================================
    Date: 2014-11-05 01:48:44.874
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

    Date: 2014-11-05 01:48:44.250
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

    Date: 2014-11-05 01:48:43.626
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

    Date: 2014-11-05 01:48:42.970
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

    Date: 2014-11-05 01:48:17.344
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

    Date: 2014-11-05 01:48:16.714
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

    Date: 2014-11-05 01:48:16.059
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

    Date: 2014-11-05 01:48:15.423
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

    Date: 2014-11-05 01:24:39.673
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

    Date: 2014-11-05 01:24:39.049
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.


    ==================== Memory info ===========================

    Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 5000+
    Percentage of memory in use: 53%
    Total physical RAM: 2941.83 MB
    Available physical RAM: 1360.24 MB
    Total Pagefile: 5950.23 MB
    Available Pagefile: 4527.56 MB
    Total Virtual: 2047.88 MB
    Available Virtual: 1890.47 MB

    ==================== Drives ================================

    Drive c: (HP) (Fixed) (Total:286.43 GB) (Free:80.93 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
    Drive d: (FACTORY_IMAGE) (Fixed) (Total:11.66 GB) (Free:1.59 GB) NTFS ==>[System with boot components (obtained from reading drive)]
    Drive f: (Seagate Backup Plus Drive) (Fixed) (Total:931.51 GB) (Free:266.96 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (Size: 298.1 GB) (Disk ID: 1549F232)
    Partition 1: (Active) - (Size=286.4 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=11.7 GB) - (Type=07 NTFS)

    ========================================================
    Disk: 1 (Size: 931.5 GB) (Disk ID: EB3631AB)
    Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

    ==================== End Of Log ============================
     
  17. 2014/11/05
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,483
    Likes Received:
    103
    Trophy Points:
    843
    Location:
    Daly City, CA
    Computer Experience:
    Experienced
    Download attached fixlist.txt file and save it to the Desktop.
    NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Run FRST(FRST64) and press the Fix button just once and wait.
    The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
     

    Attached Files:

  18. 2014/11/05
    gpb59

    gpb59 Well-Known Member Thread Starter

    Joined:
    2012/01/28
    Messages:
    282
    Likes Received:
    0
    Trophy Points:
    231
    Computer Experience:
    intermediate
    I'm not sure if this was exactly right

    Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 04-11-2014
    Ran by Gary at 2014-11-05 18:13:39 Run:1
    Running from C:\Users\Gary\Desktop
    Loaded Profile: Gary (Available profiles: Gary & UpdatusUser & Administrator)
    Boot Mode: Normal

    ==============================================

    Content of fixlist:
    *****************
    CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
    HKU\S-1-5-21-2060793998-228504606-3227568861-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
    Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File
    Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File
    FF HKLM\...\Firefox\Extensions: [{1E73965B-8B48-48be-9C8D-68B920ABC1C4}] - C:\Program Files\AVG\AVG2012\Firefox4
    FF HKLM\...\Firefox\Extensions: [avg@igeared] - C:\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared
    C:\Program Files\AVG
    CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\38.0.2125.111\ppGoogleNaClPluginChrome.dll No File
    CHR Plugin: (ActiveTouch General Plugin Container) - C:\Program Files\Mozilla Firefox\plugins\npatgpc.dll No File
    CHR Plugin: (CouponNetwork Coupon Activator Netscape Plugin v. 5.0.0.0) - C:\Program Files\Mozilla Firefox\plugins\NPcol400.dll No File
    CHR Plugin: (downloadUpdater) - C:\Program Files\Mozilla Firefox\plugins\npdnu.dll No File
    CHR Plugin: (downloadUpdater2) - C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll No File
    CHR Plugin: (Microsoft Office 2003) - C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL No File
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll No File
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll No File
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll No File
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll No File
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll No File
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
    CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
    CHR Plugin: (Winamp Application Detector) - C:\Program Files\Mozilla Firefox\plugins\npwachk.dll No File
    CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
    CHR Plugin: (MetaStream 3 Plugin) - C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll No File
    CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll No File
    CHR Plugin: (Java Deployment Toolkit 7.0.170.2) - C:\Windows\system32\npDeployJava1.dll No File
    CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
    CHR HKLM\...\Chrome\Extension: [oajgghejjpgkmpgbchgjieahoefimdle] - C:\Users\Gary\AppData\Local\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx [2014-07-07]
    CHR HKCU\...\Chrome\Extension: [oajgghejjpgkmpgbchgjieahoefimdle] - C:\Users\Gary\AppData\Local\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx [2014-07-07]
    C:\Users\Gary\AppData\Local\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx
    C:\Users\Gary\AppData\Local\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx
    S3 catchme; \??\C:\ComboFix\catchme.sys [X]
    S3 PCD5SRVC{BD6912E3-AC9D80E8-05040000}; \??\C:\PROGRA~1\PC-DOC~1\PCD5SRVC.pkms [X]
    C:\Users\Gary\webphonecfg.dat
    C:\Users\Gary\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpttlswf.dll
    C:\Users\Gary\AppData\Local\temp\Quarantine.exe
    Task: {0953F32D-4F07-429A-B423-ABC5FA428779} - System32\Tasks\d3620930 => C:\Users\Gary\AppData\Local\Temp\\setup3226017456.exe <==== ATTENTION
    Task: {13E597FC-D290-43AC-ACE7-D4BB2581BBAB} - System32\Tasks\497a9bb0 => C:\Users\Gary\AppData\Local\Temp\\setup4182059312.exe <==== ATTENTION
    Task: {227D3D9F-8397-411B-8048-006CA2CFF8D4} - System32\Tasks\53ea8ab0 => C:\Users\Gary\AppData\Local\Temp\\setup4036767152.exe <==== ATTENTION
    Task: {2E6C2426-3DC8-45F3-A50B-1208AC0A363C} - System32\Tasks\9ff5cd30 => C:\Users\Gary\AppData\Local\Temp\\setup1594326192.exe <==== ATTENTION
    Task: {5778EDE1-87C5-4581-8D16-77C8C2F858A6} - System32\Tasks\bdaf2330 => C:\Users\Gary\AppData\Local\Temp\\setup2477491632.exe <==== ATTENTION
    Task: {687207C0-9B2A-43EC-891B-A219AAC59077} - System32\Tasks\ef87ef30 => C:\Users\Gary\AppData\Local\Temp\\setup3441943216.exe <==== ATTENTION
    Task: {7528991D-ACD5-4001-970E-29154098AE36} - System32\Tasks\56d5e630 => C:\Users\Gary\AppData\Local\Temp\\setup1136458672.exe <==== ATTENTION
    Task: {80C534AE-BA1D-4224-A526-A302E89CE971} - System32\Tasks\686cdfb0 => C:\Users\Gary\AppData\Local\Temp\\setup983005616.exe <==== ATTENTION
    Task: {83190BAA-3B4D-4E0B-B7D6-5296567C0832} - System32\Tasks\b8ad5a30 => C:\Users\Gary\AppData\Local\Temp\\setup407008560.exe <==== ATTENTION
    Task: {87F26F3C-34C1-441C-86D7-08DCFD2BFB69} - System32\Tasks\69cc97b0 => C:\Users\Gary\AppData\Local\Temp\\setup1134215856.exe <==== ATTENTION
    Task: {8C273203-6035-4F22-9E57-8F68CC9DCEF0} - System32\Tasks\705e9530 => C:\Users\Gary\AppData\Local\Temp\\setup1564846768.exe <==== ATTENTION
    Task: {8D4B31E7-385F-4259-813C-9856887A1209} - System32\Tasks\4bb006b0 => C:\Users\Gary\AppData\Local\Temp\\setup757187248.exe <==== ATTENTION
    Task: {97633A62-1E9D-40AC-BD9A-62BD1AC6C979} - System32\Tasks\3d805eb0 => C:\Users\Gary\AppData\Local\Temp\\setup4046797616.exe <==== ATTENTION
    Task: {C6088343-84CF-43F2-8AC3-215790BD6CF0} - System32\Tasks\5ab7d830 => C:\Users\Gary\AppData\Local\Temp\\setup304477872.exe <==== ATTENTION
    Task: {C6379117-6E37-4BDE-8218-6AB512B92D2C} - System32\Tasks\9cdfdbb0 => C:\Users\Gary\AppData\Local\Temp\\setup2119276464.exe <==== ATTENTION
    Task: {F85B045D-CA65-4FE4-B422-6BB55304AC8A} - System32\Tasks\cef4bcb0 => C:\Users\Gary\AppData\Local\Temp\\setup2895425584.exe <==== ATTENTION
    C:\Users\Gary\AppData\Local\Temp\\setup2895425584.exe
    C:\Users\Gary\AppData\Local\Temp\\setup2119276464.exe
    C:\Users\Gary\AppData\Local\Temp\\setup304477872.exe
    C:\Users\Gary\AppData\Local\Temp\\setup4046797616.exe
    C:\Users\Gary\AppData\Local\Temp\\setup757187248.exe
    C:\Users\Gary\AppData\Local\Temp\\setup1564846768.exe
    C:\Users\Gary\AppData\Local\Temp\\setup1134215856.exe
    C:\Users\Gary\AppData\Local\Temp\\setup407008560.exe
    C:\Users\Gary\AppData\Local\Temp\\setup983005616.exe
    C:\Users\Gary\AppData\Local\Temp\\setup1136458672.exe
    C:\Users\Gary\AppData\Local\Temp\\setup3441943216.exe
    C:\Users\Gary\AppData\Local\Temp\\setup2477491632.exe
    C:\Users\Gary\AppData\Local\Temp\\setup1594326192.exe
    C:\Users\Gary\AppData\Local\Temp\\setup4036767152.exe
    C:\Users\Gary\AppData\Local\Temp\\setup4182059312.exe
    C:\Users\Gary\AppData\Local\Temp\\setup3226017456.exe

    *****************

    "HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
    "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
    "HKU\S-1-5-21-2060793998-228504606-3227568861-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
    "HKCR\PROTOCOLS\Handler\livecall" => Key deleted successfully.
    "HKCR\CLSID\{828030A1-22C1-4009-854F-8E305202313F}" => Key deleted successfully.
    "HKCR\PROTOCOLS\Handler\msnim" => Key deleted successfully.
    "HKCR\CLSID\{828030A1-22C1-4009-854F-8E305202313F}" => Key not found.
    HKLM\Software\Mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4} => value deleted successfully.
    HKLM\Software\Mozilla\Firefox\Extensions\\avg@igeared => value deleted successfully.
    C:\Program Files\AVG => Moved successfully.
    C:\Program Files\Google\Chrome\Application\38.0.2125.111\ppGoogleNaClPluginChrome.dll not found.
    C:\Program Files\Mozilla Firefox\plugins\npatgpc.dll not found.
    C:\Program Files\Mozilla Firefox\plugins\NPcol400.dll not found.
    C:\Program Files\Mozilla Firefox\plugins\npdnu.dll not found.
    C:\Program Files\Mozilla Firefox\plugins\npdnupdater2.dll not found.
    C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL not found.
    C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll not found.
    C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll not found.
    C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll not found.
    C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll not found.
    C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll not found.
    C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll not found.
    C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll not found.
    C:\Program Files\Mozilla Firefox\plugins\npwachk.dll not found.
    C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll not found.
    C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll not found.
    C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll not found.
    C:\Windows\system32\npDeployJava1.dll not found.
    c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll not found.
    "HKLM\SOFTWARE\Google\Chrome\Extensions\oajgghejjpgkmpgbchgjieahoefimdle" => Key deleted successfully.
    "C:\Users\Gary\AppData\Local\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx" => File/Directory not found.
    "HKCU\SOFTWARE\Google\Chrome\Extensions\oajgghejjpgkmpgbchgjieahoefimdle" => Key deleted successfully.
    "C:\Users\Gary\AppData\Local\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx" => File/Directory not found.
    "C:\Users\Gary\AppData\Local\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx" => File/Directory not found.
    "C:\Users\Gary\AppData\Local\CRE\oajgghejjpgkmpgbchgjieahoefimdle.crx" => File/Directory not found.
    catchme => Service deleted successfully.
    PCD5SRVC{BD6912E3-AC9D80E8-05040000} => Service deleted successfully.
    C:\Users\Gary\webphonecfg.dat => Moved successfully.
    C:\Users\Gary\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpttlswf.dll => Moved successfully.
    C:\Users\Gary\AppData\Local\temp\Quarantine.exe => Moved successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0953F32D-4F07-429A-B423-ABC5FA428779}" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0953F32D-4F07-429A-B423-ABC5FA428779}" => Key deleted successfully.
    C:\Windows\System32\Tasks\d3620930 => Moved successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\d3620930" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{13E597FC-D290-43AC-ACE7-D4BB2581BBAB}" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{13E597FC-D290-43AC-ACE7-D4BB2581BBAB}" => Key deleted successfully.
    C:\Windows\System32\Tasks\497a9bb0 => Moved successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\497a9bb0" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{227D3D9F-8397-411B-8048-006CA2CFF8D4}" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{227D3D9F-8397-411B-8048-006CA2CFF8D4}" => Key deleted successfully.
    C:\Windows\System32\Tasks\53ea8ab0 => Moved successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\53ea8ab0" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2E6C2426-3DC8-45F3-A50B-1208AC0A363C}" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2E6C2426-3DC8-45F3-A50B-1208AC0A363C}" => Key deleted successfully.
    C:\Windows\System32\Tasks\9ff5cd30 => Moved successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\9ff5cd30" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5778EDE1-87C5-4581-8D16-77C8C2F858A6}" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5778EDE1-87C5-4581-8D16-77C8C2F858A6}" => Key deleted successfully.
    C:\Windows\System32\Tasks\bdaf2330 => Moved successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\bdaf2330" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{687207C0-9B2A-43EC-891B-A219AAC59077}" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{687207C0-9B2A-43EC-891B-A219AAC59077}" => Key deleted successfully.
    C:\Windows\System32\Tasks\ef87ef30 => Moved successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ef87ef30" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7528991D-ACD5-4001-970E-29154098AE36}" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7528991D-ACD5-4001-970E-29154098AE36}" => Key deleted successfully.
    C:\Windows\System32\Tasks\56d5e630 => Moved successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\56d5e630" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{80C534AE-BA1D-4224-A526-A302E89CE971}" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{80C534AE-BA1D-4224-A526-A302E89CE971}" => Key deleted successfully.
    C:\Windows\System32\Tasks\686cdfb0 => Moved successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\686cdfb0" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{83190BAA-3B4D-4E0B-B7D6-5296567C0832}" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{83190BAA-3B4D-4E0B-B7D6-5296567C0832}" => Key deleted successfully.
    C:\Windows\System32\Tasks\b8ad5a30 => Moved successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\b8ad5a30" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{87F26F3C-34C1-441C-86D7-08DCFD2BFB69}" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{87F26F3C-34C1-441C-86D7-08DCFD2BFB69}" => Key deleted successfully.
    C:\Windows\System32\Tasks\69cc97b0 => Moved successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\69cc97b0" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8C273203-6035-4F22-9E57-8F68CC9DCEF0}" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8C273203-6035-4F22-9E57-8F68CC9DCEF0}" => Key deleted successfully.
    C:\Windows\System32\Tasks\705e9530 => Moved successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\705e9530" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8D4B31E7-385F-4259-813C-9856887A1209}" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8D4B31E7-385F-4259-813C-9856887A1209}" => Key deleted successfully.
    C:\Windows\System32\Tasks\4bb006b0 => Moved successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\4bb006b0" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{97633A62-1E9D-40AC-BD9A-62BD1AC6C979}" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{97633A62-1E9D-40AC-BD9A-62BD1AC6C979}" => Key deleted successfully.
    C:\Windows\System32\Tasks\3d805eb0 => Moved successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\3d805eb0" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C6088343-84CF-43F2-8AC3-215790BD6CF0}" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C6088343-84CF-43F2-8AC3-215790BD6CF0}" => Key deleted successfully.
    C:\Windows\System32\Tasks\5ab7d830 => Moved successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\5ab7d830" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{C6379117-6E37-4BDE-8218-6AB512B92D2C}" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C6379117-6E37-4BDE-8218-6AB512B92D2C}" => Key deleted successfully.
    C:\Windows\System32\Tasks\9cdfdbb0 => Moved successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\9cdfdbb0" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F85B045D-CA65-4FE4-B422-6BB55304AC8A}" => Key deleted successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F85B045D-CA65-4FE4-B422-6BB55304AC8A}" => Key deleted successfully.
    C:\Windows\System32\Tasks\cef4bcb0 => Moved successfully.
    "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\cef4bcb0" => Key deleted successfully.
    "C:\Users\Gary\AppData\Local\Temp\\setup2895425584.exe" => File/Directory not found.
    "C:\Users\Gary\AppData\Local\Temp\\setup2119276464.exe" => File/Directory not found.
    "C:\Users\Gary\AppData\Local\Temp\\setup304477872.exe" => File/Directory not found.
    "C:\Users\Gary\AppData\Local\Temp\\setup4046797616.exe" => File/Directory not found.
    "C:\Users\Gary\AppData\Local\Temp\\setup757187248.exe" => File/Directory not found.
    "C:\Users\Gary\AppData\Local\Temp\\setup1564846768.exe" => File/Directory not found.
    "C:\Users\Gary\AppData\Local\Temp\\setup1134215856.exe" => File/Directory not found.
    "C:\Users\Gary\AppData\Local\Temp\\setup407008560.exe" => File/Directory not found.
    "C:\Users\Gary\AppData\Local\Temp\\setup983005616.exe" => File/Directory not found.
    "C:\Users\Gary\AppData\Local\Temp\\setup1136458672.exe" => File/Directory not found.
    "C:\Users\Gary\AppData\Local\Temp\\setup3441943216.exe" => File/Directory not found.
    "C:\Users\Gary\AppData\Local\Temp\\setup2477491632.exe" => File/Directory not found.
    "C:\Users\Gary\AppData\Local\Temp\\setup1594326192.exe" => File/Directory not found.
    "C:\Users\Gary\AppData\Local\Temp\\setup4036767152.exe" => File/Directory not found.
    "C:\Users\Gary\AppData\Local\Temp\\setup4182059312.exe" => File/Directory not found.
    "C:\Users\Gary\AppData\Local\Temp\\setup3226017456.exe" => File/Directory not found.

    ==== End of Fixlog ====
     
  19. 2014/11/05
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,483
    Likes Received:
    103
    Trophy Points:
    843
    Location:
    Daly City, CA
    Computer Experience:
    Experienced
    How is computer doing?

    Last scans...

    [​IMG] Download Security Check from here or here and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
    NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
    NOTE 2. SecurityCheck may produce some false warning(s), so leave the results reading to me.
    NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run


    [​IMG] Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
    • Make sure the following options are checked:
      • Internet Services
      • Windows Firewall
      • System Restore
      • Security Center
      • Windows Update
      • Windows Defender
      • Other Services
    • Press "Scan ".
    • It will create a log (FSS.txt) in the same directory the tool is run.
    • Please copy and paste the log to your reply.

    [​IMG] Download Temp File Cleaner (TFC)
    Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.

    [​IMG] Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Internet Explorer users - Click on this link to open ESET OnlineScan.
    • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
      • Click on ESET Smart Installer to download the ESET Smart Installer. Save it to your desktop.
      • Double click on the [img=http://www.bleepstatic.com/fhost/uploads/0/esetsmartinstaller_enu.png] icon on your desktop.
    • Check "YES, I accept the Terms of Use. "
    • Click the Start button.
    • Accept any security warnings from your browser.
    • Check "Enable detection of potentially unwanted applications ".
    • Click Advanced settings and make sure all 4 boxes are checkmarked (two of them are already checkmarked by default).
      Do NOT checkmark "Use custom proxy settings "
    • Click the Start button.
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, click List Threats
    • Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • Click the Back button.
    • Click the Finish button.
     
  20. 2014/11/05
    gpb59

    gpb59 Well-Known Member Thread Starter

    Joined:
    2012/01/28
    Messages:
    282
    Likes Received:
    0
    Trophy Points:
    231
    Computer Experience:
    intermediate
    seems to be doing fine
     
  21. 2014/11/05
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,483
    Likes Received:
    103
    Trophy Points:
    843
    Location:
    Daly City, CA
    Computer Experience:
    Experienced
    [​IMG]
     

Share This Page