iSafe Redirect Virus

onehipcat · October 28, 2014

Hey ya'll,

I have been fighting this iSafe redirect thing for months. it was attached to a tool I downloaded and no matter the tool or forum info I have found will completely remove it. I have followed forum posts on here and elsewhere and used all tools. It comes back either right away or within 2 or 3 days. Programs, hkeys, and more have been deleted multiple times. Please help. This is getting annoying. I mainly use Chrome. I have avast as my main av software. etc

Thanks,

Onehipcat

To kick start this, here is my Hijack This file findings:

Logfile of Trend Micro HijackThis v2.0.5

Scan saved at 1:08:15 AM, on 10/28/2014

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v11.0 (11.00.9600.17344)

FIREFOX: 12.0 (en-US)

Boot mode: Normal

Running processes:

C:\Users\Nate\AppData\Local\Akamai\netsession_win.exe

C:\Users\Nate\AppData\Local\DIRECTV Player\PCShowServerPMWrapper.exe

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe

C:\Program Files (x86)\Philips\SPC 700NC PC Camera\TrayMin700.exe

C:\Users\Nate\AppData\Local\DIRECTV Player\NDSPCShowServer.exe

C:\Program Files\Alwil Software\Avast5\AvastUI.exe

C:\Program Files (x86)\Trend Micro\RUBotted\RUBottedGUI.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\PROGRA~2\MICROS~2\Office12\WINWORD.EXE

C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE

C:\Users\Nate\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - - (no file)

F2 - REG:system.ini: UserInit=userinit.exe,

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll

O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll

O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll

O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (file missing)

O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml

O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\Alwil Software\Avast5\AvastUI.exe" /nogui

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [Trend Micro RUBotted V2.0 Beta] C:\Program Files (x86)\Trend Micro\RUBotted\RUBottedGUI.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKCU\..\Run: [Facebook Update] "C:\Users\Nate\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

O4 - HKCU\..\Run: [Akamai NetSession Interface] "C:\Users\Nate\AppData\Local\Akamai\netsession_win.exe"

O4 - HKCU\..\Run: [Weather] C:\Program Files (x86)\AWS\WeatherBug\Weather.exe 1

O4 - HKCU\..\Run: [PCShowServer] "C:\Users\Nate\AppData\Local\DIRECTV Player\PCShowServerPMWrapper.exe"

O4 - HKCU\..\Run: [KSS] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe" /autorun

O4 - Startup: Adobe Gamma.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files (x86)\ERUNT\AUTOBACK.EXE

O4 - Startup: Monitor Ink Alerts - HP Officejet 6600.lnk = ?

O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE

O4 - Global Startup: TrayMin700.exe.lnk = ?

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll

O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (file missing)

O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (file missing)

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O15 - Trusted Zone: http://asia.msi.com.tw

O15 - Trusted Zone: http://global.msi.com.tw

O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - https://a248.e.akamai.net/f/248/14778/2h/dlmanager.download.akamai.com/14778/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab

O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{2A4B01F0-FD66-4CAB-94EA-6057AB9DC64E}: NameServer = 208.69.150.250,208.69.150.252

O17 - HKLM\System\CCS\Services\Tcpip\..\{49B78FDB-3395-4DF5-9A17-FDDDF67F6B09}: NameServer = 208.69.150.250,208.69.150.252

O17 - HKLM\System\CCS\Services\Tcpip\..\{835D3CF6-13C7-45CB-96CC-0D76846F6FAD}: NameServer = 208.69.150.250,208.69.150.252

O17 - HKLM\System\CCS\Services\Tcpip\..\{C8C944E4-F889-46A2-B738-A628A8C87211}: NameServer = 208.69.150.250,208.69.150.252

O17 - HKLM\System\CS1\Services\Tcpip\..\{2A4B01F0-FD66-4CAB-94EA-6057AB9DC64E}: NameServer = 208.69.150.250,208.69.150.252

O17 - HKLM\System\CS2\Services\Tcpip\..\{2A4B01F0-FD66-4CAB-94EA-6057AB9DC64E}: NameServer = 208.69.150.250,208.69.150.252

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (file missing)

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)

O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

O23 - Service: AMD RAIDXpert (AMD_RAIDXpert) - AMD - C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpertService.exe

O23 - Service: AODService - Unknown owner - C:\Program Files (x86)\AMD\OverDrive\AODAssist.exe

O23 - Service: ASUS System Control Service (AsSysCtrlService) - Unknown owner - C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe

O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

O23 - Service: DeviceVM Meta Data Export Service (DvmMDES) - DeviceVM, Inc. - C:\ASUS.SYS\config\DVMExportService.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: HitmanPro Scheduler (HitmanProScheduler) - SurfRight B.V. - C:\Program Files\HitmanPro\hmpsched.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)

O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files (x86)\NETGEAR\WN111v2\jswpsapi.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Kaspersky Security Scan Service (KSS) - Kaspersky Lab ZAO - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe

O23 - Service: McciCMService - Alcatel-Lucent - C:\Program Files (x86)\Common Files\Motive\McciCMService.exe

O23 - Service: McciCMService64 - Alcatel-Lucent - C:\Program Files\Common Files\Motive\McciCMService.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe

O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\SysWOW64\IoctlSvc.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Riverbed Technology, Inc. - C:\Program Files (x86)\WinPcap\rpcapd.exe

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: Trend Micro RUBotted Service (RUBotSrv) - Trend Micro Inc. - C:\Program Files (x86)\Trend Micro\RUBotted\RUBotSrv.exe

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files (x86)\VMware\VMware Player\vmware-ufad.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe

O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe

O23 - Service: VMware USB Arbitration Service (VMUSBArbService) - VMware, Inc. - C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe

O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

--

End of file - 15134 bytes

onehipcat · October 29, 2014

Bumped, and I already took out Kaspersky since it only diagnoses things. I have ran a lot of scans prior to posting this, mbam, avast, spybot, YAC, and more. They all found something and supposedly removed it.

H e l p lol

Maniac · November 1, 2014

Hello onehipcat and :welcome: ! My name is Borislav and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.
Do not perform any kind of scanning and fixing without my instructions. If you want to proceed on your own, please let me know.

Please follow the instructions here and then post your log files in a new reply in this thread:

https://forums.malwarebytes.org/index.php?/topic/9573-im-infected-what-do-i-do-now/

onehipcat · November 1, 2014

FRST.txt

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64)

Version: 01-11-2014

Ran by Nate (administrator) on ADMIN-AMD on 01-11-2014 12:47:00

Running from C:\Users\Nate\Downloads

Loaded Profile: Nate (Available profiles: Admin & Nate & Angela)

Platform: Windows 7 Professional Service Pack 1 (X64) OS

Language: English (United States)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool:

http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-

to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be

closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(AVAST Software) C:\Program Files\Alwil Software

\Avast5\AvastSvc.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI

Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(AMD) C:\Program Files (x86)\AMD\RAIDXpert\bin

\RAIDXpertService.exe

() C:\Program Files (x86)\AMD\RAIDXpert\bin\RAIDXpert.exe

() C:\Program Files (x86)\ASUS\AsSysCtrlService

\1.00.02\AsSysCtrlService.exe

(DeviceVM, Inc.) C:\ASUS.SYS\config\DVMExportService.exe

(Alcatel-Lucent) C:\Program Files (x86)\Common Files\Motive

\McciCMService.exe

(Alcatel-Lucent) C:\Program Files\Common Files\Motive

\McciCMService.exe

(Microsoft Corporation) C:\Program Files\Microsoft LifeCam

\MSCamS64.exe

(Nero AG) C:\Program Files (x86)\Nero\Nero8\Nero BackItUp

\NBService.exe

(Prolific Technology Inc.) C:\Windows\SysWOW64\IoctlSvc.exe

(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\RUBotted

\RUBotSrv.exe

(Microsoft Corporation) C:\Windows\System32\TCPSVCS.EXE

(Microsoft Corporation) C:\Windows\System32\snmp.exe

(VMware, Inc.) C:\Program Files (x86)\Common Files\VMware\USB

\vmware-usbarbitrator.exe

(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft

Shared\Windows Live\WLIDSVC.EXE

(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player

\vmware-authd.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft

Shared\Windows Live\WLIDSVCM.EXE

(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe

() C:\Windows\SysWOW64\WinMsgBalloonServer.exe

() C:\Windows\SysWOW64\WinMsgBalloonClient.exe

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and

Keyboard Center\ipoint.exe

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and

Keyboard Center\itype.exe

(Akamai Technologies, Inc.) C:\Users\Nate\AppData\Local\Akamai

\netsession_win.exe

(Akamai Technologies, Inc.) C:\Users\Nate\AppData\Local\Akamai

\netsession_win.exe

(NDS Technologies) C:\Users\Nate\AppData\Local\DIRECTV Player

\PCShowServerPMWrapper.exe

() C:\Program Files (x86)\Philips\SPC 700NC PC Camera

\TrayMin700.exe

() C:\Users\Nate\AppData\Local\DIRECTV Player

\NDSPCShowServer.exe

(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe

(AVAST Software) C:\Program Files\Alwil Software

\Avast5\AvastUI.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Trend Micro Inc.) C:\Program Files (x86)\Trend Micro\RUBotted

\RUBottedGUI.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application

\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application

\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application

\chrome.exe

(Microsoft Corporation) C:\Windows\System32\audiodg.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will

be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows

\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch

HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA

\VIAudioi\VDeck\VDeck.exe [2245120 2009-07-16] (VIA)

HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files

(x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-

02-26] (Microsoft Corporation)

HKLM-x32\...\Run: [AMD AVT] => C:\Program Files (x86)\AMD AVT

\bin\kdbsync.exe [20992 2012-03-19] ()

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil

Software\Avast5\AvastUI.exe [4085896 2014-08-01] (AVAST

Software)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common

Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-09-12] (Adobe

Systems Incorporated)

HKLM-x32\...\Run: [Trend Micro RUBotted V2.0 Beta] => C:\Program

Files (x86)\Trend Micro\RUBotted\RUBottedGUI.exe [1102872 2013-

07-25] (Trend Micro Inc.)

HKU\S-1-5-21-549523805-167737923-3235466408-1001\...\Run:

[Facebook Update] => "C:\Users\Nate\AppData\Local\Facebook

\Update\FacebookUpdate.exe" /c /nocrashserver

HKU\S-1-5-21-549523805-167737923-3235466408-1001\...\Run:

[Akamai NetSession Interface] => C:\Users\Nate\AppData\Local

\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai

Technologies, Inc.)

HKU\S-1-5-21-549523805-167737923-3235466408-1001\...\Run:

[Weather] => C:\Program Files (x86)\AWS\WeatherBug\Weather.exe 1

HKU\S-1-5-21-549523805-167737923-3235466408-1001\...\Run:

[PCShowServer] => C:\Users\Nate\AppData\Local\DIRECTV Player

\PCShowServerPMWrapper.exe [1723760 2014-07-28] (NDS

Technologies)

HKU\S-1-5-21-549523805-167737923-3235466408-1001\...\Policies

\Explorer: [NoLowDiskSpaceChecks] 1

HKU\S-1-5-21-549523805-167737923-3235466408-1001\...

\MountPoints2: {1c390a53-91f1-11e0-a4d6-005056c00008} - G:

\TLBootstrap_WPP.exe

HKU\S-1-5-21-549523805-167737923-3235466408-1001\...

\MountPoints2: {6210a2f1-d8ca-11e1-a245-005056c00008} - F:

\ToolLauncher-Bootstrap.exe

HKU\S-1-5-21-549523805-167737923-3235466408-1001\...

\MountPoints2: {a66865d9-a4be-11e2-978d-005056c00008} - F:

\ToolLauncher-Bootstrap.exe

HKU\S-1-5-21-549523805-167737923-3235466408-1001\...

\MountPoints2: {dfacdf86-f291-11e3-a8b1-005056c00008} - F:

\VZW_Software_upgrade_assistant.exe

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs

\Startup\TrayMin700.exe.lnk

ShortcutTarget: TrayMin700.exe.lnk -> C:\Program Files

(x86)\Philips\SPC 700NC PC Camera\TrayMin700.exe ()

Startup: C:\Users\Nate\AppData\Roaming\Microsoft\Windows\Start

Menu\Programs\Startup\Adobe Gamma.lnk

ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common

Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems,

Inc.)

Startup: C:\Users\Nate\AppData\Roaming\Microsoft\Windows\Start

Menu\Programs\Startup\ERUNT AutoBackup.lnk

ShortcutTarget: ERUNT AutoBackup.lnk -> C:\Program Files

(x86)\ERUNT\AUTOBACK.EXE ()

Startup: C:\Users\Nate\AppData\Roaming\Microsoft\Windows\Start

Menu\Programs\Startup\Monitor Ink Alerts - HP Officejet 6600.lnk

ShortcutTarget: Monitor Ink Alerts - HP Officejet 6600.lnk ->

C:\Program Files\HP\HP Officejet 6600\Bin\HPStatusBL.dll

(Hewlett-Packard Co.)

Startup: C:\Users\Nate\AppData\Roaming\Microsoft\Windows\Start

Menu\Programs\Startup\OneNote 2007 Screen Clipper and

Launcher.lnk

ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk ->

C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE

(Microsoft Corporation)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-

8763-00608CC02F24} => C:\Program Files\Alwil Software

\Avast5\ashShA64.dll (AVAST Software)

ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-

47B7-93E1-CDD82E34AF8B} => No File

ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-

47B7-93E1-CDD82E34AF8B} => No File

ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-

47B7-93E1-CDD82E34AF8B} => No File

ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-

47B7-93E1-CDD82E34AF8B} => No File

BootExecute: autocheck autochk * bootdelete

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item

it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page

Redirect Cache = http://www.msn.com/

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page

Redirect Cache_TIMESTAMP = 0xDFB10CF510C2CA01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page

Redirect Cache AcceptLangs = en-us

URLSearchHook: HKCU - Default Value = {CFBFAE00-17A6-11D0-99CB-

00C04FD64497}

SearchScopes: HKLM - {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL

= http://www.google.com/search?q={searchTerms}

SearchScopes: HKLM-x32 - {0191A6B0-1154-4C22-9182-23A95BBE92D9}

URL = http://www.google.com/search?q={searchTerms}

SearchScopes: HKCU - {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL

= http://www.google.com/search?q={searchTerms}

SearchScopes: HKCU - {17E5E1D0-E848-46A0-8664-EAD13704F731} URL

= https://www.google.com/search?q={searchTerms}

SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL

=

BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-

D17F00898D06} -> C:\Program Files\Alwil Software

\Avast5\aswWebRepIE64.dll (AVAST Software)

BHO: No Name -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> No

File

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-

0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office

\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-

B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java

\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)

BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-

D17F00898D06} -> C:\Program Files\Alwil Software

\Avast5\aswWebRepIE.dll (AVAST Software)

BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-

836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows

Live\Companion\companioncore.dll (Microsoft Corporation)

BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-

BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java

\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: SingleInstance Class -> {FDAD4DA1-61A2-4FD8-9C17-

86F7AC245081} -> C:\Program Files (x86)\Yahoo!\Companion

\Installs\cpn0\YTSingleInstance.dll No File

Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-

8999-7F8F10CA4CF5} - No File

Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068}

- No File

DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000}

http://download.macromedia.com/pub/shockwave/cabs/director/sw.ca

b

DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258}

http://download.macromedia.com/pub/shockwave/cabs/director/sw.ca

b

DPF: HKLM-x32 {4871A87A-BFDD-4106-8153-FFDE2BAC2967}

https://a248.e.akamai.net/f/248/14778/2h/dlmanager.download.akam

ai.com/14778/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab

DPF: HKLM-x32 {8167C273-DF59-4416-B647-C8BB2C7EE83E}

http://liveupdate.msi.com.tw/autobios/LOnline/install.cab

DPF: HKLM-x32 {99FE5072-78AA-4FEE-89BA-69A5FA55343F}

http://download.microsoft.com/download/B/3/A/B3A2EA73-793D-

4ABE-992D-C81140384044/igdtoolx.cab

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000}

http://fpdownload2.macromedia.com/get/flashplayer/current/swflas

h.cab

DPF: HKLM-x32 {E06E2E99-0AA1-11D4-ABA6-0060082AA75C}

DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7}

http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-

07617B9B86A8} - No File

Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-

07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet

Explorer\skypeieplugin.dll No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D}

- C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype

Technologies)

Hosts: There are more than one entry in Hosts. See Hosts section

of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 205.171.2.226

Tcpip\..\Interfaces\{2A4B01F0-FD66-4CAB-94EA-6057AB9DC64E}:

[NameServer] 208.69.150.250,208.69.150.252

Tcpip\..\Interfaces\{49B78FDB-3395-4DF5-9A17-FDDDF67F6B09}:

[NameServer] 208.69.150.250,208.69.150.252

Tcpip\..\Interfaces\{835D3CF6-13C7-45CB-96CC-0D76846F6FAD}:

[NameServer] 208.69.150.250,208.69.150.252

Tcpip\..\Interfaces\{C8C944E4-F889-46A2-B738-A628A8C87211}:

[NameServer] 208.69.150.250,208.69.150.252

FireFox:

========

FF ProfilePath: C:\Users\Nate\AppData\Roaming\Mozilla\Firefox

\Profiles\k7og3s3k.default

FF DefaultSearchUrl: hxxp://www.bing.com/search

FF Keyword.URL: hxxp://www.bing.com/search

FF Homepage: hxxp://www.google.com

FF NewTab: hxxp://www.google.com

FF DefaultSearchEngine: Google

FF SearchEngineOrder.1: Google

FF SelectedSearchEngine: Google

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows

\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program

Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft

Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows

\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows

\SysWOW64\Adobe\Director\np32dsw_1168638.dll (Adobe Systems,

Inc.)

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files

(x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program

Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program

Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll

(Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:

\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll

(Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program

Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll (

Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:

\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft

Corp.)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:

\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

(Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:

\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

(Microsoft Corporation)

FF Plugin-x32: @pages.tvunetworks.com/WebPlayer -> C:\Windows

\system32\TVUAx\npTVUAx.dll No File

FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program

Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No

File

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:

\Program Files (x86)\Google\Update\1.3.25.7\npGoogleUpdate3.dll

(Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:

\Program Files (x86)\Google\Update\1.3.25.7\npGoogleUpdate3.dll

(Google Inc.)

FF Plugin-x32: @veetle.com/vbp;version=0.9.17 -> C:\Program

Files (x86)\Veetle\VLCBroadcast\npvbp.dll No File

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe

\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @facebook.com/FBPlugin,version=1.0.3 -> C:

\Users\Nate\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )

FF Plugin HKCU: @nds.com/PCShowPlugin -> C:\Users\Nate\AppData

\Local\DIRECTV Player\npPCShowPlugin.dll No File

FF Plugin HKCU: @nds.com/PlayerPlugin -> C:\Users\Nate\AppData

\Local\DIRECTV Player\npPlayerPlugin.dll (DIRECTV)

FF Plugin HKCU: @nds.com/PlayerPlugin64 -> C:\Users\Nate

\AppData\Local\DIRECTV Player\win64\npPlayerPlugin64.dll

(DIRECTV)

FF Plugin HKCU: NDS.com/PlayerPlugin -> C:\Users\Nate\AppData

\Local\DIRECTV Player\npPlayerPlugin.dll (DIRECTV)