Comprev Posted March 7, 2014 ID:800266 Share Posted March 7, 2014 Hey, My brother was downloading GIMP onto his computer, and there appears to be some sort of browser hijack in it - new tabs in Firefox go to conduit.com, and random words are blue and double-underlined, and display a GIMP advertisement when hovered over with the mouse. MSE didn't find anything; Malwarebytes did, but it was unable to remove whatever's causing this mess. DDS (Ver_2012-11-20.01) - NTFS_AMD64Internet Explorer: 11.0.9600.16518 BrowserJavaVersion: 10.45.2Run by Lucas at 21:48:53 on 2014-03-06Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.5922.3776 [GMT -5:00].AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}.============== Running Processes ===============.C:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\svchost.exe -k RPCSSC:\Program Files\Microsoft Security Client\MsMpEng.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\system32\FBAgent.exeC:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exeC:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exeC:\Windows\System32\spoolsv.exeC:\Windows\system32\taskeng.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkC:\Windows\system32\rundll32.exeC:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\taskhost.exeC:\Windows\system32\taskeng.exeC:\Windows\system32\Dwm.exeC:\Program Files (x86)\ASUS\Splendid\ACMON.exeC:\Windows\system32\taskeng.exeC:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exeC:\Windows\Explorer.EXEC:\Program Files\ASUS\P4G\BatteryLife.exeC:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exeC:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exeC:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BBSvc.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonationC:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exeC:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exeC:\Windows\System32\svchost.exe -k HPZ12C:\Windows\System32\svchost.exe -k HPZ12C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exeC:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exeC:\Windows\system32\svchost.exe -k imgsvcC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEC:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exeC:\Windows\system32\wbem\wmiprvse.exeC:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exeC:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exeC:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exeC:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXEC:\Windows\SysWOW64\ACEngSvr.exeC:\Windows\system32\SearchIndexer.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestrictedC:\Windows\servicing\TrustedInstaller.exeC:\Program Files\Elantech\ETDCtrl.exeC:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exeC:\Program Files\Realtek\Audio\HDA\RAVBg64.exeC:\Program Files\Microsoft Security Client\msseces.exeC:\Windows\System32\igfxtray.exeC:\Windows\System32\hkcmd.exeC:\Program Files\Elantech\ETDCtrlHelper.exeC:\Windows\System32\igfxpers.exeC:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exeC:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exeC:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exeC:\Program Files (x86)\Ask.com\Updater\Updater.exeC:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exeC:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exeC:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exeC:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXEC:\Program Files (x86)\Common Files\Java\Java Update\jusched.exeC:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exeC:\Program Files\Windows Media Player\wmpnetwk.exeC:\Windows\System32\svchost.exe -k LocalServicePeerNetC:\Program Files\Microsoft Security Client\NisSrv.exeC:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Windows\system32\svchost.exe -k HPServiceC:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exeC:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exeC:\Windows\AsScrPro.exeC:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exeC:\Program Files\Realtek\Audio\HDA\RAVCpl64.exeC:\Program Files\Microsoft Security Client\MpCmdRun.exeC:\Windows\system32\igfxsrvc.exeC:\Windows\system32\wbem\wmiprvse.exeC:\Windows\System32\cscript.exe.============== Pseudo HJT Report ===============.uURLSearchHooks: UrlSearchHook Class: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dllmWinlogon: Userinit = userinit.exe,BHO: MSS+ Identifier: {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dllBHO: Bing Bar Helper: {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dllBHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dllBHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllBHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dllBHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLLBHO: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dllBHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dllTB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dllTB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dllTB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dllTB: Bing Bar: {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dlluRun: [steam] "C:\Program Files (x86)\Steam\Steam.exe" -silentuRun: [Optimizer Pro] C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exemRun: [Nuance PDF Reader-reminder] "C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\PDF Reader\Ereg\Ereg.ini"mRun: [ASUSPRP] "C:\Program Files (x86)\ASUS\APRP\APRP.EXE"mRun: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe /SmRun: [sonicMasterTray] C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exemRun: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exemRun: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exemRun: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exemRun: [updateLBPShortCut] "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"mRun: [updateP2GoShortCut] "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"mRun: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"mRun: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exemRun: [Nikon Message Center 2] C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe -smRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"StartupFolder: C:\Users\Lucas\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXEStartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\ASUSVI~1.LNK - C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exeStartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\FANCYS~1.LNK - C:\Windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_94E3CE3704FE82FBF49A6A.exeStartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exemPolicies-Explorer: NoActiveDesktop = dword:1mPolicies-Explorer: NoActiveDesktopChanges = dword:1mPolicies-System: ConsentPromptBehaviorUser = dword:3mPolicies-System: EnableUIADesktopToggle = dword:0IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dllIE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dllIE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dllTCP: NameServer = 192.168.1.254TCP: Interfaces\{5213283F-3399-4EB1-9F8E-A30D7440A822} : DHCPNameServer = 192.168.1.254TCP: Interfaces\{5213283F-3399-4EB1-9F8E-A30D7440A822}\2375942554139383 : DHCPNameServer = 192.168.1.254TCP: Interfaces\{5213283F-3399-4EB1-9F8E-A30D7440A822}\3516E6962656C6021427D63702E45677 : DHCPNameServer = 10.0.0.1TCP: Interfaces\{5213283F-3399-4EB1-9F8E-A30D7440A822}\762743 : DHCPNameServer = 192.168.1.1Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLLHandler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dllAppInit_DLLs= c:\progra~2\optimi~1\optpro~1.dllSSODL: WebCheck - <orphaned>mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.146\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chromex64-BHO: Bing Bar Helper: {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dllx64-BHO: TidyNetwork: {5AB835E1-4A43-3826-FDF5-5636839C9F15} -x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllx64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dllx64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLLx64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dllx64-TB: Bing Bar: {eec0f710-38b5-4aba-99bf-ec87564a4e13} -x64-Run: [ETDCtrl] C:\Program Files (x86)\Elantech\ETDCtrl.exex64-Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exex64-Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /SF3x64-Run: [setwallpaper] c:\programdata\SetWallpaper.cmdx64-Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkeyx64-Run: [igfxTray] C:\Windows\System32\igfxtray.exex64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exex64-Run: [Persistence] C:\Windows\System32\igfxpers.exex64-Run: [Logitech Download Assistant] C:\Windows\System32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetchx64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dllx64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dllx64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLLx64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>x64-Notify: igfxcui - igfxdev.dllx64-SSODL: WebCheck - <orphaned>.================= FIREFOX ===================.FF - ProfilePath - C:\Users\Lucas\AppData\Roaming\Mozilla\Firefox\Profiles\6zd0no7f.default\FF - prefs.js: browser.search.selectedEngine - GoogleFF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLLFF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLLFF - plugin: C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dllFF - plugin: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dllFF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dllFF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrlui.dllFF - plugin: C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dllFF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dllFF - plugin: C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMSS.dllFF - plugin: C:\Users\Lucas\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dllFF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1204144.dllFF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll.---- FIREFOX POLICIES ----.user_pref(extensions.autoDisableScopes,14);============= SERVICES / DRIVERS ===============.R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2013-9-27 248240]R1 ATKWMIACPIIO;ATKWMIACPI Driver;C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2010-7-26 17024]R2 70e6ca8c;Optimizer Pro Crash Monitor;C:\Windows\System32\rundll32.exe [2009-7-13 45568]R2 AFBAgent;AFBAgent;C:\Windows\System32\FBAgent.exe [2011-8-28 379520]R2 ASMMAP64;ASMMAP64;C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-7-2 15416]R2 BBSvc;BingBar Service;C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BBSvc.EXE [2013-12-16 193696]R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2013-4-22 822504]R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2014-2-15 418376]R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2014-2-15 701512]R2 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2012-3-20 134944]R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2013-6-26 523944]R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-8-28 2656280]R3 ETD;ELAN PS/2 Port Input Device;C:\Windows\System32\drivers\ETD.sys [2011-5-8 138024]R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2011-5-8 317440]R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2011-5-8 76912]R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2014-2-15 25928]R3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2013-10-23 348376]R3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;C:\Windows\System32\drivers\rtl8192ce.sys [2011-8-28 1103976]R3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2013-6-26 767144]R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2013-6-26 273576]R3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2013-6-26 28840]R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2013-6-26 23208]R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2013-6-26 207528]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]S3 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\SeaPort.EXE [2013-12-16 247968]S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2011-4-1 48488]S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2010-9-23 1493352]S3 HP8207_8307;HP-HP8207_8307;C:\Windows\System32\drivers\HP8207_8307.sys [2010-2-5 15360]S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-2-12 111616]S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [2013-9-6 288776]S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\System32\drivers\SiSG664.sys [2009-6-10 56832]S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-2-18 59392]S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2011-2-18 31232]S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-8-29 1255736]S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184].=============== Created Last 30 ================.2014-03-07 02:42:47 75888 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{8C2BEE99-E9C2-4C2D-AC58-FCD23DADF793}\offreg.dll2014-03-07 00:29:19 -------- d-----w- C:\Users\Lucas\AppData\Roaming\Optimizer Pro2014-03-07 00:27:26 -------- d-----w- C:\Users\Lucas\.gimp-2.62014-03-07 00:25:26 -------- d-----w- C:\Program Files (x86)\GIMP-2.02014-03-07 00:23:36 -------- d-----w- C:\Program Files (x86)\Optimizer Pro2014-03-07 00:22:31 -------- d-----w- C:\Program Files (x86)\TidyNetwork2014-03-07 00:20:03 -------- d-----w- C:\Users\Lucas\AppData\Local\SearchProtect2014-03-06 21:32:56 1031560 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C9941A86-AE83-422F-B55D-84D292F39969}\gapaengine.dll2014-03-06 21:32:15 10536864 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{8C2BEE99-E9C2-4C2D-AC58-FCD23DADF793}\mpengine.dll2014-03-05 01:09:15 10536864 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll2014-02-26 00:49:17 -------- d-----w- C:\Windows\Migration2014-02-16 00:24:03 -------- d-----w- C:\Users\Lucas\AppData\Roaming\Malwarebytes2014-02-16 00:23:50 -------- d-----w- C:\ProgramData\Malwarebytes2014-02-16 00:23:46 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys2014-02-16 00:23:46 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware2014-02-16 00:23:23 -------- d-----w- C:\Users\Lucas\AppData\Local\Programs2014-02-13 22:29:29 -------- d-----w- C:\Windows\System32\drivers\NSSx64\0401000.01C2014-02-13 22:29:29 -------- d-----w- C:\Windows\System32\drivers\NSSx642014-02-13 22:29:29 -------- d-----w- C:\Program Files (x86)\Norton Security Scan2014-02-13 00:02:47 548864 ----a-w- C:\Windows\System32\vbscript.dll2014-02-13 00:02:47 454656 ----a-w- C:\Windows\SysWow64\vbscript.dll2014-02-13 00:00:50 4244480 ----a-w- C:\Windows\SysWow64\jscript9.dll2014-02-13 00:00:48 5768704 ----a-w- C:\Windows\System32\jscript9.dll2014-02-11 23:48:07 1882112 ----a-w- C:\Windows\System32\msxml3.dll2014-02-11 23:48:07 1237504 ----a-w- C:\Windows\SysWow64\msxml3.dll2014-02-11 23:48:06 2048 ----a-w- C:\Windows\SysWow64\msxml3r.dll2014-02-11 23:48:06 2048 ----a-w- C:\Windows\System32\msxml3r.dll.==================== Find3M ====================.2014-03-07 02:41:20 45056 ----a-w- C:\Windows\SysWow64\acovcnt.exe2014-02-21 00:39:39 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl2014-02-21 00:39:39 692616 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe2014-02-06 11:30:46 2724864 ----a-w- C:\Windows\System32\mshtml.tlb2014-02-06 11:30:12 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll2014-02-06 11:07:39 66048 ----a-w- C:\Windows\System32\iesetup.dll2014-02-06 11:06:47 48640 ----a-w- C:\Windows\System32\ieetwproxystub.dll2014-02-06 10:49:03 139264 ----a-w- C:\Windows\System32\ieUnatt.exe2014-02-06 10:48:45 111616 ----a-w- C:\Windows\System32\ieetwcollector.exe2014-02-06 10:48:11 708608 ----a-w- C:\Windows\System32\jscript9diag.dll2014-02-06 10:20:26 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb2014-02-06 10:01:36 61952 ----a-w- C:\Windows\SysWow64\iesetup.dll2014-02-06 10:00:46 51200 ----a-w- C:\Windows\SysWow64\ieetwproxystub.dll2014-02-06 09:50:32 2041856 ----a-w- C:\Windows\System32\inetcpl.cpl2014-02-06 09:47:22 112128 ----a-w- C:\Windows\SysWow64\ieUnatt.exe2014-02-06 09:46:27 553472 ----a-w- C:\Windows\SysWow64\jscript9diag.dll2014-02-06 09:24:52 2334208 ----a-w- C:\Windows\System32\wininet.dll2014-02-06 09:09:30 1964032 ----a-w- C:\Windows\SysWow64\inetcpl.cpl2014-02-06 08:41:35 1820160 ----a-w- C:\Windows\SysWow64\wininet.dll2014-01-19 07:33:29 270496 ------w- C:\Windows\System32\MpSigStub.exe2013-12-24 23:09:41 1987584 ----a-w- C:\Windows\SysWow64\d3d10warp.dll2013-12-24 22:48:32 2565120 ----a-w- C:\Windows\System32\d3d10warp.dll.============= FINISH: 21:49:44.88 ===============.UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.IF REQUESTED, ZIP IT UP & ATTACH IT.DDS (Ver_2012-11-20.01).Microsoft Windows 7 Home PremiumBoot Device: \Device\HarddiskVolume2Install Date: 8/27/2012 8:28:47 PMSystem Uptime: 3/6/2014 9:40:33 PM (0 hours ago).Motherboard: ASUSTeK Computer Inc. | | K53EProcessor: Intel® Core i3-2330M CPU @ 2.20GHz | CPU 1 | 792/100mhz.==== Disk Partitions =========================.C: is FIXED (NTFS) - 238 GiB total, 167.464 GiB free.D: is FIXED (NTFS) - 333 GiB total, 332.602 GiB free.E: is CDROM ().==== Disabled Device Manager Items =============.Class GUID: {6bdd1fc6-810f-11d0-bec7-08002be2092f}Description: Photosmart C4700 seriesDevice ID: ROOT\IMAGE\0000Manufacturer: HPName: Photosmart C4700 seriesPNP Device ID: ROOT\IMAGE\0000Service: StillCam.Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}Description: Photosmart C4700 seriesDevice ID: ROOT\MULTIFUNCTION\0000Manufacturer: HPName: Photosmart C4700 seriesPNP Device ID: ROOT\MULTIFUNCTION\0000Service:.==== System Restore Points ===================.RP196: 2/22/2014 8:24:06 PM - Windows UpdateRP197: 2/25/2014 7:46:49 PM - Windows UpdateRP198: 2/26/2014 7:05:07 AM - Windows UpdateRP199: 3/1/2014 4:44:24 PM - Windows UpdateRP200: 3/4/2014 7:05:05 PM - Windows Update.==== Installed Programs ======================.??????? Windows Live Mesh ActiveX ??(????)??????? Windows Live Mesh ActiveX ???64 Bit HP CIO Components InstallerAdobe Flash Player 12 ActiveXAdobe Flash Player 12 PluginAdobe Shockwave Player 12.0Alcor Micro USB Card ReaderArcSoft Panorama Maker 6Ask ToolbarAsk Toolbar UpdaterASUS AI RecoveryASUS FancyStartASUS Live UpdateASUS Power4Gear HybridASUS Splendid Video Enhancement TechnologyASUS Virtual CameraASUS WebStorageAsusScr_K3 Series_ENGAsusVibe2.0ATK PackageBing BarCisco EAP-FAST ModuleCisco LEAP ModuleCisco PEAP ModuleContrôle ActiveX Windows Live Mesh pour connexions à distanceControl ActiveX de Windows Live Mesh para conexiones remotasControlo ActiveX do Windows Live Mesh para Ligações RemotasCyberLink LabelPrintCyberLink Power2GoD3DX10Definition Update for Microsoft Office 2010 (KB982726) 32-Bit EditionElsword version v3.1218.9.2ETDWare PS/2-X64 8.0.5.1_WHQLFast BootGaleria de Fotografias do Windows LiveGalerie de photos Windows LiveGalería fotográfica de Windows LiveGIMP 2.6.10Google ChromeGoogle Toolbar for Internet ExplorerGoogle Update HelperHP Photosmart C4700 All-in-One Driver 14.0 Rel. 6InsaniquariumIntel® Control CenterIntel® Management Engine ComponentsIntel® Processor GraphicsJava 7 Update 45Java Auto UpdaterJunk Mail filter updateKodu Game LabMalwarebytes Anti-Malware version 1.75.0.1300McAfee Security Scan PlusMesh RuntimeMicrosoft .NET Framework 4.5.1Microsoft Application Error ReportingMicrosoft Office 2010Microsoft Office Access MUI (English) 2010Microsoft Office Access Setup Metadata MUI (English) 2010Microsoft Office Click-to-Run 2010Microsoft Office Excel MUI (English) 2010Microsoft Office Home and Student 2010Microsoft Office Office 64-bit Components 2010Microsoft Office OneNote MUI (English) 2010Microsoft Office Outlook MUI (English) 2010Microsoft Office PowerPoint MUI (English) 2010Microsoft Office Proof (English) 2010Microsoft Office Proof (French) 2010Microsoft Office Proof (Spanish) 2010Microsoft Office Proofing (English) 2010Microsoft Office Publisher MUI (English) 2010Microsoft Office Shared 64-bit MUI (English) 2010Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010Microsoft Office Shared MUI (English) 2010Microsoft Office Shared Setup Metadata MUI (English) 2010Microsoft Office Single Image 2010Microsoft Office Starter 2010 - EnglishMicrosoft Office Word MUI (English) 2010Microsoft Security ClientMicrosoft Security EssentialsMicrosoft SilverlightMicrosoft SQL Server 2005 Compact Edition [ENU]Microsoft Visual C++ 2005 RedistributableMicrosoft Visual C++ 2005 Redistributable (x64)Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219Microsoft XNA Framework Redistributable 3.1Microsoft XNA Framework Redistributable 4.0Mozilla Firefox 27.0.1 (x86 en-US)Mozilla Maintenance ServiceMSVCRTMSVCRT_amd64MSXML 4.0 SP2 (KB954430)MSXML 4.0 SP2 (KB973688)Network64Nikon Message Center 2Nikon Movie EditorNorton Security ScanNuance PDF ReaderOptimizer Pro v3.2Picture Control Utility x64PS_AIO_06_C4700_SW_MinPursuePointRealtek High Definition Audio DriverREALTEK Wireless LAN DriverScanScribblenauts UnlimitedSecurity Update for Microsoft .NET Framework 4.5.1 (KB2898869)Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)Security Update for Microsoft Excel 2010 (KB2826033) 32-Bit EditionSecurity Update for Microsoft Office 2010 (KB2553284) 32-Bit EditionSecurity Update for Microsoft Office 2010 (KB2687423) 32-Bit EditionSecurity Update for Microsoft Office 2010 (KB2826023) 32-Bit EditionSecurity Update for Microsoft Office 2010 (KB2826035) 32-Bit EditionSecurity Update for Microsoft Office 2010 (KB2850016) 32-Bit EditionService Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit EditionSonic FocusStarCraftSteamswMSMsyncables desktop SEToolboxUnity Web PlayerUpdate for Microsoft Access 2010 (KB2553446) 32-Bit EditionUpdate for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit EditionUpdate for Microsoft InfoPath 2010 (KB2817369) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2589298) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2589352) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2589375) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2597087) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2760598) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2760631) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2794737) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2837583) 32-Bit EditionUpdate for Microsoft Office 2010 (KB2850079) 32-Bit EditionUpdate for Microsoft OneNote 2010 (KB2837595) 32-Bit EditionUpdate for Microsoft Outlook 2010 (KB2687567) 32-Bit EditionUpdate for Microsoft PowerPoint 2010 (KB2553145) 32-Bit EditionUpdate for Microsoft PowerPoint 2010 (KB2775360) 32-Bit EditionUpdate for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit EditionUpdate for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit EditionUpdate for Microsoft Word 2010 (KB2837593) 32-Bit EditionViewNX 2Windows LiveWindows Live ???Windows Live ????Windows Live Communications PlatformWindows Live EssentialsWindows Live Family SafetyWindows Live ID Sign-in AssistantWindows Live InstallerWindows Live Language SelectorWindows Live MailWindows Live MeshWindows Live Mesh ActiveX Control for Remote ConnectionsWindows Live MessengerWindows Live MIME IFilterWindows Live Movie MakerWindows Live Photo CommonWindows Live Photo GalleryWindows Live PIMT PlatformWindows Live Remote ClientWindows Live Remote Client ResourcesWindows Live Remote ServiceWindows Live Remote Service ResourcesWindows Live SOXEWindows Live SOXE DefinitionsWindows Live UX PlatformWindows Live UX Platform Language PackWindows Live WriterWindows Live Writer ResourcesWinFlashWireless Console 3.==== Event Viewer Messages From Past Week ========.3/2/2014 10:58:54 AM, Error: bowser [8003] - The master browser has received a server announcement from the computer BRITTWINS-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{5213283F-3399-4EB1-9F8E-A30D7440A822}. The master browser is stopping or an election is being forced..==== End Of File ===========================Thanks once again for taking the time to assist me with this. Link to post Share on other sites More sharing options...
Staff gringo_pr Posted March 10, 2014 Staff ID:801335 Share Posted March 10, 2014 Hello Comprev I would like to welcome you to the Malware Removal section of the forum. Around here they call me Gringo and I will be glad to help you with your malware problems. Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!Please do not run any tools unless instructed to do so.We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.Please do not attach logs or use code boxes, just copy and paste the text.Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.Please read every post completely before doing anything.Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.Please provide feedback about your experience as we go.A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster. NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer. NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions. These are the programs I would like you to run next, if you have any problems with one of these just skip it and move on to the next one. -AdwCleaner- Please download AdwCleaner by Xplode onto your desktop.Close all open programs and internet browsers.Double click on AdwCleaner.exe to run the tool.Click on Scan.After the scan is complete click on "Clean"Confirm each time with Ok.Your computer will be rebooted automatically. A text file will open after the restart.Please post the content of that logfile with your next answer.You can find the logfile at C:\AdwCleaner[s1].txt as well.-Junkware-Removal-Tool- Please download Junkware Removal Tool to your desktop.Shut down your protection software now to avoid potential conflicts.Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".The tool will open and start scanning your system.Please be patient as this can take a while to complete depending on your system's specifications.On completion, a log (JRT.txt) is saved to your desktop and will automatically open.Post the contents of JRT.txt into your next message.When they are complete let me have the two reports and let me know how things are running. Gringo Link to post Share on other sites More sharing options...
Staff gringo_pr Posted March 13, 2014 Staff ID:802651 Share Posted March 13, 2014 Hello 48 Hour bump It has been more than 48 hours since my last post.do you still need help with this?do you need more time?are you having problems following my instructions?if after 48hrs you have not replied to this thread then it will have to be closed!Gringo Link to post Share on other sites More sharing options...
Comprev Posted March 13, 2014 Author ID:802838 Share Posted March 13, 2014 Haven't seen you here before ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Junkware Removal Tool (JRT) by ThisisuVersion: 6.1.2 (02.20.2014:1)OS: Windows 7 Home Premium x64Ran by Lucas on Thu 03/13/2014 at 18:36:35.26~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Services~~~ Registry ValuesSuccessfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs~~~ Registry KeysSuccessfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{3EF0E6B0-0DA1-4CB4-975C-10FD3F6536E3}Successfully deleted: [Registry Key] "hkey_current_user\software\microsoft\internet explorer\low rights\elevationpolicy\{a5aa24ea-11b8-4113-95ae-9ed71deaf12a}"~~~ Files~~~ FoldersSuccessfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{0293A61C-2017-4B54-91C5-90A682A24994}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{02C48749-2F3A-4572-B2C2-E7F2EC5CB007}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{04EB1E06-E6D8-4E71-8D0B-E78A2FC1C4EF}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{06853AE0-2701-4614-93C2-B3BA13DB7AF1}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{1EDEB6BD-23EB-4F0D-B264-BE5ADB2A76C8}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{2BA3D17B-3598-4BF7-82AF-02B1FD41CD30}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{330E09E1-978F-4AF9-B31C-C3242899C1F7}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{35CBFE1B-25CB-474D-B427-6EDFFB0C82CA}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{3DB51FCF-CFD7-4501-B4C7-380B595E60C6}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{3DC8344D-BBA1-40EC-9536-A60748F3E23B}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{4EC86299-6AB2-4BEA-93A1-1A092C05ECF9}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{54583C9E-45F5-4668-8FE7-707FC6A21A69}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{57958D80-032B-4838-8FA1-C469EDED2CC7}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{5C9BB924-93B3-477D-AF5E-94295154C424}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{66933081-A66E-428B-AB7E-F0973625F50E}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{6774874F-EC6D-4853-AECB-47107A8EBFBF}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{6A605025-3623-4505-9158-AB67AEAE517D}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{6BA2BC79-7870-46EB-BD37-417FE8E04D0B}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{84A2BE64-489E-4992-BE41-303412FD65D2}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{8707A224-ADD0-486A-A15B-9A4A9E6776A0}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{8F49CB79-3766-4441-9006-BD8A8523F03B}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{A475E013-7EA8-4FE3-90A5-22E17C1075A6}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{AC04475D-CE1C-4BDB-909B-897DEC3C1A81}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{B02645B2-968C-495A-BCF6-68A84EE8091F}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{B7528A70-5BFE-4F7F-9013-F460D0557D70}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{BA1ACE1E-9880-49FB-B931-E26EB31C1BF7}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{D2ED117D-F631-48D7-9CC1-1BF5FF94CAF0}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{EA50EE8E-4F81-429F-9E01-18EA3D8837E9}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{EC0399C8-5862-4750-835F-00F562E666F1}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{F5977A3D-B5F5-416A-8B43-CE43336EF5DA}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{F7449E47-5E95-4FD3-A477-BEB8B855E56A}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{F81B767F-BD89-49CC-B6ED-D892D4585142}Successfully deleted: [Empty Folder] C:\Users\Lucas\appdata\local\{F9FAF168-4F7F-40FB-B5DC-461B115755CD}~~~ FireFoxEmptied folder: C:\Users\Lucas\AppData\Roaming\mozilla\firefox\profiles\6zd0no7f.default\minidumps [349 files]~~~ Event Viewer Logs were cleared~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Scan was completed on Thu 03/13/2014 at 18:54:30.52End of JRT log~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~# AdwCleaner v3.022 - Report created 13/03/2014 at 18:29:50# Updated 13/03/2014 by Xplode# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)# Username : Lucas - LUCAS-PC# Running from : C:\Users\Lucas\Downloads\AdwCleaner.exe# Option : Clean***** [ Services ] *****Service Deleted : 70e6ca8c***** [ Files / Folders ] *****Folder Deleted : C:\ProgramData\AskFolder Deleted : C:\ProgramData\PartnerFolder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\optimizer pro v3.2Folder Deleted : C:\Program Files (x86)\Ask.comFolder Deleted : C:\Program Files (x86)\Optimizer ProFolder Deleted : C:\Program Files (x86)\TidyNetworkFolder Deleted : C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}Folder Deleted : C:\Users\Lucas\AppData\Local\apnFolder Deleted : C:\Users\Lucas\AppData\Local\SearchProtectFolder Deleted : C:\Users\Lucas\AppData\LocalLow\AskToolbarFolder Deleted : C:\Users\Lucas\AppData\Roaming\Optimizer ProFolder Deleted : C:\Users\Lucas\Documents\Optimizer ProFile Deleted : C:\ENDFile Deleted : C:\Users\Lucas\AppData\Roaming\Mozilla\Firefox\Profiles\6zd0no7f.default\searchplugins\Askcom.xmlFile Deleted : C:\Users\Lucas\AppData\Roaming\Mozilla\Firefox\Profiles\6zd0no7f.default\searchplugins\conduit-search.xmlFile Deleted : C:\Users\Lucas\AppData\Roaming\Mozilla\Firefox\Profiles\6zd0no7f.default\user.jsFile Deleted : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar***** [ Shortcuts ] ********** [ Registry ] *****Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Optimizer Pro]Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLLKey Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWndKey Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1Key Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbhoKey Deleted : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCSKey Deleted : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCSValue Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}Key Deleted : HKCU\Software\APNKey Deleted : HKCU\Software\Ask.comKey Deleted : HKCU\Software\Optimizer ProKey Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbarKey Deleted : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}Key Deleted : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}Key Deleted : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}Key Deleted : HKLM\Software\APNKey Deleted : HKLM\Software\AskToolbarKey Deleted : HKLM\Software\SearchProtectKey Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1Data Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dllData Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\OPTIMI~1\OPTPRO~2.DLLKey Deleted : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEFKey Deleted : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF***** [ Browsers ] *****-\\ Internet Explorer v11.0.9600.16518-\\ Mozilla Firefox v27.0.1 (en-US)[ File : C:\Users\Lucas\AppData\Roaming\Mozilla\Firefox\Profiles\6zd0no7f.default\prefs.js ]Line Deleted : user_pref("browser.search.defaultengine", "Ask.com");Line Deleted : user_pref("browser.search.order.1", "Ask.com");Line Deleted : user_pref("extensions.asktb.ff-original-keyword-url", "");-\\ Google Chrome v33.0.1750.146[ File : C:\Users\Lucas\AppData\Local\Google\Chrome\User Data\Default\preferences ]Deleted : icon_url*************************AdwCleaner[R0].txt - [7101 octets] - [13/03/2014 18:28:11]AdwCleaner[s0].txt - [6471 octets] - [13/03/2014 18:29:50]########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [6531 octets] ##########There was an add-on that we removed before the scans that got rid of the ads, but we still had the redirect until the scan was run. Link to post Share on other sites More sharing options...
Staff gringo_pr Posted March 14, 2014 Staff ID:802888 Share Posted March 14, 2014 Hello Comprev Yea I am one of the new kids. I Would like you to do the following. Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them. Run Combofix: You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this) Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here< Combofix may need to reboot your computer more than once to do its job this is normal. You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.Link 1 Link 2 Link 3 1. Close any open browsers or any other programs that are open. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Double click on combofix.exe & follow the prompts. When finished, it will produce a report for you. Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer "information and logs"In your next post I need the followingLog from Combofixlet me know of any problems you may have hadHow is the computer doing now?Gringo Link to post Share on other sites More sharing options...
Staff gringo_pr Posted March 16, 2014 Staff ID:803796 Share Posted March 16, 2014 Greetings I have not heard from you in a couple of days so I am coming by to check on you to see if you are having problems or you just need some more time. Also to remind you that it is very important that we finish the process completely so as to not get reinfected. I will let you know when we are complete and I will ask to remove our tools Gringo Link to post Share on other sites More sharing options...
Staff gringo_pr Posted March 19, 2014 Staff ID:804985 Share Posted March 19, 2014 Hello 48 Hour bump It has been more than 48 hours since my last post.do you still need help with this?do you need more time?are you having problems following my instructions?if after 48hrs you have not replied to this thread then it will have to be closed!Gringo Link to post Share on other sites More sharing options...
Comprev Posted March 19, 2014 Author ID:805106 Share Posted March 19, 2014 Hey, sorry about the late response. I'll be able to get on the computer soon, and I'll get to you when I can. Thanks Link to post Share on other sites More sharing options...
Staff gringo_pr Posted March 19, 2014 Staff ID:805237 Share Posted March 19, 2014 No problem and I will check on you in a couple of days gringo Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 21, 2014 Root Admin ID:805800 Share Posted March 21, 2014 Are you still with us? This topic will be closed soon if we do not hear back from you. Link to post Share on other sites More sharing options...
Staff gringo_pr Posted March 25, 2014 Staff ID:807761 Share Posted March 25, 2014 Hello 48 Hour bump It has been more than 48 hours since my last post.do you still need help with this?do you need more time?are you having problems following my instructions?if after 48hrs you have not replied to this thread then it will have to be closed!Gringo Link to post Share on other sites More sharing options...
Staff gringo_pr Posted March 31, 2014 Staff ID:810891 Share Posted March 31, 2014 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted April 7, 2014 Root Admin ID:814744 Share Posted April 7, 2014 Topic reopened per user request Link to post Share on other sites More sharing options...
Staff gringo_pr Posted April 7, 2014 Staff ID:814798 Share Posted April 7, 2014 Sorry Comprev Let me have the report for me to review gringo Link to post Share on other sites More sharing options...
Staff gringo_pr Posted April 11, 2014 Staff ID:816896 Share Posted April 11, 2014 Greetings I have not heard from you in a couple of days so I am coming by to check on you to see if you are having problems or you just need some more time. Also to remind you that it is very important that we finish the process completely so as to not get reinfected. I will let you know when we are complete and I will ask to remove our tools Gringo Link to post Share on other sites More sharing options...
Comprev Posted April 12, 2014 Author ID:817257 Share Posted April 12, 2014 I'll have it by tomorrow, definitely. I'm really terribly sorry about how long this has been taking. Link to post Share on other sites More sharing options...
Staff gringo_pr Posted April 12, 2014 Staff ID:817400 Share Posted April 12, 2014 I will look for you then gringo Link to post Share on other sites More sharing options...
Staff gringo_pr Posted April 15, 2014 Staff ID:818542 Share Posted April 15, 2014 Hello Comprev It has been 33 days since I asked for the last report we need to finish this or start over. Gringo Link to post Share on other sites More sharing options...
Comprev Posted April 16, 2014 Author ID:818931 Share Posted April 16, 2014 Again, I'm very, very sorry for the wait. I'll make sure it doesn't happen again. My apologies for this out. ComboFix 14-04-12.01 - Lucas 04/15/2014 19:35:50.1.4 - x64Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.5922.4464 [GMT -4:00]Running from: c:\users\Lucas\Downloads\ComboFix.exeAV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..c:\users\Lucas\AppData\Local\Microsoft\Windows\Temporary Internet Files\{07C20F8E-9676-433E-B3EC-E8853DC729FF}.xpsc:\users\Lucas\AppData\Local\Microsoft\Windows\Temporary Internet Files\{1ADE91E7-35FD-4AD1-B835-0312E2F86CC3}.xpsc:\users\Lucas\AppData\Local\Microsoft\Windows\Temporary Internet Files\{2BE8F50D-FFF6-4300-8B8A-EC9D35937D1B}.xpsc:\users\Lucas\AppData\Local\Microsoft\Windows\Temporary Internet Files\{32680394-EAE6-42C0-8B37-5C1F82F16475}.xpsc:\users\Lucas\AppData\Local\Microsoft\Windows\Temporary Internet Files\{3D07C742-4436-48FF-9D57-FB3A52691B33}.xpsc:\users\Lucas\AppData\Local\Microsoft\Windows\Temporary Internet Files\{41E4362C-21B9-40C1-93AF-9102BBE71775}.xpsc:\users\Lucas\AppData\Local\Microsoft\Windows\Temporary Internet Files\{48B272A7-4BAD-4896-B092-D0831408112A}.xpsc:\users\Lucas\AppData\Local\Microsoft\Windows\Temporary Internet Files\{6A6166C7-13AD-42B1-97DF-A81D67931BD3}.xpsc:\users\Lucas\AppData\Local\Microsoft\Windows\Temporary Internet Files\{84EF7F24-6C9B-4230-88EF-F43758629731}.xpsc:\users\Lucas\AppData\Local\Microsoft\Windows\Temporary Internet Files\{ABC2FDA6-09D7-4AB1-8D21-73C91F7ECE8A}.xpsc:\users\Lucas\AppData\Local\Microsoft\Windows\Temporary Internet Files\{B47E4D1C-50A1-4B39-9373-0C90BC7FBF55}.xpsc:\users\Lucas\AppData\Local\Microsoft\Windows\Temporary Internet Files\{BF122C44-8B67-43D4-BA36-3060879144D0}.xpsc:\users\Lucas\AppData\Local\Microsoft\Windows\Temporary Internet Files\{C35DA063-3588-48D3-9FB4-343F0288F24B}.xpsc:\users\Lucas\AppData\Local\Microsoft\Windows\Temporary Internet Files\{C94480F8-19F4-40C3-B0F2-B5ACA13284D2}.xpsc:\users\Lucas\Documents\~WRL3669.tmp..((((((((((((((((((((((((( Files Created from 2014-03-16 to 2014-04-16 )))))))))))))))))))))))))))))))..2014-04-16 01:30 . 2014-04-16 01:30 -------- d-----w- c:\users\Default\AppData\Local\temp2014-04-16 01:06 . 2014-04-01 01:15 10651696 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C5F15611-7648-4465-9AE7-8F85A85B0F73}\mpengine.dll2014-04-14 23:15 . 2014-03-07 04:43 10521840 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll2014-04-11 07:01 . 2014-03-06 08:32 574976 ----a-w- c:\windows\system32\ieui.dll2014-04-11 07:01 . 2014-03-06 06:00 359936 ----a-w- c:\program files\Internet Explorer\IEShims.dll2014-04-11 07:01 . 2014-03-06 05:50 257536 ----a-w- c:\program files (x86)\Internet Explorer\IEShims.dll2014-04-11 07:01 . 2014-03-06 08:57 548352 ----a-w- c:\windows\system32\vbscript.dll2014-04-11 07:01 . 2014-03-06 08:02 455168 ----a-w- c:\windows\SysWow64\vbscript.dll2014-04-11 07:01 . 2014-03-06 08:36 222720 ----a-w- c:\program files\Internet Explorer\ielowutil.exe2014-04-11 07:01 . 2014-03-06 07:44 222720 ----a-w- c:\program files (x86)\Internet Explorer\ielowutil.exe2014-04-11 07:01 . 2014-03-06 07:03 470016 ----a-w- c:\program files (x86)\Internet Explorer\ieinstal.exe2014-04-09 21:01 . 2014-02-04 02:35 190912 ----a-w- c:\windows\system32\drivers\storport.sys2014-04-03 23:40 . 2014-02-20 01:04 1031560 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F48D764C-9DA1-4A8F-A327-B454DDBDA75A}\gapaengine.dll2014-03-22 21:37 . 2014-04-15 20:33 -------- d-----w- c:\users\Lucas\AppData\Local\Windows Live...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2014-04-10 11:41 . 2012-09-08 16:33 90655440 ----a-w- c:\windows\system32\MRT.exe2014-04-08 19:37 . 2012-09-11 02:46 45056 ----a-w- c:\windows\SysWow64\acovcnt.exe2014-03-22 19:02 . 2012-09-02 23:57 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl2014-03-22 19:02 . 2012-09-02 23:57 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe2014-03-11 13:52 . 2012-03-21 03:44 133928 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys2014-03-04 09:17 . 2014-04-09 21:01 44032 ----a-w- c:\windows\apppatch\acwow64.dll2014-02-20 01:04 . 2012-10-02 21:39 1031560 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll2014-02-07 01:23 . 2014-03-13 18:15 3156480 ----a-w- c:\windows\system32\win32k.sys2014-02-04 02:32 . 2014-03-13 18:11 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll2014-02-04 02:32 . 2014-03-13 18:11 624128 ----a-w- c:\windows\system32\qedit.dll2014-02-04 02:04 . 2014-03-13 18:11 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll2014-02-04 02:04 . 2014-03-13 18:11 509440 ----a-w- c:\windows\SysWow64\qedit.dll2014-01-29 02:32 . 2014-03-13 18:15 484864 ----a-w- c:\windows\system32\wer.dll2014-01-29 02:06 . 2014-03-13 18:15 381440 ----a-w- c:\windows\SysWow64\wer.dll2014-01-28 02:32 . 2014-03-13 18:15 228864 ----a-w- c:\windows\system32\wwansvc.dll2014-01-25 05:19 . 2014-01-25 05:19 268512 ----a-w- c:\windows\system32\drivers\MpFilter.sys2014-01-19 07:33 . 2012-08-27 21:53 270496 ------w- c:\windows\system32\MpSigStub.exe..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Steam"="c:\program files (x86)\Steam\Steam.exe" [2014-02-25 1821888].[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]"Nuance PDF Reader-reminder"="c:\program files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" [2008-11-03 328992]"ASUSPRP"="c:\program files (x86)\ASUS\APRP\APRP.EXE" [2011-04-02 2018032]"ASUSWebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe" [2011-02-23 731472]"SonicMasterTray"="c:\program files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe" [2010-07-10 984400]"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-08-17 5732992]"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2011-10-19 2319536]"Nikon Message Center 2"="c:\program files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe" [2011-10-30 571392]"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336].c:\users\Lucas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE /tsr [2013-6-25 228552].c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\AsusVibeLauncher.lnk - c:\program files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe /start [2011-4-2 548528]FancyStart daemon.lnk - c:\windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_94E3CE3704FE82FBF49A6A.exe -d [2011-8-28 12862]McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.8.130\SSScheduler.exe [2013-9-6 324320].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorUser"= 3 (0x3)"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]"LoadAppInit_DLLs"=1 (0x1).[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]@="Service".R2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.3.132.0\BBSvc.exe;c:\program files (x86)\Microsoft\BingBar\7.3.132.0\BBSvc.exe [x]R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]R3 HP8207_8307;HP-HP8207_8307;c:\windows\system32\DRIVERS\HP8207_8307.sys;c:\windows\SYSNATIVE\DRIVERS\HP8207_8307.sys [x]R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe;c:\program files\McAfee Security Scan\3.8.130\McCHSvc.exe [x]R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys;c:\windows\SYSNATIVE\DRIVERS\SiSG664.sys [x]R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]R3 X6va015;X6va015;c:\windows\SysWOW64\Drivers\X6va015;c:\windows\SysWOW64\Drivers\X6va015 [x]R3 X6va016;X6va016;c:\windows\SysWOW64\Drivers\X6va016;c:\windows\SysWOW64\Drivers\X6va016 [x]R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [x]S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe;c:\windows\SYSNATIVE\FBAgent.exe [x]S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [x]S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [x]S3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.exe;c:\program files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.exe [x]S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys;c:\windows\SYSNATIVE\DRIVERS\rtl8192Ce.sys [x]S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]..[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]2014-04-09 20:42 1077576 ----a-w- c:\program files (x86)\Google\Chrome\Application\34.0.1847.116\Installer\chrmstp.exe.Contents of the 'Scheduled Tasks' folder.2014-04-16 c:\windows\Tasks\Adobe Flash Player Updater.job- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-02 19:02].2014-04-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-02 04:36].2014-04-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-02 04:36].2014-04-12 c:\windows\Tasks\Norton Security Scan for Lucas.job- c:\progra~2\NORTON~2\Engine\410~1.28\Nss.exe [2014-02-13 06:04]..--------- X64 Entries -----------..[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]2010-09-02 08:41 220160 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSShellExt64.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]@="{64174815-8D98-4CE6-8646-4C039977D808}"[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]2010-09-02 08:41 220160 ----a-w- c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSShellExt64.dll.[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2011-03-21 361984]"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-01-18 2188904]"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-03-11 1271072]"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-07-28 167704]"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-07-28 392472]"Persistence"="c:\windows\system32\igfxpers.exe" [2011-07-28 416024]"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2012-09-20 1832760].------- Supplementary Scan -------.uLocal Page = c:\windows\system32\blank.htmmLocal Page = c:\windows\SysWOW64\blank.htmIE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105TCP: DhcpNameServer = 192.168.1.254FF - ProfilePath - c:\users\Lucas\AppData\Roaming\Mozilla\Firefox\Profiles\6zd0no7f.default\FF - prefs.js: browser.search.selectedEngine - Google.- - - - ORPHANS REMOVED - - - -.Toolbar-Locked - (no file)Wow6432Node-HKLM-Run-<NO NAME> - (no file)HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - startBHO-{5AB835E1-4A43-3826-FDF5-5636839C9F15} - c:\program files (x86)\TidyNetwork\petn64.dllToolbar-Locked - (no file)HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exeHKLM-Run-Setwallpaper - c:\programdata\SetWallpaper.cmd...[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va015]"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va015".[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va016]"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va016".--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="IFlashBroker5".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Shockwave Flash Object".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]@="0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]@="ShockwaveFlash.ShockwaveFlash.12".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="ShockwaveFlash.ShockwaveFlash".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Macromedia Flash Factory Object".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]@="FlashFactory.FlashFactory.1".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="FlashFactory.FlashFactory".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="IFlashBroker5".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]@Denied: (A) (Everyone)"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}".[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]@Denied: (A) (Everyone).[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]"Key"="ActionsPane3""Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd".[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]@Denied: (Full) (Everyone).Completion time: 2014-04-15 21:36:48ComboFix-quarantined-files.txt 2014-04-16 01:36.Pre-Run: 180,621,262,848 bytes freePost-Run: 181,666,492,416 bytes free.- - End Of File - - 786F702BEB7C016130B2A14E3203727E So far there are no indicators of a continued infections as far as I've observed. Thanks once again. Link to post Share on other sites More sharing options...
Staff gringo_pr Posted April 16, 2014 Staff ID:819140 Share Posted April 16, 2014 Hello These logs are looking allot better. But we still have some work to do. Please print out these instructions, or copy them to a Notepad file. It will make it easier for you to follow the instructions and complete all of the necessary steps.. uninstall some programs NOTE** Because of the cleanup process some of the programs I have listed may not be in add/remove anymore this is fine just move to the next item on the list. You can remove these programs using add/remove or you can use the free uninstaller from Revo (Revo does allot better of a job)Programs to removeAsk Toolbar Ask Toolbar Updater Java 7 Update 45 McAfee Security Scan Plus Optimizer Pro v3.2 Please download and install Revo Uninstaller FreeDouble click Revo Uninstaller to run it.From the list of programs double click on The Program to removeWhen prompted if you want to uninstall click Yes.Be sure the Moderate option is selected then click Next.The program will run, If prompted again click Yeswhen the built-in uninstaller is finished click on Next.Once the program has searched for leftovers click Next.Check/tick the bolded items only on the list then click Deletewhen prompted click on Yes and then on next.put a check on any folders that are found and select deletewhen prompted select yes then on nextOnce done click Finish.. Install Java: Please go here to install Javaclick on the Free Java Download Buttonclick on Agree and start Free downloadclick on Runclick on run againclick on installwhen install is complete click on closeClean Out Temp FilesThis small application you may want to keep and use once a week to keep the computer clean. Download CCleaner from here CCleanerRun the installer to install the application.When it gives you the option to install Yahoo toolbar uncheck the box next to it.Run CCleaner. default settings are fineClick Run Cleaner.Close CCleaner.: Malwarebytes' Anti-Malware : I see that you have MBAM installed - That is great!! and at this time I would like you to update it and run me a quick scanDouble-click mbam icongo to the update tab at the topclick on check for updatesIf an update is found, it will download and install the latest version.Once the program has loaded, select Perform quick scan, then click Scan.When the scan is complete, click OK, then Show Results to view the results.Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.When completed, a log will open in Notepad. please copy and paste the log into your next replyIf you accidentally close it, the log file is saved here and will be named like this:C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txtNote: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware. Download HijackThisGo Here to download HijackThis programSave HijackThis to your desktop.Right Click on Hijackthis and select "Run as Admin" (XP users just need to double click to run)Click on "Do A system scan and save a logfile" (if you do not see "Do A system scan and save a logfile" then click on main menu)copy and paste hijackthis report into the topic"information and logs"In your next post I need the followingLog From MBAMreport from Hijackthislet me know of any problems you may have hadHow is the computer doing now?Gringo Link to post Share on other sites More sharing options...
Comprev Posted April 18, 2014 Author ID:820073 Share Posted April 18, 2014 Before I run the scans, I think I should point out that my brother just got another bit of adware on his computer, one that redirects to default-search.net MSE didn't find anything, and here's the log from MBAM: Malwarebytes Anti-Malware 1.75.0.1300www.malwarebytes.orgDatabase version: v2014.04.18.01Windows 7 Service Pack 1 x64 NTFSInternet Explorer 11.0.9600.17041Lucas :: LUCAS-PC [administrator]4/17/2014 10:31:00 PMmbam-log-2014-04-17 (22-31-00).txtScan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 235665Time elapsed: 11 minute(s), 1 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 1C:\Program Files (x86)\Settings Manager\systemk\sysapcrt.dll (PUP.Optional.SettingsManager.A) -> Delete on reboot.Registry Keys Detected: 0(No malicious items detected)Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 2C:\Program Files (x86)\Settings Manager\systemk (PUP.Optional.SettingsManager.A) -> Delete on reboot.C:\Program Files (x86)\Settings Manager\systemk\x64 (PUP.Optional.SettingsManager.A) -> Delete on reboot.Files Detected: 2C:\Program Files (x86)\Settings Manager\systemk\sysapcrt.dll (PUP.Optional.SettingsManager.A) -> Delete on reboot.C:\Program Files (x86)\Settings Manager\systemk\x64\sysapcrt.dll (PUP.Optional.SettingsManager.A) -> Delete on reboot.(end) Link to post Share on other sites More sharing options...
Staff gringo_pr Posted April 18, 2014 Staff ID:820266 Share Posted April 18, 2014 Hello Comprev Please download Farbar Recovery Scan Tool and save it to your desktop. Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.Double-click to run it. When the tool opens click Yes to disclaimer.Press Scan button.It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.Gringo Link to post Share on other sites More sharing options...
Comprev Posted April 20, 2014 Author ID:821205 Share Posted April 20, 2014 Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-04-2014Ran by Lucas (administrator) on LUCAS-PC on 20-04-2014 10:35:12Running from C:\Users\Lucas\DesktopWindows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)Internet Explorer Version 11Boot Mode: NormalThe only official download link for FRST:Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/Download link from any site other than Bleeping Computer is unpermitted or outdated.See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/==================== Processes (Whitelisted) =================(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe(ASUSTeK Computer Inc.) C:\Windows\system32\FBAgent.exe(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe(Intel Corporation) C:\Windows\System32\igfxtray.exe(Intel Corporation) C:\Windows\System32\hkcmd.exe(Intel Corporation) C:\Windows\System32\igfxpers.exe(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe(Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE(Virage Logic Corporation / Sonic Focus) C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe(ASUS) C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe(ASUS) C:\Windows\AsScrPro.exe(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.exe(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE(Microsoft Corporation) C:\Windows\splwow64.exe(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE==================== Registry (Whitelisted) ==================HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2587944 2010-12-31] (ELAN Microelectronics Corp.)HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [361984 2011-03-21] (Alcor Micro Corp.)HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2188904 2011-01-18] (Realtek Semiconductor)HKLM\...\Run: [setwallpaper] => c:\programdata\SetWallpaper.cmdHKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing)HKLM-x32\...\Run: [Nuance PDF Reader-reminder] => C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe [328992 2008-11-03] (Nuance Communications, Inc.)HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [2018032 2011-04-02] (ASUSTek Computer Inc.)HKLM-x32\...\Run: [ASUSWebStorage] => C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe [731472 2011-02-23] (ecareme)HKLM-x32\...\Run: [sonicMasterTray] => C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe [984400 2010-07-10] (Virage Logic Corporation / Sonic Focus)HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5732992 2010-08-17] (ASUS)HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)HKLM-x32\...\Run: [updateLBPShortCut] => C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)HKLM-x32\...\Run: [updateP2GoShortCut] => C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)HKLM-x32\...\Run: [] => [X]HKLM-x32\...\Run: [Wireless Console 3] => C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2319536 2011-10-18] (ASUS)HKLM-x32\...\Run: [Nikon Message Center 2] => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe [571392 2011-10-30] (Nikon Corporation)HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)HKU\S-1-5-21-524691610-2607265322-4011940379-1000\...\Run: [steam] => C:\Program Files (x86)\Steam\Steam.exe [1821888 2014-02-25] (Valve Corporation)HKU\S-1-5-21-524691610-2607265322-4011940379-1000\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_12_0_0_77_Plugin.exe [841096 2014-03-22] (Adobe Systems Incorporated)AppInit_DLLs: C:\PROGRA~2\Linkey\IEEXTE~1\iedll64.dll => C:\PROGRA~2\Linkey\IEEXTE~1\iedll64.dll File Not FoundIFEO\bitguard.exe: [Debugger] tasklist.exeIFEO\bprotect.exe: [Debugger] tasklist.exeIFEO\bpsvc.exe: [Debugger] tasklist.exeIFEO\browserdefender.exe: [Debugger] tasklist.exeIFEO\browserprotect.exe: [Debugger] tasklist.exeIFEO\browsersafeguard.exe: [Debugger] tasklist.exeIFEO\dprotectsvc.exe: [Debugger] tasklist.exeIFEO\jumpflip: [Debugger] tasklist.exeIFEO\protectedsearch.exe: [Debugger] tasklist.exeIFEO\searchinstaller.exe: [Debugger] tasklist.exeIFEO\searchprotection.exe: [Debugger] tasklist.exeIFEO\searchprotector.exe: [Debugger] tasklist.exeIFEO\searchsettings.exe: [Debugger] tasklist.exeIFEO\searchsettings64.exe: [Debugger] tasklist.exeIFEO\snapdo.exe: [Debugger] tasklist.exeIFEO\stinst32.exe: [Debugger] tasklist.exeIFEO\stinst64.exe: [Debugger] tasklist.exeIFEO\umbrella.exe: [Debugger] tasklist.exeIFEO\utiljumpflip.exe: [Debugger] tasklist.exeIFEO\volaro: [Debugger] tasklist.exeIFEO\vonteera: [Debugger] tasklist.exeIFEO\websteroids.exe: [Debugger] tasklist.exeIFEO\websteroidsservice.exe: [Debugger] tasklist.exeStartup: C:\Users\Lucas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnkShortcutTarget: OneNote 2010 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)HKLM\...\AppCertDlls: [x86] -> C:\Program Files (x86)\Settings Manager\systemk\sysapcrt.dllHKLM\...\AppCertDlls: [x64] -> C:\Program Files (x86)\Settings Manager\systemk\x64\sysapcrt.dll==================== Internet (Whitelisted) ====================HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearchHKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.default-search.net?sid=492&aid=100&itype=n&ver=12283&tm=320&src=hmpStartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exeSearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-search.net/search?sid=492&aid=100&itype=n&ver=12283&tm=320&src=ds&p={searchTerms}SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUTSearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-search.net/search?sid=492&aid=100&itype=n&ver=12283&tm=320&src=ds&p={searchTerms}SearchScopes: HKCU - URL http://search.conduit.com/Results.aspx?ctid=CT3321972&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP2C19C6B8-4F4A-4707-B89D-6BD7DB65654D&q={searchTerms}&SSPV=SearchScopes: HKCU - SuggestionsURL_JSON http://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-search.net/search?sid=492&aid=100&itype=n&ver=12283&tm=320&src=ds&p={searchTerms}BHO: Linkey - {4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47} - C:\Program Files (x86)\Linkey\IEExtension\iedll64.dll No FileBHO: TidyNetwork - {5AB835E1-4A43-3826-FDF5-5636839C9F15} - C:\Program Files (x86)\TidyNetwork\petn64.dll No FileBHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.)BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.)BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.)Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.)Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)Tcpip\Parameters: [DhcpNameServer] 192.168.1.254FireFox:========FF ProfilePath: C:\Users\Lucas\AppData\Roaming\Mozilla\Firefox\Profiles\6zd0no7f.defaultFF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()FF Plugin: @microsoft.com/GENUINE - disabled No FileFF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1209149.dll (Adobe Systems, Inc.)FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)FF Plugin-x32: @microsoft.com/GENUINE - disabled No FileFF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: ZEON/PDF,version=2.0 - C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Lucas\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)FF SearchPlugin: C:\Users\Lucas\AppData\Roaming\Mozilla\Firefox\Profiles\6zd0no7f.default\searchplugins\default-search.xmlFF Extension: Linkey for Firefox - C:\Users\Lucas\AppData\Roaming\Mozilla\Firefox\Profiles\6zd0no7f.default\Extensions\extension@linkeyproject.com [2014-04-17]FF Extension: Settings Manager - C:\Users\Lucas\AppData\Roaming\Mozilla\Firefox\Profiles\6zd0no7f.default\Extensions\{37F9163C-392F-354F-E58C-3C8922A98E9E} [2014-04-17]FF Extension: Flashblock - C:\Users\Lucas\AppData\Roaming\Mozilla\Firefox\Profiles\6zd0no7f.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2013-04-15]FF Extension: WOT - C:\Users\Lucas\AppData\Roaming\Mozilla\Firefox\Profiles\6zd0no7f.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-28]FF Extension: Adblock Plus - C:\Users\Lucas\AppData\Roaming\Mozilla\Firefox\Profiles\6zd0no7f.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-09-16]Chrome:=======CHR DefaultSearchProvider: default-search.netCHR DefaultSearchURL: http://www.default-search.net/search?sid=492&aid=100&itype=n&ver=12283&tm=320&src=ds&p={searchTerms}CHR Extension: (Google Wallet) - C:\Users\Lucas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-28]==================== Services (Whitelisted) =================S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)==================== Drivers (Whitelisted) ====================U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2014-02-13] (Symantec Corporation)S3 HP8207_8307; C:\Windows\System32\DRIVERS\HP8207_8307.sys [15360 2010-02-05] (Windows ® Win 7 DDK provider)R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)S3 catchme; \??\C:\ComboFix\catchme.sys [X]S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X]S3 X6va016; \??\C:\Windows\SysWOW64\Drivers\X6va016 [X]==================== NetSvcs (Whitelisted) ======================================= One Month Created Files and Folders ========2014-04-20 10:35 - 2014-04-20 10:36 - 00019170 _____ () C:\Users\Lucas\Desktop\FRST.txt2014-04-20 10:35 - 2014-04-20 10:35 - 00000000 ____D () C:\FRST2014-04-20 10:33 - 2014-04-20 10:34 - 02055680 _____ (Farbar) C:\Users\Lucas\Desktop\FRST64.exe2014-04-17 18:02 - 2014-04-17 18:02 - 00000000 ____D () C:\Program Files\File Association Helper2014-04-17 18:02 - 2014-04-17 18:02 - 00000000 ____D () C:\Program Files (x86)\Settings Manager2014-04-17 18:01 - 2014-04-17 18:01 - 00820840 _____ ( ) C:\Users\Lucas\Downloads\winzip175-mediafire.exe2014-04-17 06:20 - 2014-04-17 06:20 - 00000000 __SHD () C:\Users\Lucas\AppData\Local\EmieUserList2014-04-17 06:20 - 2014-04-17 06:20 - 00000000 __SHD () C:\Users\Lucas\AppData\Local\EmieSiteList2014-04-15 21:36 - 2014-04-15 21:36 - 00021712 _____ () C:\ComboFix.txt2014-04-15 21:28 - 2014-04-15 21:28 - 00000219 _____ () C:\Users\Lucas\Desktop\Super Mario Boards - Index.URL2014-04-15 19:32 - 2011-06-26 02:45 - 00256000 _____ () C:\Windows\PEV.exe2014-04-15 19:32 - 2010-11-07 13:20 - 00208896 _____ () C:\Windows\MBR.exe2014-04-15 19:32 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe2014-04-15 19:32 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe2014-04-15 19:32 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe2014-04-15 19:32 - 2000-08-30 20:00 - 00098816 _____ () C:\Windows\sed.exe2014-04-15 19:32 - 2000-08-30 20:00 - 00080412 _____ () C:\Windows\grep.exe2014-04-15 19:32 - 2000-08-30 20:00 - 00068096 _____ () C:\Windows\zip.exe2014-04-15 19:31 - 2014-04-15 21:36 - 00000000 ____D () C:\Qoobox2014-04-15 19:31 - 2014-04-15 21:33 - 00000000 ____D () C:\Windows\erdnt2014-04-15 16:34 - 2014-04-15 16:34 - 00000000 ____D () C:\Users\Lucas\AppData\Local\{39B74F4D-1646-4C4B-97CA-810E1CBA9B5F}2014-04-11 19:25 - 2014-04-11 19:25 - 01070496 _____ (Unity Technologies ApS) C:\Users\Lucas\Downloads\UnityWebPlayer.exe2014-04-11 03:01 - 2014-03-06 04:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll2014-04-11 03:01 - 2014-03-06 04:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll2014-04-11 03:01 - 2014-03-06 04:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll2014-04-11 03:01 - 2014-03-06 03:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2014-04-11 03:00 - 2014-03-06 06:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll2014-04-11 03:00 - 2014-03-06 05:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb2014-04-11 03:00 - 2014-03-06 05:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll2014-04-11 03:00 - 2014-03-06 05:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2014-04-11 03:00 - 2014-03-06 04:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll2014-04-11 03:00 - 2014-03-06 04:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll2014-04-11 03:00 - 2014-03-06 04:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll2014-04-11 03:00 - 2014-03-06 04:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll2014-04-11 03:00 - 2014-03-06 04:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll2014-04-11 03:00 - 2014-03-06 04:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2014-04-11 03:00 - 2014-03-06 04:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe2014-04-11 03:00 - 2014-03-06 04:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe2014-04-11 03:00 - 2014-03-06 04:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll2014-04-11 03:00 - 2014-03-06 04:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe2014-04-11 03:00 - 2014-03-06 04:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll2014-04-11 03:00 - 2014-03-06 04:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll2014-04-11 03:00 - 2014-03-06 04:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe2014-04-11 03:00 - 2014-03-06 04:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll2014-04-11 03:00 - 2014-03-06 04:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll2014-04-11 03:00 - 2014-03-06 03:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll2014-04-11 03:00 - 2014-03-06 03:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll2014-04-11 03:00 - 2014-03-06 03:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2014-04-11 03:00 - 2014-03-06 03:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2014-04-11 03:00 - 2014-03-06 03:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2014-04-11 03:00 - 2014-03-06 03:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll2014-04-11 03:00 - 2014-03-06 03:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll2014-04-11 03:00 - 2014-03-06 03:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2014-04-11 03:00 - 2014-03-06 03:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll2014-04-11 03:00 - 2014-03-06 03:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll2014-04-11 03:00 - 2014-03-06 03:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll2014-04-11 03:00 - 2014-03-06 03:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll2014-04-11 03:00 - 2014-03-06 03:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl2014-04-11 03:00 - 2014-03-06 03:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll2014-04-11 03:00 - 2014-03-06 03:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll2014-04-11 03:00 - 2014-03-06 02:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll2014-04-11 03:00 - 2014-03-06 02:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll2014-04-11 03:00 - 2014-03-06 02:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2014-04-11 03:00 - 2014-03-06 02:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2014-04-11 03:00 - 2014-03-06 02:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll2014-04-11 03:00 - 2014-03-06 01:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll2014-04-11 03:00 - 2014-03-06 01:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll2014-04-11 03:00 - 2014-03-06 01:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll2014-04-11 03:00 - 2014-03-06 01:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2014-04-11 03:00 - 2014-03-06 01:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2014-04-09 17:01 - 2014-03-04 05:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll2014-04-09 17:01 - 2014-03-04 05:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll2014-04-09 17:01 - 2014-03-04 05:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll2014-04-09 17:01 - 2014-03-04 05:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll2014-04-09 17:01 - 2014-03-04 05:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll2014-04-09 17:01 - 2014-03-04 05:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll2014-04-09 17:01 - 2014-03-04 05:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll2014-04-09 17:01 - 2014-03-04 05:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe2014-04-09 17:01 - 2014-03-04 05:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll2014-04-09 17:01 - 2014-03-04 04:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe2014-04-09 17:01 - 2014-03-04 04:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe2014-04-09 17:01 - 2014-02-03 22:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys2014-04-09 17:01 - 2014-02-03 22:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys2014-04-09 17:01 - 2014-02-03 22:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys2014-04-09 17:01 - 2014-02-03 22:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll2014-04-09 17:01 - 2014-02-03 22:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll2014-04-09 17:01 - 2014-01-23 22:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys2014-04-08 15:08 - 2014-04-15 19:30 - 05194807 ____R (Swearware) C:\Users\Lucas\Downloads\ComboFix.exe2014-04-01 19:26 - 2014-04-01 19:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox2014-03-22 17:37 - 2014-04-15 16:33 - 00000000 ____D () C:\Users\Lucas\AppData\Local\Windows Live2014-03-22 17:36 - 2014-03-22 17:37 - 00000000 ____D () C:\Users\Lucas\AppData\Local\{AA7F4B20-D403-4462-8560-FE6118872D41}2014-03-22 16:17 - 2014-03-22 16:17 - 00024576 ___SH () C:\Users\Lucas\Thumbs.db2014-03-22 15:00 - 2014-03-22 15:00 - 02269709 _____ () C:\Users\Lucas\Downloads\forge-1.6.4-9.11.1.953-installer.jar==================== One Month Modified Files and Folders =======2014-04-20 10:36 - 2014-04-20 10:35 - 00019170 _____ () C:\Users\Lucas\Desktop\FRST.txt2014-04-20 10:35 - 2014-04-20 10:35 - 00000000 ____D () C:\FRST2014-04-20 10:34 - 2014-04-20 10:33 - 02055680 _____ (Farbar) C:\Users\Lucas\Desktop\FRST64.exe2014-04-20 10:33 - 2012-09-02 19:57 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job2014-04-20 10:16 - 2011-08-28 23:00 - 01939170 _____ () C:\Windows\WindowsUpdate.log2014-04-20 10:15 - 2011-04-02 00:36 - 00000912 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job2014-04-19 19:15 - 2011-04-02 00:36 - 00000908 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job2014-04-19 18:46 - 2013-10-22 19:10 - 00000452 ____H () C:\Windows\Tasks\Norton Security Scan for Lucas.job2014-04-19 09:14 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\rescache2014-04-19 07:05 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\system32\NDF2014-04-18 07:40 - 2012-09-10 22:46 - 00045056 _____ () C:\Windows\SysWOW64\acovcnt.exe2014-04-18 07:29 - 2009-07-14 00:45 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02014-04-18 07:29 - 2009-07-14 00:45 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02014-04-18 07:22 - 2013-01-10 17:35 - 00000000 ____D () C:\Program Files (x86)\Steam2014-04-18 07:22 - 2012-08-27 20:28 - 00000000 ___HD () C:\ASUS.DAT2014-04-18 07:21 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2014-04-18 07:21 - 2009-07-14 00:51 - 00078880 _____ () C:\Windows\setupact.log2014-04-17 22:53 - 2011-04-02 00:17 - 00564568 _____ () C:\Windows\PFRO.log2014-04-17 22:24 - 2011-08-28 23:12 - 00002106 _____ () C:\Windows\system32\AutoRunFilter.ini2014-04-17 18:02 - 2014-04-17 18:02 - 00000000 ____D () C:\Program Files\File Association Helper2014-04-17 18:02 - 2014-04-17 18:02 - 00000000 ____D () C:\Program Files (x86)\Settings Manager2014-04-17 18:01 - 2014-04-17 18:01 - 00820840 _____ ( ) C:\Users\Lucas\Downloads\winzip175-mediafire.exe2014-04-17 06:20 - 2014-04-17 06:20 - 00000000 __SHD () C:\Users\Lucas\AppData\Local\EmieUserList2014-04-17 06:20 - 2014-04-17 06:20 - 00000000 __SHD () C:\Users\Lucas\AppData\Local\EmieSiteList2014-04-15 21:36 - 2014-04-15 21:36 - 00021712 _____ () C:\ComboFix.txt2014-04-15 21:36 - 2014-04-15 19:31 - 00000000 ____D () C:\Qoobox2014-04-15 21:36 - 2009-07-13 23:20 - 00000000 __RHD () C:\Users\Default2014-04-15 21:33 - 2014-04-15 19:31 - 00000000 ____D () C:\Windows\erdnt2014-04-15 21:31 - 2009-07-13 22:34 - 00000215 _____ () C:\Windows\system.ini2014-04-15 21:28 - 2014-04-15 21:28 - 00000219 _____ () C:\Users\Lucas\Desktop\Super Mario Boards - Index.URL2014-04-15 19:30 - 2014-04-08 15:08 - 05194807 ____R (Swearware) C:\Users\Lucas\Downloads\ComboFix.exe2014-04-15 16:34 - 2014-04-15 16:34 - 00000000 ____D () C:\Users\Lucas\AppData\Local\{39B74F4D-1646-4C4B-97CA-810E1CBA9B5F}2014-04-15 16:33 - 2014-03-22 17:37 - 00000000 ____D () C:\Users\Lucas\AppData\Local\Windows Live2014-04-11 20:35 - 2012-09-08 12:35 - 00000000 ____D () C:\Users\Lucas\AppData\Roaming\.minecraft2014-04-11 19:25 - 2014-04-11 19:25 - 01070496 _____ (Unity Technologies ApS) C:\Users\Lucas\Downloads\UnityWebPlayer.exe2014-04-11 03:04 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\PolicyDefinitions2014-04-10 07:56 - 2009-07-14 01:08 - 00032582 _____ () C:\Windows\Tasks\SCHEDLGU.TXT2014-04-10 07:45 - 2012-09-03 14:12 - 00000000 ____D () C:\ProgramData\Microsoft Help2014-04-10 07:44 - 2013-07-19 14:46 - 00000000 ____D () C:\Windows\system32\MRT2014-04-10 07:41 - 2012-09-08 12:33 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe2014-04-08 21:15 - 2013-09-28 14:32 - 00000000 ____D () C:\Users\Lucas\Desktop\EVERYTHING2014-04-03 16:35 - 2012-08-27 17:50 - 00001945 _____ () C:\Windows\epplauncher.mif2014-04-03 16:34 - 2012-08-27 17:50 - 00000000 ____D () C:\Program Files\Microsoft Security Client2014-04-03 16:34 - 2012-08-27 17:50 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client2014-04-03 16:34 - 2009-07-14 01:13 - 00798780 _____ () C:\Windows\system32\PerfStringBackup.INI2014-04-03 16:29 - 2012-08-27 17:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service2014-04-01 19:27 - 2014-04-01 19:26 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox2014-03-31 19:10 - 2011-04-02 00:36 - 00003908 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA2014-03-31 19:10 - 2011-04-02 00:36 - 00003656 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore2014-03-22 17:37 - 2014-03-22 17:36 - 00000000 ____D () C:\Users\Lucas\AppData\Local\{AA7F4B20-D403-4462-8560-FE6118872D41}2014-03-22 16:17 - 2014-03-22 16:17 - 00024576 ___SH () C:\Users\Lucas\Thumbs.db2014-03-22 16:17 - 2012-08-27 20:28 - 00000000 ____D () C:\Users\Lucas2014-03-22 15:02 - 2014-01-20 11:44 - 00000000 ____D () C:\Users\Lucas\AppData\Local\Adobe2014-03-22 15:02 - 2012-09-02 19:57 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2014-03-22 15:02 - 2012-09-02 19:57 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2014-03-22 15:02 - 2012-09-02 19:57 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater2014-03-22 15:00 - 2014-03-22 15:00 - 02269709 _____ () C:\Users\Lucas\Downloads\forge-1.6.4-9.11.1.953-installer.jarFiles to move or delete:====================C:\ProgramData\PKP_DLeo.DATC:\ProgramData\PKP_DLes.DATC:\ProgramData\PKP_DLet.DATC:\ProgramData\PKP_DLev.DATSome content of TEMP:====================C:\Users\Lucas\AppData\Local\Temp\ICReinstall_winzip175-mediafire.exe==================== Bamital & volsnap Check =================C:\Windows\System32\winlogon.exe => MD5 is legitC:\Windows\System32\wininit.exe => MD5 is legitC:\Windows\SysWOW64\wininit.exe => MD5 is legitC:\Windows\explorer.exe => MD5 is legitC:\Windows\SysWOW64\explorer.exe => MD5 is legitC:\Windows\System32\svchost.exe => MD5 is legitC:\Windows\SysWOW64\svchost.exe => MD5 is legitC:\Windows\System32\services.exe => MD5 is legitC:\Windows\System32\User32.dll => MD5 is legitC:\Windows\SysWOW64\User32.dll => MD5 is legitC:\Windows\System32\userinit.exe => MD5 is legitC:\Windows\SysWOW64\userinit.exe => MD5 is legitC:\Windows\System32\rpcss.dll => MD5 is legitC:\Windows\System32\Drivers\volsnap.sys => MD5 is legitLastRegBack: 2014-04-19 09:07==================== End Of Log ============================Addition.txt Link to post Share on other sites More sharing options...
Staff gringo_pr Posted April 21, 2014 Staff ID:821465 Share Posted April 21, 2014 Hello Comprev I need you to download this script I have made for you --> fixlist.txt It needs to be saved Next to the "Farbar Recovery Scan Tool" (FRST) program (If asked to overwrite existing one please allow) Run FRST again but this time press the Fix button just once and wait. When finished, it will make a log (fixlog.txt) next to FRST. Please copy and paste the content of this file to your reply. NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system Gringo Link to post Share on other sites More sharing options...
Comprev Posted April 23, 2014 Author ID:822577 Share Posted April 23, 2014 Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 23-04-2014Ran by Lucas at 2014-04-23 18:08:53 Run:1Running from C:\Users\Lucas\DesktopBoot Mode: Normal==============================================Content of fixlist:*****************IFEO\bitguard.exe: [Debugger] tasklist.exeIFEO\bprotect.exe: [Debugger] tasklist.exeIFEO\bpsvc.exe: [Debugger] tasklist.exeIFEO\browserdefender.exe: [Debugger] tasklist.exeIFEO\browserprotect.exe: [Debugger] tasklist.exeIFEO\browsersafeguard.exe: [Debugger] tasklist.exeIFEO\dprotectsvc.exe: [Debugger] tasklist.exeIFEO\jumpflip: [Debugger] tasklist.exeIFEO\protectedsearch.exe: [Debugger] tasklist.exeIFEO\searchinstaller.exe: [Debugger] tasklist.exeIFEO\searchprotection.exe: [Debugger] tasklist.exeIFEO\searchprotector.exe: [Debugger] tasklist.exeIFEO\searchsettings.exe: [Debugger] tasklist.exeIFEO\searchsettings64.exe: [Debugger] tasklist.exeIFEO\snapdo.exe: [Debugger] tasklist.exeIFEO\stinst32.exe: [Debugger] tasklist.exeIFEO\stinst64.exe: [Debugger] tasklist.exeIFEO\umbrella.exe: [Debugger] tasklist.exeIFEO\utiljumpflip.exe: [Debugger] tasklist.exeIFEO\volaro: [Debugger] tasklist.exeIFEO\vonteera: [Debugger] tasklist.exeIFEO\websteroids.exe: [Debugger] tasklist.exeIFEO\websteroidsservice.exe: [Debugger] tasklist.exeAppInit_DLLs: C:\PROGRA~2\Linkey\IEEXTE~1\iedll64.dll => C:\PROGRA~2\Linkey\IEEXTE~1\iedll64.dll File Not FoundSearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-s...m=320&src=ds&p={searchTerms}SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-s...m=320&src=ds&p={searchTerms}SearchScopes: HKCU - URL http://search.condui...6BD7DB65654D&q={searchTerms}&SSPV=SearchScopes: HKCU - SuggestionsURL_JSON http://suggest.searc...on.ashx?prefix={searchTerms}SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-s...m=320&src=ds&p={searchTerms}BHO: Linkey - {4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47} - C:\Program Files (x86)\Linkey\IEExtension\iedll64.dll No FileBHO: TidyNetwork - {5AB835E1-4A43-3826-FDF5-5636839C9F15} - C:\Program Files (x86)\TidyNetwork\petn64.dll No FileHKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.default-s...&tm=320&src=hmpFF Extension: Linkey for Firefox - C:\Users\Lucas\AppData\Roaming\Mozilla\Firefox\Profiles\6zd0no7f.default\Extensions\extension@linkeyproject.com [2014-04-17]*****************HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\bitguard.exe => Key deleted successfully.HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\bprotect.exe => Key deleted successfully.HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\bpsvc.exe => Key deleted successfully.HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\browserdefender.exe => Key deleted successfully.HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\browserprotect.exe => Key deleted successfully.HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\browsersafeguard.exe => Key deleted successfully.HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\dprotectsvc.exe => Key deleted successfully.HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\jumpflip => Key deleted successfully.HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\protectedsearch.exe => Key deleted successfully.HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\searchinstaller.exe => Key deleted successfully.HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\searchprotection.exe => Key deleted successfully.HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\searchprotector.exe => Key deleted successfully.HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\searchsettings.exe => Key deleted successfully.HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\searchsettings64.exe => Key deleted successfully.HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\snapdo.exe => Key deleted successfully.HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\stinst32.exe => Key deleted successfully.HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\stinst64.exe => Key deleted successfully.HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\umbrella.exe => Key deleted successfully.HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\utiljumpflip.exe => Key deleted successfully.HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\volaro => Key deleted successfully.HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\vonteera => Key deleted successfully.HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\websteroids.exe => Key deleted successfully.HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\websteroidsservice.exe => Key deleted successfully."C:\PROGRA~2\Linkey\IEEXTE~1\iedll64.dll" => Value Data removed successfully.HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} => Key deleted successfully.HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} => Key deleted successfully.HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} => Key deleted successfully.HKCR\Wow6432Node\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} => Key deleted successfully.HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\URL => Value deleted successfully.HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\SuggestionsURL_JSON => Value deleted successfully.HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key deleted successfully.HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key deleted successfully.HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} => Key deleted successfully.HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} => Key deleted successfully.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47} => Key deleted successfully.HKCR\CLSID\{4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47} => Key deleted successfully.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5AB835E1-4A43-3826-FDF5-5636839C9F15} => Key deleted successfully.HKCR\CLSID\{5AB835E1-4A43-3826-FDF5-5636839C9F15} => Key deleted successfully.HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.C:\Users\Lucas\AppData\Roaming\Mozilla\Firefox\Profiles\6zd0no7f.default\Extensions\extension@linkeyproject.com => Moved successfully.==== End of Fixlog ==== Link to post Share on other sites More sharing options...
Recommended Posts