Jump to content

mynameisaron

Members
  • Posts

    12
  • Joined

  • Last visited

Reputation

0 Neutral
  1. Any info about this? What problems did this cause and why was it so difficult to remove or anything else? C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\Extensions\einszfeapc@einszfeapc.org.xpi Results of screen317's Security Check version 0.99.73 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Webroot SecureAnywhere Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware version 1.75.0.1300 Java 6 Update 22 Java 6 Update 25 Java version out of Date! Adobe Flash Player 11.8.800.168 Adobe Reader XI Mozilla Firefox (23.0.1) Google Chrome 29.0.1547.62 Google Chrome 29.0.1547.66 ````````Process Check: objlist.exe by Laurent```````` Norton ccSvcHst.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 0% ````````````````````End of Log``````````````````````
  2. This might have worked! The program only took a few seconds to run. I have done about 10 searches but haven't been redirected. I have seen some pages load with sites something like reachlocal.com, but the site loads with the actual page I clicked on so I am guessing that is some legit marketing thing that I just haven't notice before. Thanks! Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-09-2013 Ran by owner at 2013-09-17 06:54:33 Run:1 Running from C:\Users\owner\Downloads Boot Mode: Normal ============================================== Content of fixlist: ***************** CHR HKLM-x32\...\Chrome\Extension: [ngmmcbedgcbfghamlghhpbpifnbhhpik] - C:\Users\owner\AppData\Local\Temp\crxE35.tmp Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File C:\Users\owner\AppData\Local\Temp\crxE35.tmp C:\Users\owner\AppData\Local\Temp\DefaultAssets.exe C:\Users\owner\AppData\Local\Temp\NLStubInstallerResources.dll FF Extension: einszfeapc - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\Extensions\einszfeapc@einszfeapc.org.xpi Use DeleteJunctionsIndirectory: C:\Windows\system64 ***************** HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Value deleted successfully. HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Key not found. HKCR\PROTOCOLS\Handler\skype-ie-addon-data => Key deleted successfully. HKCR\CLSID\{91774881-D725-4E58-B298-07617B9B86A8} => Key not found. HKCR\PROTOCOLS\Filter\application/x-ica => Key deleted successfully. HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found. HKCR\PROTOCOLS\Filter\application/x-ica; charset=euc-jp => Key deleted successfully. HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found. HKCR\PROTOCOLS\Filter\application/x-ica; charset=ISO-8859-1 => Key deleted successfully. HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found. HKCR\PROTOCOLS\Filter\application/x-ica; charset=MS936 => Key deleted successfully. HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found. HKCR\PROTOCOLS\Filter\application/x-ica; charset=MS949 => Key deleted successfully. HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found. HKCR\PROTOCOLS\Filter\application/x-ica; charset=MS950 => Key deleted successfully. HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found. HKCR\PROTOCOLS\Filter\application/x-ica; charset=UTF-8 => Key deleted successfully. HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found. HKCR\PROTOCOLS\Filter\application/x-ica; charset=UTF8 => Key deleted successfully. HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found. HKCR\PROTOCOLS\Filter\application/x-ica;charset=euc-jp => Key deleted successfully. HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found. HKCR\PROTOCOLS\Filter\application/x-ica;charset=ISO-8859-1 => Key deleted successfully. HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found. HKCR\PROTOCOLS\Filter\application/x-ica;charset=MS936 => Key deleted successfully. HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found. HKCR\PROTOCOLS\Filter\application/x-ica;charset=MS949 => Key deleted successfully. HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found. HKCR\PROTOCOLS\Filter\application/x-ica;charset=MS950 => Key deleted successfully. HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found. HKCR\PROTOCOLS\Filter\application/x-ica;charset=UTF-8 => Key deleted successfully. HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found. HKCR\PROTOCOLS\Filter\application/x-ica;charset=UTF8 => Key deleted successfully. HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found. HKCR\PROTOCOLS\Filter\ica => Key deleted successfully. HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found. C:\Users\owner\AppData\Local\Temp\DefaultAssets.exe => Moved successfully. C:\Users\owner\AppData\Local\Temp\NLStubInstallerResources.dll => Moved successfully. C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\Extensions\einszfeapc@einszfeapc.org.xpi => Moved successfully. "C:\Windows\system64" => Deleting reparse point and unlocking started. "C:\Windows\system64" => Deleting reparse point and unlocking done. "C:\Windows\system64" => Deleting reparse point and unlocking completed. ==== End of Fixlog ====
  3. Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-09-2013 Ran by owner at 2013-09-15 23:53:25 Running from C:\Users\owner\Downloads Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= Adobe AIR (x32 Version: 2.6.0.19140) Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.174) Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.168) Adobe Reader XI (11.0.03) (x32 Version: 11.0.03) AIM 7 (x32) Bejeweled 3 (x32 Version: 2.2.0.97) BitTorrent (x32 Version: 7.6.1) BurnAware Free 6.3 (x32) Chuzzle Deluxe (x32 Version: 2.2.0.95) Citrix Receiver (HDX Flash Redirection) (x32 Version: 13.0.0.6685) Citrix Receiver (x32 Version: 13.0.0.6685) Citrix Receiver Inside (x32 Version: 3.0.0.56418) Citrix Receiver(Aero) (x32 Version: 13.0.0.6685) Citrix Receiver(DV) (x32 Version: 13.0.0.6685) Citrix Receiver(USB) (x32 Version: 13.0.0.6685) D3DX10 (x32 Version: 15.4.2368.0902) Easy Video Splitter 1.28 (x32) FATE - The Traitor Soul (x32 Version: 2.2.0.95) ffdshow v1.1.3996 [2011-10-13] (x32 Version: 1.1.3996.0) Fishdom 2 (x32 Version: 2.2.0.98) Free Video Converter 2.0 (x32) Garmin Communicator Plugin (x32 Version: 4.0.4) Garmin Communicator Plugin x64 (Version: 4.0.4) Garmin Training Center (x32 Version: 3.4.5) Garmin USB Drivers (x32 Version: 2.3.0.0) Google Chrome (x32 Version: 29.0.1547.66) Google Earth (x32 Version: 7.1.1.1888) Google Update Helper (x32 Version: 1.3.21.153) HitmanPro 3.6 (Version: 3.6.0.146) ImgBurn (x32 Version: 2.5.7.0) Intel® Management Engine Components (x32 Version: 7.0.0.1144) Intel® Processor Graphics (x32 Version: 8.15.10.2353) Intel® Rapid Storage Technology (x32 Version: 10.1.2.1004) Java Auto Updater (x32 Version: 2.0.4.1) Java 6 Update 22 (x32 Version: 6.0.220) Java 6 Update 25 (x32 Version: 6.0.250) Junk Mail filter update (x32 Version: 15.4.3502.0922) Label@Once 1.0 (x32 Version: 1.0) Malwarebytes Anti-Malware version 1.75.0.1300 (x32 Version: 1.75.0.1300) McAfee Security Scan Plus (x32 Version: 3.0.318.3) Mesh Runtime (x32 Version: 15.4.5722.2) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Office 2010 (x32 Version: 14.0.4763.1000) Microsoft Office Click-to-Run 2010 (Version: 14.0.4763.1000) Microsoft Office Click-to-Run 2010 (x32 Version: 14.0.4763.1000) Microsoft Office Starter 2010 - English (x32 Version: 14.0.4763.1000) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (x32 Version: 10.0.30319) Mozilla Firefox 23.0.1 (x86 en-US) (x32 Version: 23.0.1) Mozilla Maintenance Service (x32 Version: 23.0.1) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT_amd64 (x32 Version: 15.4.2862.0708) Online Plug-in (x32 Version: 13.0.0.6685) OpenOffice.org 3.3 (x32 Version: 3.3.9567) Paltalk Messenger 10.2 (x32 Version: 10.2.0) PeerBlock 1.1 (r518) (Version: 1.1.0.518) Penguins! (x32 Version: 2.2.0.95) Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95) PlayReady PC Runtime amd64 (Version: 1.3.0) PlayReady PC Runtime x86 (x32 Version: 1.3.0) Polar Bowler (x32 Version: 2.2.0.97) PowerISO (x32 Version: 4.9) Realtek Ethernet Controller Driver (x32 Version: 7.38.113.2011) Realtek High Definition Audio Driver (x32 Version: 6.0.1.6410) Realtek USB 2.0 Card Reader (x32 Version: 6.1.7600.30126) Realtek WLAN Driver (x32 Version: 2.00.0013) Skype Click to Call (x32 Version: 5.10.9560) Skype Launcher (x32 Version: 2.01) Skype™ 6.3 (x32 Version: 6.3.107) SoulSeek 157 NS 13e (x32) Synaptics Pointing Device Driver (Version: 15.2.11.1) Tom Clancy's Splinter Cell (x32 Version: 2.2.0.97) Toshiba App Place (x32 Version: 1.0.6.3) TOSHIBA Application Installer (x32 Version: 9.0.1.2) TOSHIBA Assist (x32 Version: 4.2.3.0) Toshiba Book Place (x32 Version: 2.2.7530) TOSHIBA Bulletin Board (Version: 1.6.08.64) TOSHIBA Bulletin Board (x32 Version: 1.6.08.64) TOSHIBA Disc Creator (Version: 2.1.0.11 for x64) TOSHIBA eco Utility (Version: 1.3.5.64) TOSHIBA Face Recognition (Version: 3.1.17.64) TOSHIBA Face Recognition (x32 Version: 3.1.17.64) TOSHIBA Hardware Setup (x32 Version: 2.00.0014) TOSHIBA HDD/SSD Alert (Version: 3.1.64.9) Toshiba Laptop Checkup (x32 Version: 2.0.13.11) TOSHIBA Media Controller (x32 Version: 1.0.87.4) TOSHIBA Media Controller Plug-in (x32 Version: 1.0.7.5) Toshiba Online Backup (x32 Version: 2.0.0.31) TOSHIBA PC Health Monitor (Version: 1.7.9.64) TOSHIBA Quality Application (x32 Version: 1.0.3) TOSHIBA Recovery Media Creator (x32 Version: 2.1.5.5109a) TOSHIBA ReelTime (Version: 1.7.21.64) TOSHIBA ReelTime (x32 Version: 1.7.21.64) TOSHIBA Resolution+ Plug-in for Windows Media Player (x32 Version: 1.1.2) TOSHIBA Service Station (x32 Version: 2.2.12) TOSHIBA Sleep Utility (x32 Version: 1.4.2.8) TOSHIBA Supervisor Password (x32 Version: 2.00.0006) TOSHIBA Value Added Package (Version: 1.6.1.64) TOSHIBA Value Added Package (x32 Version: 1.6.1.64) TOSHIBA Web Camera Application (x32 Version: 2.0.3.3) TOSHIBA Wireless LAN Indicator (x32 Version: 1.0.5) TOSHIBARegistration (x32 Version: 1.0.6) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1) Update Installer for WildTangent Games App (x32) Virtual Villagers 5 - New Believers (x32 Version: 2.2.0.97) VLC media player 2.0.3 (x32 Version: 2.0.3) Webroot SecureAnywhere (x32 Version: 8.0.2.155) WildTangent Games (x32 Version: 1.0.2.5) WildTangent Games App (Toshiba Games) (x32 Version: 4.0.5.14) Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0) (Version: 06/03/2009 2.3.0.0) Windows Live Communications Platform (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3538.0513) Windows Live ID Sign-in Assistant (Version: 7.250.4232.0) Windows Live Installer (x32 Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3538.0513) Windows Live Mail (x32 Version: 15.4.3502.0922) Windows Live Mesh (x32 Version: 15.4.3502.0922) Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2) Windows Live Messenger (x32 Version: 15.4.3538.0513) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Movie Maker (x32 Version: 15.4.3502.0922) Windows Live Photo Common (x32 Version: 15.4.3502.0922) Windows Live Photo Gallery (x32 Version: 15.4.3502.0922) Windows Live PIMT Platform (x32 Version: 15.4.3508.1109) Windows Live Remote Client (Version: 15.4.5722.2) Windows Live Remote Client Resources (Version: 15.4.5722.2) Windows Live Remote Service (Version: 15.4.5722.2) Windows Live Remote Service Resources (Version: 15.4.5722.2) Windows Live SOXE (x32 Version: 15.4.3502.0922) Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922) Windows Live UX Platform (x32 Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109) Windows Live Writer (x32 Version: 15.4.3502.0922) Windows Live Writer Resources (x32 Version: 15.4.3502.0922) WinRAR 4.01 (32-bit) (x32 Version: 4.01.0) Xilisoft Video Editor 2 (HKCU Version: 2.1.1.0901) YTD Video Downloader 3.9.4 (x32) Zuma's Revenge (x32 Version: 2.2.0.97) ==================== Restore Points ========================= 23-08-2013 04:06:55 Windows Update 27-08-2013 10:52:46 Windows Update 07-09-2013 02:04:53 Scheduled Checkpoint 10-09-2013 02:53:20 ComboFix created restore point 11-09-2013 03:41:44 Windows Update ==================== Hosts content: ========================== 2009-07-13 22:34 - 2013-09-10 05:43 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => Sc.exe start w32time task_started Task: {3A866332-8B2C-4B6E-854C-291736BB62CD} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-23] (Google Inc.) Task: {532743AA-2A36-4EB6-89CB-CDECD50AAB51} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-14] (Adobe Systems Incorporated) Task: {5D370F27-11EA-4DB1-AECE-57D5715DF55B} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task Task: {B4B2F622-3707-480E-8DBE-9D19047C3068} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc Task: {CD9FDAD6-33AA-4039-ACC1-12D3AD016850} - System32\Tasks\Norton PC Checkup Setup => C:\Users\owner\AppData\Roaming\PCCUStubInstaller\SymcPCCUInstaller.exe [2013-08-09] (Symantec Corporation) Task: {E47CBD67-40E3-4E36-A127-269A66A0B441} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-23] (Google Inc.) Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2011-11-30 10:41 - 2013-06-20 22:04 - 00102792 _____ (Webroot) C:\windows\system32\WRusr.dll 2011-04-04 22:28 - 2011-04-04 22:28 - 00285696 _____ (Intel Corporation) C:\windows\system32\igfxrENU.lrc 2011-04-04 22:18 - 2011-04-04 22:18 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll 2011-05-17 17:35 - 2011-05-17 17:35 - 00128960 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrReg.dll 2011-05-17 17:34 - 2011-05-17 17:34 - 00152512 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrFunc.dll 2011-05-17 17:36 - 2011-05-17 17:36 - 00309184 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TtosFunc.dll 2011-05-17 17:31 - 2011-05-17 17:31 - 00266688 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TCooling.dll 2011-05-17 17:34 - 2011-05-17 17:34 - 00346048 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TOddPwr.dll 2011-05-17 17:35 - 2011-05-17 17:35 - 00061376 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrSrv.dll 2011-05-17 17:34 - 2011-05-17 17:34 - 00278480 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrBrightness.dll 2011-05-17 17:31 - 2011-05-17 17:31 - 00268224 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\T1394Pwr.dll 2011-05-17 17:34 - 2011-05-17 17:34 - 00273856 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TKBLEDPwr.dll 2011-05-17 17:35 - 2011-05-17 17:35 - 00268224 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TSDPwr.dll 2011-05-17 17:34 - 2011-05-17 17:34 - 00266688 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPCIePwr.dll 2011-05-17 17:35 - 2011-05-17 17:35 - 00270784 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TScreen.dll 2010-09-09 14:03 - 2010-09-09 14:03 - 00059768 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdEvnt.dll 2010-12-10 18:54 - 2010-12-10 18:54 - 00247672 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.dll 2010-11-18 20:18 - 2010-11-18 20:18 - 11190784 _____ () C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll 2010-03-03 17:15 - 2010-03-03 17:15 - 00265016 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\FnPRTSC.dll 2011-04-25 12:02 - 2011-04-25 12:02 - 00172928 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\FnSticky.dll 2011-01-20 18:13 - 2011-01-20 18:13 - 00091000 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\Hotkey\Mute.dll 2010-12-02 22:50 - 2010-12-02 22:50 - 00044920 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\SmoothView.dll 2008-07-14 13:35 - 2008-07-14 13:35 - 00107832 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TWarnMsg\TWarnMsg.dll 2010-12-08 20:58 - 2010-12-08 20:58 - 00297336 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TBS\TBSMain.dll 2008-07-14 13:34 - 2008-07-14 13:34 - 00053560 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF1.dll 2011-05-17 17:31 - 2011-05-17 17:31 - 00273856 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TFunc2.DLL 2008-07-14 13:34 - 2008-07-14 13:34 - 00054072 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF3.dll 2008-07-14 13:34 - 2008-07-14 13:34 - 00054072 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF4.dll 2011-03-03 15:11 - 2011-03-03 15:11 - 00128928 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF5.dll 2011-01-20 18:13 - 2011-01-20 18:13 - 00097144 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\Hotkey\Brightness.dll 2011-04-06 15:01 - 2011-04-06 15:01 - 00381360 _____ (TOSHIBA Corporation.) C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF8Dll.dll 2011-01-18 15:55 - 2011-01-18 15:55 - 00114552 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\Hotkey\Touchpad.dll 2010-06-02 17:43 - 2010-06-02 17:43 - 00080792 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnSpace.dll 2011-09-23 10:01 - 2010-11-03 21:30 - 00149608 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RtkCfg64.dll 2011-09-23 10:01 - 2011-07-07 00:42 - 03148904 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RtkAPO64.dll 2011-02-03 22:56 - 2011-02-03 22:56 - 00405800 _____ (Synaptics Incorporated) C:\windows\system32\SynCOM.dll 2011-02-03 22:56 - 2011-02-03 22:56 - 00224040 _____ (Synaptics Incorporated) C:\windows\system32\SynTPAPI.dll 2011-05-24 12:58 - 2011-05-24 12:58 - 00592832 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoPower.dll 2011-05-24 12:58 - 2011-05-24 12:58 - 00089536 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoHci.dll 2010-12-15 18:19 - 2010-12-15 18:19 - 00124320 _____ () C:\Program Files\TOSHIBA\TECO\MUIHelp.dll 2010-04-23 16:58 - 2010-04-23 16:58 - 03409256 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll 2011-09-23 10:08 - 2011-07-11 20:16 - 00061824 _____ (TOSHIBA Corporation) C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\PluginLib.dll 2011-09-23 10:42 - 2011-07-19 11:59 - 00644984 ____R (Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccL90U.dll 2011-09-23 10:42 - 2011-07-19 11:59 - 00085880 ____R (Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccVrTrst.dll 2011-09-23 10:42 - 2011-07-19 11:59 - 00134520 ____R (Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvc.dll 2011-09-23 10:42 - 2011-07-19 11:59 - 00152440 ____R (Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccIPC.dll 2011-09-23 10:42 - 2011-07-19 11:59 - 00381304 ____R (Symantec Corporation) C:\PROGRAM FILES (X86)\NORTON PC CHECKUP\ENGINE\2.0.13.11\CCJOBMGR.DLL 2012-02-29 16:24 - 2012-02-29 16:24 - 00252928 _____ (AOL Inc.) C:\Program Files (x86)\AIM\xprt6.dll 2010-01-06 02:03 - 2010-01-06 02:03 - 00163840 _____ (AOL Inc.) C:\Program Files (x86)\Common Files\AOL\AOLDiag\tbdiag.dll 2012-02-29 16:24 - 2012-02-29 16:24 - 00751616 _____ (AOL Inc.) C:\Program Files (x86)\AIM\acccore.dll 2012-02-29 16:24 - 2012-02-29 16:24 - 01208320 _____ (AOL Inc.) C:\Program Files (x86)\AIM\coolcore61.dll 2012-02-29 16:24 - 2012-02-29 16:24 - 00348160 _____ (Netscape Communications Corporation) C:\Program Files (x86)\AIM\nss3.dll 2012-02-29 16:24 - 2012-02-29 16:24 - 00372736 _____ (Netscape Communications Corporation) C:\Program Files (x86)\AIM\softokn3.dll 2012-02-29 16:24 - 2012-02-29 16:24 - 00028672 _____ (Netscape Communications Corporation) C:\Program Files (x86)\AIM\plc4.dll 2012-02-29 16:24 - 2012-02-29 16:24 - 00159744 _____ (Netscape Communications Corporation) C:\Program Files (x86)\AIM\nspr4.dll 2012-02-29 16:24 - 2012-02-29 16:24 - 00024576 _____ (Netscape Communications Corporation) C:\Program Files (x86)\AIM\plds4.dll 2012-02-29 16:24 - 2012-02-29 16:24 - 00110592 _____ (Netscape Communications Corporation) C:\Program Files (x86)\AIM\ssl3.dll 2012-02-29 16:24 - 2012-02-29 16:24 - 00106496 _____ (Netscape Communications Corporation) C:\Program Files (x86)\AIM\smime3.dll 2012-02-29 16:24 - 2012-02-29 16:24 - 00176128 _____ () C:\Program Files (x86)\AIM\nssckbi.dll 2011-01-17 17:19 - 2011-12-01 15:05 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll 2011-08-11 12:18 - 2011-08-11 12:18 - 00370624 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\ctxmui.dll 2011-08-11 12:18 - 2011-08-11 12:18 - 00128960 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\CCMSDK.dll 2011-08-11 12:14 - 2011-08-11 12:14 - 00011200 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\resource\en\ctxmuiUI.DLL 2011-08-11 12:15 - 2011-08-11 12:15 - 00427968 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\resource\en\concenUI.DLL 2012-10-27 16:57 - 2011-07-19 18:58 - 00033152 _____ (Citrix Systems, Inc.) C:\Users\owner\AppData\Local\Citrix\Receiver\WindowsAppRHelper_concentr.exe.dll 2011-07-19 18:58 - 2011-07-19 18:58 - 00206720 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\WindowsAppRHelper.dll 2011-08-11 12:17 - 2011-08-11 12:17 - 00025024 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\CCMProxy.dll 2011-07-19 18:58 - 2011-07-19 18:58 - 00595840 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\ResourceKeeper.dll 2011-07-19 18:58 - 2011-07-19 18:58 - 00042368 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\nativemessagebox.dll 2011-07-19 18:58 - 2011-07-19 18:58 - 00731008 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\nativesystrayue.dll 2011-07-19 18:58 - 2011-07-19 18:58 - 00092032 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\progressnotification.dll 2011-07-19 18:58 - 2011-07-19 18:58 - 00083840 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\toaster.dll 2011-08-11 12:23 - 2011-08-11 12:23 - 00088000 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\ProgressNotificationCommon.dll 2011-08-11 12:25 - 2011-08-11 12:25 - 00075712 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\WFCWINN.dll 2011-08-11 12:23 - 2011-08-11 12:23 - 00096192 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\acrdlg.dll 2011-08-11 12:20 - 2011-08-11 12:20 - 00096192 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\statuin.dll 2011-08-11 12:18 - 2011-08-11 12:18 - 00092096 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\confmgr.dll 2011-08-11 12:18 - 2011-08-11 12:18 - 00022976 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\ctxlogging.dll 2011-08-11 12:18 - 2011-08-11 12:18 - 00032192 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\icafile.dll 2011-08-11 12:26 - 2011-08-11 12:26 - 00317376 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\RSManager.dll 2011-08-11 12:26 - 2011-08-11 12:26 - 00024000 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\RSMHook.dll 2011-08-11 12:24 - 2011-08-11 12:24 - 00493504 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\CST.dll 2011-08-11 12:14 - 2011-08-11 12:14 - 00020416 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\resource\en\ProgressNotificationCommonUI.dll 2011-08-11 12:15 - 2011-08-11 12:15 - 00571328 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\resource\en\statuiUI.DLL 2011-08-11 12:15 - 2011-08-11 12:15 - 00112576 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\resource\en\CSTUI.DLL 2011-08-11 12:16 - 2011-08-11 12:16 - 00116672 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\resource\en\wfcrunUI.DLL 2012-10-27 16:57 - 2011-07-19 18:58 - 00033152 _____ (Citrix Systems, Inc.) C:\Users\owner\AppData\Local\Citrix\Receiver\WindowsAppRHelper_wfcrun32.exe.dll ==================== Alternate Data Streams (whitelisted) ========== ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (09/15/2013 11:50:58 PM) (Source: Toshiba App Place) (User: ) Description: System.ArgumentOutOfRangeException: Number must be either non-negative and less than or equal to Int32.MaxValue or -1. Parameter name: dueTime Stack Trace: at System.Threading.Timer..ctor(TimerCallback callback, Object state, Int32 dueTime, Int32 period) at System.Timers.Timer.set_Enabled(Boolean value) at SnappCloud.ActivationReminder.AraClient.PostInit() at SnappCloud.ActivationReminder.Program.Main(String[] args) Error: (09/15/2013 11:50:39 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/13/2013 11:23:25 PM) (Source: Toshiba App Place) (User: ) Description: System.ArgumentOutOfRangeException: Number must be either non-negative and less than or equal to Int32.MaxValue or -1. Parameter name: dueTime Stack Trace: at System.Threading.Timer..ctor(TimerCallback callback, Object state, Int32 dueTime, Int32 period) at System.Timers.Timer.set_Enabled(Boolean value) at SnappCloud.ActivationReminder.AraClient.PostInit() at SnappCloud.ActivationReminder.Program.Main(String[] args) Error: (09/13/2013 11:23:11 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/13/2013 08:32:24 PM) (Source: Toshiba App Place) (User: ) Description: System.ArgumentOutOfRangeException: Number must be either non-negative and less than or equal to Int32.MaxValue or -1. Parameter name: dueTime Stack Trace: at System.Threading.Timer..ctor(TimerCallback callback, Object state, Int32 dueTime, Int32 period) at System.Timers.Timer.set_Enabled(Boolean value) at SnappCloud.ActivationReminder.AraClient.PostInit() at SnappCloud.ActivationReminder.Program.Main(String[] args) Error: (09/13/2013 08:32:01 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/13/2013 07:32:51 AM) (Source: Toshiba App Place) (User: ) Description: System.ArgumentOutOfRangeException: Number must be either non-negative and less than or equal to Int32.MaxValue or -1. Parameter name: dueTime Stack Trace: at System.Threading.Timer..ctor(TimerCallback callback, Object state, Int32 dueTime, Int32 period) at System.Timers.Timer.set_Enabled(Boolean value) at SnappCloud.ActivationReminder.AraClient.PostInit() at SnappCloud.ActivationReminder.Program.Main(String[] args) Error: (09/13/2013 07:32:36 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/12/2013 11:03:42 PM) (Source: Toshiba App Place) (User: ) Description: System.ArgumentOutOfRangeException: Number must be either non-negative and less than or equal to Int32.MaxValue or -1. Parameter name: dueTime Stack Trace: at System.Threading.Timer..ctor(TimerCallback callback, Object state, Int32 dueTime, Int32 period) at System.Timers.Timer.set_Enabled(Boolean value) at SnappCloud.ActivationReminder.AraClient.PostInit() at SnappCloud.ActivationReminder.Program.Main(String[] args) Error: (09/12/2013 11:03:26 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (09/15/2013 00:31:01 PM) (Source: Service Control Manager) (User: ) Description: The WRSVC service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service. Error: (09/15/2013 08:15:15 AM) (Source: DCOM) (User: ) Description: {4EB61BAC-A3B6-4760-9581-655041EF4D69} Error: (09/15/2013 08:14:37 AM) (Source: Service Control Manager) (User: ) Description: The Google Update Service (gupdate) service terminated unexpectedly. It has done this 1 time(s). Error: (09/15/2013 08:14:09 AM) (Source: Service Control Manager) (User: ) Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service. Error: (09/14/2013 06:55:10 PM) (Source: Service Control Manager) (User: ) Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service. Error: (09/14/2013 11:53:31 AM) (Source: Schannel) (User: NT AUTHORITY) Description: The following fatal alert was generated: 40. The internal error state is 252. Error: (09/14/2013 11:53:31 AM) (Source: Schannel) (User: NT AUTHORITY) Description: The following fatal alert was generated: 40. The internal error state is 252. Error: (09/13/2013 10:42:47 PM) (Source: DCOM) (User: ) Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF} Error: (09/13/2013 07:25:09 AM) (Source: DCOM) (User: ) Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} Error: (09/11/2013 10:14:32 PM) (Source: DCOM) (User: ) Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} Microsoft Office Sessions: ========================= Error: (09/15/2013 11:50:58 PM) (Source: Toshiba App Place)(User: ) Description: System.ArgumentOutOfRangeException: Number must be either non-negative and less than or equal to Int32.MaxValue or -1. Parameter name: dueTime Stack Trace: at System.Threading.Timer..ctor(TimerCallback callback, Object state, Int32 dueTime, Int32 period) at System.Timers.Timer.set_Enabled(Boolean value) at SnappCloud.ActivationReminder.AraClient.PostInit() at SnappCloud.ActivationReminder.Program.Main(String[] args) Error: (09/15/2013 11:50:39 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/13/2013 11:23:25 PM) (Source: Toshiba App Place)(User: ) Description: System.ArgumentOutOfRangeException: Number must be either non-negative and less than or equal to Int32.MaxValue or -1. Parameter name: dueTime Stack Trace: at System.Threading.Timer..ctor(TimerCallback callback, Object state, Int32 dueTime, Int32 period) at System.Timers.Timer.set_Enabled(Boolean value) at SnappCloud.ActivationReminder.AraClient.PostInit() at SnappCloud.ActivationReminder.Program.Main(String[] args) Error: (09/13/2013 11:23:11 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/13/2013 08:32:24 PM) (Source: Toshiba App Place)(User: ) Description: System.ArgumentOutOfRangeException: Number must be either non-negative and less than or equal to Int32.MaxValue or -1. Parameter name: dueTime Stack Trace: at System.Threading.Timer..ctor(TimerCallback callback, Object state, Int32 dueTime, Int32 period) at System.Timers.Timer.set_Enabled(Boolean value) at SnappCloud.ActivationReminder.AraClient.PostInit() at SnappCloud.ActivationReminder.Program.Main(String[] args) Error: (09/13/2013 08:32:01 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/13/2013 07:32:51 AM) (Source: Toshiba App Place)(User: ) Description: System.ArgumentOutOfRangeException: Number must be either non-negative and less than or equal to Int32.MaxValue or -1. Parameter name: dueTime Stack Trace: at System.Threading.Timer..ctor(TimerCallback callback, Object state, Int32 dueTime, Int32 period) at System.Timers.Timer.set_Enabled(Boolean value) at SnappCloud.ActivationReminder.AraClient.PostInit() at SnappCloud.ActivationReminder.Program.Main(String[] args) Error: (09/13/2013 07:32:36 AM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/12/2013 11:03:42 PM) (Source: Toshiba App Place)(User: ) Description: System.ArgumentOutOfRangeException: Number must be either non-negative and less than or equal to Int32.MaxValue or -1. Parameter name: dueTime Stack Trace: at System.Threading.Timer..ctor(TimerCallback callback, Object state, Int32 dueTime, Int32 period) at System.Timers.Timer.set_Enabled(Boolean value) at SnappCloud.ActivationReminder.AraClient.PostInit() at SnappCloud.ActivationReminder.Program.Main(String[] args) Error: (09/12/2013 11:03:26 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 CodeIntegrity Errors: =================================== Date: 2013-09-10 05:39:13.858 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-09-10 05:39:13.796 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. ==================== Memory info =========================== Percentage of memory in use: 36% Total physical RAM: 4007.98 MB Available physical RAM: 2558.27 MB Total Pagefile: 8014.14 MB Available Pagefile: 6440.31 MB Total Virtual: 8192 MB Available Virtual: 8191.82 MB ==================== Drives ================================ Drive c: (TI106229W0C) (Fixed) (Total:282.21 GB) (Free:144.28 GB) NTFS ==>[system with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: C010E626) Partition 1: (Active) - (Size=1 GB) - (Type=27) Partition 2: (Not Active) - (Size=282 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=14 GB) - (Type=17) ==================== End Of Log ============================
  4. Addition.txt Hmm it doesn't seem like it found anything. Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-09-2013 Ran by owner (administrator) on OWNER-PC on 15-09-2013 23:51:36 Running from C:\Users\owner\Downloads Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US) Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Webroot) C:\Program Files\Webroot\WRSA.exe () C:\Windows\System32\GFNEXSrv.exe (Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Webroot) C:\Program Files\Webroot\WRSA.exe (Skype Technologies) C:\Program Files (x86)\Skype\Updater\Updater.exe (Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe (TOSHIBA Corporation) C:\windows\system32\TODDSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler64.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\Teco.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (AOL Inc.) C:\Program Files (x86)\AIM\aim.exe (BitTorrent, Inc.) C:\Program Files (x86)\BitTorrent\BitTorrent.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (TOSHIBA Corporation) C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\ToshibaServiceStation.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (Power Software Ltd) C:\Program Files (x86)\ISO\PowerISO\PWRISOVM.EXE (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Microsoft Corporation) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [HotKeysCmds] - C:\windows\system32\hkcmd.exe [ ] () HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [590256 2011-05-17] (TOSHIBA Corporation) HKLM\...\Run: [HSON] - C:\Program Files\TOSHIBA\TBS\HSON.exe [296824 2010-09-25] (TOSHIBA Corporation) HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [972672 2011-04-27] (TOSHIBA Corporation) HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12558440 2011-07-07] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2226280 2011-06-03] (Realtek Semiconductor) HKLM\...\Run: [synTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2679592 2011-02-03] (Synaptics Incorporated) HKLM\...\Run: [Teco] - C:\Program Files\TOSHIBA\TECO\Teco.exe [1544624 2011-05-24] (TOSHIBA Corporation) HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710560 2011-06-10] (TOSHIBA Corporation) HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [712096 2011-07-01] (TOSHIBA Corporation) HKLM\...\Run: [TosVolRegulator] - C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation) HKLM\...\Run: [TosNC] - C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [595816 2010-04-23] (TOSHIBA Corporation) HKLM\...\Run: [TosReelTimeMonitor] - C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38824 2011-06-28] (TOSHIBA Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKLM\...\Policies\Explorer: [NoDevMgrUpdate] 0 HKCU\...\Run: [Aim] - C:\Program Files (x86)\AIM\aim.exe [4321112 2012-02-29] (AOL Inc.) HKCU\...\Run: [bitTorrent] - C:\Program Files (x86)\BitTorrent\BitTorrent.exe [6380400 2012-05-11] (BitTorrent, Inc.) HKCU\...\Run: [skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.) HKCU\...\Run: [PeerBlock] - C:\Program Files\PeerBlock\peerblock.exe [2646128 2010-11-06] (PeerBlock, LLC) HKCU\...\Policies\Explorer: [NoDevMgrUpdate] 0 HKLM-x32\...\Run: [ToshibaServiceStation] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1298816 2011-07-11] (TOSHIBA Corporation) HKLM-x32\...\Run: [ToshibaAppPlace] - C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe [552960 2010-09-23] (Toshiba) HKLM-x32\...\Run: [NortonOnlineBackupReminder] - C:\Program Files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe [3218864 2011-06-22] (Toshiba) HKLM-x32\...\Run: [WRSVC] - C:\Program Files\Webroot\WRSA.exe [740328 2013-06-20] (Webroot) HKLM-x32\...\Run: [PWRISOVM.EXE] - C:\Program Files (x86)\ISO\PowerISO\PWRISOVM.EXE [312376 2011-11-14] (Power Software Ltd) HKLM-x32\...\Run: [ConnectionCenter] - C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [358336 2011-08-11] (Citrix Systems, Inc.) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated) Startup: C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.toshiba.com/?cid=C001B2Y StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Webroot Browser Helper Object - {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} - C:\ProgramData\WRData\pkg\LPBar64.dll (Webroot Software, Inc.) BHO: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\x64\TOSHIBAMediaControllerIE.dll (<TOSHIBA>) BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Webroot Browser Helper Object - {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} - C:\ProgramData\WRData\pkg\LPBar.dll (Webroot Software, Inc.) BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO-x32: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>) Toolbar: HKLM - Webroot Toolbar - {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\ProgramData\WRData\pkg\LPBar64.dll (Webroot Software, Inc.) Toolbar: HKLM-x32 - Webroot Toolbar - {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\ProgramData\WRData\pkg\LPBar.dll (Webroot Software, Inc.) Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - No File Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default FF SelectedSearchEngine: Google FF Homepage: about:home FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll () FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll () FF Plugin-x32: @garmin.com/GpsControl - C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.) FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll () FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Extension: Webroot - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\Extensions\{8ac62a8b-8b3f-43ba-9b1a-90c299b9dfda} FF Extension: Webroot - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\Extensions\{8ac62a8b-8b3f-43ba-9b1a-90c299b9dfda}_deleted FF Extension: einszfeapc - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\Extensions\einszfeapc@einszfeapc.org.xpi FF Extension: No Name - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\Extensions\{7CA9CF31-1C73-46CD-8377-85AB71EA771F}.xpi FF HKLM-x32\...\Firefox\Extensions: [{C7AE725D-FA5C-4027-BB4C-787EF9F8248A}] - C:\Program Files (x86)\RelevantKnowledge\firefox FF StartMenuInternet: FIREFOX.EXE - C:\Users\owner\AppData\Local\Mozilla Firefox\firefox.exe Chrome: ======= Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx CHR HKLM-x32\...\Chrome\Extension: [ngmmcbedgcbfghamlghhpbpifnbhhpik] - C:\Users\owner\AppData\Local\Temp\crxE35.tmp ==================== Services (Whitelisted) ================= S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2011-12-15] (Adobe Systems) R2 GFNEXSrv; C:\Windows\System32\GFNEXSrv.exe [162824 2010-09-09] () S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.) S2 Norton PC Checkup Application Launcher; C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\SymcPCCULaunchSvc.exe [123320 2012-07-27] (Symantec Corporation) R2 PCCUJobMgr; C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe [126392 2011-07-19] (Symantec Corporation) R2 WRSVC; C:\Program Files\Webroot\WRSA.exe [740328 2013-06-20] (Webroot) ==================== Drivers (Whitelisted) ==================== S3 hitmanpro35; C:\windows\system32\drivers\hitmanpro36.sys [27424 2012-03-07] () S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-13] (Brother Industries Ltd.) R0 WRkrn; C:\Windows\System32\drivers\WRkrn.sys [112616 2013-06-20] (Webroot) U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-09-15 23:32 - 2013-09-15 23:32 - 00000000 ____D C:\FRST 2013-09-15 22:07 - 2013-09-15 22:08 - 01951158 _____ (Farbar) C:\Users\owner\Downloads\FRST64.exe 2013-09-13 20:30 - 2013-09-13 20:30 - 00001243 _____ C:\Users\owner\Desktop\AdwCleaner[R2]913.txt 2013-09-11 22:09 - 2013-09-11 22:09 - 00005995 _____ C:\Users\owner\Desktop\AdwCleaner[R0].txt 2013-09-11 20:13 - 2013-09-13 23:27 - 00000000 ____D C:\AdwCleaner 2013-09-10 23:49 - 2013-08-10 01:22 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll 2013-09-10 23:49 - 2013-08-10 01:22 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll 2013-09-10 23:49 - 2013-08-10 01:22 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe 2013-09-10 23:49 - 2013-08-10 01:21 - 19246592 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll 2013-09-10 23:49 - 2013-08-10 01:21 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll 2013-09-10 23:49 - 2013-08-10 01:21 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll 2013-09-10 23:49 - 2013-08-10 01:20 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll 2013-09-10 23:49 - 2013-08-10 01:20 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll 2013-09-10 23:49 - 2013-08-10 01:20 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll 2013-09-10 23:49 - 2013-08-10 01:20 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll 2013-09-10 23:49 - 2013-08-10 01:20 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll 2013-09-10 23:49 - 2013-08-10 01:20 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll 2013-09-10 23:49 - 2013-08-10 01:20 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll 2013-09-10 23:49 - 2013-08-10 01:20 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll 2013-09-10 23:49 - 2013-08-09 23:59 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll 2013-09-10 23:49 - 2013-08-09 23:59 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll 2013-09-10 23:49 - 2013-08-09 23:58 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll 2013-09-10 23:49 - 2013-08-09 23:58 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll 2013-09-10 23:49 - 2013-08-09 23:58 - 02048000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll 2013-09-10 23:49 - 2013-08-09 23:58 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll 2013-09-10 23:49 - 2013-08-09 23:58 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll 2013-09-10 23:49 - 2013-08-09 23:58 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll 2013-09-10 23:49 - 2013-08-09 23:58 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll 2013-09-10 23:49 - 2013-08-09 23:58 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll 2013-09-10 23:49 - 2013-08-09 23:58 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll 2013-09-10 23:49 - 2013-08-09 23:58 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll 2013-09-10 23:49 - 2013-08-09 23:17 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb 2013-09-10 23:49 - 2013-08-09 23:07 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb 2013-09-10 23:49 - 2013-08-09 22:27 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe 2013-09-10 23:49 - 2013-08-09 22:17 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe 2013-09-10 23:48 - 2013-08-09 23:58 - 14332928 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll 2013-09-10 23:31 - 2013-08-07 21:20 - 03155456 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys 2013-09-10 23:31 - 2013-08-04 22:25 - 00155584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ataport.sys 2013-09-10 23:31 - 2013-08-01 22:23 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe 2013-09-10 23:31 - 2013-08-01 22:15 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll 2013-09-10 23:31 - 2013-08-01 22:15 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll 2013-09-10 23:31 - 2013-08-01 22:15 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll 2013-09-10 23:31 - 2013-08-01 22:15 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll 2013-09-10 23:31 - 2013-08-01 22:14 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll 2013-09-10 23:31 - 2013-08-01 22:14 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll 2013-09-10 23:31 - 2013-08-01 22:13 - 01161216 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll 2013-09-10 23:31 - 2013-08-01 22:13 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:59 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe 2013-09-10 23:31 - 2013-08-01 21:59 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe 2013-09-10 23:31 - 2013-08-01 21:51 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll 2013-09-10 23:31 - 2013-08-01 21:50 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll 2013-09-10 23:31 - 2013-08-01 21:50 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll 2013-09-10 23:31 - 2013-08-01 21:50 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 21:09 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe 2013-09-10 23:31 - 2013-08-01 20:59 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe 2013-09-10 23:31 - 2013-08-01 20:45 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe 2013-09-10 23:31 - 2013-08-01 20:45 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll 2013-09-10 23:31 - 2013-08-01 20:45 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe 2013-09-10 23:31 - 2013-08-01 20:45 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe 2013-09-10 23:31 - 2013-08-01 20:43 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 20:43 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 20:43 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll 2013-09-10 23:31 - 2013-08-01 20:43 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll 2013-09-10 23:31 - 2013-07-25 22:24 - 14172672 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll 2013-09-10 23:31 - 2013-07-25 22:24 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\shdocvw.dll 2013-09-10 23:31 - 2013-07-25 21:55 - 12872704 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll 2013-09-10 23:31 - 2013-07-25 21:55 - 00180224 _____ (Microsoft Corporation) C:\windows\SysWOW64\shdocvw.dll 2013-09-10 19:55 - 2013-09-10 19:55 - 01037278 _____ C:\Users\owner\Downloads\AdwCleaner.exe 2013-09-10 05:52 - 2013-09-10 05:52 - 00021904 _____ C:\ComboFix.txt 2013-09-09 22:49 - 2013-09-09 22:49 - 00000000 ____D C:\Users\owner\Documents\ProcAlyzer Dumps 2013-09-08 13:55 - 2011-06-26 02:45 - 00256000 _____ C:\windows\PEV.exe 2013-09-08 13:55 - 2010-11-07 13:20 - 00208896 _____ C:\windows\MBR.exe 2013-09-08 13:55 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe 2013-09-08 13:55 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe 2013-09-08 13:55 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe 2013-09-08 13:55 - 2000-08-30 20:00 - 00098816 _____ C:\windows\sed.exe 2013-09-08 13:55 - 2000-08-30 20:00 - 00080412 _____ C:\windows\grep.exe 2013-09-08 13:55 - 2000-08-30 20:00 - 00068096 _____ C:\windows\zip.exe 2013-09-08 10:03 - 2013-09-10 05:52 - 00000000 ____D C:\Qoobox 2013-09-08 10:03 - 2013-09-10 05:48 - 00000000 ____D C:\windows\erdnt 2013-09-08 10:00 - 2013-09-08 10:00 - 05120615 ____R (Swearware) C:\Users\owner\Downloads\ComboFix.exe 2013-09-07 21:40 - 2013-09-07 22:23 - 746690519 _____ C:\Users\owner\Downloads\prnfle1610x.mp4 2013-09-07 14:08 - 2013-09-07 23:49 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2013-09-07 14:06 - 2013-09-08 07:30 - 00000000 ____D C:\Users\owner\Desktop\mbar 2013-09-05 19:47 - 2013-09-06 20:06 - 00000000 ____D C:\Users\owner\Desktop\RK_Quarantine 2013-09-05 19:40 - 2013-09-05 19:40 - 00688992 ____R (Swearware) C:\Users\owner\Downloads\dds.com 2013-09-05 19:39 - 2013-09-05 19:39 - 03787264 _____ C:\Users\owner\Downloads\RogueKillerX64.exe 2013-09-05 07:29 - 2013-09-15 23:50 - 00002352 _____ C:\windows\setupact.log 2013-09-04 06:56 - 2013-09-07 23:24 - 00003453 _____ C:\Users\owner\Downloads\up.csv 2013-09-03 19:48 - 2013-09-03 19:48 - 00000000 ____D C:\Users\owner\AppData\Roaming\Malwarebytes 2013-09-03 19:47 - 2013-09-03 19:47 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-09-03 19:47 - 2013-09-03 19:47 - 00000000 ____D C:\Program Files (x86)\AntiVirus 2013-09-03 19:47 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys 2013-09-01 22:35 - 2013-09-01 22:35 - 00000306 _____ C:\Users\owner\Downloads\SAV_217.csv 2013-09-01 22:34 - 2013-09-01 22:34 - 00013142 _____ C:\Users\owner\Downloads\CHK_225.csv 2013-09-01 22:34 - 2013-09-01 22:34 - 00000074 _____ C:\Users\owner\Downloads\SAV_309.csv 2013-09-01 22:23 - 2013-09-01 22:23 - 00002451 _____ C:\Users\owner\Downloads\ofx.csv 2013-08-31 23:43 - 2013-09-01 00:01 - 531132104 _____ C:\Users\owner\Downloads\EuroSexParties - Tits And Ass - Chrissy, Roseline Love, Kendra Star.mp4 2013-08-24 11:09 - 2013-08-24 11:09 - 00000000 ____D C:\Users\owner\Downloads\CumFiesta - Valerie White - Call Of Booty SD 2013-08-23 22:44 - 2013-08-24 16:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-08-23 22:44 - 2013-08-23 22:52 - 00001222 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2013-08-23 22:44 - 2013-08-23 22:44 - 00000000 ____D C:\ProgramData\Mozilla 2013-08-22 22:26 - 2013-07-09 01:52 - 00224256 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll 2013-08-22 22:26 - 2013-07-09 01:46 - 01472512 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll 2013-08-22 22:26 - 2013-07-09 01:46 - 00184320 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll 2013-08-22 22:26 - 2013-07-09 01:46 - 00139776 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll 2013-08-22 22:26 - 2013-07-09 00:52 - 00175104 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll 2013-08-22 22:26 - 2013-07-09 00:46 - 01166848 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll 2013-08-22 22:26 - 2013-07-09 00:46 - 00140288 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll 2013-08-22 22:26 - 2013-07-09 00:46 - 00103936 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll 2013-08-22 22:25 - 2013-07-25 05:25 - 01888768 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL 2013-08-22 22:25 - 2013-07-25 04:57 - 01620992 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL 2013-08-22 22:25 - 2013-07-18 21:58 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll 2013-08-22 22:25 - 2013-07-18 21:41 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll 2013-08-22 22:24 - 2013-07-09 01:51 - 01217024 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll 2013-08-22 22:24 - 2013-07-09 00:52 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll 2013-08-22 22:24 - 2013-07-06 02:03 - 01910208 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys 2013-08-22 22:24 - 2013-06-15 00:32 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tssecsrv.sys ==================== One Month Modified Files and Folders ======= 2013-09-15 23:52 - 2011-12-01 01:00 - 00000000 ____D C:\Users\owner\AppData\Roaming\BitTorrent 2013-09-15 23:50 - 2013-09-05 07:29 - 00002352 _____ C:\windows\setupact.log 2013-09-15 23:50 - 2011-09-23 10:35 - 00000908 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-09-15 23:50 - 2009-07-14 01:08 - 00000006 ____H C:\windows\Tasks\SA.DAT 2013-09-15 23:49 - 2011-09-23 10:04 - 01338311 _____ C:\windows\WindowsUpdate.log 2013-09-15 23:47 - 2011-09-23 10:35 - 00000912 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-09-15 23:32 - 2013-09-15 23:32 - 00000000 ____D C:\FRST 2013-09-15 23:32 - 2011-11-30 10:41 - 00000000 ____D C:\ProgramData\WRData 2013-09-15 23:31 - 2013-05-30 06:18 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job 2013-09-15 22:10 - 2009-07-14 01:13 - 00744730 _____ C:\windows\system32\PerfStringBackup.INI 2013-09-15 22:08 - 2013-09-15 22:07 - 01951158 _____ (Farbar) C:\Users\owner\Downloads\FRST64.exe 2013-09-15 13:38 - 2012-03-22 18:17 - 00000000 ____D C:\Users\owner\AppData\Roaming\Skype 2013-09-14 00:31 - 2013-05-30 06:18 - 00003768 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater 2013-09-14 00:31 - 2013-03-10 15:56 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe 2013-09-14 00:31 - 2011-07-26 23:34 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-09-13 23:30 - 2009-07-14 00:45 - 00024608 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-09-13 23:30 - 2009-07-14 00:45 - 00024608 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-09-13 23:27 - 2013-09-11 20:13 - 00000000 ____D C:\AdwCleaner 2013-09-13 20:30 - 2013-09-13 20:30 - 00001243 _____ C:\Users\owner\Desktop\AdwCleaner[R2]913.txt 2013-09-13 08:05 - 2009-07-13 23:20 - 00000000 ____D C:\windows\rescache 2013-09-11 22:09 - 2013-09-11 22:09 - 00005995 _____ C:\Users\owner\Desktop\AdwCleaner[R0].txt 2013-09-11 06:49 - 2011-11-30 06:35 - 00000000 ___RD C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-09-11 06:49 - 2011-11-30 06:35 - 00000000 ___RD C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2013-09-11 06:49 - 2009-07-14 00:45 - 00294200 _____ C:\windows\system32\FNTCACHE.DAT 2013-09-10 23:48 - 2013-07-15 06:49 - 00000000 ____D C:\windows\system32\MRT 2013-09-10 23:48 - 2011-12-01 03:20 - 00761426 _____ C:\windows\SysWOW64\PerfStringBackup.INI 2013-09-10 23:48 - 2011-12-01 03:20 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client 2013-09-10 23:43 - 2011-11-30 10:46 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2013-09-10 19:55 - 2013-09-10 19:55 - 01037278 _____ C:\Users\owner\Downloads\AdwCleaner.exe 2013-09-10 05:52 - 2013-09-10 05:52 - 00021904 _____ C:\ComboFix.txt 2013-09-10 05:52 - 2013-09-08 10:03 - 00000000 ____D C:\Qoobox 2013-09-10 05:48 - 2013-09-08 10:03 - 00000000 ____D C:\windows\erdnt 2013-09-10 05:43 - 2010-11-20 23:47 - 00720232 _____ C:\windows\PFRO.log 2013-09-10 05:43 - 2009-07-13 22:34 - 00000215 _____ C:\windows\system.ini 2013-09-10 05:42 - 2009-07-13 22:34 - 60555264 _____ C:\windows\system32\config\software.bak 2013-09-10 05:42 - 2009-07-13 22:34 - 44040192 _____ C:\windows\system32\config\components.bak 2013-09-10 05:42 - 2009-07-13 22:34 - 19660800 _____ C:\windows\system32\config\system.bak 2013-09-10 05:42 - 2009-07-13 22:34 - 01048576 _____ C:\windows\system32\config\default.bak 2013-09-10 05:42 - 2009-07-13 22:34 - 00262144 _____ C:\windows\system32\config\security.bak 2013-09-10 05:42 - 2009-07-13 22:34 - 00262144 _____ C:\windows\system32\config\sam.bak 2013-09-09 22:51 - 2009-07-14 01:08 - 00032580 _____ C:\windows\Tasks\SCHEDLGU.TXT 2013-09-09 22:49 - 2013-09-09 22:49 - 00000000 ____D C:\Users\owner\Documents\ProcAlyzer Dumps 2013-09-09 22:49 - 2012-02-13 13:03 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-09-08 23:39 - 2011-12-01 03:21 - 00000000 ____D C:\Users\owner\AppData\Roaming\SoftGrid Client 2013-09-08 10:01 - 2013-08-03 21:33 - 00003168 _____ C:\Users\owner\Desktop\net.txt 2013-09-08 10:00 - 2013-09-08 10:00 - 05120615 ____R (Swearware) C:\Users\owner\Downloads\ComboFix.exe 2013-09-08 07:30 - 2013-09-07 14:06 - 00000000 ____D C:\Users\owner\Desktop\mbar 2013-09-07 23:49 - 2013-09-07 14:08 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2013-09-07 23:24 - 2013-09-04 06:56 - 00003453 _____ C:\Users\owner\Downloads\up.csv 2013-09-07 22:23 - 2013-09-07 21:40 - 746690519 _____ C:\Users\owner\Downloads\prnfle1610x.mp4 2013-09-07 22:01 - 2012-09-30 17:49 - 00000000 ____D C:\Users\owner\AppData\Roaming\vlc 2013-09-07 14:06 - 2011-11-30 22:15 - 00000000 ____D C:\Files 2013-09-06 23:37 - 2011-09-23 10:36 - 00000000 ____D C:\Program Files\Google 2013-09-06 23:37 - 2011-09-23 10:35 - 00000000 ____D C:\Program Files (x86)\Google 2013-09-06 23:00 - 2011-11-30 22:12 - 00000000 ____D C:\Users\owner\AppData\Local\Google 2013-09-06 23:00 - 2011-09-23 10:28 - 00000000 ____D C:\ProgramData\Google 2013-09-06 20:06 - 2013-09-05 19:47 - 00000000 ____D C:\Users\owner\Desktop\RK_Quarantine 2013-09-05 19:40 - 2013-09-05 19:40 - 00688992 ____R (Swearware) C:\Users\owner\Downloads\dds.com 2013-09-05 19:39 - 2013-09-05 19:39 - 03787264 _____ C:\Users\owner\Downloads\RogueKillerX64.exe 2013-09-03 21:10 - 2012-03-05 18:44 - 00000000 ____D C:\Users\owner\AppData\Local\Tific 2013-09-03 19:48 - 2013-09-03 19:48 - 00000000 ____D C:\Users\owner\AppData\Roaming\Malwarebytes 2013-09-03 19:47 - 2013-09-03 19:47 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-09-03 19:47 - 2013-09-03 19:47 - 00000000 ____D C:\Program Files (x86)\AntiVirus 2013-09-01 22:35 - 2013-09-01 22:35 - 00000306 _____ C:\Users\owner\Downloads\SAV_217.csv 2013-09-01 22:34 - 2013-09-01 22:34 - 00013142 _____ C:\Users\owner\Downloads\CHK_225.csv 2013-09-01 22:34 - 2013-09-01 22:34 - 00000074 _____ C:\Users\owner\Downloads\SAV_309.csv 2013-09-01 22:23 - 2013-09-01 22:23 - 00002451 _____ C:\Users\owner\Downloads\ofx.csv 2013-09-01 00:01 - 2013-08-31 23:43 - 531132104 _____ C:\Users\owner\Downloads\EuroSexParties - Tits And Ass - Chrissy, Roseline Love, Kendra Star.mp4 2013-08-31 09:36 - 2013-06-01 17:35 - 00000000 ____D C:\Users\owner\AppData\Local\{6984B620-46F5-4BC0-98D5-73073495CC9F} 2013-08-24 16:19 - 2013-08-23 22:44 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-08-24 11:09 - 2013-08-24 11:09 - 00000000 ____D C:\Users\owner\Downloads\CumFiesta - Valerie White - Call Of Booty SD 2013-08-23 22:52 - 2013-08-23 22:44 - 00001222 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2013-08-23 22:52 - 2013-08-07 22:28 - 00000000 ____D C:\Users\owner\AppData\Local\Mozilla Firefox 2013-08-23 22:44 - 2013-08-23 22:44 - 00000000 ____D C:\ProgramData\Mozilla 2013-08-23 01:01 - 2013-07-02 21:47 - 00000000 ____D C:\Users\owner\AppData\Local\Mozilla Firefox.bak 2013-08-23 01:01 - 2013-03-10 15:56 - 00000000 ____D C:\ProgramData\McAfee Security Scan 2013-08-23 01:01 - 2011-11-30 10:41 - 00000000 ____D C:\Program Files\Webroot 2013-08-23 01:01 - 2009-07-13 23:20 - 00000000 ____D C:\windows\AppCompat 2013-08-23 01:01 - 2009-07-13 23:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared 2013-08-23 01:00 - 2009-07-13 23:20 - 00000000 ____D C:\windows\registration 2013-08-23 00:57 - 2011-12-01 10:34 - 00000000 ___RD C:\MSOCache 2013-08-22 22:10 - 2011-11-30 06:34 - 00000000 ____D C:\Users\owner 2013-08-19 06:56 - 2011-12-01 18:27 - 00000000 ____D C:\Users\owner\AppData\Local\CrashDumps Some content of TEMP: ==================== C:\Users\owner\AppData\Local\Temp\DefaultAssets.exe C:\Users\owner\AppData\Local\Temp\NLStubInstallerResources.dll ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Windows\system64 LastRegBack: 2013-09-11 20:34 ==================== End Of Log ============================
  5. Just Firefox 23.0.1, which I recently upgraded to. IE doesn't give me problems, though I use it less.
  6. Oh I thought I replied. It looks like there is still an issue. I cleaned up the files but it looks like two directories came back. It's frustrating because it seems minor, I had to click on three search links before I was redirected to a spam site, but it won't go away. Most recent search. thanks. # AdwCleaner v3.003 - Report created 13/09/2013 at 20:29:55 # Updated 07/09/2013 by Xplode # Operating System : Windows 7 Home Premium Service Pack 1 (64 bits) # Username : owner - OWNER-PC # Running from : C:\Users\owner\Downloads\AdwCleaner.exe # Option : Scan ***** [ Services ] ***** ***** [ Files / Folders ] ***** Folder Found C:\Users\owner\AppData\Local\Temp\boost_interprocess Folder Found C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\jetpack ***** [ Shortcuts ] ***** ***** [ Registry ] ***** ***** [ Browsers ] ***** -\\ Internet Explorer v10.0.9200.16686 -\\ Mozilla Firefox v23.0.1 (en-US) [ File : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\prefs.js ] -\\ Google Chrome v29.0.1547.66 [ File : C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [5995 octets] - [11/09/2013 20:13:56] AdwCleaner[R1].txt - [6055 octets] - [12/09/2013 20:15:03] AdwCleaner[R2].txt - [1043 octets] - [13/09/2013 20:29:55] AdwCleaner[s0].txt - [6180 octets] - [12/09/2013 20:15:56] ########## EOF - C:\AdwCleaner\AdwCleaner[R2].txt - [1163 octets] ##########
  7. Hi, Here is the log file. I am not sure if any legit or not. I did install BitTorrent but not sure about the tool bar. Any insight? # AdwCleaner v3.003 - Report created 11/09/2013 at 20:13:56 # Updated 07/09/2013 by Xplode # Operating System : Windows 7 Home Premium Service Pack 1 (64 bits) # Username : owner - OWNER-PC # Running from : C:\Users\owner\Downloads\AdwCleaner.exe # Option : Scan ***** [ Services ] ***** ***** [ Files / Folders ] ***** File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.xpt File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.xpt File Found : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\user.js Folder Found C:\Program Files (x86)\BitTorrentBar2 Folder Found C:\Program Files (x86)\Common Files\Software Update Utility Folder Found C:\Program Files (x86)\Conduit Folder Found C:\Users\owner\AppData\Local\Conduit Folder Found C:\Users\owner\AppData\Local\Temp\boost_interprocess Folder Found C:\Users\owner\AppData\LocalLow\BitTorrentBar2 Folder Found C:\Users\owner\AppData\LocalLow\Conduit Folder Found C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\jetpack ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Found : HKCU\Software\APN PIP Key Found : HKCU\Software\AppDataLow\Software\BitTorrentBar2 Key Found : HKCU\Software\AppDataLow\Software\Conduit Key Found : HKCU\Software\AppDataLow\Toolbar Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{656461EF-40F6-4115-9FF1-BCED9812CCBB} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{656461EF-40F6-4115-9FF1-BCED9812CCBB} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Key Found : HKCU\Software\PIP Key Found : [x64] HKCU\Software\APN PIP Key Found : [x64] HKCU\Software\PIP Key Found : HKLM\Software\BitTorrentBar2 Key Found : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1} Key Found : HKLM\SOFTWARE\Classes\AppID\dnu.EXE Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Found : HKLM\SOFTWARE\Classes\CLSID\{656461EF-40F6-4115-9FF1-BCED9812CCBB} Key Found : HKLM\SOFTWARE\Classes\CLSID\{70B469C4-47B1-48BD-8149-D2749E4B8832} Key Found : HKLM\SOFTWARE\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96} Key Found : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D} Key Found : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Key Found : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468} Key Found : HKLM\SOFTWARE\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70} Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Key Found : HKLM\SOFTWARE\Classes\dnUpdate Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1 Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1 Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Found : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5} Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Found : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90} Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3045275 Key Found : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Found : HKLM\Software\Conduit Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\mkndcbhcgphcfkkddanakjiepeknbgle Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2D4A786A-FC70-4829-8D28-F89C16EDC873} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D855E4C2-57F2-4CA7-A7C3-6D32CBC3BF69} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{656461EF-40F6-4115-9FF1-BCED9812CCBB} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{70B469C4-47B1-48BD-8149-D2749E4B8832} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BitTorrentBar2 Toolbar Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility Key Found : HKLM\Software\PIP Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{656461EF-40F6-4115-9FF1-BCED9812CCBB}] Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{656461EF-40F6-4115-9FF1-BCED9812CCBB}] Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{656461EF-40F6-4115-9FF1-BCED9812CCBB}] Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{656461EF-40F6-4115-9FF1-BCED9812CCBB}] ***** [ Browsers ] ***** -\\ Internet Explorer v10.0.9200.16686 -\\ Mozilla Firefox v23.0.1 (en-US) [ File : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\prefs.js ] -\\ Google Chrome v29.0.1547.66 [ File : C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [5847 octets] - [11/09/2013 20:13:56] ########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [5907 octets] ########## Thanks.
  8. No, it still seems to occur. Though I did about 5 searches and clicked on 5 links before I got a redirect issue, so it doesn't happen every time. I should mention I had some issues with ComboFix running with Spybot in the background, but I finally uninstalled and then was able to run CF fully this time. Here is the log. thanks. ComboFix 13-09-06.01 - owner 09/09/2013 22:59:02.2.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4008.2711 [GMT -4:00] Running from: c:\users\owner\Downloads\ComboFix.exe AV: Webroot SecureAnywhere *Disabled/Updated* {9C0666FC-6C7D-3E97-3C40-0C6B33FC7401} SP: Webroot SecureAnywhere *Disabled/Updated* {27678718-4A47-3119-06F0-3719487B3EBC} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\wininit.ini . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Service_RelevantKnowledge . . ((((((((((((((((((((((((( Files Created from 2013-08-10 to 2013-09-10 ))))))))))))))))))))))))))))))) . . 2013-09-10 09:40 . 2013-09-10 09:40 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-09-07 18:08 . 2013-09-08 03:49 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable) 2013-09-03 23:48 . 2013-09-03 23:48 -------- d-----w- c:\users\owner\AppData\Roaming\Malwarebytes 2013-09-03 23:47 . 2013-09-03 23:47 -------- d-----w- c:\programdata\Malwarebytes 2013-09-03 23:47 . 2013-04-04 18:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys 2013-09-03 23:47 . 2013-09-03 23:47 -------- d-----w- c:\program files (x86)\AntiVirus 2013-08-27 00:51 . 2013-07-09 05:03 3913664 ----a-w- c:\windows\SysWow64\ntoskrnl.exe 2013-08-27 00:51 . 2013-07-09 05:03 3968960 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe 2013-08-27 00:51 . 2013-07-09 04:53 1292192 ----a-w- c:\windows\SysWow64\ntdll.dll 2013-08-27 00:51 . 2013-07-09 04:52 5120 ----a-w- c:\windows\SysWow64\wow32.dll 2013-08-27 00:51 . 2013-07-09 02:49 25600 ----a-w- c:\windows\SysWow64\setup16.exe 2013-08-27 00:51 . 2013-07-09 02:49 7680 ----a-w- c:\windows\SysWow64\instnm.exe 2013-08-27 00:51 . 2013-07-09 02:49 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll 2013-08-27 00:51 . 2013-07-09 02:49 2048 ----a-w- c:\windows\SysWow64\user.exe 2013-08-27 00:51 . 2013-07-09 05:53 243712 ----a-w- c:\windows\system32\wow64.dll 2013-08-27 00:51 . 2013-07-09 06:03 5550528 ----a-w- c:\windows\system32\ntoskrnl.exe 2013-08-27 00:51 . 2013-07-09 05:54 1732032 ----a-w- c:\windows\system32\ntdll.dll 2013-08-24 02:44 . 2013-08-24 20:19 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service 2013-08-23 02:26 . 2013-07-09 05:52 224256 ----a-w- c:\windows\system32\wintrust.dll 2013-08-23 02:26 . 2013-07-09 05:46 184320 ----a-w- c:\windows\system32\cryptsvc.dll 2013-08-23 02:26 . 2013-07-09 05:46 1472512 ----a-w- c:\windows\system32\crypt32.dll 2013-08-23 02:26 . 2013-07-09 05:46 139776 ----a-w- c:\windows\system32\cryptnet.dll 2013-08-23 02:26 . 2013-07-09 04:52 175104 ----a-w- c:\windows\SysWow64\wintrust.dll 2013-08-23 02:26 . 2013-07-09 04:46 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll 2013-08-23 02:26 . 2013-07-09 04:46 1166848 ----a-w- c:\windows\SysWow64\crypt32.dll 2013-08-23 02:26 . 2013-07-09 04:46 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll 2013-08-23 02:25 . 2013-07-19 01:58 2048 ----a-w- c:\windows\system32\tzres.dll 2013-08-23 02:25 . 2013-07-19 01:41 2048 ----a-w- c:\windows\SysWow64\tzres.dll 2013-08-23 02:25 . 2013-07-25 09:25 1888768 ----a-w- c:\windows\system32\WMVDECOD.DLL 2013-08-23 02:25 . 2013-07-25 08:57 1620992 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL 2013-08-23 02:24 . 2013-07-09 05:51 1217024 ----a-w- c:\windows\system32\rpcrt4.dll 2013-08-23 02:24 . 2013-07-09 04:52 663552 ----a-w- c:\windows\SysWow64\rpcrt4.dll 2013-08-23 02:24 . 2013-06-15 04:32 39936 ----a-w- c:\windows\system32\drivers\tssecsrv.sys 2013-08-23 02:24 . 2013-07-06 06:03 1910208 ----a-w- c:\windows\system32\drivers\tcpip.sys . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-08-23 23:31 . 2013-03-10 19:56 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-08-23 23:31 . 2011-07-27 03:34 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-08-23 04:07 . 2011-11-30 14:46 78161360 ----a-w- c:\windows\system32\MRT.exe 2013-07-14 04:07 . 2013-07-14 04:07 0 ----a-w- c:\windows\SysWow64\sho70BA.tmp 2013-07-09 04:45 . 2013-08-27 00:51 44032 ----a-w- c:\windows\apppatch\acwow64.dll 2013-06-21 02:04 . 2011-11-30 14:41 102792 ----a-w- c:\windows\system32\WRusr.dll 2013-06-21 02:04 . 2011-11-30 14:41 150160 ----a-w- c:\windows\SysWow64\WRusr.dll 2013-06-21 02:04 . 2011-11-30 14:41 112616 ----a-w- c:\windows\system32\drivers\WRkrn.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{656461ef-40f6-4115-9ff1-bced9812ccbb}"= "c:\program files (x86)\BitTorrentBar2\prxtbBitT.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{656461ef-40f6-4115-9ff1-bced9812ccbb}] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{656461ef-40f6-4115-9ff1-bced9812ccbb}] 2011-05-09 09:49 176936 ----a-w- c:\program files (x86)\BitTorrentBar2\prxtbBitT.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{656461ef-40f6-4115-9ff1-bced9812ccbb}"= "c:\program files (x86)\BitTorrentBar2\prxtbBitT.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{656461ef-40f6-4115-9ff1-bced9812ccbb}] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Aim"="c:\program files (x86)\AIM\aim.exe" [2012-02-29 4321112] "BitTorrent"="c:\program files (x86)\BitTorrent\BitTorrent.exe" [2012-05-11 6380400] "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-04-19 18678376] "PeerBlock"="c:\program files\PeerBlock\peerblock.exe" [2010-11-07 2646128] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2011-07-12 1298816] "ToshibaAppPlace"="c:\program files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe" [2010-09-23 552960] "NortonOnlineBackupReminder"="c:\program files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe" [2011-06-22 3218864] "WRSVC"="c:\program files\Webroot\WRSA.exe" [2013-06-21 740328] "PWRISOVM.EXE"="c:\program files (x86)\ISO\PowerISO\PWRISOVM.EXE" [2011-11-15 312376] "ConnectionCenter"="c:\program files (x86)\Citrix\ICA Client\concentr.exe" [2011-08-11 358336] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576] . c:\users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe [2013-2-5 272248] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoDevMgrUpdate"= 0 (0x0) . [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDevMgrUpdate"= 0 (0x0) . [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDevMgrUpdate"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux1"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x] R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x] R3 hitmanpro35;Hitman Pro 3.5 Support Driver;c:\windows\system32\drivers\hitmanpro36.sys;c:\windows\SYSNATIVE\drivers\hitmanpro36.sys [x] R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe;c:\program files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [x] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x] R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [x] R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [x] R3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x] S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys;c:\windows\SYSNATIVE\DRIVERS\tos_sps64.sys [x] S0 WRkrn;WRkrn;c:\windows\System32\drivers\WRkrn.sys;c:\windows\SYSNATIVE\drivers\WRkrn.sys [x] S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys;c:\windows\SYSNATIVE\DRIVERS\ctxusbm.sys [x] S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x] S2 GFNEXSrv;GFNEX Service;c:\windows\System32\GFNEXSrv.exe;c:\windows\SYSNATIVE\GFNEXSrv.exe [x] S2 Norton PC Checkup Application Launcher;Toshiba Laptop Checkup Application Launcher;c:\program files (x86)\Norton PC Checkup\Engine\2.0.13.11\SymcPCCULaunchSvc.exe;c:\program files (x86)\Norton PC Checkup\Engine\2.0.13.11\SymcPCCULaunchSvc.exe [x] S2 PCCUJobMgr;Common Client Job Manager Service;c:\program files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe;c:\program files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe [x] S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x] S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe;c:\program files\TOSHIBA\TECO\TecoService.exe [x] S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys;c:\windows\SYSNATIVE\DRIVERS\TVALZFL.sys [x] S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [x] S2 WRSVC;WRSVC;c:\program files\Webroot\WRSA.exe;c:\program files\Webroot\WRSA.exe [x] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x] S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys;c:\windows\SYSNATIVE\DRIVERS\pgeffect.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x] S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys;c:\windows\SYSNATIVE\DRIVERS\rtl8192Ce.sys [x] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2013-09-07 17:50 1177552 ----a-w- c:\program files (x86)\Google\Chrome\Application\29.0.1547.66\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2013-09-10 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-10 23:31] . 2013-09-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-23 14:35] . 2013-09-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-23 14:35] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-08 167256] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-08 391000] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-08 418136] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-07-07 12558440] "RtHDVBg_Dolby"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-06-03 2226280] "TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2011-06-10 710560] "TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376] . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = <local> TCP: DhcpNameServer = 192.168.2.1 FF - ProfilePath - c:\users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - about:home FF - user.js: extensions.autoDisableScopes - 14 FF - user.js: security.csp.enable - false . . ------- File Associations ------- . inifile=%SystemRoot%\SysWow64\NOTEPAD.EXE %1 JSEFile="%SystemRoot%\System32\WScript.exe" "%1" %* txtfile=%SystemRoot%\SysWow64\NOTEPAD.EXE %1 . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Wow6432Node-HKLM-Run-TSleepSrv - %ProgramFiles(x86)%\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start Toolbar-Locked - (no file) WebBrowser-{656461EF-40F6-4115-9FF1-BCED9812CCBB} - (no file) HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE HKLM-Run-HSON - c:\program files (x86)\TOSHIBA\TBS\HSON.exe HKLM-Run-TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe HKLM-Run-Teco - c:\program files (x86)\TOSHIBA\TECO\Teco.exe HKLM-Run-TosWaitSrv - c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe HKLM-Run-TosNC - c:\program files (x86)\Toshiba\BulletinBoard\TosNcCore.exe HKLM-Run-TosReelTimeMonitor - c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCCUJobMgr] "ImagePath"="\"c:\program files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe\" /s \"PCCUJobMgr\" /m \"c:\program files (x86)\Norton PC Checkup\Engine\2.0.13.11\diMaster.dll\" /prefetch:1" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe c:\program files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler.exe c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe . ************************************************************************** . Completion time: 2013-09-10 05:52:25 - machine was rebooted ComboFix-quarantined-files.txt 2013-09-10 09:52 . Pre-Run: 159,027,634,176 bytes free Post-Run: 158,514,810,880 bytes free . - - End Of File - - 4BC8DB43EECAA837D867A1FB118E907A
  9. Malwarebytes Anti-Rootkit BETA 1.07.0.1005 www.malwarebytes.org Database version: v2013.09.07.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16660 owner :: OWNER-PC [administrator] 9/7/2013 2:08:31 PM mbar-log-2013-09-07 (14-08-31).txt Scan type: Quick scan Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken Scan options disabled: Objects scanned: 241339 Time elapsed: 37 minute(s), 35 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) Physical Sectors Detected: 0 (No malicious items detected) (end)
  10. It looks like the iglhsip32 issue has been fixed and Malware results show no issues. However, I am still getting occasional redirects to random search sites when using Firefox and searching with Yahoo. I don't use IE much and it doesn't seem to be affected. fixdamage.exe was run. Some things: I recently installed a new Firefox, on 8/23. This might be related to a program called "Spyhunter" based on some of the sites I am redirected to. About a week ago I got a Webroot Secure Anywhere messages saying "Warning: meviodisplayads.com (contains malicious content.) This website contains a known threat and has been blocked, but I am not clear as to why I'd be getting that message based on the sites I was on when the message appeared. About a week ago I got a McAfee message saying harmful websites, "These websites you visited put your security at risk, psych.ly" Any other ideas?
  11. The log files are attached. It does look like I am still having issues. While searching online on Yahoo, it looks like I get redirected to random search sites, despite clicking on what appears to be legitimate links. Thanks. dds.txt attach.txt RKreport0_S_09052013_195051.txt
  12. Hi, I recently used Malwarebytes and it seemed to take care of some issues. However, whenever I start my computer I get the message: "RegSvr32 The Module "C:\Users\owner\AppData\Local\Tific\iglhsip32.dll failed to load. Make sure the binary is stored at the specified path or debug to check for problems with the binary or dependent .DLL files. The specified module could not be found." It doesn't appear to affect my computer, atleast not in any way I can see (ie my internet seems to work fine, no problems with programs crashing, etc) I am guessing it has to do with this line from the scan: C:\Users\owner\AppData\Local\Tific\iglhsip32.dll (VirTool.Vbcrypt) -> Delete on reboot. Any input on what the issue is/how to fix would be appreciated. Here is the full scan txt: Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.09.03.08 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16660 owner :: OWNER-PC [administrator] 9/3/2013 7:49:10 PM mbam-log-2013-09-03 (19-49-10).txt Scan type: Full scan (C:\|Q:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 387691 Time elapsed: 1 hour(s), 13 minute(s), 50 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 1 C:\Users\owner\AppData\Local\Tific\iglhsip32.dll (VirTool.Vbcrypt) -> Delete on reboot. Registry Keys Detected: 1 HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Quarantined and deleted successfully. Registry Values Detected: 1 HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Data: zr1E1EtGtDtH1O1K1L1KtI0JtH0R -> Quarantined and deleted successfully. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 4 C:\Users\owner\AppData\Roaming\Remote (Trojan.Agent) -> Quarantined and deleted successfully. C:\ProgramData\Tarma Installer (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully. C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96} (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully. C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Cache (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully. Files Detected: 15 C:\Users\owner\AppData\Local\Tific\iglhsip32.dll (VirTool.Vbcrypt) -> Delete on reboot. C:\Users\owner\AppData\Roaming\Remote\n1je.dat (Trojan.Agent) -> Quarantined and deleted successfully. C:\Users\owner\AppData\Roaming\Remote\cg1f.dat (Trojan.Agent) -> Quarantined and deleted successfully. C:\Users\owner\AppData\Roaming\Remote\ffcd (Trojan.Agent) -> Quarantined and deleted successfully. C:\Users\owner\AppData\Roaming\Remote\mxd1.txt (Trojan.Agent) -> Quarantined and deleted successfully. C:\Users\owner\AppData\Roaming\Remote\pr5_shrd (Trojan.Agent) -> Quarantined and deleted successfully. C:\Users\owner\AppData\Roaming\Remote\r1g.dat (Trojan.Agent) -> Quarantined and deleted successfully. C:\Users\owner\AppData\Roaming\Remote\ulcim (Trojan.Agent) -> Quarantined and deleted successfully. C:\Users\owner\AppData\Roaming\Remote\x1nre.dat (Trojan.Agent) -> Quarantined and deleted successfully. C:\Windows\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Setup.dat (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully. C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Setup.exe (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully. C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Setup.ico (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully. C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setup.dll (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully. C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setupx.dll (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully. (end)
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.