Jump to content

iglhsip32.dll failed to load message


Recommended Posts

Hi,

 

I recently used Malwarebytes and it seemed to take care of some issues.  However, whenever I start my computer I get the message:

 

"RegSvr32
The Module
"C:\Users\owner\AppData\Local\Tific\iglhsip32.dll failed to load.
Make sure the binary is stored at the specified path or debug to check for problems with the binary or dependent .DLL files.
The specified module could not be found."

 

It doesn't appear to affect my computer, atleast not in any way I can see (ie my internet seems to work fine, no problems with programs crashing, etc)

 

I am guessing it has to do with this line from the scan:
C:\Users\owner\AppData\Local\Tific\iglhsip32.dll (VirTool.Vbcrypt) -> Delete on reboot.

 

Any input on what the issue is/how to fix would be appreciated.

 

Here is the full scan txt:

 

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.09.03.08

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16660
owner :: OWNER-PC [administrator]

9/3/2013 7:49:10 PM
mbam-log-2013-09-03 (19-49-10).txt

Scan type: Full scan (C:\|Q:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 387691
Time elapsed: 1 hour(s), 13 minute(s), 50 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 1
C:\Users\owner\AppData\Local\Tific\iglhsip32.dll (VirTool.Vbcrypt) -> Delete on reboot.

Registry Keys Detected: 1
HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Quarantined and deleted successfully.

Registry Values Detected: 1
HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Data: zr1E1EtGtDtH1O1K1L1KtI0JtH0R -> Quarantined and deleted successfully.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 4
C:\Users\owner\AppData\Roaming\Remote (Trojan.Agent) -> Quarantined and deleted successfully.
C:\ProgramData\Tarma Installer (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully.
C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96} (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully.
C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Cache (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully.

Files Detected: 15
C:\Users\owner\AppData\Local\Tific\iglhsip32.dll (VirTool.Vbcrypt) -> Delete on reboot.
C:\Users\owner\AppData\Roaming\Remote\n1je.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\owner\AppData\Roaming\Remote\cg1f.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\owner\AppData\Roaming\Remote\ffcd (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\owner\AppData\Roaming\Remote\mxd1.txt (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\owner\AppData\Roaming\Remote\pr5_shrd (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\owner\AppData\Roaming\Remote\r1g.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\owner\AppData\Roaming\Remote\ulcim (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\owner\AppData\Roaming\Remote\x1nre.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Setup.dat (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully.
C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Setup.exe (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully.
C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\Setup.ico (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully.
C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setup.dll (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully.
C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setupx.dll (PUP.Optional.Tarma.A) -> Quarantined and deleted successfully.

(end)

Link to post
Share on other sites

Welcome to the forum, please start HERE
Post back the 2 logs here.....DDS.txt and Attach.txt
(please don't put logs in code or quotes)

P2P/Piracy Warning:

1. If you're using Peer 2 Peer software such uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
2. If you have illegal/cracked software, cracks, keygens, Adobe host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy.
Failure to remove such software will result in your topic being closed and no further assistance being provided.


<====><====><====><====><====><====><====><====>

Next................

Please download and run RogueKiller 32 bit to your desktop.

RogueKiller<---use this one for 64 bit systems

Quit all running programs.

For Windows XP, double-click to start.
For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.


Click Scan to scan the system.
When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.
(please don't put logs in code or quotes)
MrC


Note:
Please read all of my instructions completely including these.

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly


Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive


<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.


<+>The removal of malware isn't instantaneous, please be patient.


<+>When we are done, I'll give to instructions on how to cleanup all the tools and logs


<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.


------->Your topic will be closed if you haven't replied within 3 days!<--------
(If I don't respond within 24 hours, please send me a PM)

Link to post
Share on other sites

Run RogueKiller again and click Scan

When the scan completes > click on the Registry tab

Put a check next to all of these and uncheck the rest: (if found)

 

[RUN][sUSP PATH] HKCU\[...]\Run : Mozilla (rundll32 "C:\Users\owner\AppData\Local\{6984B620-46F5-4BC0-98D5-73073495CC9F}\Mozilla\jimpmhgo.dll",DllRegisterServer [x][-][x]) -> FOUND

[RUN][sUSP PATH] HKCU\[...]\Run : Tific Update (regsvr32.exe C:\Users\owner\AppData\Local\Tific\iglhsip32.dll [x][x]) -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-3452899927-2547884897-355902324-1000\[...]\Run : Mozilla (rundll32 "C:\Users\owner\AppData\Local\{6984B620-46F5-4BC0-98D5-73073495CC9F}\Mozilla\jimpmhgo.dll",DllRegisterServer [x][-][x]) -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-3452899927-2547884897-355902324-1000\[...]\Run : Tific Update (regsvr32.exe C:\Users\owner\AppData\Local\Tific\iglhsip32.dll [x][x]) -> FOUND

Now click Delete on the right hand column under Options

-------------

Next click on the Processes tab and put a check next to these and uncheck the rest. (if found)

 

[sUSP PATH][DLL] rundll32.exe -- C:\Users\owner\AppData\Local\{6984B620-46F5-4BC0-98D5-73073495CC9F}\Mozilla\jimpmhgo.dll [-] -> rundll32.exe KILLED [TermProc]

[sUSP PATH][DLL] rundll32.exe -- C:\Users\owner\AppData\Local\{6984B620-46F5-4BC0-98D5-73073495CC9F}\Mozilla\jimpmhgo.dll [-] -> rundll32.exe KILLED [TermProc]

Now click Delete on the right hand column under Options

-------------

    • Unzip the contents to a folder in a convenient location.
    • Open the folder where the contents were unzipped and run mbar.exe
    • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
    • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
    • Wait while the system shuts down and the cleanup process is performed.
    • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
    • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

To attach a log if needed:

Bottom right corner of this page.

reply1.jpg

New window that comes up.

replyer1.jpg

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot. It's located in the Plugins folder which is in the MBAR folder.

Just run fixdamage.exe.

Verify that they are now functioning normally.

MrC

Link to post
Share on other sites

It looks like the iglhsip32 issue has been fixed and Malware results show no issues.
However, I am still getting occasional redirects to random search sites when using Firefox and searching with Yahoo.  I don't use IE much and it doesn't seem to be affected.  fixdamage.exe was run.

Some things:
I recently installed a new Firefox, on 8/23.
This might be related to a program called "Spyhunter" based on some of the sites I am redirected to.
About a week ago I got a Webroot Secure Anywhere messages saying "Warning: meviodisplayads.com (contains malicious content.) This website contains a known threat and has been blocked, but I am not clear as to why I'd be getting that message based on the sites I was on when the message appeared.
About a week ago I got a McAfee message saying harmful websites, "These websites you visited put your security at risk, psych.ly"
 

Any other ideas?

Link to post
Share on other sites

Malwarebytes Anti-Rootkit BETA 1.07.0.1005
www.malwarebytes.org

Database version: v2013.09.07.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16660
owner :: OWNER-PC [administrator]

9/7/2013 2:08:31 PM
mbar-log-2013-09-07 (14-08-31).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 241339
Time elapsed: 37 minute(s), 35 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
 

Link to post
Share on other sites

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

Link to post
Share on other sites

No, it still seems to occur.   Though I did about 5 searches and clicked on 5 links before I got a redirect issue, so it doesn't happen every time.  I should mention I had some issues with ComboFix running with Spybot in the background, but I finally uninstalled and then was able to run CF fully this time.  Here is the log.

 

thanks.

 

ComboFix 13-09-06.01 - owner 09/09/2013  22:59:02.2.2 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.4008.2711 [GMT -4:00]
Running from: c:\users\owner\Downloads\ComboFix.exe
AV: Webroot SecureAnywhere *Disabled/Updated* {9C0666FC-6C7D-3E97-3C40-0C6B33FC7401}
SP: Webroot SecureAnywhere *Disabled/Updated* {27678718-4A47-3119-06F0-3719487B3EBC}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\wininit.ini
.
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_RelevantKnowledge
.
.
(((((((((((((((((((((((((   Files Created from 2013-08-10 to 2013-09-10  )))))))))))))))))))))))))))))))
.
.
2013-09-10 09:40 . 2013-09-10 09:40    --------    d-----w-    c:\users\Default\AppData\Local\temp
2013-09-07 18:08 . 2013-09-08 03:49    --------    d-----w-    c:\programdata\Malwarebytes' Anti-Malware (portable)
2013-09-03 23:48 . 2013-09-03 23:48    --------    d-----w-    c:\users\owner\AppData\Roaming\Malwarebytes
2013-09-03 23:47 . 2013-09-03 23:47    --------    d-----w-    c:\programdata\Malwarebytes
2013-09-03 23:47 . 2013-04-04 18:50    25928    ----a-w-    c:\windows\system32\drivers\mbam.sys
2013-09-03 23:47 . 2013-09-03 23:47    --------    d-----w-    c:\program files (x86)\AntiVirus
2013-08-27 00:51 . 2013-07-09 05:03    3913664    ----a-w-    c:\windows\SysWow64\ntoskrnl.exe
2013-08-27 00:51 . 2013-07-09 05:03    3968960    ----a-w-    c:\windows\SysWow64\ntkrnlpa.exe
2013-08-27 00:51 . 2013-07-09 04:53    1292192    ----a-w-    c:\windows\SysWow64\ntdll.dll
2013-08-27 00:51 . 2013-07-09 04:52    5120    ----a-w-    c:\windows\SysWow64\wow32.dll
2013-08-27 00:51 . 2013-07-09 02:49    25600    ----a-w-    c:\windows\SysWow64\setup16.exe
2013-08-27 00:51 . 2013-07-09 02:49    7680    ----a-w-    c:\windows\SysWow64\instnm.exe
2013-08-27 00:51 . 2013-07-09 02:49    14336    ----a-w-    c:\windows\SysWow64\ntvdm64.dll
2013-08-27 00:51 . 2013-07-09 02:49    2048    ----a-w-    c:\windows\SysWow64\user.exe
2013-08-27 00:51 . 2013-07-09 05:53    243712    ----a-w-    c:\windows\system32\wow64.dll
2013-08-27 00:51 . 2013-07-09 06:03    5550528    ----a-w-    c:\windows\system32\ntoskrnl.exe
2013-08-27 00:51 . 2013-07-09 05:54    1732032    ----a-w-    c:\windows\system32\ntdll.dll
2013-08-24 02:44 . 2013-08-24 20:19    --------    d-----w-    c:\program files (x86)\Mozilla Maintenance Service
2013-08-23 02:26 . 2013-07-09 05:52    224256    ----a-w-    c:\windows\system32\wintrust.dll
2013-08-23 02:26 . 2013-07-09 05:46    184320    ----a-w-    c:\windows\system32\cryptsvc.dll
2013-08-23 02:26 . 2013-07-09 05:46    1472512    ----a-w-    c:\windows\system32\crypt32.dll
2013-08-23 02:26 . 2013-07-09 05:46    139776    ----a-w-    c:\windows\system32\cryptnet.dll
2013-08-23 02:26 . 2013-07-09 04:52    175104    ----a-w-    c:\windows\SysWow64\wintrust.dll
2013-08-23 02:26 . 2013-07-09 04:46    140288    ----a-w-    c:\windows\SysWow64\cryptsvc.dll
2013-08-23 02:26 . 2013-07-09 04:46    1166848    ----a-w-    c:\windows\SysWow64\crypt32.dll
2013-08-23 02:26 . 2013-07-09 04:46    103936    ----a-w-    c:\windows\SysWow64\cryptnet.dll
2013-08-23 02:25 . 2013-07-19 01:58    2048    ----a-w-    c:\windows\system32\tzres.dll
2013-08-23 02:25 . 2013-07-19 01:41    2048    ----a-w-    c:\windows\SysWow64\tzres.dll
2013-08-23 02:25 . 2013-07-25 09:25    1888768    ----a-w-    c:\windows\system32\WMVDECOD.DLL
2013-08-23 02:25 . 2013-07-25 08:57    1620992    ----a-w-    c:\windows\SysWow64\WMVDECOD.DLL
2013-08-23 02:24 . 2013-07-09 05:51    1217024    ----a-w-    c:\windows\system32\rpcrt4.dll
2013-08-23 02:24 . 2013-07-09 04:52    663552    ----a-w-    c:\windows\SysWow64\rpcrt4.dll
2013-08-23 02:24 . 2013-06-15 04:32    39936    ----a-w-    c:\windows\system32\drivers\tssecsrv.sys
2013-08-23 02:24 . 2013-07-06 06:03    1910208    ----a-w-    c:\windows\system32\drivers\tcpip.sys
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-23 23:31 . 2013-03-10 19:56    692104    ----a-w-    c:\windows\SysWow64\FlashPlayerApp.exe
2013-08-23 23:31 . 2011-07-27 03:34    71048    ----a-w-    c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-08-23 04:07 . 2011-11-30 14:46    78161360    ----a-w-    c:\windows\system32\MRT.exe
2013-07-14 04:07 . 2013-07-14 04:07    0    ----a-w-    c:\windows\SysWow64\sho70BA.tmp
2013-07-09 04:45 . 2013-08-27 00:51    44032    ----a-w-    c:\windows\apppatch\acwow64.dll
2013-06-21 02:04 . 2011-11-30 14:41    102792    ----a-w-    c:\windows\system32\WRusr.dll
2013-06-21 02:04 . 2011-11-30 14:41    150160    ----a-w-    c:\windows\SysWow64\WRusr.dll
2013-06-21 02:04 . 2011-11-30 14:41    112616    ----a-w-    c:\windows\system32\drivers\WRkrn.sys
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{656461ef-40f6-4115-9ff1-bced9812ccbb}"= "c:\program files (x86)\BitTorrentBar2\prxtbBitT.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{656461ef-40f6-4115-9ff1-bced9812ccbb}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{656461ef-40f6-4115-9ff1-bced9812ccbb}]
2011-05-09 09:49    176936    ----a-w-    c:\program files (x86)\BitTorrentBar2\prxtbBitT.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{656461ef-40f6-4115-9ff1-bced9812ccbb}"= "c:\program files (x86)\BitTorrentBar2\prxtbBitT.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{656461ef-40f6-4115-9ff1-bced9812ccbb}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim"="c:\program files (x86)\AIM\aim.exe" [2012-02-29 4321112]
"BitTorrent"="c:\program files (x86)\BitTorrent\BitTorrent.exe" [2012-05-11 6380400]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-04-19 18678376]
"PeerBlock"="c:\program files\PeerBlock\peerblock.exe" [2010-11-07 2646128]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2011-07-12 1298816]
"ToshibaAppPlace"="c:\program files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe" [2010-09-23 552960]
"NortonOnlineBackupReminder"="c:\program files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe" [2011-06-22 3218864]
"WRSVC"="c:\program files\Webroot\WRSA.exe" [2013-06-21 740328]
"PWRISOVM.EXE"="c:\program files (x86)\ISO\PowerISO\PWRISOVM.EXE" [2011-11-15 312376]
"ConnectionCenter"="c:\program files (x86)\Citrix\ICA Client\concentr.exe" [2011-08-11 358336]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
.
c:\users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe [2013-2-5 272248]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDevMgrUpdate"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDevMgrUpdate"= 0 (0x0)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDevMgrUpdate"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute    REG_MULTI_SZ       autocheck autochk *\0\0sdnclean64.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 hitmanpro35;Hitman Pro 3.5 Support Driver;c:\windows\system32\drivers\hitmanpro36.sys;c:\windows\SYSNATIVE\drivers\hitmanpro36.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe;c:\program files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [x]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [x]
R3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys;c:\windows\SYSNATIVE\DRIVERS\tos_sps64.sys [x]
S0 WRkrn;WRkrn;c:\windows\System32\drivers\WRkrn.sys;c:\windows\SYSNATIVE\drivers\WRkrn.sys [x]
S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys;c:\windows\SYSNATIVE\DRIVERS\ctxusbm.sys [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 GFNEXSrv;GFNEX Service;c:\windows\System32\GFNEXSrv.exe;c:\windows\SYSNATIVE\GFNEXSrv.exe [x]
S2 Norton PC Checkup Application Launcher;Toshiba Laptop Checkup Application Launcher;c:\program files (x86)\Norton PC Checkup\Engine\2.0.13.11\SymcPCCULaunchSvc.exe;c:\program files (x86)\Norton PC Checkup\Engine\2.0.13.11\SymcPCCULaunchSvc.exe [x]
S2 PCCUJobMgr;Common Client Job Manager Service;c:\program files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe;c:\program files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe;c:\program files\TOSHIBA\TECO\TecoService.exe [x]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys;c:\windows\SYSNATIVE\DRIVERS\TVALZFL.sys [x]
S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [x]
S2 WRSVC;WRSVC;c:\program files\Webroot\WRSA.exe;c:\program files\Webroot\WRSA.exe [x]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys;c:\windows\SYSNATIVE\DRIVERS\pgeffect.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys;c:\windows\SYSNATIVE\DRIVERS\rtl8192Ce.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-09-07 17:50    1177552    ----a-w-    c:\program files (x86)\Google\Chrome\Application\29.0.1547.66\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-09-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-10 23:31]
.
2013-09-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-23 14:35]
.
2013-09-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-23 14:35]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-08 167256]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-08 391000]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-08 418136]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-07-07 12558440]
"RtHDVBg_Dolby"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-06-03 2226280]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2011-06-10 710560]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - about:home
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: security.csp.enable - false
.
.
------- File Associations -------
.
inifile=%SystemRoot%\SysWow64\NOTEPAD.EXE %1
JSEFile="%SystemRoot%\System32\WScript.exe" "%1" %*
txtfile=%SystemRoot%\SysWow64\NOTEPAD.EXE %1
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-TSleepSrv - %ProgramFiles(x86)%\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
WebBrowser-{656461EF-40F6-4115-9FF1-BCED9812CCBB} - (no file)
HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE
HKLM-Run-HSON - c:\program files (x86)\TOSHIBA\TBS\HSON.exe
HKLM-Run-TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-Teco - c:\program files (x86)\TOSHIBA\TECO\Teco.exe
HKLM-Run-TosWaitSrv - c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe
HKLM-Run-TosNC - c:\program files (x86)\Toshiba\BulletinBoard\TosNcCore.exe
HKLM-Run-TosReelTimeMonitor - c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCCUJobMgr]
"ImagePath"="\"c:\program files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe\" /s \"PCCUJobMgr\" /m \"c:\program files (x86)\Norton PC Checkup\Engine\2.0.13.11\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler.exe
c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Completion time: 2013-09-10  05:52:25 - machine was rebooted
ComboFix-quarantined-files.txt  2013-09-10 09:52
.
Pre-Run: 159,027,634,176 bytes free
Post-Run: 158,514,810,880 bytes free
.
- - End Of File - - 4BC8DB43EECAA837D867A1FB118E907A
 

Link to post
Share on other sites

Lets clean out any adware while you're here: (this will require a reboot so save all your work)

Please download AdwCleaner by Xplode and save to your Desktop.

  • Double click on AdwCleaner.exe to run the tool.

    Vista/Windows 7/8 users right-click and select Run As Administrator

  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • When it's done you'll see: Pending: Please uncheck elements you don't want removed.
  • Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • Look over the log especially under Files/Folders for any program you want to save.
  • If there's a program you want to save, just uncheck it from AdwCleaner.
  • If you're not sure, post the log for review.
  • If you're ready to clean it all up.....click the Clean button.
  • After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of that logfile will also be saved in the C:\AdwCleaner folder.
  • Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
  • To restore an item that has been deleted:
  • Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.
Then..................

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

Please let me know how computer is running now, MrC

Link to post
Share on other sites

Hi,

 

Here is the log file.  I am not sure if any legit or not.  I did install BitTorrent but not sure about the tool bar.  Any insight?

 

# AdwCleaner v3.003 - Report created 11/09/2013 at 20:13:56
# Updated 07/09/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : owner - OWNER-PC
# Running from : C:\Users\owner\Downloads\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll
File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.xpt
File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll
File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.xpt
File Found : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\user.js
Folder Found C:\Program Files (x86)\BitTorrentBar2
Folder Found C:\Program Files (x86)\Common Files\Software Update Utility
Folder Found C:\Program Files (x86)\Conduit
Folder Found C:\Users\owner\AppData\Local\Conduit
Folder Found C:\Users\owner\AppData\Local\Temp\boost_interprocess
Folder Found C:\Users\owner\AppData\LocalLow\BitTorrentBar2
Folder Found C:\Users\owner\AppData\LocalLow\Conduit
Folder Found C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\jetpack

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\APN PIP
Key Found : HKCU\Software\AppDataLow\Software\BitTorrentBar2
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Toolbar
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{656461EF-40F6-4115-9FF1-BCED9812CCBB}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{656461EF-40F6-4115-9FF1-BCED9812CCBB}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKCU\Software\PIP
Key Found : [x64] HKCU\Software\APN PIP
Key Found : [x64] HKCU\Software\PIP
Key Found : HKLM\Software\BitTorrentBar2
Key Found : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}
Key Found : HKLM\SOFTWARE\Classes\AppID\dnu.EXE
Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{656461EF-40F6-4115-9FF1-BCED9812CCBB}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{70B469C4-47B1-48BD-8149-D2749E4B8832}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Found : HKLM\SOFTWARE\Classes\dnUpdate
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController
Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1
Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Found : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}
Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3045275
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Found : HKLM\Software\Conduit
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\mkndcbhcgphcfkkddanakjiepeknbgle
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2D4A786A-FC70-4829-8D28-F89C16EDC873}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D855E4C2-57F2-4CA7-A7C3-6D32CBC3BF69}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{656461EF-40F6-4115-9FF1-BCED9812CCBB}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{70B469C4-47B1-48BD-8149-D2749E4B8832}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BitTorrentBar2 Toolbar
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtility
Key Found : HKLM\Software\PIP
Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{656461EF-40F6-4115-9FF1-BCED9812CCBB}]
Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{656461EF-40F6-4115-9FF1-BCED9812CCBB}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{656461EF-40F6-4115-9FF1-BCED9812CCBB}]
Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{656461EF-40F6-4115-9FF1-BCED9812CCBB}]

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16686


-\\ Mozilla Firefox v23.0.1 (en-US)

[ File : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\prefs.js ]


-\\ Google Chrome v29.0.1547.66

[ File : C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [5847 octets] - [11/09/2013 20:13:56]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [5907 octets] ##########
 

Thanks.

Link to post
Share on other sites

Oh I thought I replied.  It looks like there is still an issue.  I cleaned up the files but it looks like two directories came back.  It's frustrating because it seems minor, I had to click on three search links before I was redirected to a spam site, but it won't go away.  Most recent search.

 

thanks.

 

# AdwCleaner v3.003 - Report created 13/09/2013 at 20:29:55
# Updated 07/09/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : owner - OWNER-PC
# Running from : C:\Users\owner\Downloads\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Found C:\Users\owner\AppData\Local\Temp\boost_interprocess
Folder Found C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\jetpack

***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16686


-\\ Mozilla Firefox v23.0.1 (en-US)

[ File : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\prefs.js ]


-\\ Google Chrome v29.0.1547.66

[ File : C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [5995 octets] - [11/09/2013 20:13:56]
AdwCleaner[R1].txt - [6055 octets] - [12/09/2013 20:15:03]
AdwCleaner[R2].txt - [1043 octets] - [13/09/2013 20:29:55]
AdwCleaner[s0].txt - [6180 octets] - [12/09/2013 20:15:56]

########## EOF - C:\AdwCleaner\AdwCleaner[R2].txt - [1163 octets] ##########
 

Link to post
Share on other sites

Please download Farbar Recovery Scan Tool and save it to a folder. (use correct version for your system)

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
MrC
Link to post
Share on other sites

Addition.txt

 

Hmm it doesn't seem like it found anything.

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-09-2013
Ran by owner (administrator) on OWNER-PC on 15-09-2013 23:51:36
Running from C:\Users\owner\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Webroot) C:\Program Files\Webroot\WRSA.exe
() C:\Windows\System32\GFNEXSrv.exe
(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Webroot) C:\Program Files\Webroot\WRSA.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Updater\Updater.exe
(Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe
(TOSHIBA Corporation) C:\windows\system32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\Teco.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
(AOL Inc.) C:\Program Files (x86)\AIM\aim.exe
(BitTorrent, Inc.) C:\Program Files (x86)\BitTorrent\BitTorrent.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(TOSHIBA Corporation) C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\ToshibaServiceStation.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Power Software Ltd) C:\Program Files (x86)\ISO\PowerISO\PWRISOVM.EXE
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Microsoft Corporation) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HotKeysCmds] - C:\windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [590256 2011-05-17] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] - C:\Program Files\TOSHIBA\TBS\HSON.exe [296824 2010-09-25] (TOSHIBA Corporation)
HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [972672 2011-04-27] (TOSHIBA Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12558440 2011-07-07] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2226280 2011-06-03] (Realtek Semiconductor)
HKLM\...\Run: [synTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2679592 2011-02-03] (Synaptics Incorporated)
HKLM\...\Run: [Teco] - C:\Program Files\TOSHIBA\TECO\Teco.exe [1544624 2011-05-24] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710560 2011-06-10] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [712096 2011-07-01] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] - C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [TosNC] - C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [595816 2010-04-23] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] - C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38824 2011-06-28] (TOSHIBA Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKCU\...\Run: [Aim] - C:\Program Files (x86)\AIM\aim.exe [4321112 2012-02-29] (AOL Inc.)
HKCU\...\Run: [bitTorrent] - C:\Program Files (x86)\BitTorrent\BitTorrent.exe [6380400 2012-05-11] (BitTorrent, Inc.)
HKCU\...\Run: [skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\...\Run: [PeerBlock] - C:\Program Files\PeerBlock\peerblock.exe [2646128 2010-11-06] (PeerBlock, LLC)
HKCU\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKLM-x32\...\Run: [ToshibaServiceStation] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1298816 2011-07-11] (TOSHIBA Corporation)
HKLM-x32\...\Run: [ToshibaAppPlace] - C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe [552960 2010-09-23] (Toshiba)
HKLM-x32\...\Run: [NortonOnlineBackupReminder] - C:\Program Files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe [3218864 2011-06-22] (Toshiba)
HKLM-x32\...\Run: [WRSVC] - C:\Program Files\Webroot\WRSA.exe [740328 2013-06-20] (Webroot)
HKLM-x32\...\Run: [PWRISOVM.EXE] - C:\Program Files (x86)\ISO\PowerISO\PWRISOVM.EXE [312376 2011-11-14] (Power Software Ltd)
HKLM-x32\...\Run: [ConnectionCenter] - C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [358336 2011-08-11] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
Startup: C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.toshiba.com/?cid=C001B2Y
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Webroot Browser Helper Object - {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} - C:\ProgramData\WRData\pkg\LPBar64.dll (Webroot Software, Inc.)
BHO: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\x64\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Webroot Browser Helper Object - {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} - C:\ProgramData\WRData\pkg\LPBar.dll (Webroot Software, Inc.)
BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
Toolbar: HKLM - Webroot Toolbar - {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\ProgramData\WRData\pkg\LPBar64.dll (Webroot Software, Inc.)
Toolbar: HKLM-x32 - Webroot Toolbar - {97ab88ef-346b-4179-a0b1-7445896547a5} - C:\ProgramData\WRData\pkg\LPBar.dll (Webroot Software, Inc.)
Toolbar: HKCU -  No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default
FF SelectedSearchEngine: Google
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @garmin.com/GpsControl - C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Webroot - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\Extensions\{8ac62a8b-8b3f-43ba-9b1a-90c299b9dfda}
FF Extension: Webroot - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\Extensions\{8ac62a8b-8b3f-43ba-9b1a-90c299b9dfda}_deleted
FF Extension: einszfeapc - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\Extensions\einszfeapc@einszfeapc.org.xpi
FF Extension: No Name - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\Extensions\{7CA9CF31-1C73-46CD-8377-85AB71EA771F}.xpi
FF HKLM-x32\...\Firefox\Extensions: [{C7AE725D-FA5C-4027-BB4C-787EF9F8248A}] - C:\Program Files (x86)\RelevantKnowledge\firefox
FF StartMenuInternet: FIREFOX.EXE - C:\Users\owner\AppData\Local\Mozilla Firefox\firefox.exe

Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
CHR HKLM-x32\...\Chrome\Extension: [ngmmcbedgcbfghamlghhpbpifnbhhpik] - C:\Users\owner\AppData\Local\Temp\crxE35.tmp

==================== Services (Whitelisted) =================

S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2011-12-15] (Adobe Systems)
R2 GFNEXSrv; C:\Windows\System32\GFNEXSrv.exe [162824 2010-09-09] ()
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
S2 Norton PC Checkup Application Launcher; C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\SymcPCCULaunchSvc.exe [123320 2012-07-27] (Symantec Corporation)
R2 PCCUJobMgr; C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe [126392 2011-07-19] (Symantec Corporation)
R2 WRSVC; C:\Program Files\Webroot\WRSA.exe [740328 2013-06-20] (Webroot)

==================== Drivers (Whitelisted) ====================

S3 hitmanpro35; C:\windows\system32\drivers\hitmanpro36.sys [27424 2012-03-07] ()
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-13] (Brother Industries Ltd.)
R0 WRkrn; C:\Windows\System32\drivers\WRkrn.sys [112616 2013-06-20] (Webroot)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-09-15 23:32 - 2013-09-15 23:32 - 00000000 ____D C:\FRST
2013-09-15 22:07 - 2013-09-15 22:08 - 01951158 _____ (Farbar) C:\Users\owner\Downloads\FRST64.exe
2013-09-13 20:30 - 2013-09-13 20:30 - 00001243 _____ C:\Users\owner\Desktop\AdwCleaner[R2]913.txt
2013-09-11 22:09 - 2013-09-11 22:09 - 00005995 _____ C:\Users\owner\Desktop\AdwCleaner[R0].txt
2013-09-11 20:13 - 2013-09-13 23:27 - 00000000 ____D C:\AdwCleaner
2013-09-10 23:49 - 2013-08-10 01:22 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-09-10 23:49 - 2013-08-10 01:22 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-09-10 23:49 - 2013-08-10 01:22 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-09-10 23:49 - 2013-08-10 01:21 - 19246592 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-09-10 23:49 - 2013-08-10 01:21 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-09-10 23:49 - 2013-08-10 01:21 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-09-10 23:49 - 2013-08-10 01:20 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-09-10 23:49 - 2013-08-10 01:20 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-09-10 23:49 - 2013-08-10 01:20 - 02647040 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-09-10 23:49 - 2013-08-10 01:20 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-09-10 23:49 - 2013-08-10 01:20 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-09-10 23:49 - 2013-08-10 01:20 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-09-10 23:49 - 2013-08-10 01:20 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-09-10 23:49 - 2013-08-10 01:20 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-09-10 23:49 - 2013-08-09 23:59 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-09-10 23:49 - 2013-08-09 23:59 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-09-10 23:49 - 2013-08-09 23:58 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-09-10 23:49 - 2013-08-09 23:58 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-09-10 23:49 - 2013-08-09 23:58 - 02048000 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-09-10 23:49 - 2013-08-09 23:58 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-09-10 23:49 - 2013-08-09 23:58 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-09-10 23:49 - 2013-08-09 23:58 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-09-10 23:49 - 2013-08-09 23:58 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-09-10 23:49 - 2013-08-09 23:58 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-09-10 23:49 - 2013-08-09 23:58 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-09-10 23:49 - 2013-08-09 23:58 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-09-10 23:49 - 2013-08-09 23:17 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-09-10 23:49 - 2013-08-09 23:07 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-09-10 23:49 - 2013-08-09 22:27 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-09-10 23:49 - 2013-08-09 22:17 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-10 23:48 - 2013-08-09 23:58 - 14332928 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-09-10 23:31 - 2013-08-07 21:20 - 03155456 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-09-10 23:31 - 2013-08-04 22:25 - 00155584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ataport.sys
2013-09-10 23:31 - 2013-08-01 22:23 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2013-09-10 23:31 - 2013-08-01 22:15 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2013-09-10 23:31 - 2013-08-01 22:15 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll
2013-09-10 23:31 - 2013-08-01 22:15 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2013-09-10 23:31 - 2013-08-01 22:15 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2013-09-10 23:31 - 2013-08-01 22:14 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll
2013-09-10 23:31 - 2013-08-01 22:14 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
2013-09-10 23:31 - 2013-08-01 22:13 - 01161216 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll
2013-09-10 23:31 - 2013-08-01 22:13 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:59 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2013-09-10 23:31 - 2013-08-01 21:59 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2013-09-10 23:31 - 2013-08-01 21:51 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2013-09-10 23:31 - 2013-08-01 21:50 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll
2013-09-10 23:31 - 2013-08-01 21:50 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
2013-09-10 23:31 - 2013-08-01 21:50 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 21:09 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
2013-09-10 23:31 - 2013-08-01 20:59 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2013-09-10 23:31 - 2013-08-01 20:45 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2013-09-10 23:31 - 2013-08-01 20:45 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2013-09-10 23:31 - 2013-08-01 20:45 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2013-09-10 23:31 - 2013-08-01 20:45 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2013-09-10 23:31 - 2013-08-01 20:43 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 20:43 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 20:43 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-10 23:31 - 2013-08-01 20:43 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-10 23:31 - 2013-07-25 22:24 - 14172672 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2013-09-10 23:31 - 2013-07-25 22:24 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\shdocvw.dll
2013-09-10 23:31 - 2013-07-25 21:55 - 12872704 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2013-09-10 23:31 - 2013-07-25 21:55 - 00180224 _____ (Microsoft Corporation) C:\windows\SysWOW64\shdocvw.dll
2013-09-10 19:55 - 2013-09-10 19:55 - 01037278 _____ C:\Users\owner\Downloads\AdwCleaner.exe
2013-09-10 05:52 - 2013-09-10 05:52 - 00021904 _____ C:\ComboFix.txt
2013-09-09 22:49 - 2013-09-09 22:49 - 00000000 ____D C:\Users\owner\Documents\ProcAlyzer Dumps
2013-09-08 13:55 - 2011-06-26 02:45 - 00256000 _____ C:\windows\PEV.exe
2013-09-08 13:55 - 2010-11-07 13:20 - 00208896 _____ C:\windows\MBR.exe
2013-09-08 13:55 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-09-08 13:55 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-09-08 13:55 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-09-08 13:55 - 2000-08-30 20:00 - 00098816 _____ C:\windows\sed.exe
2013-09-08 13:55 - 2000-08-30 20:00 - 00080412 _____ C:\windows\grep.exe
2013-09-08 13:55 - 2000-08-30 20:00 - 00068096 _____ C:\windows\zip.exe
2013-09-08 10:03 - 2013-09-10 05:52 - 00000000 ____D C:\Qoobox
2013-09-08 10:03 - 2013-09-10 05:48 - 00000000 ____D C:\windows\erdnt
2013-09-08 10:00 - 2013-09-08 10:00 - 05120615 ____R (Swearware) C:\Users\owner\Downloads\ComboFix.exe
2013-09-07 21:40 - 2013-09-07 22:23 - 746690519 _____ C:\Users\owner\Downloads\prnfle1610x.mp4
2013-09-07 14:08 - 2013-09-07 23:49 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-09-07 14:06 - 2013-09-08 07:30 - 00000000 ____D C:\Users\owner\Desktop\mbar
2013-09-05 19:47 - 2013-09-06 20:06 - 00000000 ____D C:\Users\owner\Desktop\RK_Quarantine
2013-09-05 19:40 - 2013-09-05 19:40 - 00688992 ____R (Swearware) C:\Users\owner\Downloads\dds.com
2013-09-05 19:39 - 2013-09-05 19:39 - 03787264 _____ C:\Users\owner\Downloads\RogueKillerX64.exe
2013-09-05 07:29 - 2013-09-15 23:50 - 00002352 _____ C:\windows\setupact.log
2013-09-04 06:56 - 2013-09-07 23:24 - 00003453 _____ C:\Users\owner\Downloads\up.csv
2013-09-03 19:48 - 2013-09-03 19:48 - 00000000 ____D C:\Users\owner\AppData\Roaming\Malwarebytes
2013-09-03 19:47 - 2013-09-03 19:47 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-03 19:47 - 2013-09-03 19:47 - 00000000 ____D C:\Program Files (x86)\AntiVirus
2013-09-03 19:47 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-09-01 22:35 - 2013-09-01 22:35 - 00000306 _____ C:\Users\owner\Downloads\SAV_217.csv
2013-09-01 22:34 - 2013-09-01 22:34 - 00013142 _____ C:\Users\owner\Downloads\CHK_225.csv
2013-09-01 22:34 - 2013-09-01 22:34 - 00000074 _____ C:\Users\owner\Downloads\SAV_309.csv
2013-09-01 22:23 - 2013-09-01 22:23 - 00002451 _____ C:\Users\owner\Downloads\ofx.csv
2013-08-31 23:43 - 2013-09-01 00:01 - 531132104 _____ C:\Users\owner\Downloads\EuroSexParties - Tits And Ass - Chrissy, Roseline Love, Kendra Star.mp4
2013-08-24 11:09 - 2013-08-24 11:09 - 00000000 ____D C:\Users\owner\Downloads\CumFiesta - Valerie White - Call Of Booty SD
2013-08-23 22:44 - 2013-08-24 16:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-23 22:44 - 2013-08-23 22:52 - 00001222 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-23 22:44 - 2013-08-23 22:44 - 00000000 ____D C:\ProgramData\Mozilla
2013-08-22 22:26 - 2013-07-09 01:52 - 00224256 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2013-08-22 22:26 - 2013-07-09 01:46 - 01472512 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2013-08-22 22:26 - 2013-07-09 01:46 - 00184320 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2013-08-22 22:26 - 2013-07-09 01:46 - 00139776 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll
2013-08-22 22:26 - 2013-07-09 00:52 - 00175104 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2013-08-22 22:26 - 2013-07-09 00:46 - 01166848 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2013-08-22 22:26 - 2013-07-09 00:46 - 00140288 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2013-08-22 22:26 - 2013-07-09 00:46 - 00103936 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll
2013-08-22 22:25 - 2013-07-25 05:25 - 01888768 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2013-08-22 22:25 - 2013-07-25 04:57 - 01620992 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
2013-08-22 22:25 - 2013-07-18 21:58 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2013-08-22 22:25 - 2013-07-18 21:41 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2013-08-22 22:24 - 2013-07-09 01:51 - 01217024 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2013-08-22 22:24 - 2013-07-09 00:52 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2013-08-22 22:24 - 2013-07-06 02:03 - 01910208 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2013-08-22 22:24 - 2013-06-15 00:32 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tssecsrv.sys

==================== One Month Modified Files and Folders =======

2013-09-15 23:52 - 2011-12-01 01:00 - 00000000 ____D C:\Users\owner\AppData\Roaming\BitTorrent
2013-09-15 23:50 - 2013-09-05 07:29 - 00002352 _____ C:\windows\setupact.log
2013-09-15 23:50 - 2011-09-23 10:35 - 00000908 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-15 23:50 - 2009-07-14 01:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-09-15 23:49 - 2011-09-23 10:04 - 01338311 _____ C:\windows\WindowsUpdate.log
2013-09-15 23:47 - 2011-09-23 10:35 - 00000912 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-15 23:32 - 2013-09-15 23:32 - 00000000 ____D C:\FRST
2013-09-15 23:32 - 2011-11-30 10:41 - 00000000 ____D C:\ProgramData\WRData
2013-09-15 23:31 - 2013-05-30 06:18 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-09-15 22:10 - 2009-07-14 01:13 - 00744730 _____ C:\windows\system32\PerfStringBackup.INI
2013-09-15 22:08 - 2013-09-15 22:07 - 01951158 _____ (Farbar) C:\Users\owner\Downloads\FRST64.exe
2013-09-15 13:38 - 2012-03-22 18:17 - 00000000 ____D C:\Users\owner\AppData\Roaming\Skype
2013-09-14 00:31 - 2013-05-30 06:18 - 00003768 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-09-14 00:31 - 2013-03-10 15:56 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-09-14 00:31 - 2011-07-26 23:34 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-13 23:30 - 2009-07-14 00:45 - 00024608 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-13 23:30 - 2009-07-14 00:45 - 00024608 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-13 23:27 - 2013-09-11 20:13 - 00000000 ____D C:\AdwCleaner
2013-09-13 20:30 - 2013-09-13 20:30 - 00001243 _____ C:\Users\owner\Desktop\AdwCleaner[R2]913.txt
2013-09-13 08:05 - 2009-07-13 23:20 - 00000000 ____D C:\windows\rescache
2013-09-11 22:09 - 2013-09-11 22:09 - 00005995 _____ C:\Users\owner\Desktop\AdwCleaner[R0].txt
2013-09-11 06:49 - 2011-11-30 06:35 - 00000000 ___RD C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-11 06:49 - 2011-11-30 06:35 - 00000000 ___RD C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-11 06:49 - 2009-07-14 00:45 - 00294200 _____ C:\windows\system32\FNTCACHE.DAT
2013-09-10 23:48 - 2013-07-15 06:49 - 00000000 ____D C:\windows\system32\MRT
2013-09-10 23:48 - 2011-12-01 03:20 - 00761426 _____ C:\windows\SysWOW64\PerfStringBackup.INI
2013-09-10 23:48 - 2011-12-01 03:20 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client
2013-09-10 23:43 - 2011-11-30 10:46 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-09-10 19:55 - 2013-09-10 19:55 - 01037278 _____ C:\Users\owner\Downloads\AdwCleaner.exe
2013-09-10 05:52 - 2013-09-10 05:52 - 00021904 _____ C:\ComboFix.txt
2013-09-10 05:52 - 2013-09-08 10:03 - 00000000 ____D C:\Qoobox
2013-09-10 05:48 - 2013-09-08 10:03 - 00000000 ____D C:\windows\erdnt
2013-09-10 05:43 - 2010-11-20 23:47 - 00720232 _____ C:\windows\PFRO.log
2013-09-10 05:43 - 2009-07-13 22:34 - 00000215 _____ C:\windows\system.ini
2013-09-10 05:42 - 2009-07-13 22:34 - 60555264 _____ C:\windows\system32\config\software.bak
2013-09-10 05:42 - 2009-07-13 22:34 - 44040192 _____ C:\windows\system32\config\components.bak
2013-09-10 05:42 - 2009-07-13 22:34 - 19660800 _____ C:\windows\system32\config\system.bak
2013-09-10 05:42 - 2009-07-13 22:34 - 01048576 _____ C:\windows\system32\config\default.bak
2013-09-10 05:42 - 2009-07-13 22:34 - 00262144 _____ C:\windows\system32\config\security.bak
2013-09-10 05:42 - 2009-07-13 22:34 - 00262144 _____ C:\windows\system32\config\sam.bak
2013-09-09 22:51 - 2009-07-14 01:08 - 00032580 _____ C:\windows\Tasks\SCHEDLGU.TXT
2013-09-09 22:49 - 2013-09-09 22:49 - 00000000 ____D C:\Users\owner\Documents\ProcAlyzer Dumps
2013-09-09 22:49 - 2012-02-13 13:03 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-08 23:39 - 2011-12-01 03:21 - 00000000 ____D C:\Users\owner\AppData\Roaming\SoftGrid Client
2013-09-08 10:01 - 2013-08-03 21:33 - 00003168 _____ C:\Users\owner\Desktop\net.txt
2013-09-08 10:00 - 2013-09-08 10:00 - 05120615 ____R (Swearware) C:\Users\owner\Downloads\ComboFix.exe
2013-09-08 07:30 - 2013-09-07 14:06 - 00000000 ____D C:\Users\owner\Desktop\mbar
2013-09-07 23:49 - 2013-09-07 14:08 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-09-07 23:24 - 2013-09-04 06:56 - 00003453 _____ C:\Users\owner\Downloads\up.csv
2013-09-07 22:23 - 2013-09-07 21:40 - 746690519 _____ C:\Users\owner\Downloads\prnfle1610x.mp4
2013-09-07 22:01 - 2012-09-30 17:49 - 00000000 ____D C:\Users\owner\AppData\Roaming\vlc
2013-09-07 14:06 - 2011-11-30 22:15 - 00000000 ____D C:\Files
2013-09-06 23:37 - 2011-09-23 10:36 - 00000000 ____D C:\Program Files\Google
2013-09-06 23:37 - 2011-09-23 10:35 - 00000000 ____D C:\Program Files (x86)\Google
2013-09-06 23:00 - 2011-11-30 22:12 - 00000000 ____D C:\Users\owner\AppData\Local\Google
2013-09-06 23:00 - 2011-09-23 10:28 - 00000000 ____D C:\ProgramData\Google
2013-09-06 20:06 - 2013-09-05 19:47 - 00000000 ____D C:\Users\owner\Desktop\RK_Quarantine
2013-09-05 19:40 - 2013-09-05 19:40 - 00688992 ____R (Swearware) C:\Users\owner\Downloads\dds.com
2013-09-05 19:39 - 2013-09-05 19:39 - 03787264 _____ C:\Users\owner\Downloads\RogueKillerX64.exe
2013-09-03 21:10 - 2012-03-05 18:44 - 00000000 ____D C:\Users\owner\AppData\Local\Tific
2013-09-03 19:48 - 2013-09-03 19:48 - 00000000 ____D C:\Users\owner\AppData\Roaming\Malwarebytes
2013-09-03 19:47 - 2013-09-03 19:47 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-03 19:47 - 2013-09-03 19:47 - 00000000 ____D C:\Program Files (x86)\AntiVirus
2013-09-01 22:35 - 2013-09-01 22:35 - 00000306 _____ C:\Users\owner\Downloads\SAV_217.csv
2013-09-01 22:34 - 2013-09-01 22:34 - 00013142 _____ C:\Users\owner\Downloads\CHK_225.csv
2013-09-01 22:34 - 2013-09-01 22:34 - 00000074 _____ C:\Users\owner\Downloads\SAV_309.csv
2013-09-01 22:23 - 2013-09-01 22:23 - 00002451 _____ C:\Users\owner\Downloads\ofx.csv
2013-09-01 00:01 - 2013-08-31 23:43 - 531132104 _____ C:\Users\owner\Downloads\EuroSexParties - Tits And Ass - Chrissy, Roseline Love, Kendra Star.mp4
2013-08-31 09:36 - 2013-06-01 17:35 - 00000000 ____D C:\Users\owner\AppData\Local\{6984B620-46F5-4BC0-98D5-73073495CC9F}
2013-08-24 16:19 - 2013-08-23 22:44 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-24 11:09 - 2013-08-24 11:09 - 00000000 ____D C:\Users\owner\Downloads\CumFiesta - Valerie White - Call Of Booty SD
2013-08-23 22:52 - 2013-08-23 22:44 - 00001222 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-08-23 22:52 - 2013-08-07 22:28 - 00000000 ____D C:\Users\owner\AppData\Local\Mozilla Firefox
2013-08-23 22:44 - 2013-08-23 22:44 - 00000000 ____D C:\ProgramData\Mozilla
2013-08-23 01:01 - 2013-07-02 21:47 - 00000000 ____D C:\Users\owner\AppData\Local\Mozilla Firefox.bak
2013-08-23 01:01 - 2013-03-10 15:56 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-08-23 01:01 - 2011-11-30 10:41 - 00000000 ____D C:\Program Files\Webroot
2013-08-23 01:01 - 2009-07-13 23:20 - 00000000 ____D C:\windows\AppCompat
2013-08-23 01:01 - 2009-07-13 23:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-08-23 01:00 - 2009-07-13 23:20 - 00000000 ____D C:\windows\registration
2013-08-23 00:57 - 2011-12-01 10:34 - 00000000 ___RD C:\MSOCache
2013-08-22 22:10 - 2011-11-30 06:34 - 00000000 ____D C:\Users\owner
2013-08-19 06:56 - 2011-12-01 18:27 - 00000000 ____D C:\Users\owner\AppData\Local\CrashDumps

Some content of TEMP:
====================
C:\Users\owner\AppData\Local\Temp\DefaultAssets.exe
C:\Users\owner\AppData\Local\Temp\NLStubInstallerResources.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Windows\system64

LastRegBack: 2013-09-11 20:34

==================== End Of Log ============================

Link to post
Share on other sites

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-09-2013
Ran by owner at 2013-09-15 23:53:25
Running from C:\Users\owner\Downloads
Boot Mode: Normal
==========================================================

==================== Installed Programs =======================

Adobe AIR (x32 Version: 2.6.0.19140)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.174)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.168)
Adobe Reader XI (11.0.03) (x32 Version: 11.0.03)
AIM 7 (x32)
Bejeweled 3 (x32 Version: 2.2.0.97)
BitTorrent (x32 Version: 7.6.1)
BurnAware Free 6.3 (x32)
Chuzzle Deluxe (x32 Version: 2.2.0.95)
Citrix Receiver (HDX Flash Redirection) (x32 Version: 13.0.0.6685)
Citrix Receiver (x32 Version: 13.0.0.6685)
Citrix Receiver Inside (x32 Version: 3.0.0.56418)
Citrix Receiver(Aero) (x32 Version: 13.0.0.6685)
Citrix Receiver(DV) (x32 Version: 13.0.0.6685)
Citrix Receiver(USB) (x32 Version: 13.0.0.6685)
D3DX10 (x32 Version: 15.4.2368.0902)
Easy Video Splitter 1.28 (x32)
FATE - The Traitor Soul (x32 Version: 2.2.0.95)
ffdshow v1.1.3996 [2011-10-13] (x32 Version: 1.1.3996.0)
Fishdom 2 (x32 Version: 2.2.0.98)
Free Video Converter 2.0 (x32)
Garmin Communicator Plugin (x32 Version: 4.0.4)
Garmin Communicator Plugin x64 (Version: 4.0.4)
Garmin Training Center (x32 Version: 3.4.5)
Garmin USB Drivers (x32 Version: 2.3.0.0)
Google Chrome (x32 Version: 29.0.1547.66)
Google Earth (x32 Version: 7.1.1.1888)
Google Update Helper (x32 Version: 1.3.21.153)
HitmanPro 3.6 (Version: 3.6.0.146)
ImgBurn (x32 Version: 2.5.7.0)
Intel® Management Engine Components (x32 Version: 7.0.0.1144)
Intel® Processor Graphics (x32 Version: 8.15.10.2353)
Intel® Rapid Storage Technology (x32 Version: 10.1.2.1004)
Java Auto Updater (x32 Version: 2.0.4.1)
Java 6 Update 22 (x32 Version: 6.0.220)
Java 6 Update 25 (x32 Version: 6.0.250)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Label@Once 1.0 (x32 Version: 1.0)
Malwarebytes Anti-Malware version 1.75.0.1300 (x32 Version: 1.75.0.1300)
McAfee Security Scan Plus (x32 Version: 3.0.318.3)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Click-to-Run 2010 (Version: 14.0.4763.1000)
Microsoft Office Click-to-Run 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Starter 2010 - English (x32 Version: 14.0.4763.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (x32 Version: 10.0.30319)
Mozilla Firefox 23.0.1 (x86 en-US) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
Online Plug-in (x32 Version: 13.0.0.6685)
OpenOffice.org 3.3 (x32 Version: 3.3.9567)
Paltalk Messenger  10.2 (x32 Version: 10.2.0)
PeerBlock 1.1 (r518) (Version: 1.1.0.518)
Penguins! (x32 Version: 2.2.0.95)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95)
PlayReady PC Runtime amd64 (Version: 1.3.0)
PlayReady PC Runtime x86 (x32 Version: 1.3.0)
Polar Bowler (x32 Version: 2.2.0.97)
PowerISO (x32 Version: 4.9)
Realtek Ethernet Controller Driver (x32 Version: 7.38.113.2011)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6410)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.7600.30126)
Realtek WLAN Driver (x32 Version: 2.00.0013)
Skype Click to Call (x32 Version: 5.10.9560)
Skype Launcher (x32 Version: 2.01)
Skype™ 6.3 (x32 Version: 6.3.107)
SoulSeek 157 NS 13e (x32)
Synaptics Pointing Device Driver (Version: 15.2.11.1)
Tom Clancy's Splinter Cell (x32 Version: 2.2.0.97)
Toshiba App Place (x32 Version: 1.0.6.3)
TOSHIBA Application Installer (x32 Version: 9.0.1.2)
TOSHIBA Assist (x32 Version: 4.2.3.0)
Toshiba Book Place (x32 Version: 2.2.7530)
TOSHIBA Bulletin Board (Version: 1.6.08.64)
TOSHIBA Bulletin Board (x32 Version: 1.6.08.64)
TOSHIBA Disc Creator (Version: 2.1.0.11 for x64)
TOSHIBA eco Utility (Version: 1.3.5.64)
TOSHIBA Face Recognition (Version: 3.1.17.64)
TOSHIBA Face Recognition (x32 Version: 3.1.17.64)
TOSHIBA Hardware Setup (x32 Version: 2.00.0014)
TOSHIBA HDD/SSD Alert (Version: 3.1.64.9)
Toshiba Laptop Checkup (x32 Version: 2.0.13.11)
TOSHIBA Media Controller (x32 Version: 1.0.87.4)
TOSHIBA Media Controller Plug-in (x32 Version: 1.0.7.5)
Toshiba Online Backup (x32 Version: 2.0.0.31)
TOSHIBA PC Health Monitor (Version: 1.7.9.64)
TOSHIBA Quality Application (x32 Version: 1.0.3)
TOSHIBA Recovery Media Creator (x32 Version: 2.1.5.5109a)
TOSHIBA ReelTime (Version: 1.7.21.64)
TOSHIBA ReelTime (x32 Version: 1.7.21.64)
TOSHIBA Resolution+ Plug-in for Windows Media Player (x32 Version: 1.1.2)
TOSHIBA Service Station (x32 Version: 2.2.12)
TOSHIBA Sleep Utility (x32 Version: 1.4.2.8)
TOSHIBA Supervisor Password (x32 Version: 2.00.0006)
TOSHIBA Value Added Package (Version: 1.6.1.64)
TOSHIBA Value Added Package (x32 Version: 1.6.1.64)
TOSHIBA Web Camera Application (x32 Version: 2.0.3.3)
TOSHIBA Wireless LAN Indicator (x32 Version: 1.0.5)
TOSHIBARegistration (x32 Version: 1.0.6)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update Installer for WildTangent Games App (x32)
Virtual Villagers 5 - New Believers (x32 Version: 2.2.0.97)
VLC media player 2.0.3 (x32 Version: 2.0.3)
Webroot SecureAnywhere (x32 Version: 8.0.2.155)
WildTangent Games (x32 Version: 1.0.2.5)
WildTangent Games App (Toshiba Games) (x32 Version: 4.0.5.14)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices  (06/03/2009 2.3.0.0) (Version: 06/03/2009 2.3.0.0)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3538.0513)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3538.0513)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3538.0513)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
WinRAR 4.01 (32-bit) (x32 Version: 4.01.0)
Xilisoft Video Editor 2 (HKCU Version: 2.1.1.0901)
YTD Video Downloader 3.9.4 (x32)
Zuma's Revenge (x32 Version: 2.2.0.97)

==================== Restore Points  =========================

23-08-2013 04:06:55 Windows Update
27-08-2013 10:52:46 Windows Update
07-09-2013 02:04:53 Scheduled Checkpoint
10-09-2013 02:53:20 ComboFix created restore point
11-09-2013 03:41:44 Windows Update

==================== Hosts content: ==========================

2009-07-13 22:34 - 2013-09-10 05:43 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => Sc.exe start w32time task_started
Task: {3A866332-8B2C-4B6E-854C-291736BB62CD} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-23] (Google Inc.)
Task: {532743AA-2A36-4EB6-89CB-CDECD50AAB51} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-14] (Adobe Systems Incorporated)
Task: {5D370F27-11EA-4DB1-AECE-57D5715DF55B} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {B4B2F622-3707-480E-8DBE-9D19047C3068} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {CD9FDAD6-33AA-4039-ACC1-12D3AD016850} - System32\Tasks\Norton PC Checkup Setup => C:\Users\owner\AppData\Roaming\PCCUStubInstaller\SymcPCCUInstaller.exe [2013-08-09] (Symantec Corporation)
Task: {E47CBD67-40E3-4E36-A127-269A66A0B441} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-09-23] (Google Inc.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2011-11-30 10:41 - 2013-06-20 22:04 - 00102792 _____ (Webroot) C:\windows\system32\WRusr.dll
2011-04-04 22:28 - 2011-04-04 22:28 - 00285696 _____ (Intel Corporation) C:\windows\system32\igfxrENU.lrc
2011-04-04 22:18 - 2011-04-04 22:18 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2011-05-17 17:35 - 2011-05-17 17:35 - 00128960 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrReg.dll
2011-05-17 17:34 - 2011-05-17 17:34 - 00152512 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrFunc.dll
2011-05-17 17:36 - 2011-05-17 17:36 - 00309184 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TtosFunc.dll
2011-05-17 17:31 - 2011-05-17 17:31 - 00266688 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TCooling.dll
2011-05-17 17:34 - 2011-05-17 17:34 - 00346048 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TOddPwr.dll
2011-05-17 17:35 - 2011-05-17 17:35 - 00061376 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrSrv.dll
2011-05-17 17:34 - 2011-05-17 17:34 - 00278480 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrBrightness.dll
2011-05-17 17:31 - 2011-05-17 17:31 - 00268224 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\T1394Pwr.dll
2011-05-17 17:34 - 2011-05-17 17:34 - 00273856 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TKBLEDPwr.dll
2011-05-17 17:35 - 2011-05-17 17:35 - 00268224 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TSDPwr.dll
2011-05-17 17:34 - 2011-05-17 17:34 - 00266688 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPCIePwr.dll
2011-05-17 17:35 - 2011-05-17 17:35 - 00270784 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TScreen.dll
2010-09-09 14:03 - 2010-09-09 14:03 - 00059768 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdEvnt.dll
2010-12-10 18:54 - 2010-12-10 18:54 - 00247672 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.dll
2010-11-18 20:18 - 2010-11-18 20:18 - 11190784 _____ () C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll
2010-03-03 17:15 - 2010-03-03 17:15 - 00265016 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\FnPRTSC.dll
2011-04-25 12:02 - 2011-04-25 12:02 - 00172928 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\FnSticky.dll
2011-01-20 18:13 - 2011-01-20 18:13 - 00091000 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\Hotkey\Mute.dll
2010-12-02 22:50 - 2010-12-02 22:50 - 00044920 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\SmoothView.dll
2008-07-14 13:35 - 2008-07-14 13:35 - 00107832 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TWarnMsg\TWarnMsg.dll
2010-12-08 20:58 - 2010-12-08 20:58 - 00297336 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TBS\TBSMain.dll
2008-07-14 13:34 - 2008-07-14 13:34 - 00053560 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF1.dll
2011-05-17 17:31 - 2011-05-17 17:31 - 00273856 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TFunc2.DLL
2008-07-14 13:34 - 2008-07-14 13:34 - 00054072 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF3.dll
2008-07-14 13:34 - 2008-07-14 13:34 - 00054072 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF4.dll
2011-03-03 15:11 - 2011-03-03 15:11 - 00128928 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF5.dll
2011-01-20 18:13 - 2011-01-20 18:13 - 00097144 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\Hotkey\Brightness.dll
2011-04-06 15:01 - 2011-04-06 15:01 - 00381360 _____ (TOSHIBA Corporation.) C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF8Dll.dll
2011-01-18 15:55 - 2011-01-18 15:55 - 00114552 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\Hotkey\Touchpad.dll
2010-06-02 17:43 - 2010-06-02 17:43 - 00080792 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnSpace.dll
2011-09-23 10:01 - 2010-11-03 21:30 - 00149608 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RtkCfg64.dll
2011-09-23 10:01 - 2011-07-07 00:42 - 03148904 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RtkAPO64.dll
2011-02-03 22:56 - 2011-02-03 22:56 - 00405800 _____ (Synaptics Incorporated) C:\windows\system32\SynCOM.dll
2011-02-03 22:56 - 2011-02-03 22:56 - 00224040 _____ (Synaptics Incorporated) C:\windows\system32\SynTPAPI.dll
2011-05-24 12:58 - 2011-05-24 12:58 - 00592832 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoPower.dll
2011-05-24 12:58 - 2011-05-24 12:58 - 00089536 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoHci.dll
2010-12-15 18:19 - 2010-12-15 18:19 - 00124320 _____ () C:\Program Files\TOSHIBA\TECO\MUIHelp.dll
2010-04-23 16:58 - 2010-04-23 16:58 - 03409256 _____ (TOSHIBA Corporation) C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll
2011-09-23 10:08 - 2011-07-11 20:16 - 00061824 _____ (TOSHIBA Corporation) C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\PluginLib.dll
2011-09-23 10:42 - 2011-07-19 11:59 - 00644984 ____R (Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccL90U.dll
2011-09-23 10:42 - 2011-07-19 11:59 - 00085880 ____R (Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccVrTrst.dll
2011-09-23 10:42 - 2011-07-19 11:59 - 00134520 ____R (Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvc.dll
2011-09-23 10:42 - 2011-07-19 11:59 - 00152440 ____R (Symantec Corporation) C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccIPC.dll
2011-09-23 10:42 - 2011-07-19 11:59 - 00381304 ____R (Symantec Corporation) C:\PROGRAM FILES (X86)\NORTON PC CHECKUP\ENGINE\2.0.13.11\CCJOBMGR.DLL
2012-02-29 16:24 - 2012-02-29 16:24 - 00252928 _____ (AOL Inc.) C:\Program Files (x86)\AIM\xprt6.dll
2010-01-06 02:03 - 2010-01-06 02:03 - 00163840 _____ (AOL Inc.) C:\Program Files (x86)\Common Files\AOL\AOLDiag\tbdiag.dll
2012-02-29 16:24 - 2012-02-29 16:24 - 00751616 _____ (AOL Inc.) C:\Program Files (x86)\AIM\acccore.dll
2012-02-29 16:24 - 2012-02-29 16:24 - 01208320 _____ (AOL Inc.) C:\Program Files (x86)\AIM\coolcore61.dll
2012-02-29 16:24 - 2012-02-29 16:24 - 00348160 _____ (Netscape Communications Corporation) C:\Program Files (x86)\AIM\nss3.dll
2012-02-29 16:24 - 2012-02-29 16:24 - 00372736 _____ (Netscape Communications Corporation) C:\Program Files (x86)\AIM\softokn3.dll
2012-02-29 16:24 - 2012-02-29 16:24 - 00028672 _____ (Netscape Communications Corporation) C:\Program Files (x86)\AIM\plc4.dll
2012-02-29 16:24 - 2012-02-29 16:24 - 00159744 _____ (Netscape Communications Corporation) C:\Program Files (x86)\AIM\nspr4.dll
2012-02-29 16:24 - 2012-02-29 16:24 - 00024576 _____ (Netscape Communications Corporation) C:\Program Files (x86)\AIM\plds4.dll
2012-02-29 16:24 - 2012-02-29 16:24 - 00110592 _____ (Netscape Communications Corporation) C:\Program Files (x86)\AIM\ssl3.dll
2012-02-29 16:24 - 2012-02-29 16:24 - 00106496 _____ (Netscape Communications Corporation) C:\Program Files (x86)\AIM\smime3.dll
2012-02-29 16:24 - 2012-02-29 16:24 - 00176128 _____ () C:\Program Files (x86)\AIM\nssckbi.dll
2011-01-17 17:19 - 2011-12-01 15:05 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2011-08-11 12:18 - 2011-08-11 12:18 - 00370624 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\ctxmui.dll
2011-08-11 12:18 - 2011-08-11 12:18 - 00128960 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\CCMSDK.dll
2011-08-11 12:14 - 2011-08-11 12:14 - 00011200 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\resource\en\ctxmuiUI.DLL
2011-08-11 12:15 - 2011-08-11 12:15 - 00427968 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\resource\en\concenUI.DLL
2012-10-27 16:57 - 2011-07-19 18:58 - 00033152 _____ (Citrix Systems, Inc.) C:\Users\owner\AppData\Local\Citrix\Receiver\WindowsAppRHelper_concentr.exe.dll
2011-07-19 18:58 - 2011-07-19 18:58 - 00206720 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\WindowsAppRHelper.dll
2011-08-11 12:17 - 2011-08-11 12:17 - 00025024 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\CCMProxy.dll
2011-07-19 18:58 - 2011-07-19 18:58 - 00595840 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\ResourceKeeper.dll
2011-07-19 18:58 - 2011-07-19 18:58 - 00042368 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\nativemessagebox.dll
2011-07-19 18:58 - 2011-07-19 18:58 - 00731008 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\nativesystrayue.dll
2011-07-19 18:58 - 2011-07-19 18:58 - 00092032 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\progressnotification.dll
2011-07-19 18:58 - 2011-07-19 18:58 - 00083840 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\toaster.dll
2011-08-11 12:23 - 2011-08-11 12:23 - 00088000 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\ProgressNotificationCommon.dll
2011-08-11 12:25 - 2011-08-11 12:25 - 00075712 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\WFCWINN.dll
2011-08-11 12:23 - 2011-08-11 12:23 - 00096192 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\acrdlg.dll
2011-08-11 12:20 - 2011-08-11 12:20 - 00096192 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\statuin.dll
2011-08-11 12:18 - 2011-08-11 12:18 - 00092096 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\confmgr.dll
2011-08-11 12:18 - 2011-08-11 12:18 - 00022976 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\ctxlogging.dll
2011-08-11 12:18 - 2011-08-11 12:18 - 00032192 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\icafile.dll
2011-08-11 12:26 - 2011-08-11 12:26 - 00317376 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\RSManager.dll
2011-08-11 12:26 - 2011-08-11 12:26 - 00024000 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\RSMHook.dll
2011-08-11 12:24 - 2011-08-11 12:24 - 00493504 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\CST.dll
2011-08-11 12:14 - 2011-08-11 12:14 - 00020416 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\resource\en\ProgressNotificationCommonUI.dll
2011-08-11 12:15 - 2011-08-11 12:15 - 00571328 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\resource\en\statuiUI.DLL
2011-08-11 12:15 - 2011-08-11 12:15 - 00112576 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\resource\en\CSTUI.DLL
2011-08-11 12:16 - 2011-08-11 12:16 - 00116672 _____ (Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\resource\en\wfcrunUI.DLL
2012-10-27 16:57 - 2011-07-19 18:58 - 00033152 _____ (Citrix Systems, Inc.) C:\Users\owner\AppData\Local\Citrix\Receiver\WindowsAppRHelper_wfcrun32.exe.dll

==================== Alternate Data Streams (whitelisted) ==========

 

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (09/15/2013 11:50:58 PM) (Source: Toshiba App Place) (User: )
Description: System.ArgumentOutOfRangeException: Number must be either non-negative and less than or equal to Int32.MaxValue or -1.
Parameter name: dueTime
Stack Trace:
   at System.Threading.Timer..ctor(TimerCallback callback, Object state, Int32 dueTime, Int32 period)
   at System.Timers.Timer.set_Enabled(Boolean value)
   at SnappCloud.ActivationReminder.AraClient.PostInit()
   at SnappCloud.ActivationReminder.Program.Main(String[] args)

Error: (09/15/2013 11:50:39 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/13/2013 11:23:25 PM) (Source: Toshiba App Place) (User: )
Description: System.ArgumentOutOfRangeException: Number must be either non-negative and less than or equal to Int32.MaxValue or -1.
Parameter name: dueTime
Stack Trace:
   at System.Threading.Timer..ctor(TimerCallback callback, Object state, Int32 dueTime, Int32 period)
   at System.Timers.Timer.set_Enabled(Boolean value)
   at SnappCloud.ActivationReminder.AraClient.PostInit()
   at SnappCloud.ActivationReminder.Program.Main(String[] args)

Error: (09/13/2013 11:23:11 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/13/2013 08:32:24 PM) (Source: Toshiba App Place) (User: )
Description: System.ArgumentOutOfRangeException: Number must be either non-negative and less than or equal to Int32.MaxValue or -1.
Parameter name: dueTime
Stack Trace:
   at System.Threading.Timer..ctor(TimerCallback callback, Object state, Int32 dueTime, Int32 period)
   at System.Timers.Timer.set_Enabled(Boolean value)
   at SnappCloud.ActivationReminder.AraClient.PostInit()
   at SnappCloud.ActivationReminder.Program.Main(String[] args)

Error: (09/13/2013 08:32:01 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/13/2013 07:32:51 AM) (Source: Toshiba App Place) (User: )
Description: System.ArgumentOutOfRangeException: Number must be either non-negative and less than or equal to Int32.MaxValue or -1.
Parameter name: dueTime
Stack Trace:
   at System.Threading.Timer..ctor(TimerCallback callback, Object state, Int32 dueTime, Int32 period)
   at System.Timers.Timer.set_Enabled(Boolean value)
   at SnappCloud.ActivationReminder.AraClient.PostInit()
   at SnappCloud.ActivationReminder.Program.Main(String[] args)

Error: (09/13/2013 07:32:36 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/12/2013 11:03:42 PM) (Source: Toshiba App Place) (User: )
Description: System.ArgumentOutOfRangeException: Number must be either non-negative and less than or equal to Int32.MaxValue or -1.
Parameter name: dueTime
Stack Trace:
   at System.Threading.Timer..ctor(TimerCallback callback, Object state, Int32 dueTime, Int32 period)
   at System.Timers.Timer.set_Enabled(Boolean value)
   at SnappCloud.ActivationReminder.AraClient.PostInit()
   at SnappCloud.ActivationReminder.Program.Main(String[] args)

Error: (09/12/2013 11:03:26 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

System errors:
=============
Error: (09/15/2013 00:31:01 PM) (Source: Service Control Manager) (User: )
Description: The WRSVC service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 10000 milliseconds: Restart the service.

Error: (09/15/2013 08:15:15 AM) (Source: DCOM) (User: )
Description: {4EB61BAC-A3B6-4760-9581-655041EF4D69}

Error: (09/15/2013 08:14:37 AM) (Source: Service Control Manager) (User: )
Description: The Google Update Service (gupdate) service terminated unexpectedly.  It has done this 1 time(s).

Error: (09/15/2013 08:14:09 AM) (Source: Service Control Manager) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service.

Error: (09/14/2013 06:55:10 PM) (Source: Service Control Manager) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Wlansvc service.

Error: (09/14/2013 11:53:31 AM) (Source: Schannel) (User: NT AUTHORITY)
Description: The following fatal alert was generated: 40. The internal error state is 252.

Error: (09/14/2013 11:53:31 AM) (Source: Schannel) (User: NT AUTHORITY)
Description: The following fatal alert was generated: 40. The internal error state is 252.

Error: (09/13/2013 10:42:47 PM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}

Error: (09/13/2013 07:25:09 AM) (Source: DCOM) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Error: (09/11/2013 10:14:32 PM) (Source: DCOM) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

Microsoft Office Sessions:
=========================
Error: (09/15/2013 11:50:58 PM) (Source: Toshiba App Place)(User: )
Description: System.ArgumentOutOfRangeException: Number must be either non-negative and less than or equal to Int32.MaxValue or -1.
Parameter name: dueTime
Stack Trace:
   at System.Threading.Timer..ctor(TimerCallback callback, Object state, Int32 dueTime, Int32 period)
   at System.Timers.Timer.set_Enabled(Boolean value)
   at SnappCloud.ActivationReminder.AraClient.PostInit()
   at SnappCloud.ActivationReminder.Program.Main(String[] args)

Error: (09/15/2013 11:50:39 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/13/2013 11:23:25 PM) (Source: Toshiba App Place)(User: )
Description: System.ArgumentOutOfRangeException: Number must be either non-negative and less than or equal to Int32.MaxValue or -1.
Parameter name: dueTime
Stack Trace:
   at System.Threading.Timer..ctor(TimerCallback callback, Object state, Int32 dueTime, Int32 period)
   at System.Timers.Timer.set_Enabled(Boolean value)
   at SnappCloud.ActivationReminder.AraClient.PostInit()
   at SnappCloud.ActivationReminder.Program.Main(String[] args)

Error: (09/13/2013 11:23:11 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/13/2013 08:32:24 PM) (Source: Toshiba App Place)(User: )
Description: System.ArgumentOutOfRangeException: Number must be either non-negative and less than or equal to Int32.MaxValue or -1.
Parameter name: dueTime
Stack Trace:
   at System.Threading.Timer..ctor(TimerCallback callback, Object state, Int32 dueTime, Int32 period)
   at System.Timers.Timer.set_Enabled(Boolean value)
   at SnappCloud.ActivationReminder.AraClient.PostInit()
   at SnappCloud.ActivationReminder.Program.Main(String[] args)

Error: (09/13/2013 08:32:01 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/13/2013 07:32:51 AM) (Source: Toshiba App Place)(User: )
Description: System.ArgumentOutOfRangeException: Number must be either non-negative and less than or equal to Int32.MaxValue or -1.
Parameter name: dueTime
Stack Trace:
   at System.Threading.Timer..ctor(TimerCallback callback, Object state, Int32 dueTime, Int32 period)
   at System.Timers.Timer.set_Enabled(Boolean value)
   at SnappCloud.ActivationReminder.AraClient.PostInit()
   at SnappCloud.ActivationReminder.Program.Main(String[] args)

Error: (09/13/2013 07:32:36 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (09/12/2013 11:03:42 PM) (Source: Toshiba App Place)(User: )
Description: System.ArgumentOutOfRangeException: Number must be either non-negative and less than or equal to Int32.MaxValue or -1.
Parameter name: dueTime
Stack Trace:
   at System.Threading.Timer..ctor(TimerCallback callback, Object state, Int32 dueTime, Int32 period)
   at System.Timers.Timer.set_Enabled(Boolean value)
   at SnappCloud.ActivationReminder.AraClient.PostInit()
   at SnappCloud.ActivationReminder.Program.Main(String[] args)

Error: (09/12/2013 11:03:26 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

CodeIntegrity Errors:
===================================
  Date: 2013-09-10 05:39:13.858
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

  Date: 2013-09-10 05:39:13.796
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

==================== Memory info ===========================

Percentage of memory in use: 36%
Total physical RAM: 4007.98 MB
Available physical RAM: 2558.27 MB
Total Pagefile: 8014.14 MB
Available Pagefile: 6440.31 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (TI106229W0C) (Fixed) (Total:282.21 GB) (Free:144.28 GB) NTFS ==>[system with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: C010E626)
Partition 1: (Active) - (Size=1 GB) - (Type=27)
Partition 2: (Not Active) - (Size=282 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=14 GB) - (Type=17)

==================== End Of Log ============================

Link to post
Share on other sites

This might have worked!  The program only took a few seconds to run.  I have done about 10 searches but haven't been redirected.  I have seen some pages load with sites something like reachlocal.com, but the site loads with the actual page I clicked on so I am guessing that is some legit marketing thing that I just haven't notice before.

 

Thanks!

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-09-2013
Ran by owner at 2013-09-17 06:54:33 Run:1
Running from C:\Users\owner\Downloads
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
CHR HKLM-x32\...\Chrome\Extension: [ngmmcbedgcbfghamlghhpbpifnbhhpik] - C:\Users\owner\AppData\Local\Temp\crxE35.tmp
Toolbar: HKCU -  No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
 C:\Users\owner\AppData\Local\Temp\crxE35.tmp
C:\Users\owner\AppData\Local\Temp\DefaultAssets.exe
C:\Users\owner\AppData\Local\Temp\NLStubInstallerResources.dll
FF Extension: einszfeapc - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\Extensions\einszfeapc@einszfeapc.org.xpi
Use DeleteJunctionsIndirectory: C:\Windows\system64
*****************

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Value deleted successfully.
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Key not found.
HKCR\PROTOCOLS\Handler\skype-ie-addon-data => Key deleted successfully.
HKCR\CLSID\{91774881-D725-4E58-B298-07617B9B86A8} => Key not found.
HKCR\PROTOCOLS\Filter\application/x-ica => Key deleted successfully.
HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found.
HKCR\PROTOCOLS\Filter\application/x-ica; charset=euc-jp => Key deleted successfully.
HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found.
HKCR\PROTOCOLS\Filter\application/x-ica; charset=ISO-8859-1 => Key deleted successfully.
HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found.
HKCR\PROTOCOLS\Filter\application/x-ica; charset=MS936 => Key deleted successfully.
HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found.
HKCR\PROTOCOLS\Filter\application/x-ica; charset=MS949 => Key deleted successfully.
HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found.
HKCR\PROTOCOLS\Filter\application/x-ica; charset=MS950 => Key deleted successfully.
HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found.
HKCR\PROTOCOLS\Filter\application/x-ica; charset=UTF-8 => Key deleted successfully.
HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found.
HKCR\PROTOCOLS\Filter\application/x-ica; charset=UTF8 => Key deleted successfully.
HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found.
HKCR\PROTOCOLS\Filter\application/x-ica;charset=euc-jp => Key deleted successfully.
HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found.
HKCR\PROTOCOLS\Filter\application/x-ica;charset=ISO-8859-1 => Key deleted successfully.
HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found.
HKCR\PROTOCOLS\Filter\application/x-ica;charset=MS936 => Key deleted successfully.
HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found.
HKCR\PROTOCOLS\Filter\application/x-ica;charset=MS949 => Key deleted successfully.
HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found.
HKCR\PROTOCOLS\Filter\application/x-ica;charset=MS950 => Key deleted successfully.
HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found.
HKCR\PROTOCOLS\Filter\application/x-ica;charset=UTF-8 => Key deleted successfully.
HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found.
HKCR\PROTOCOLS\Filter\application/x-ica;charset=UTF8 => Key deleted successfully.
HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found.
HKCR\PROTOCOLS\Filter\ica => Key deleted successfully.
HKCR\CLSID\{CFB6322E-CC85-4d1b-82C7-893888A236BC} => Key not found.
C:\Users\owner\AppData\Local\Temp\DefaultAssets.exe => Moved successfully.
C:\Users\owner\AppData\Local\Temp\NLStubInstallerResources.dll => Moved successfully.
C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\Extensions\einszfeapc@einszfeapc.org.xpi => Moved successfully.
"C:\Windows\system64" => Deleting reparse point and unlocking started.
"C:\Windows\system64" => Deleting reparse point and unlocking done.
"C:\Windows\system64" => Deleting reparse point and unlocking completed.

==== End of Fixlog ====

Link to post
Share on other sites

This was the culprit:
C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\Extensions\einszfeapc@einszfeapc.org.xpi

~~~~~~~~~~~~~~~~~~~~~~~~~~~`

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • If you get Unsupported operating system. Aborting now, just reboot and try again.
  • A Notepad document should open automatically called checkup.txt.
  • Please Post the contents of that document.
  • Do Not Attach It!!!

MrC

Link to post
Share on other sites

Any info about this?  What problems did this cause and why was it so difficult to remove or anything else?

 

C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\Extensions\einszfeapc@einszfeapc.org.xpi

 

 Results of screen317's Security Check version 0.99.73  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled!  
Webroot SecureAnywhere   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:`````````
 Malwarebytes Anti-Malware version 1.75.0.1300  
 Java 6 Update 22  
 Java 6 Update 25  
 Java version out of Date!
 Adobe Flash Player 11.8.800.168  
 Adobe Reader XI  
 Mozilla Firefox (23.0.1)
 Google Chrome 29.0.1547.62  
 Google Chrome 29.0.1547.66  
````````Process Check: objlist.exe by Laurent````````  
 Norton ccSvcHst.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````
 

Link to post
Share on other sites

Any info about this? What problems did this cause and why was it so difficult to remove or anything else?

C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\x1padiwo.default\Extensions\einszfeapc@einszfeapc.org.xpi

 

It wasn't hard to remove, it's just not in the system...so it's not detected.

If you zip up this folder and attach it, I'll make sure that it get's put into the system and will be detected next time.

C:\FRST\Quarantine

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Out dated programs on the system are vulnerable to malware.

Please update or uninstall them:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please uninstall these and any other Java listed in your add/remove programs:

Java™ 6 Update 22

Java™ 6 Update 25

Java version out of Date! <-------Download and install the latest version (Java™ 7 Update 40) from Here. Uncheck the box to install the Ask toolbar!!! and any other free "stuff".

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

cf2.jpg

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall or download and run the uninstaller)

---------------------------------

If you used FRST:

Download the fixlist.txt to the same folder as FRST.

Run FRST and click Fix only once and wait

That will delete the quarantine folder created by FRST.

-----------------------------

Please download OTC to your desktop.

http://oldtimer.geekstogo.com/OTC.exe

Double-click OTC to run it. (Vista and up users, please right click on OTC and select "Run as an Administrator")

Click on the CleanUp! button and follow the prompts.

(If you get a warning from your firewall or other security programs regarding OTC attempting to contact the Internet, please allow the connection.)

You will be asked to reboot the machine to finish the Cleanup process, choose Yes.

After the reboot all the tools we used should be gone.

Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, MBAR, etc....AdwCleaner > just run the program and click uninstall.

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.