|
|||||||
| Malware Removal Discussion about Trojans, viruses, hoaxes, firewalls, spyware, and general Security issues. If you suspect your PC is infected with a virus, trojan or spyware app please include any supporting documentation or logs |
 |
|
|
Topic Tools |
|
#1
February 13th, 2014, 06:11 AM
|
||||
|
||||
|
Malware issue?
I have this as my startup page on Google Chrome. I know it is something bad for my computer and wondered if you can help me out. Thank you in advance.
Here is the link: http://mysearch.avg.com/?cid={3DAC8EFA-B47C-43E4-AC1B-B90D5A6C8F0A}&mid=aa7997593bfe9c9f87ca27c5d0a2a6b8-4409656dccfc7ae33b81de90e33b54a7dd4a8bf7&lang=en&d s=oc011&coid=avgtbdisoc&cmpid=&pr=sa&d=2014-02-11%2021:42:17&v=17.3.1.91&pid=safeguard&sg=&sap=hp Last edited by werkshop; February 13th, 2014 at 07:00 AM. 
|
|
#2
February 13th, 2014, 03:41 PM
|
||||
|
||||
|
Welcome to the CTH forum,werkshop!
Not at all and please, do the following. Please download Farbar Recovery Scan Tool and save it to a folder. (use correct version for your system)
|
|
#3
February 14th, 2014, 02:54 AM
|
||||
|
||||
|
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-02-2014 01
Ran by Corpuz (administrator) on WERKSHOP on 13-02-2014 17:48:29 Running from C:\Users\Corpuz\Desktop\MALWAREFOLDER Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: English(US) Internet Explorer Version 9 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/down...an-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/down...an-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic...ery-scan-tool/ ==================== Processes (Whitelisted) ================= (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgrsx.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Microsoft Corporation) C:\Windows\system32\SLsvc.exe (Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe () C:\Windows\System32\WLTRYSVC.EXE (Dell Inc.) C:\Windows\System32\bcmwltry.exe (Microsoft Corporation) C:\Windows\system32\WLANExt.exe (SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgidsagent.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgwdsvc.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Nero AG) C:\Program Files\Nero\Update\NASvc.exe (Intuit) C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe (iAnywhere Solutions, Inc.) C:\Program Files\Intuit\QuickBooks 2008\QBDBMgrN.exe () C:\Program Files\Fawkes Engineering\AccuRIP\RipCore.exe (Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (IDT, Inc.) C:\Windows\system32\STacSV.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgnsx.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Dell Inc.) C:\Program Files\Dell\QuickSet\NicConfigSvc.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Stardock Corporation) C:\Program Files\Dell\DellDock\DellDock.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Creative Technology Ltd.) C:\Windows\OEM02Mon.exe (Logitech Inc.) C:\Program Files\Common Files\Logitech\LCD Manager\LCDMon.exe (Dell Inc.) C:\Windows\System32\WLTRAY.EXE (CyberLink Corp.) C:\Program Files\Dell\MediaDirect\PCMService.exe (Citrix Systems, Inc.) C:\Program Files\Citrix\ICA Client\concentr.exe (IDT, Inc.) C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) C:\Windows\System32\mobsync.exe (Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe (Logitech Inc.) C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDClock.exe (Logitech Inc.) C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDPOP3.exe (Logitech Inc.) C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDMedia.exe (Citrix Systems, Inc.) C:\Program Files\Citrix\ICA Client\wfcrun32.exe (Logitech Inc.) C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDCountdown.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil32_11_ 2_202_235_ActiveX.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Microsoft Corporation) C:\Windows\system32\msiexec.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgcsrvx.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1029416 2008-03-27] (Synaptics, Inc.) HKLM\...\Run: [OEM02Mon.exe] - C:\Windows\OEM02Mon.exe [36864 2007-12-02] (Creative Technology Ltd.) HKLM\...\Run: [Launch LCDMon] - C:\Program Files\Common Files\Logitech\LCD Manager\LCDMon.exe [775952 2007-07-18] (Logitech Inc.) HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Windows\system32\WLTRAY.exe [3563520 2008-10-27] (Dell Inc.) HKLM\...\Run: [PCMService] - C:\Program Files\Dell\MediaDirect\PCMService.exe [184320 2008-11-06] (CyberLink Corp.) HKLM\...\Run: [NvCplDaemon] - C:\Windows\system32\NvCpl.dll [13793824 2009-06-16] (NVIDIA Corporation) HKLM\...\Run: [NVHotkey] - C:\Windows\system32\nvHotkey.dll [92704 2009-06-16] (NVIDIA Corporation) HKLM\...\Run: [ConnectionCenter] - C:\Program Files\Citrix\ICA Client\concentr.exe [305088 2011-04-25] (Citrix Systems, Inc.) HKLM\...\Run: [SigmatelSysTrayApp] - C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe [405504 2008-01-01] (IDT, Inc.) HKU\S-1-5-21-2681079163-3059944450-1427626601-1000\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-20] (Microsoft Corporation) HKU\S-1-5-21-2681079163-3059944450-1427626601-1000\...\Run: [AVG-Secure-Search-Update_0214c] - C:\Users\Corpuz\AppData\Roaming\AVG 0214c Campaign\AVG-Secure-Search-Update-0214c.exe /PROMPT /mid=aa7997593bfe9c9f87ca27c5d0a2a6b8-4409656dccfc7ae33b81de90e33b54a7dd4a8bf7 /CMPID=0214c Startup: C:\Users\Corpuz\AppData\Roaming\Microsoft\Windows\ Start Menu\Programs\Startup\Dell Dock.lnk ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation) Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows \Start Menu\Programs\Startup\Dell Dock First Run.lnk ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation) Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation) Startup: C:\Users\QBDataServiceUser18\AppData\Roaming\Micro soft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir...ie&ar=iesearch SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKLM - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} URL = http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg-chrome&type=yahoo_avg_hs2-tb-web_chrome_us&p={searchTerms} SearchScopes: HKCU - DefaultScope {01ED202A-EF3C-403D-88A9-17BF7B50D27A} URL = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language }&ie={inputEncoding}&oe={outputEncoding}&startInde x={startIndex?}&startPage={startPage} SearchScopes: HKCU - {01ED202A-EF3C-403D-88A9-17BF7B50D27A} URL = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language }&ie={inputEncoding}&oe={outputEncoding}&startInde x={startIndex?}&startPage={startPage} SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - {A86CB93C-AF88-B5FE-F4D9-E79E5C6A4474} URL = http://www.bing.com/search?q={searchTerms}&pc=ZUGO&form=ZGAIDF SearchScopes: HKCU - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} URL = BHO: Octh Class - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com) BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation) BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKLM - Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll () Toolbar: HKCU - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation) Toolbar: HKCU - Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll () DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/...Uploader55.cab DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} http://tools.ebayimg.com/eps/wl/acti..._v1-0-31-0.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: intu-help-qb1 - {9B0F96C7-2E4B-433e-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll (TODO: <Company name>) Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - No File Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\system32\mscoree.dll (Microsoft Corporation) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) ShellExecuteHooks: - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No File [ ] Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.) FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\CCMSDK.dll (Citrix Systems, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\cgpcfg.dll (Citrix Systems, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\CgpCore.dll (Citrix Systems, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\confmgr.dll (Citrix Systems, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\ctxlogging.dll (Citrix Systems, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\ctxmui.dll (Citrix Systems, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\icafile.dll (Citrix Systems, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\icalogon.dll (Citrix Systems, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npicaN.dll () FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\sslsdk_b.dll (Citrix Systems, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\TcpPServ.dll (Citrix Systems, Inc.) FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [] FF HKLM\...\Firefox\Extensions: [{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}] - C:\Program Files\Updater By SweetPacks\Firefox FF HKCU\...\Firefox\Extensions: [VideoBar@meep.com] - C:\Program Files\Meep\FF\ Chrome: ======= CHR HomePage: https://www.google.com/ CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\32.0.1700.107\Pepp erFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\32.0.1700.107\ppGo ogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\32.0.1700.107\pdf. dll () CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.) CHR Plugin: (DivX Web Player) - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.) CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll () CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) CHR Extension: (Google Drive) - C:\Users\Corpuz\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigk jlhalf [2013-07-27] CHR Extension: (YouTube) - C:\Users\Corpuz\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldk acnbeo [2013-07-27] CHR Extension: (Google Search) - C:\Users\Corpuz\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljnie djpjpf [2013-07-27] CHR Extension: (Google Wallet) - C:\Users\Corpuz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccm gmieda [2013-08-23] CHR Extension: (Gmail) - C:\Users\Corpuz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoe jaedia [2013-07-27] CHR HKLM\...\Chrome\Extension: [hbcennhacfaagdopikcegfcobcadeocj] - C:\Program Files\Common Files\Spigot\GC\saebay_1.0.crx [2013-07-27] CHR HKLM\...\Chrome\Extension: [icdlfehblmklkikfigmjhbmmpmkmpooj] - C:\Program Files\Common Files\Spigot\GC\errorassistant_1.1.crx [2013-07-27] CHR HKLM\...\Chrome\Extension: [mhkaekfpcppmmioggniknbnbdbcigpkk] - C:\Users\Corpuz\AppData\Local\Slick Savings\coupons.crx [2013-06-08] CHR HKLM\...\Chrome\Extension: [pfndaklgolladniicklehhancnlgocpp] - C:\Program Files\Common Files\Spigot\GC\saamazon_1.0.crx [2013-06-08] ========================== Services (Whitelisted) ================= S3 Adobe Version Cue CS3; C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe [153792 2007-03-20] (Adobe Systems Incorporated) R2 AVGIDSAgent; C:\Program Files\AVG\AVG2014\avgidsagent.exe [3478544 2013-11-11] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files\AVG\AVG2014\avgwdsvc.exe [348008 2013-09-24] (AVG Technologies CZ, s.r.o.) R2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2008-09-23] (Stardock Corporation) R2 EpsonBidirectionalService; C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION) S2 MSSQL$SONY_MEDIAMGR; C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe [7520337 2002-12-17] (Microsoft Corporation) S3 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe [66112 2002-12-17] (Microsoft Corporation) R2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [490280 2010-03-25] (Nero AG) R2 nicconfigsvc; C:\Program Files\Dell\QuickSet\NicConfigSvc.exe [390424 2008-02-22] (Dell Inc.) R2 QuickBooksDB18; C:\Program Files\Intuit\QuickBooks 2008\QBDBMgrN.exe [128536 2006-09-13] (iAnywhere Solutions, Inc.) R2 RipCore; C:\Program Files\Fawkes Engineering\AccuRIP\RipCore.exe [1871872 2009-06-11] () S3 SQLAgent$SONY_MEDIAMGR; C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE [311872 2002-12-17] (Microsoft Corporation) R2 wltrysvc; C:\Windows\System32\bcmwltry.exe [2654208 2008-10-27] (Dell Inc.) ==================== Drivers (Whitelisted) ==================== R1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [120600 2013-11-05] (AVG Technologies CZ, s.r.o.) R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [209176 2013-11-04] (AVG Technologies CZ, s.r.o.) R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [147768 2013-10-24] (AVG Technologies CZ, s.r.o.) R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [22840 2013-09-17] (AVG Technologies CZ, s.r.o.) R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [176952 2013-10-31] (AVG Technologies CZ, s.r.o.) R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [222520 2013-10-31] (AVG Technologies CZ, s.r.o.) R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [102712 2013-10-01] (AVG Technologies CZ, s.r.o.) R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [27448 2013-09-10] (AVG Technologies CZ, s.r.o.) R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [193848 2013-08-01] (AVG Technologies CZ, s.r.o.) R3 BCM42RLY; C:\Windows\System32\drivers\BCM42RLY.sys [18424 2008-10-27] (Broadcom Corporation) S2 DgiVecp; C:\Windows\System32\Drivers\DgiVecp.sys [40448 2003-07-28] (DeviceGuys, Inc.) S4 sptd; C:\Windows\System32\Drivers\sptd.sys [716272 2009-01-14] (Duplex Secure Ltd.) S3 usbbus; C:\Windows\System32\DRIVERS\lgusbbus.sys [21344 2005-05-26] (LG Electronics Inc.) S3 UsbDiag; C:\Windows\System32\DRIVERS\lgusbdiag.sys [38144 2005-05-26] (LG Electronics Inc.) S3 USBModem; C:\Windows\System32\DRIVERS\lgusbmodem.sys [39036 2005-06-24] (LG Electronics Inc.) U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-20] (Microsoft Corporation) S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-02-13 17:48 - 2014-02-13 17:48 - 00000000 ____D () C:\FRST 2014-02-13 17:47 - 2014-02-13 17:48 - 00000000 ____D () C:\Users\Corpuz\Desktop\MALWAREFOLDER 2014-02-12 20:39 - 2014-02-12 20:39 - 00000000 ____D () C:\Program Files\Enigma Software Group 2014-02-12 20:38 - 2014-02-12 21:04 - 00000000 ____D () C:\Windows\455F074C814E4520B69B5584BD90400C.TMP 2014-02-12 20:38 - 2014-02-12 20:38 - 00000000 ____D () C:\Program Files\Common Files\Wise Installation Wizard 2014-02-12 20:23 - 2014-02-12 20:23 - 00000000 ____D () C:\ProgramData\PC1Data 2014-02-12 20:23 - 2014-02-12 20:22 - 06346448 _____ (PC Cleaners) C:\ProgramData\pclunst.exe 2014-02-12 17:05 - 2014-02-12 17:05 - 00000598 _____ () C:\Windows\PFRO.log 2014-02-11 22:02 - 2014-02-05 00:58 - 12345344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-11 22:02 - 2014-02-05 00:56 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-02-11 22:02 - 2014-02-05 00:53 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-11 22:02 - 2014-02-05 00:51 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-11 22:02 - 2014-02-05 00:50 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-11 22:02 - 2014-02-05 00:49 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-02-11 22:02 - 2014-02-05 00:49 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-02-11 22:02 - 2014-02-05 00:48 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-11 22:02 - 2014-02-05 00:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-02-11 22:02 - 2014-02-05 00:48 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-02-11 22:02 - 2014-02-05 00:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-02-11 22:02 - 2014-02-05 00:48 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-11 22:02 - 2014-02-05 00:47 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-11 22:02 - 2014-02-05 00:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-11 22:02 - 2014-02-05 00:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-02-11 22:02 - 2014-02-05 00:46 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-02-11 21:37 - 2014-02-11 21:37 - 00000000 ____D () C:\Users\Corpuz\AppData\Roaming\Philipp Winterberg 2014-02-11 21:36 - 2014-02-11 21:36 - 00000000 ____D () C:\Users\Corpuz\AppData\Roaming\OpenCandy 2014-02-11 20:27 - 2014-02-11 20:46 - 57445495 _____ () C:\Users\Corpuz\Downloads\AvidProtools10win.cracke d.part09.rar 2014-02-11 18:54 - 2013-12-04 18:12 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-02-11 17:55 - 2014-02-11 19:04 - 209715200 _____ () C:\Users\Corpuz\Downloads\AvidProtools10win.cracke d.part08.rar 2014-02-10 21:59 - 2014-02-10 23:08 - 209715200 _____ () C:\Users\Corpuz\Downloads\AvidProtools10win.cracke d.part07.rar 2014-02-10 19:35 - 2014-02-10 20:43 - 209715200 _____ () C:\Users\Corpuz\Downloads\AvidProtools10win.cracke d.part06.rar 2014-02-09 21:05 - 2014-02-09 22:14 - 209715200 _____ () C:\Users\Corpuz\Downloads\AvidProtools10win.cracke d.part05.rar 2014-02-09 19:01 - 2014-02-09 20:09 - 209715200 _____ () C:\Users\Corpuz\Downloads\AvidProtools10win.cracke d.part04.rar 2014-02-09 16:09 - 2014-02-09 17:18 - 209715200 _____ () C:\Users\Corpuz\Downloads\AvidProtools10win.cracke d.part03.rar 2014-02-09 14:08 - 2014-02-09 15:16 - 209715200 _____ () C:\Users\Corpuz\Downloads\AvidProtools10win.cracke d.part02.rar 2014-02-09 12:05 - 2014-02-09 13:13 - 209715200 _____ () C:\Users\Corpuz\Downloads\AvidProtools10win.cracke d.part01.rar 2014-02-08 20:35 - 2014-02-08 20:35 - 00000000 ____D () C:\Users\Corpuz\AppData\Local\Microsoft Corporation 2014-02-05 20:53 - 2014-02-05 20:53 - 00000104 _____ () C:\Users\Corpuz\Desktop\Recycle Bin - Shortcut (2).lnk 2014-02-05 20:52 - 2014-02-05 20:52 - 00000104 _____ () C:\Users\Corpuz\Desktop\Recycle Bin.lnk 2014-02-04 18:35 - 2014-02-04 18:35 - 00000000 ____D () C:\Users\Corpuz\Documents\SecurDisc Key Data ==================== One Month Modified Files and Folders ======= 2014-02-13 17:48 - 2014-02-13 17:48 - 00000000 ____D () C:\FRST 2014-02-13 17:48 - 2014-02-13 17:47 - 00000000 ____D () C:\Users\Corpuz\Desktop\MALWAREFOLDER 2014-02-13 17:46 - 2011-04-28 23:20 - 00000000 ____D () C:\ProgramData\MFAData 2014-02-13 17:46 - 2009-04-02 14:18 - 01356207 _____ () C:\Windows\WindowsUpdate.log 2014-02-13 17:45 - 2009-07-12 22:33 - 00009160 _____ () C:\Users\Corpuz\AppData\Local\d3d9caps.dat 2014-02-13 17:44 - 2012-12-17 23:31 - 00000882 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-02-13 17:44 - 2010-10-24 19:46 - 00000314 _____ () C:\Windows\Tasks\GlaryInitialize.job 2014-02-13 17:40 - 2006-11-02 05:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-02-13 17:40 - 2006-11-02 04:47 - 00003744 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2014-02-13 17:40 - 2006-11-02 04:47 - 00003744 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2014-02-13 00:11 - 2008-12-23 18:20 - 00000012 _____ () C:\Windows\bthservsdp.dat 2014-02-13 00:11 - 2006-11-02 05:01 - 00032558 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-02-13 00:05 - 2012-12-17 23:31 - 00000886 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-02-12 21:04 - 2014-02-12 20:38 - 00000000 ____D () C:\Windows\455F074C814E4520B69B5584BD90400C.TMP 2014-02-12 20:39 - 2014-02-12 20:39 - 00000000 ____D () C:\Program Files\Enigma Software Group 2014-02-12 20:38 - 2014-02-12 20:38 - 00000000 ____D () C:\Program Files\Common Files\Wise Installation Wizard 2014-02-12 20:23 - 2014-02-12 20:23 - 00000000 ____D () C:\ProgramData\PC1Data 2014-02-12 20:22 - 2014-02-12 20:23 - 06346448 _____ (PC Cleaners) C:\ProgramData\pclunst.exe 2014-02-12 18:12 - 2006-11-02 03:18 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-02-12 17:35 - 2013-01-11 00:17 - 00000000 ____D () C:\Users\Corpuz\Desktop\Orbit 2014-02-12 17:35 - 2009-01-29 20:15 - 00000000 ____D () C:\Users\Corpuz\Desktop\WerkshopQB 2014-02-12 17:05 - 2014-02-12 17:05 - 00000598 _____ () C:\Windows\PFRO.log 2014-02-11 22:12 - 2006-11-02 02:33 - 00804346 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-02-11 22:10 - 2013-08-15 02:15 - 00000000 ____D () C:\Windows\system32\MRT 2014-02-11 22:07 - 2006-11-02 02:24 - 85946576 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2014-02-11 21:37 - 2014-02-11 21:37 - 00000000 ____D () C:\Users\Corpuz\AppData\Roaming\Philipp Winterberg 2014-02-11 21:36 - 2014-02-11 21:36 - 00000000 ____D () C:\Users\Corpuz\AppData\Roaming\OpenCandy 2014-02-11 20:46 - 2014-02-11 20:27 - 57445495 _____ () C:\Users\Corpuz\Downloads\AvidProtools10win.cracke d.part09.rar 2014-02-11 19:04 - 2014-02-11 17:55 - 209715200 _____ () C:\Users\Corpuz\Downloads\AvidProtools10win.cracke d.part08.rar 2014-02-10 23:08 - 2014-02-10 21:59 - 209715200 _____ () C:\Users\Corpuz\Downloads\AvidProtools10win.cracke d.part07.rar 2014-02-10 20:43 - 2014-02-10 19:35 - 209715200 _____ () C:\Users\Corpuz\Downloads\AvidProtools10win.cracke d.part06.rar 2014-02-09 22:14 - 2014-02-09 21:05 - 209715200 _____ () C:\Users\Corpuz\Downloads\AvidProtools10win.cracke d.part05.rar 2014-02-09 20:09 - 2014-02-09 19:01 - 209715200 _____ () C:\Users\Corpuz\Downloads\AvidProtools10win.cracke d.part04.rar 2014-02-09 17:18 - 2014-02-09 16:09 - 209715200 _____ () C:\Users\Corpuz\Downloads\AvidProtools10win.cracke d.part03.rar 2014-02-09 15:16 - 2014-02-09 14:08 - 209715200 _____ () C:\Users\Corpuz\Downloads\AvidProtools10win.cracke d.part02.rar 2014-02-09 13:13 - 2014-02-09 12:05 - 209715200 _____ () C:\Users\Corpuz\Downloads\AvidProtools10win.cracke d.part01.rar 2014-02-09 12:11 - 2009-11-10 15:05 - 00000000 ____D () C:\Program Files\Canon 2014-02-08 20:35 - 2014-02-08 20:35 - 00000000 ____D () C:\Users\Corpuz\AppData\Local\Microsoft Corporation 2014-02-06 18:41 - 2012-02-19 17:35 - 00000000 ____D () C:\Users\Corpuz\Desktop\GO LOOK FOR A JOB YOU RN 2014-02-05 20:53 - 2014-02-05 20:53 - 00000104 _____ () C:\Users\Corpuz\Desktop\Recycle Bin - Shortcut (2).lnk 2014-02-05 20:52 - 2014-02-05 20:52 - 00000104 _____ () C:\Users\Corpuz\Desktop\Recycle Bin.lnk 2014-02-05 00:58 - 2014-02-11 22:02 - 12345344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-05 00:56 - 2014-02-11 22:02 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-02-05 00:53 - 2014-02-11 22:02 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-05 00:51 - 2014-02-11 22:02 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-05 00:50 - 2014-02-11 22:02 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-05 00:49 - 2014-02-11 22:02 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-02-05 00:49 - 2014-02-11 22:02 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-02-05 00:48 - 2014-02-11 22:02 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-05 00:48 - 2014-02-11 22:02 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-02-05 00:48 - 2014-02-11 22:02 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-02-05 00:48 - 2014-02-11 22:02 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-02-05 00:48 - 2014-02-11 22:02 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-05 00:47 - 2014-02-11 22:02 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-05 00:47 - 2014-02-11 22:02 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-05 00:47 - 2014-02-11 22:02 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-02-05 00:46 - 2014-02-11 22:02 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-02-04 21:03 - 2009-01-29 07:57 - 00000000 ____D () C:\Users\Corpuz\Desktop\Werkshop2009Artwerk 2014-02-04 20:45 - 2010-05-31 20:24 - 00000000 ____D () C:\Users\Corpuz\Desktop\2010Projects 2014-02-04 20:40 - 2012-03-21 21:09 - 00000000 ____D () C:\Users\Corpuz\Desktop\itouch 2014-02-04 20:15 - 2011-08-01 20:09 - 00000000 ____D () C:\Users\Corpuz\Desktop\New Folder 2014-02-04 18:35 - 2014-02-04 18:35 - 00000000 ____D () C:\Users\Corpuz\Documents\SecurDisc Key Data 2014-02-04 18:23 - 2006-11-02 04:47 - 01748920 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-02-03 21:24 - 2010-08-01 13:40 - 00000000 ____D () C:\Users\Corpuz\AppData\Roaming\SanDisk 2014-02-03 20:45 - 2009-01-09 22:52 - 00112000 _____ () C:\Users\Corpuz\AppData\Local\GDIPFONTCACHEV1.DAT 2014-02-03 20:16 - 2009-01-11 22:49 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-02-03 19:23 - 2013-07-27 09:17 - 00001933 _____ () C:\Users\Public\Desktop\Google Chrome.lnk Files to move or delete: ==================== C:\Users\Corpuz\AppData\Roaming\desktop.ini C:\ProgramData\pclunst.exe Some content of TEMP: ==================== C:\Users\Corpuz\AppData\Local\temp\oi_{75CCED36-7FC8-448C-A4D2-B377CC8C55BA}.exe C:\Users\Corpuz\AppData\Local\temp\SHSetup.exe C:\Users\Corpuz\AppData\Local\temp\UNINSTALL.EXE ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\system32\winlogon.exe => MD5 is legit C:\Windows\system32\wininit.exe => MD5 is legit C:\Windows\system32\svchost.exe => MD5 is legit C:\Windows\system32\services.exe => MD5 is legit C:\Windows\system32\User32.dll => MD5 is legit C:\Windows\system32\userinit.exe => MD5 is legit C:\Windows\system32\rpcss.dll => MD5 is legit C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-02-13 17:49 ==================== End Of Log ============================
|
|
#4
February 14th, 2014, 02:55 AM
|
||||
|
||||
|
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 12-02-2014 01
Ran by Corpuz at 2014-02-13 17:50:45 Running from C:\Users\Corpuz\Desktop\MALWAREFOLDER Boot Mode: Normal ================================================== ======== ==================== Security Center ======================== AV: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664} ==================== Installed Programs ====================== Sansa Media Converter (Version: 1.0-B4.256 - ) Update for Microsoft Office 2007 (KB2508958) (Version: - Microsoft) µTorrent (HKCU Version: 3.3.2.30303 - BitTorrent Inc.) 7-Zip 4.65 (Version: - ) AccuRIP 01.01.053 - Fawkes Engineering (Version: - ) Add or Remove Adobe Creative Suite 3 Design Premium (Version: 1.0 - Adobe Systems Incorporated) Adobe Acrobat 8 Professional (Version: 8.1.3 - Adobe Systems) Hidden Adobe Anchor Service CS3 (Version: 1.0 - Adobe Systems Incorporated) Hidden Adobe Asset Services CS3 (Version: 3 - Adobe Systems Incorporated) Hidden Adobe Bridge CS3 (Version: 2 - Adobe Systems Incorporated) Hidden Adobe Bridge Start Meeting (Version: 1.0 - Adobe Systems Incorporated) Hidden Adobe BridgeTalk Plugin CS3 (Version: 1.0 - Adobe Systems Incorporated) Hidden Adobe Camera Raw 4.0 (Version: 4.0 - Adobe Systems Incorporated) Hidden Adobe CMaps (Version: 1.0 - Adobe Systems Incorporated) Hidden Adobe Color - Photoshop Specific (Version: 1.0 - Adobe Systems Incorporated) Hidden Adobe Color Common Settings (Version: 1.0 - Adobe Systems Incorporated) Hidden Adobe Color EU Extra Settings (Version: 1.0 - Adobe Systems Incorporated) Hidden Adobe Color JA Extra Settings (Version: 1.0 - Adobe Systems Incorporated) Hidden Adobe Color NA Recommended Settings (Version: 1.0 - Adobe Systems Incorporated) Hidden Adobe Creative Suite 3 Design Premium (Version: 1.0 - Adobe Systems Incorporated) Hidden Adobe Default Language CS3 (Version: 1.0 - Adobe Systems Incorporated) Hidden Adobe Device Central CS3 (Version: 1.0 - Adobe Systems Incorporated) Hidden Adobe Dreamweaver CS3 (Version: 9 - Adobe Systems Incorporated) Hidden Adobe ExtendScript Toolkit 2 (Version: 2.0 - Adobe Systems Incorporated) Hidden Adobe Extension Manager CS3 (Version: 1.8 - Adobe Systems Incorporated) Hidden Adobe Flash CS3 (Version: 9.0 - Adobe Systems Incorporated) Hidden Adobe Flash Player 10 Plugin (Version: 10.1.53.64 - Adobe Systems Incorporated) Adobe Flash Player 11 ActiveX (Version: 11.2.202.235 - Adobe Systems Incorporated) Adobe Flash Video Encoder (Version: 2.0 - Adobe Systems Incorporated) Hidden Adobe Fonts All (Version: 1.0 - Adobe Systems Incorporated) Hidden Adobe Help Viewer CS3 (Version: 1 - Adobe Systems Incorporated) Hidden Adobe Illustrator CS3 (Version: 13.0 - Adobe Systems Incorporated) Hidden Adobe InDesign CS3 (Version: 5.0 - Adobe Systems Incorporated) Hidden Adobe InDesign CS3 Icon Handler (Version: 5.0 - Adobe Systems Incorporated) Hidden Adobe Linguistics CS3 (Version: 3.0.0 - Adobe Systems Incorporated) Hidden Adobe MotionPicture Color Files (Version: 1.0 - Adobe Systems Incorporated) Hidden Adobe PDF Library Files (Version: 8.0 - Adobe Systems Incorporated) Hidden Adobe Photoshop CS3 (Version: 10 - Adobe Systems Incorporated) Hidden Adobe Reader 8.1.3 (Version: 8.1.3 - Adobe Systems Incorporated) Adobe Setup (Version: 1.0 - Adobe Systems Incorporated) Hidden Adobe SING CS3 (Version: 0.1 - Adobe Systems Incorporated) Hidden Adobe Stock Photos CS3 (Version: 1.5 - Adobe Systems Incorporated) Hidden Adobe Type Support (Version: 1.0 - Adobe Systems Incorporated) Hidden Adobe Update Manager CS3 (Version: 5.1.0 - Adobe Systems Incorporated) Hidden Adobe Version Cue CS3 Client (Version: 3 - Adobe Systems Incorporated) Hidden Adobe Version Cue CS3 Server (Version: 3.0 - Adobe Systems Incorporated) Hidden Adobe WAS CS3 (Version: 1.0 - Adobe Systems Incorporated) Hidden Adobe WinSoft Linguistics Plugin (Version: 1.0 - Adobe Systems Incorporated) Hidden Adobe XMP Panels CS3 (Version: 1.0 - Adobe Systems Incorporated) Hidden Advanced Audio FX Engine (Version: - ) Advanced Video FX Engine (Version: - ) AHV content for Acrobat and Flash (Version: 1 - Adobe Systems Incorporated) Hidden Apple Application Support (Version: 2.3.6 - Apple Inc.) Apple Mobile Device Support (Version: 7.0.0.117 - Apple Inc.) Apple Software Update (Version: 2.1.3.127 - Apple Inc.) AVG 2014 (Version: 14.0.3705 - AVG Technologies) Hidden AVG 2014 (Version: 14.0.4259 - AVG Technologies) Hidden AVG 2014 (Version: 2014.0.4259 - AVG Technologies) AviSynth 2.5 (Version: - ) Bejeweled Twist 1.0 (Version: 1.0 - PopCap Games) Bonjour (Version: 3.0.0.10 - Apple Inc.) Broadcom Management Programs (Version: 10.20.03 - Broadcom Corporation) Canon MP Navigator EX 2.1 (Version: - ) Canon MX330 series MP Drivers (Version: - ) Canon MX330 series User Registration (Version: - ) CCleaner (remove only) (Version: - ) Cisco EAP-FAST Module (Version: 2.1.3 - Cisco Systems, Inc.) Cisco LEAP Module (Version: 1.0.12 - Cisco Systems, Inc.) Cisco PEAP Module (Version: 1.0.13 - Cisco Systems, Inc.) Citrix online plug-in - web (Version: 12.1.44.1 - Citrix Systems, Inc.) Citrix online plug-in (DV) (Version: 12.1.44.1 - Citrix Systems, Inc.) Hidden Citrix online plug-in (HDX) (Version: 12.1.44.1 - Citrix Systems, Inc.) Hidden Citrix online plug-in (USB) (Version: 12.1.44.1 - Citrix Systems, Inc.) Hidden Citrix online plug-in (Web) (Version: 12.1.44.1 - Citrix Systems, Inc.) Hidden Compatibility Pack for the 2007 Office system (Version: 12.0.6612.1000 - Microsoft Corporation) ConvertXtoDVD 2.2.3.258 (Version: 2.2.3.258 - VSO-Software SARL) D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden Dell Dock (Version: 1.0.0 - Dell) Dell Driver Download Manager (HKCU Version: 1.0.0.0 - Dell Inc.) Dell Getting Started Guide (Version: 1.00.0000 - Dell Inc.) Dell Touchpad (Version: 10.1.2.0 - Synaptics) Dell Webcam Center (Version: - ) Dell Webcam Manager (Version: - ) Dell Wireless WLAN Card Utility (Version: 4.170.77.17 - Dell Inc.) DivX Setup (Version: 1.0.2.23 - DivX, Inc. ) Documents To Go Desktop for iPhone (Version: 2.0000.006 - DataViz, Inc.) DVD Shrink 3.2 (Version: - DVD Shrink) DVDFab 8.1.0.5 (04/07/2011) Qt (Version: - Fengtao Software Inc.) EDocs (Version: - ) EPSON Printer Software (Version: - ) EpsonNet Config V2 (Version: 2.2b - SEIKO EPSON CORPORATION) ESET Online Scanner v3 (Version: - ) FL Studio 11 (Version: - Image-Line) FlowStone FL 3.0 (Version: - ) FrostWire 5.3.8 (Version: 5.3.8.0 - FrostWire Team) FruityLoops v3.4 (Version: - ) GameSpy Arcade (Version: - ) Glary Utilities 2.29.0.1032 (Version: 2.29.0.1032 - Glarysoft Ltd) Google Chrome (Version: 32.0.1700.107 - Google Inc.) Google Earth Plug-in (Version: 7.1.2.2041 - Google) Google Update Helper (Version: 1.3.22.3 - Google Inc.) Hidden High-Definition Video Playback 10 (Version: 7.0.11400.29.0 - Nero AG) Hidden IL Download Manager (Version: - Image-Line) IL Shared Libraries (Version: - Image-Line) ImTOO DVD Creator (Version: 3.0.38.0822 - ImTOO) InfraRecorder (Version: - ) Intel® Matrix Storage Manager (Version: - Intel Corporation) iTunes (Version: 11.1.3.8 - Apple Inc.) Java Auto Updater (Version: 2.0.7.1 - Sun Microsystems, Inc.) Hidden Java(TM) 6 Update 31 (Version: 6.0.310 - Oracle) Laptop Integrated Webcam Driver (1.04.01.1011) (Version: - ) Logitech Gaming LCD Software 1.04 (Version: 1.04.158 - Logitech) MagicDisc 2.7.106 (Version: - ) Malwarebytes' Anti-Malware (Version: - Malwarebytes Corporation) MediaDirect (Version: 3.5 - Dell) Microsoft .NET Framework 1.1 (Version: - ) Microsoft .NET Framework 1.1 (Version: 1.1.4322 - Microsoft) Hidden Microsoft .NET Framework 1.1 Security Update (KB2698023) (Version: - ) Microsoft .NET Framework 1.1 Security Update (KB2833941) (Version: - ) Microsoft .NET Framework 1.1 Security Update (KB979906) (Version: - ) Microsoft .NET Framework 3.5 SP1 (Version: - Microsoft Corporation) Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden Microsoft Halo (Version: - Microsoft) Microsoft Office 2007 Service Pack 3 (SP3) (Version: - Microsoft) Microsoft Office 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden Microsoft Office Access MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Access Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office File Validation Add-In (Version: 14.0.5130.5003 - Microsoft Corporation) Microsoft Office InfoPath MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1 - Microsoft Corporation) Microsoft Office Outlook Connector (Version: 14.0.5118.5000 - Microsoft Corporation) Microsoft Office Outlook MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Professional Plus 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Professional Plus 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden Microsoft Office Publisher MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Primary Interoperability Assemblies 2005 (Version: 8.0.50727.42 - Microsoft Corporation) Microsoft Search Enhancement Pack (Version: 3.0.133.0 - Microsoft Corporation) Hidden Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000 - Microsoft Corporation) Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR) (Version: 8.00.761 - Microsoft Corporation) Microsoft VC9 runtime libraries (Version: 2.0.0 - AOL Inc.) Hidden Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Windows Media Video 9 VCM (Version: - ) Microsoft Works (Version: 9.7.0621 - Microsoft Corporation) MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden MSVCRT Redists (Version: 1.0 - Sony Creative Software Inc.) Hidden MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0 - Microsoft Corporation) MSXML 4.0 SP2 Parser and SDK (Version: 4.20.9818.0 - Microsoft Corporation) Nero 10 Menu TemplatePack Basic (Version: 10.0.10600.6.0 - Nero AG) Hidden Nero 10 Movie ThemePack Basic (Version: 10.0.10600.6.0 - Nero AG) Hidden Nero BackItUp 10 (Version: 5.4.11600.19.100 - Nero AG) Nero BackItUp 10 Help (CHM) (Version: 1.0.10700 - Nero AG) Hidden Nero Burning ROM 10 (Version: 10.0.11100.10.100 - Nero AG) Nero BurningROM 10 Help (CHM) (Version: 1.0.10700 - Nero AG) Hidden Nero BurnRights 10 (Version: 4.0.11000.12.100 - Nero AG) Nero BurnRights 10 Help (CHM) (Version: 1.0.10600 - Nero AG) Hidden Nero Control Center 10 (Version: 10.0.12000.1.4 - Nero AG) Hidden Nero ControlCenter 10 Help (CHM) (Version: 1.0.10700 - Nero AG) Hidden Nero Core Components 10 (Version: 2.0.13700.0.1 - Nero AG) Hidden Nero CoverDesigner 10 (Version: 5.0.10900.11.100 - Nero AG) Nero CoverDesigner 10 Help (CHM) (Version: 1.0.10600 - Nero AG) Hidden Nero DiscCopy Gadget 10 (Version: 3.0.10700.9.100 - Nero AG) Nero DiscCopyGadget 10 Help (CHM) (Version: 1.0.10600 - Nero AG) Hidden Nero DiscSpeed 10 (Version: 6.0.10800.7.100 - Nero AG) Nero DiscSpeed 10 Help (CHM) (Version: 1.0.10600 - Nero AG) Hidden Nero Dolby Files 10 (Version: 2.0.11000.0.10 - Nero AG) Hidden Nero Express 10 (Version: 10.0.11000.10.100 - Nero AG) Nero Express 10 Help (CHM) (Version: 1.0.10700 - Nero AG) Hidden Nero InfoTool 10 (Version: 7.0.10800.8.100 - Nero AG) Nero InfoTool 10 Help (CHM) (Version: 1.0.10600 - Nero AG) Hidden Nero MediaHub 10 (Version: 1.0.13400.11.100 - Nero AG) Nero MediaHub 10 Help (CHM) (Version: 1.0.10700 - Nero AG) Hidden Nero Multimedia Suite 10 (Version: 10.0.13100 - Nero AG) Nero Recode 10 (Version: 4.6.10900.4.100 - Nero AG) Nero Recode 10 Help (CHM) (Version: 1.0.10600 - Nero AG) Hidden Nero RescueAgent 10 (Version: 3.0.10900.9.100 - Nero AG) Nero RescueAgent 10 Help (CHM) (Version: 1.0.10700 - Nero AG) Hidden Nero SoundTrax 10 (Version: 4.6.10600.2.100 - Nero AG) Nero SoundTrax 10 Help (CHM) (Version: 1.0.10600 - Nero AG) Hidden Nero StartSmart 10 (Version: 10.0.11200.12.100 - Nero AG) Nero StartSmart 10 Help (CHM) (Version: 1.0.10700 - Nero AG) Hidden Nero Update (Version: 1.0.0017 - Nero AG) Nero Vision 10 (Version: 7.0.11100.8.100 - Nero AG) Nero Vision 10 Help (CHM) (Version: 1.0.10600 - Nero AG) Hidden Nero WaveEditor 10 (Version: 5.6.10600.2.100 - Nero AG) Nero WaveEditor 10 Help (CHM) (Version: 1.0.10600 - Nero AG) Hidden NVIDIA Drivers (Version: 1.3 - NVIDIA Corporation) OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden Orbit Downloader (Version: - www.orbitdownloader.com) OutlookAddinSetup (Version: 1.0.0 - CyberLink) PDF Settings (Version: 1.0 - Adobe Systems Incorporated) Hidden Prism Video Converter (Version: - NCH Software) QuickBooks Pro 2008 (Version: 18.0.4008.606 - Intuit Inc.) QuickSet (Version: 8.2.20 - Dell Inc.) QuickTime (Version: 7.74.80.86 - Apple Inc.) Segoe UI (Version: 15.4.2271.0615 - Microsoft Corp) Hidden Skype™ 5.10 (Version: 5.10.116 - Skype Technologies S.A.) Sony Noise Reduction Plug-In 2.0e (Version: 2.0.444 - Sony) Sony Sound Forge 8.0 (Version: 8.0.53 - Sony) Spybot - Search & Destroy (Version: 1.6.0 - Safer Networking Limited) SupportSoft Assisted Service (Version: 15 - SupportSoft) Update for 2007 Microsoft Office System (KB967642) (Version: - Microsoft) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3 - Microsoft Corporation) Update for Microsoft Office 2007 Help for Common Features (KB963673) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (Version: - Microsoft) Update for Microsoft Office Access 2007 Help (KB963663) (Version: - Microsoft) Update for Microsoft Office Excel 2007 Help (KB963678) (Version: - Microsoft) Update for Microsoft Office Infopath 2007 Help (KB963662) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (Version: - Microsoft) Update for Microsoft Office Outlook 2007 Help (KB963677) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2850085) 32-Bit Edition (Version: - Microsoft) Update for Microsoft Office Powerpoint 2007 Help (KB963669) (Version: - Microsoft) Update for Microsoft Office Publisher 2007 Help (KB963667) (Version: - Microsoft) Update for Microsoft Office Script Editor Help (KB963671) (Version: - Microsoft) Update for Microsoft Office Word 2007 Help (KB963665) (Version: - Microsoft) VC80CRTRedist - 8.0.50727.4053 (Version: 1.1.0 - DivX, Inc) Hidden Vegas Pro 11.0 (Version: 11.0.700 - Sony) Visual C++ 8.0 ATL (x86) WinSXS MSM (Version: 8.0.50727.762 - Microsoft Corporation) Hidden Visual C++ 8.0 CRT (x86) WinSXS MSM (Version: 8.0.50727.762 - Microsoft Corporation) Hidden Visual Studio 2012 x86 Redistributables (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.) WIDCOMM Bluetooth Software 6.0.1.3100 (Version: 6.0.1.3100 - Dell) Windows Live Communications Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Essentials (Version: 15.4.3502.0922 - Microsoft Corporation) Windows Live Essentials (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden Windows Live Installer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Movie Maker (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Common (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Gallery (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live PIMT Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live SOXE (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live SOXE Definitions (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform Language Pack (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden WinRAR archiver (Version: - ) ==================== Restore Points ========================= 11-12-2013 02:18:51 Scheduled Checkpoint 11-12-2013 08:05:19 Windows Update 12-12-2013 05:25:59 Scheduled Checkpoint 13-12-2013 02:23:21 Scheduled Checkpoint 16-12-2013 02:50:40 Scheduled Checkpoint 04-02-2014 04:12:29 Windows Update 05-02-2014 06:02:33 Scheduled Checkpoint 07-02-2014 03:36:46 Scheduled Checkpoint 09-02-2014 04:34:09 Installed Windows 7 Upgrade Advisor 09-02-2014 20:06:33 Removed Windows 7 Upgrade Advisor 09-02-2014 20:07:54 Removed Vegas Pro 9.0 11-02-2014 05:22:23 Scheduled Checkpoint 12-02-2014 03:34:58 Scheduled Checkpoint 12-02-2014 06:00:55 Windows Update 13-02-2014 04:38:49 Installed SpyHunter 13-02-2014 05:01:41 Removed SpyHunter ==================== Hosts content: ========================== 2006-11-02 02:23 - 2013-07-10 05:54 - 00000027 ____N C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= Task: {04A79ED0-2A5D-47F8-8F12-9F167ED4A53F} - System32\Tasks\{59255F7D-5FDA-42E2-B51D-319CA1785C76} => C:\Program Files\Skype\Phone\Skype.exe [2012-07-13] (Skype Technologies S.A.) Task: {1AC39EC7-9791-4247-8D03-EEC151326CE4} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation) Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM Task: {27E7C152-6DFD-430F-8CF6-E65D425C0C75} - System32\Tasks\4824 => Wscript.exe C:\Users\Corpuz\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION Task: {314608E2-0042-44A1-A87C-AAB10110BCEC} - System32\Tasks\0 => Iexplore.exe <==== ATTENTION Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProt ection\NAPStatus UI Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartP ages Task: {41979175-CD8A-4CCB-A6CE-D629D8945D29} - System32\Tasks\GlaryInitialize => C:\Program Files\Glary Utilities\initialize.exe [2010-10-14] (Glarysoft Ltd) Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-20] (Microsoft Corporation) Task: {5DF8B8EC-C97F-463F-B9D9-3742167D3164} - System32\Tasks\ROC_REG_JAN_DELETE => C:\ProgramData\AVG January 2013 Campaign\ROC.exe [2013-01-17] () Task: {A2244F25-7CD4-4630-B5A7-1FB0320B6FBC} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-12-17] (Google Inc.) Task: {D4AD9531-4B9F-4B2E-9E6E-31F9771265CF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-12-17] (Google Inc.) Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWi relessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-20] () Task: C:\Windows\Tasks\GlaryInitialize.job => C:\Program Files\Glary Utilities\initialize.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\ROC_REG_JAN_DELETE.job => C:\ProgramData\AVG January 2013 Campaign\ROC.exe ==================== Loaded Modules (whitelisted) ============= 2014-02-12 17:44 - 2014-02-12 17:44 - 00284160 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\Vis taBridgeLibrary\4f7f17456ff47d4bce1bb84f7e8cc7e3\V istaBridgeLibrary.ni.dll 2008-12-24 00:40 - 2008-10-27 01:52 - 00055808 _____ () C:\Windows\System32\bcmwlrmt.dll ==================== Alternate Data Streams (whitelisted) ========= AlternateDataStreams: C:\ProgramData\Temp:B946D9EE AlternateDataStreams: C:\ProgramData\Temp:FB1B13D8 ==================== Safe Mode (whitelisted) =================== ==================== Disabled items from MSCONFIG ============== MSCONFIG\Services: AESTFilters => 2 MSCONFIG\Services: SkypeUpdate => 2 MSCONFIG\Services: STacSV => 2 MSCONFIG\Services: SysMain => 2 MSCONFIG\Services: TapiSrv => 3 MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk => C:\Windows\pss\Adobe Acrobat Speed Launcher.lnk.CommonStartup MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk => C:\Windows\pss\Adobe Acrobat Synchronizer.lnk.CommonStartup MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk => C:\Windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk => C:\Windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk => C:\Windows\pss\Bluetooth.lnk.CommonStartup MSCONFIG\startupreg: Acrobat Assistant 8.0 => "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" MSCONFIG\startupreg: Adobe_ID0EYTHM => C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VER SIO~2.EXE MSCONFIG\startupreg: AppleSyncNotifier => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" MSCONFIG\startupreg: AVG_UI => "C:\Program Files\AVG\AVG2014\avgui.exe" /TRAYONLY MSCONFIG\startupreg: CanonMyPrinter => MSCONFIG\startupreg: CanonSolutionMenu => MSCONFIG\startupreg: IAAnotif => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe" MSCONFIG\startupreg: Malwarebytes Anti-Malware (reboot) => "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript MSCONFIG\startupreg: NBAgent => "C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime MSCONFIG\startupreg: SigmatelSysTrayApp => %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun MSCONFIG\startupreg: SpybotSD TeaTimer => C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe" MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide MSCONFIG\startupreg: WMPNSCFG => C:\Program Files\Windows Media Player\WMPNSCFG.exe MSCONFIG\startupreg: YouTube Converter => C:\Program Files\Moyea\YouTube Converter\FLVDownloader.exe -autorun ==================== Faulty Device Manager Devices ============= Name: 3D Video Controller Description: 3D Video Controller Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: Description: Class Guid: Manufacturer: Service: NPF Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. ==================== Event log errors: ========================= Application errors: ================== Error: (02/13/2014 05:41:13 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/12/2014 08:14:20 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/12/2014 05:07:30 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/11/2014 09:48:24 PM) (Source: Windows Search Service) (User: ) Description: The entry <C:\USERS\CORPUZ\APPDATA\LOCAL\MICROSOFT\WINDOWS\T EMPORARY INTERNET FILES\LOW\CONTENT.IE5\C5YT3DXR\ZZZZZZZZZZZZZ.ZZZ> in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details: A device attached to the system is not functioning. (0x8007001f) Error: (02/11/2014 09:48:21 PM) (Source: Windows Search Service) (User: ) Description: The entry <C:\USERS\CORPUZ\APPDATA\LOCAL\MICROSOFT\WINDOWS\T EMPORARY INTERNET FILES\LOW\CONTENT.IE5\C5YT3DXR\ZZZZZZZZZZZZZZZ.ZZZ > in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details: A device attached to the system is not functioning. (0x8007001f) Error: (02/11/2014 09:48:21 PM) (Source: Windows Search Service) (User: ) Description: The entry <C:\USERS\CORPUZ\APPDATA\LOCAL\MICROSOFT\WINDOWS\T EMPORARY INTERNET FILES\LOW\CONTENT.IE5\C5YT3DXR\ZZZZZZZZZZZZ.ZZZ> in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details: A device attached to the system is not functioning. (0x8007001f) Error: (02/11/2014 09:48:21 PM) (Source: Windows Search Service) (User: ) Description: The entry <C:\USERS\CORPUZ\APPDATA\LOCAL\MICROSOFT\WINDOWS\T EMPORARY INTERNET FILES\LOW\CONTENT.IE5\C5YT3DXR\ZZZZZZZZZZZZ.ZZZ> in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details: A device attached to the system is not functioning. (0x8007001f) Error: (02/11/2014 09:48:21 PM) (Source: Windows Search Service) (User: ) Description: The entry <C:\USERS\CORPUZ\APPDATA\LOCAL\MICROSOFT\WINDOWS\T EMPORARY INTERNET FILES\LOW\CONTENT.IE5\C5YT3DXR\ZZZZZZZZ.ZZ> in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details: A device attached to the system is not functioning. (0x8007001f) Error: (02/11/2014 09:48:21 PM) (Source: Windows Search Service) (User: ) Description: The entry <C:\USERS\CORPUZ\APPDATA\LOCAL\MICROSOFT\WINDOWS\T EMPORARY INTERNET FILES\LOW\CONTENT.IE5\C5YT3DXR\ZZZZZZZZZZZZZZ.ZZZ> in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details: A device attached to the system is not functioning. (0x8007001f) Error: (02/11/2014 09:48:21 PM) (Source: Windows Search Service) (User: ) Description: The entry <C:\USERS\CORPUZ\APPDATA\LOCAL\MICROSOFT\WINDOWS\T EMPORARY INTERNET FILES\LOW\CONTENT.IE5\C5YT3DXR\ZZZZZZZZZZZZZZZZZZ. ZZZ> in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details: A device attached to the system is not functioning. (0x8007001f) System errors: ============= Error: (02/13/2014 05:52:59 PM) (Source: Service Control Manager) (User: ) Description: Remote Access Connection ManagerTelephony%%1058 Error: (02/13/2014 05:52:59 PM) (Source: Service Control Manager) (User: ) Description: Remote Access Connection ManagerTelephony%%1058 Error: (02/13/2014 05:48:08 PM) (Source: Service Control Manager) (User: ) Description: Remote Access Connection ManagerTelephony%%1058 Error: (02/13/2014 05:48:03 PM) (Source: Service Control Manager) (User: ) Description: Remote Access Connection ManagerTelephony%%1058 Error: (02/13/2014 05:48:02 PM) (Source: Service Control Manager) (User: ) Description: Remote Access Connection ManagerTelephony%%1058 Error: (02/13/2014 05:48:02 PM) (Source: Service Control Manager) (User: ) Description: Remote Access Connection ManagerTelephony%%1058 Error: (02/13/2014 05:47:57 PM) (Source: Service Control Manager) (User: ) Description: Remote Access Connection ManagerTelephony%%1058 Error: (02/13/2014 05:47:57 PM) (Source: Service Control Manager) (User: ) Description: Remote Access Connection ManagerTelephony%%1058 Error: (02/13/2014 05:47:57 PM) (Source: Service Control Manager) (User: ) Description: Remote Access Connection ManagerTelephony%%1058 Error: (02/13/2014 05:47:56 PM) (Source: Service Control Manager) (User: ) Description: Remote Access Connection ManagerTelephony%%1058 Microsoft Office Sessions: ========================= Error: (05/19/2011 09:05:23 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6550.5004, Microsoft Office Version: 12.0.6425.1000. This session lasted 14 seconds with 0 seconds of active time. This session ended with a crash. Error: (01/22/2011 01:00:34 AM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 22763 seconds with 1260 seconds of active time. This session ended with a crash. Error: (01/12/2011 01:22:47 AM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4816 seconds with 360 seconds of active time. This session ended with a crash. Error: (12/14/2010 11:19:08 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 7 seconds with 0 seconds of active time. This session ended with a crash. Error: (11/09/2010 01:27:09 AM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4829 seconds with 960 seconds of active time. This session ended with a crash. Error: (11/22/2009 11:42:41 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2 seconds with 0 seconds of active time. This session ended with a crash. Error: (10/07/2009 03:13:03 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 42 seconds with 0 seconds of active time. This session ended with a crash. Error: (07/16/2009 10:56:44 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 537 seconds with 240 seconds of active time. This session ended with a crash. CodeIntegrity Errors: =================================== Date: 2014-02-13 17:49:57.300 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\a vgidshx.sys because the set of per-page image hashes could not be found on the system. Date: 2014-02-13 17:49:57.082 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\a vgidshx.sys because the set of per-page image hashes could not be found on the system. Date: 2014-02-13 17:49:56.848 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\a vgidshx.sys because the set of per-page image hashes could not be found on the system. Date: 2014-02-13 17:49:56.598 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\a vgidshx.sys because the set of per-page image hashes could not be found on the system. Date: 2014-02-12 20:42:59.557 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\a vgidshx.sys because the set of per-page image hashes could not be found on the system. Date: 2014-02-12 20:42:59.279 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\a vgidshx.sys because the set of per-page image hashes could not be found on the system. Date: 2014-02-12 20:42:59.003 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\a vgidshx.sys because the set of per-page image hashes could not be found on the system. Date: 2014-02-12 20:42:58.729 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\a vgidshx.sys because the set of per-page image hashes could not be found on the system. Date: 2014-02-12 20:42:58.412 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\a vgidsdriverx.sys because the set of per-page image hashes could not be found on the system. Date: 2014-02-12 20:42:58.143 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\a vgidsdriverx.sys because the set of per-page image hashes could not be found on the system. ==================== Memory info =========================== Percentage of memory in use: 56% Total physical RAM: 3069.14 MB Available physical RAM: 1341 MB Total Pagefile: 6345.3 MB Available Pagefile: 4651.48 MB Total Virtual: 2047.88 MB Available Virtual: 1913.71 MB ==================== Drives ================================ Drive c: (OS) (Fixed) (Total:220.31 GB) (Free:24.15 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive d: (RECOVERY) (Fixed) (Total:10 GB) (Free:4.79 GB) NTFS ==================== MBR & Partition Table ================== ================================================== ====== Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 233 GB) (Disk ID: 20000000) Partition 1: (Not Active) - (Size=78 MB) - (Type=DE) Partition 2: (Not Active) - (Size=10 GB) - (Type=07 NTFS) Partition 3: (Active) - (Size=220 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=3 GB) - (Type=OF Extended) ==================== End Of Log ============================
|
|
#5
February 14th, 2014, 01:36 PM
|
||||
|
||||
|
Hi werkshop and thanks for Logs.
Please go to Start, Click Control Panel , click Programs and then click Programs and Features Uninstall the following program: AVG Security Toolbar ----------------------------------- Step1: Please open notepad (Start > All Programs > Accessories > Notepad) Copy the entire contents of the code box below (Do not copy the word 'code') to Notepad. Save it to the Desktop, and name it: fixlist.txt Important: Frst software and fixlist.txt on the desktop Code:
start
HKU\S-1-5-21-2681079163-3059944450-1427626601-1000\...\Run: [AVG-Secure-Search-Update_0214c] - C:\Users\Corpuz\AppData\Roaming\AVG 0214c Campaign\AVG-Secure-Search-Update-0214c.exe /PROMPT /mid=aa7997593bfe9c9f87ca27c5d0a2a6b8-4409656dccfc7ae33b81de90e33b54a7dd4a8bf7 /CMPID=0214c
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} URL = http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg-chrome&type=yahoo_avg_hs2-tb-web_chrome_us&p={searchTerms}
SearchScopes: HKCU - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} URL =
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - No File
ShellExecuteHooks: - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No File [ ]
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR HKLM\...\Chrome\Extension: [hbcennhacfaagdopikcegfcobcadeocj] - C:\Program Files\Common Files\Spigot\GC\saebay_1.0.crx [2013-07-27]
CHR HKLM\...\Chrome\Extension: [icdlfehblmklkikfigmjhbmmpmkmpooj] - C:\Program Files\Common Files\Spigot\GC\errorassistant_1.1.crx [2013-07-27]
CHR HKLM\...\Chrome\Extension: [mhkaekfpcppmmioggniknbnbdbcigpkk] - C:\Users\Corpuz\AppData\Local\Slick Savings\coupons.crx [2013-06-08]
CHR HKLM\...\Chrome\Extension: [pfndaklgolladniicklehhancnlgocpp] - C:\Program Files\Common Files\Spigot\GC\saamazon_1.0.crx [2013-06-08]
C:\Users\Corpuz\AppData\Roaming\OpenCandy
C:\Users\Corpuz\Desktop\Recycle Bin - Shortcut (2).lnk
C:\Users\Corpuz\AppData\Roaming\desktop.ini
C:\Users\Corpuz\AppData\Local\temp\oi_{75CCED36-7FC8-448C-A4D2-B377CC8C55BA}.exe
C:\Users\Corpuz\AppData\Local\temp\SHSetup.exe
C:\Users\Corpuz\AppData\Local\temp\UNINSTALL.EXE
Task: {27E7C152-6DFD-430F-8CF6-E65D425C0C75} - System32\Tasks\4824 => Wscript.exe C:\Users\Corpuz\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {314608E2-0042-44A1-A87C-AAB10110BCEC} - System32\Tasks\0 => Iexplore.exe <==== ATTENTION
AlternateDataStreams: C:\ProgramData\Temp:B946D9EE
AlternateDataStreams: C:\ProgramData\Temp:FB1B13D8
end
Running this on another computer may cause damage to the Operating System. Now, please run FRST, and press the Fix button, just once, and wait. When done, the tool creates a report on the Desktop called: Fixlog.txt >> Please post the Fixlog.txt in your reply. Step2: Please download AdwCleaner by Xplode onto your desktop.
Step3: Please download Junkware Removal Tool to your desktop.
Good day.
|
|
#6
February 15th, 2014, 01:00 AM
|
||||
|
||||
|
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 12-02-2014 01
Ran by Corpuz at 2014-02-14 16:00:04 Run:1 Running from C:\Users\Corpuz\Desktop\MALWAREFOLDER Boot Mode: Normal ============================================== Content of fixlist: ***************** start HKU\S-1-5-21-2681079163-3059944450-1427626601-1000\...\Run: [AVG-Secure-Search-Update_0214c] - C:\Users\Corpuz\AppData\Roaming\AVG 0214c Campaign\AVG-Secure-Search-Update-0214c.exe /PROMPT /mid=aa7997593bfe9c9f87ca27c5d0a2a6b8-4409656dccfc7ae33b81de90e33b54a7dd4a8bf7 /CMPID=0214c SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKLM - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} URL = http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg-chrome&type=yahoo_avg_hs2-tb-web_chrome_us&p={searchTerms} SearchScopes: HKCU - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} URL = Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - No File ShellExecuteHooks: - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No File [ ] CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File CHR HKLM\...\Chrome\Extension: [hbcennhacfaagdopikcegfcobcadeocj] - C:\Program Files\Common Files\Spigot\GC\saebay_1.0.crx [2013-07-27] CHR HKLM\...\Chrome\Extension: [icdlfehblmklkikfigmjhbmmpmkmpooj] - C:\Program Files\Common Files\Spigot\GC\errorassistant_1.1.crx [2013-07-27] CHR HKLM\...\Chrome\Extension: [mhkaekfpcppmmioggniknbnbdbcigpkk] - C:\Users\Corpuz\AppData\Local\Slick Savings\coupons.crx [2013-06-08] CHR HKLM\...\Chrome\Extension: [pfndaklgolladniicklehhancnlgocpp] - C:\Program Files\Common Files\Spigot\GC\saamazon_1.0.crx [2013-06-08] C:\Users\Corpuz\AppData\Roaming\OpenCandy C:\Users\Corpuz\Desktop\Recycle Bin - Shortcut (2).lnk C:\Users\Corpuz\AppData\Roaming\desktop.ini C:\Users\Corpuz\AppData\Local\temp\oi_{75CCED36-7FC8-448C-A4D2-B377CC8C55BA}.exe C:\Users\Corpuz\AppData\Local\temp\SHSetup.exe C:\Users\Corpuz\AppData\Local\temp\UNINSTALL.EXE Task: {27E7C152-6DFD-430F-8CF6-E65D425C0C75} - System32\Tasks\4824 => Wscript.exe C:\Users\Corpuz\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION Task: {314608E2-0042-44A1-A87C-AAB10110BCEC} - System32\Tasks\0 => Iexplore.exe <==== ATTENTION AlternateDataStreams: C:\ProgramData\Temp:B946D9EE AlternateDataStreams: C:\ProgramData\Temp:FB1B13D8 end ***************** HKU\S-1-5-21-2681079163-3059944450-1427626601-1000\Software\Microsoft\Windows\CurrentVersion\Run \\AVG-Secure-Search-Update_0214c => Value deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} => Key not found. HKCR\PROTOCOLS\Handler\linkscanner => Key deleted successfully. HKCR\CLSID\{F274614C-63F8-47D5-A4D1-FBDDE494F8D1} => Key not found. HKLM\Software\Microsoft\Windows\CurrentVersion\exp lorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} => Value deleted successfully. HKCR\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972} => Key not found. c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll not found. C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll not found. HKLM\SOFTWARE\Google\Chrome\Extensions\hbcennhacfa agdopikcegfcobcadeocj => Key deleted successfully. "C:\Program Files\Common Files\Spigot\GC\saebay_1.0.crx" => File/Directory not found. HKLM\SOFTWARE\Google\Chrome\Extensions\icdlfehblmk lkikfigmjhbmmpmkmpooj => Key deleted successfully. "C:\Program Files\Common Files\Spigot\GC\errorassistant_1.1.crx" => File/Directory not found. HKLM\SOFTWARE\Google\Chrome\Extensions\mhkaekfpcpp mmioggniknbnbdbcigpkk => Key deleted successfully. C:\Users\Corpuz\AppData\Local\Slick Savings\coupons.crx => Moved successfully. HKLM\SOFTWARE\Google\Chrome\Extensions\pfndaklgoll adniicklehhancnlgocpp => Key deleted successfully. "C:\Program Files\Common Files\Spigot\GC\saamazon_1.0.crx" => File/Directory not found. C:\Users\Corpuz\AppData\Roaming\OpenCandy => Moved successfully. C:\Users\Corpuz\Desktop\Recycle Bin - Shortcut (2).lnk => Moved successfully. C:\Users\Corpuz\AppData\Roaming\desktop.ini => Moved successfully. C:\Users\Corpuz\AppData\Local\temp\oi_{75CCED36-7FC8-448C-A4D2-B377CC8C55BA}.exe => Moved successfully. C:\Users\Corpuz\AppData\Local\temp\SHSetup.exe => Moved successfully. C:\Users\Corpuz\AppData\Local\temp\UNINSTALL.EXE => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{27E7C1 52-6DFD-430F-8CF6-E65D425C0C75} => Error deleting key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{27E7C1 52-6DFD-430F-8CF6-E65D425C0C75} => Error deleting key C:\Windows\System32\Tasks\4824 => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\4824 => Error deleting key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{314608 E2-0042-44A1-A87C-AAB10110BCEC} => Error deleting key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{314608 E2-0042-44A1-A87C-AAB10110BCEC} => Error deleting key C:\Windows\System32\Tasks\0 => Moved successfully. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\0 => Error deleting key C:\ProgramData\Temp => ":B946D9EE" ADS removed successfully. C:\ProgramData\Temp => ":FB1B13D8" ADS removed successfully. ==== End of Fixlog ====
|
|
#7
February 15th, 2014, 02:25 AM
|
||||
|
||||
|
# AdwCleaner v3.018 - Report created 14/02/2014 at 17:17:24
# Updated 28/01/2014 by Xplode # Operating System : Windows Vista (TM) Home Premium Service Pack 2 (32 bits) # Username : Corpuz - WERKSHOP # Running from : C:\Users\Corpuz\Desktop\MALWAREFOLDER\adwcleaner.e xe # Option : Clean ***** [ Services ] ***** ***** [ Files / Folders ] ***** Folder Deleted : C:\Program Files\orbitdownloader ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}] Key Deleted : HKCU\Software\Microsoft\Internet Explorer\MenuExt\&Download by Orbit Key Deleted : HKCU\Software\Microsoft\Internet Explorer\MenuExt\&Grab video by Orbit Key Deleted : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Do&wnload selected by Orbit Key Deleted : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Down&load all by Orbit Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{000123B4-9B42-4900-B3F7-F4B073EFC214} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3F1D494B-0CEF-4468-96C9-386E2E4DEC90} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7854F00C-DC77-477E-A10E-603F48442D3B} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A0880527-DC28-4EBB-BA27-D22102F22A9F} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{BCDDE143-FAE3-4C57-B22B-C4E8678CFDC0} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{000123B4-9B42-4900-B3F7-F4B073EFC214} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext \Stats\{000123B4-9B42-4900-B3F7-F4B073EFC214} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext \Stats\{7854F00C-DC77-477E-A10E-603F48442D3B} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext \Settings\{000123B4-9B42-4900-B3F7-F4B073EFC214} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4250488A-CB24-0893-C066-B1AEA57BCFF2} Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAcces s\Parameters\FirewallPolicy\StandardProfile\Author izedApplications\List [C:\Program Files\Orbitdownloader\orbitdm.exe] Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAcces s\Parameters\FirewallPolicy\StandardProfile\Author izedApplications\List [C:\Program Files\Orbitdownloader\orbitnet.exe] Key Deleted : HKCU\Software\AVG Secure Search Key Deleted : HKCU\Software\Orbit Key Deleted : HKCU\Software\ParetoLogic Key Deleted : HKLM\Software\AVG Secure Search Key Deleted : HKLM\Software\Orbit Key Deleted : HKLM\Software\Updater By Sweetpacks Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uni nstall\Orbit_is1 Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Orbit_is1 ***** [ Browsers ] ***** -\\ Internet Explorer v9.0.8112.16533 -\\ Mozilla Firefox v -\\ Google Chrome v32.0.1700.107 [ File : C:\Users\Corpuz\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [3483 octets] - [14/02/2014 16:03:10] AdwCleaner[S0].txt - [3468 octets] - [14/02/2014 17:17:24] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3528 octets] ##########
|
|
#8
February 15th, 2014, 02:47 AM
|
||||
|
||||
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu Version: 6.1.1 (02.04.2014:1) OS: Windows Vista (TM) Home Premium x86 Ran by Corpuz on Fri 02/14/2014 at 17:32:22.09 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2681079163-3059944450-1427626601-1000\Software\sweetim Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2681079163-3059944450-1427626601-1000\Software\wajam Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\firstsearch Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\solid savings Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011501158} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{A86CB93C-AF88-B5FE-F4D9-E79E5C6A4474} ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\ProgramData\pc1data" Successfully deleted: [Folder] "C:\Users\Corpuz\AppData\Roaming\red kawa" Successfully deleted: [Folder] "C:\Users\Corpuz\appdata\local\slick savings" Successfully deleted: [Folder] "C:\Program Files\bucksbee loyalty plugin - 100815" Successfully deleted: [Folder] "C:\Program Files\coupons" Successfully deleted: [Empty Folder] C:\Users\Corpuz\appdata\local\{4E08D6A0-2668-4C3C-98FB-92BDCCA09CBE} Successfully deleted: [Empty Folder] C:\Users\Corpuz\appdata\local\{5DDFC94A-14E3-4039-A5E9-46F8A6F21739} Successfully deleted: [Empty Folder] C:\Users\Corpuz\appdata\local\{CB15A4EB-BB5C-4DF3-8BB8-DED20C48920D} Successfully deleted: [Empty Folder] C:\Users\Corpuz\appdata\local\{F80EEB28-7909-44F4-B4C5-B59A9685F51A} ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~ Scan was completed on Fri 02/14/2014 at 17:36:06.68 Computer was rebooted End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~
|
|
#9
February 15th, 2014, 04:07 PM
|
||||
|
||||
|
Hi werkshop. Thanks for Logs.
Do you still have http://mysearch.avg.com the problem ? If the problem still persists; Chrome, see if these will help. Please read and apply. https://support.google.com/chrome/answer/95653?hl=en https://support.google.com/chromeboo...er/95314?hl=en --------------------------------------------------------------------------- Step1: Please download Malwarebytes Anti-Malware and save it to your desktop. alternate download link 1 alternate download link 2
Step2: Updating Java and Clearing Cache: These are all outdated, and security risks by having them installed still. Reboot your computer once all those Java components are removed. Please go to Start > Control Panel > Programs and Features > uninstall all the Java Programs you see, now download the latest Java from the following link and install it: Java 6 Update 31 Now system reboot. Next, download the latest Java, version 7 update 51, from the following link Download Free Java Software  See this page for instructions on how to clear java's cache. Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)
|
|
#10
February 17th, 2014, 10:20 PM
|
||||
|
||||
|
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org Database version: v2013.04.04.07 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 Corpuz :: WERKSHOP [administrator] 2/17/2014 1:07:55 PM mbam-log-2014-02-17 (13-07-55).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 244204 Time elapsed: 10 minute(s), 14 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 3 C:\Users\Corpuz\Desktop\Patch_SVP.11_(32bit).exe (PUP.Hacktool.Patcher) -> Quarantined and deleted successfully. C:\Users\Corpuz\Desktop\Keygen.exe (RiskWare.Tool.HCK) -> Quarantined and deleted successfully. C:\Users\Corpuz\Desktop\SonyVegasPro Patch.exe (RiskWare.Tool.HCK) -> Quarantined and deleted successfully. (end)
|
|
#11
February 17th, 2014, 10:52 PM
|
||||
|
||||
|
Hi werkshop, thanks for Logs.
Do you still have google chrome ''http://mysearch.avg.com'' the problem ? --------------------- Please do the followings: Step 1: Download Security Check by screen317 from here.
Disable your antivirus program and click here and download the esetsmartinstaller_enu.exe Eset installer. Then click that file to run the scanner. If you accept the Terms of Use, check the box and click Start. It will take a couple minutes for the scanner to get ready. When the Computer scan settings display shows, check the following boxes: Remove found threats Scan unwanted applications Next to "Current scan targets: Operating memory, Local drives", click the "Change" word. Make sure you place a check next to all disk drives, including any external drives that are attached (no need to check off the floppy or DVD/CD-Rom drives). Then click the Advanced option, the place a check next to the following (if it is not already checked): Enable Anti-Stealth technology Click Start. This scan may take a while, so please be patient. If infection is found, at the end of the scan click "List of found threats". In that display, at the bottom, select the option to save the results as a text file, and save that to your desktop. Post that back here please. Good day, regards.
|
|
#12
February 18th, 2014, 01:17 AM
|
||||
|
||||
|
Hi werkshop.
I am really sorry. I see illegaly software on your system. Please, you ask them to uninstall all illegal software, including CS3, reboot, and post a new Farbar scan log. Good day.
|
|
#13
February 18th, 2014, 11:30 AM
|
|||
|
|||
|
As per the CTH guidelines for the Malware Removal Forum shown Here, this post has been deleted. Members who have not been approved by the CTH Staff to provide infection removal/repair steps are prohibited from posting advice. Please disregard any information/steps that had been posted here.
|
|
| Bookmarks |
«
Previous Topic
|
Next Topic
»
|
|
Similar Topics
|
||||
| Topic | Topic Starter | Forum | Replies | Last Post |
| Malware issue | Quetzal59 | Windows XP | 6 | April 19th, 2011 12:04 PM |
| Possible Malware Issue | sylphie | Malware Removal | 6 | December 7th, 2010 01:10 PM |
| Firewall issue? Malware issue? | Dave441 | Malware Removal | 1 | June 10th, 2009 05:16 AM |
| Serious Issue with malware!! | KronoSfear | Malware Removal | 20 | November 3rd, 2007 03:54 PM |
| HJT possible malware issue... | Ora | Malware Removal | 13 | October 5th, 2007 01:11 AM |
All times are GMT +1. The time now is 07:21 PM.