Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

backdoor.frauder infection


  • This topic is locked This topic is locked
18 replies to this topic

#1 JonJonz321

JonJonz321

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:13 PM

Posted 24 July 2012 - 03:12 PM

Hi, last night I was optimizing my computer using advanced system care pro and then it found an backdoor.frauder object. I deleted it and restarted my computer in safe mode to run SpotBot. It was pretty much clean except for a few tracking cookies. I restarted my computer and it started up really slow. After inputting my password, the screen went black for at least 2 minutes before the windows loaded, so I suspected that there was still something wrong I felt unsafe and ran superantispyware which caught more tracking cookies. Then I tried to run MBAM, which froze mid-scan. I ran tdss killer and found 4 suspicious objects and some infections. I didn't do anything with the tdss-killer. Any help would be great.


.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by owner at 15:02:51 on 2012-07-24
Microsoft Windows 7 Home Premium 6.1.7601.1.932.81.1033.18.3933.1411 [GMT -5:00]
.
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\windows\system32\wininit.exe
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\Program Files\Sandboxie\SbieSvc.exe
C:\Program Files\Tablet\Pen\Pen_TouchService.exe
C:\windows\SYSTEM32\WISPTIS.EXE
C:\windows\system32\ngvpnmgr.exe
C:\windows\system32\svchost.exe -k NetworkService
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\windows\System32\spoolsv.exe
C:\windows\system32\taskhost.exe
C:\windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\windows\system32\Dwm.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\windows\Explorer.EXE
C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
C:\windows\system32\taskeng.exe
C:\Program Files (x86)\IObit\Smart Defrag 2\SmartDefrag.exe
C:\Program Files (x86)\IObit\Game Booster\gbtray.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Motive\McciCMService.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Users\owner\AppData\Local\sdsvc_Win32\sdsvc.exe
C:\windows\system32\svchost.exe -k imgsvc
C:\Program Files\Tablet\Pen\Pen_Tablet.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Tablet\Pen\Pen_Tablet.exe
C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\igfxtray.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\system32\igfxsrvc.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
C:\Windows\System32\StikyNot.exe
C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Sandboxie\SbieCtrl.exe
C:\Program Files (x86)\Toshiba\Utilities\KeNotify.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\ToshibaServiceStation.exe
C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\windows\system32\igfxext.exe
C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\windows\SysWOW64\rundll32.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\windows\System32\svchost.exe -k secsvcs
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Nexon\Atlantica\Atlantica.exe
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\windows\system32\taskhost.exe
C:\windows\system32\taskmgr.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\windows\SysWOW64\ctfmon.exe
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\windows\system32\DllHost.exe
C:\windows\system32\DllHost.exe
C:\windows\SysWOW64\cmd.exe
C:\windows\system32\conhost.exe
C:\windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3197087
uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
uWindow Title =
mDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
uURLSearchHooks: YTNavAssistPlugin Class: {81017ea9-9aa8-4a6a-9734-7af40e7d593f} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll
uURLSearchHooks: IMVU Inc Toolbar: {90b49673-5506-483e-b92b-ca0265bd9ca8} - C:\Program Files (x86)\IMVU_Inc\prxtbIMVU.dll
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
mURLSearchHooks: IMVU Inc Toolbar: {90b49673-5506-483e-b92b-ca0265bd9ca8} - C:\Program Files (x86)\IMVU_Inc\prxtbIMVU.dll
mURLSearchHooks: YTNavAssistPlugin Class: {81017ea9-9aa8-4a6a-9734-7af40e7d593f} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll
mWinlogon: Userinit=userinit.exe,
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE

\rpbrowserrecordplugin.dll
BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: IMVU Inc Toolbar: {90b49673-5506-483e-b92b-ca0265bd9ca8} - C:\Program Files (x86)\IMVU_Inc\prxtbIMVU.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll
TB: IMVU Inc Toolbar: {90b49673-5506-483e-b92b-ca0265bd9ca8} - C:\Program Files (x86)\IMVU_Inc\prxtbIMVU.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
TB: {93C338DE-5FB5-4FB5-AB4E-0EEDC0BD9F3A} - No File
uRun: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe
uRun: [Advanced SystemCare 5] "C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" /AutoStart
uRun: [Google Update] "C:\Users\owner\AppData\Local\Google\Update\GoogleUpdate.exe" /c
uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
uRun: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe"
uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
mRun: [SVPWUTIL] C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
mRun: [KeNotify] C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
mRun: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
mRun: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [BambooCore] C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun: [TkBellExe] "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [Otshot] c:\program files\otshot\otshot.exe -minimize
mRunOnce: [1] C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\mbam-chameleon.exe /r /p
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MIF5BA~1\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MIF5BA~1\Office12\REFIEBAR.DLL
Trusted Zone: $talisma_url$
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{4AAC1865-70C9-4D56-A74C-C1609AA0102E} : DhcpNameServer = 192.168.1.254
TCP: Interfaces\{CA82EE73-F6D2-4937-8E6E-AFB944201E74}\4656071657C626C65756 : DhcpNameServer = 140.192.0.2 140.192.239.2
TCP: Interfaces\{CA82EE73-F6D2-4937-8E6E-AFB944201E74}\4656071657C677962756C6563737 : DhcpNameServer = 140.192.0.2 140.192.239.2
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
BHO-X64: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll
BHO-X64: 0x1 - No File
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE

\rpbrowserrecordplugin.dll
BHO-X64: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
BHO-X64: Increase performance and video formats for your HTML5 <video> - No File
BHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live

\WindowsLiveLogin.dll
BHO-X64: IMVU Inc Toolbar: {90b49673-5506-483e-b92b-ca0265bd9ca8} - C:\Program Files (x86)\IMVU_Inc\prxtbIMVU.dll
BHO-X64: IMVU Inc - No File
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO-X64: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
TB-X64: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll
TB-X64: IMVU Inc Toolbar: {90b49673-5506-483e-b92b-ca0265bd9ca8} - C:\Program Files (x86)\IMVU_Inc\prxtbIMVU.dll
TB-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
TB-X64: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
TB-X64: {93C338DE-5FB5-4FB5-AB4E-0EEDC0BD9F3A} - No File
mRun-x64: [SVPWUTIL] C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
mRun-x64: [KeNotify] C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
mRun-x64: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
mRun-x64: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun-x64: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [BambooCore] C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
mRun-x64: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun-x64: [TkBellExe] "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot
mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun-x64: [Otshot] c:\program files\otshot\otshot.exe -minimize
mRunOnce-x64: [1] C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\mbam-chameleon.exe /r /p
Hosts: 127.0.0.1 www.spywareinfo.com
.
============= SERVICES / DRIVERS ===============
.
R0 PxHlpa64;PxHlpa64;C:\windows\system32\Drivers\PxHlpa64.sys --> C:\windows\system32\Drivers\PxHlpa64.sys [?]
R0 SmartDefragDriver;SmartDefragDriver;C:\windows\system32\Drivers\SmartDefragDriver.sys --> C:\windows\system32\Drivers\SmartDefragDriver.sys [?]
R0 tos_sps64;TOSHIBA tos_sps64 Service;C:\windows\system32\DRIVERS\tos_sps64.sys --> C:\windows\system32\DRIVERS\tos_sps64.sys [?]
R1 aswKbd;aswKbd;C:\windows\system32\drivers\aswKbd.sys --> C:\windows\system32\drivers\aswKbd.sys [?]
R1 aswSnx;aswSnx;C:\windows\system32\drivers\aswSnx.sys --> C:\windows\system32\drivers\aswSnx.sys [?]
R1 aswSP;aswSP;C:\windows\system32\drivers\aswSP.sys --> C:\windows\system32\drivers\aswSP.sys [?]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R1 vwififlt;Virtual WiFi Filter Driver;C:\windows\system32\DRIVERS\vwififlt.sys --> C:\windows\system32\DRIVERS\vwififlt.sys [?]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2011-8-11 140672]
R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]
R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2011-11-18 913792]
R2 aswFsBlk;aswFsBlk;C:\windows\system32\drivers\aswFsBlk.sys --> C:\windows\system32\drivers\aswFsBlk.sys [?]
R2 aswMonFlt;aswMonFlt;\??\C:\windows\system32\drivers\aswMonFlt.sys --> C:\windows\system32\drivers\aswMonFlt.sys [?]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-7-6 44808]
R2 cfWiMAXService;ConfigFree WiMAX Service;C:\Program Files (x86)\Toshiba\ConfigFree\CFIWmxSvcs64.exe [2009-8-10 248688]
R2 ConfigFree Gadget Service;ConfigFree Gadget Service;C:\Program Files (x86)\Toshiba\ConfigFree\CFProcSRVC.exe [2009-7-14 42368]
R2 ConfigFree Service;ConfigFree Service;C:\Program Files (x86)\Toshiba\ConfigFree\CFSvcs.exe [2009-3-10 46448]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-9-28 655944]
R2 McciCMService64;McciCMService64;C:\Program Files\Common Files\Motive\McciCMService.exe [2012-4-18 517632]
R2 NgVpnMgr;Aventail VPN Client;C:\windows\system32\ngvpnmgr.exe --> C:\windows\system32\ngvpnmgr.exe [?]
R2 sdSvc;SdDataOptimize.;C:\Users\owner\AppData\Local\sdsvc_Win32\sdsvc.exe [2012-7-21 296240]
R2 TabletServicePen;TabletServicePen;C:\Program Files\Tablet\Pen\Pen_Tablet.exe [2012-4-5 6583160]
R2 TouchServicePen;Wacom Consumer Touch Service;C:\Program Files\Tablet\Pen\Pen_TouchService.exe [2012-4-5 528760]
R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\windows\system32\DRIVERS\dtsoftbus01.sys --> C:\windows\system32\DRIVERS\dtsoftbus01.sys [?]
R3 MBAMProtector;MBAMProtector;\??\C:\windows\system32\drivers\mbam.sys --> C:\windows\system32\drivers\mbam.sys [?]
R3 NgLog;Aventail VPN Logging;C:\windows\system32\DRIVERS\nglog.sys --> C:\windows\system32\DRIVERS\nglog.sys [?]
R3 NgVpn;Aventail VPN Adapter;C:\windows\system32\DRIVERS\ngvpn.sys --> C:\windows\system32\DRIVERS\ngvpn.sys [?]
R3 NgWfp;Aventail VPN Callout;C:\windows\system32\DRIVERS\ngwfp.sys --> C:\windows\system32\DRIVERS\ngwfp.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\windows\system32\DRIVERS\Rt64win7.sys --> C:\windows\system32\DRIVERS\Rt64win7.sys [?]
R3 SbieDrv;SbieDrv;C:\Program Files\Sandboxie\SbieDrv.sys [2012-4-10 164528]
R3 TMachInfo;TMachInfo;C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\TMachInfo.exe [2011-7-4 51512]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2009-8-3 137560]
R3 WinRing0_1_2_0;WinRing0_1_2_0;C:\Program Files (x86)\IObit\Game Booster\Driver\WinRing0x64.sys [2012-6-8 14544]
S1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-7-4 135664]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-7-4 135664]
S3 NgFilter;Aventail VPN Filter;C:\windows\system32\DRIVERS\ngfilter.sys --> C:\windows\system32\DRIVERS\ngfilter.sys [?]
S3 npggsvc;nProtect GameGuard Service;C:\windows\system32\GameMon.des -service --> C:\windows\system32\GameMon.des -service [?]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\windows\system32\Drivers\RtsUStor.sys --> C:\windows\system32\Drivers\RtsUStor.sys [?]
S3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;C:\windows\system32\DRIVERS\RTL8187B.sys --> C:\windows\system32\DRIVERS\RTL8187B.sys

[?]
S3 TsUsbFlt;TsUsbFlt;C:\windows\system32\drivers\tsusbflt.sys --> C:\windows\system32\drivers\tsusbflt.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\system32\Wat\WatAdminSvc.exe --> C:\windows\system32\Wat\WatAdminSvc.exe [?]
.
=============== Created Last 30 ================
.
2012-07-24 18:29:13 -------- d-----w- C:\Users\owner\AppData\Roaming\SUPERAntiSpyware.com
2012-07-24 18:28:13 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com
2012-07-24 18:28:13 -------- d-----w- C:\Program Files\SUPERAntiSpyware
2012-07-24 17:53:25 -------- d-----w- C:\Users\owner\AppData\Local\{00A084E6-FE2A-4FC5-BCA6-89DCF8CB30E3}
2012-07-24 17:53:10 -------- d-----w- C:\Users\owner\AppData\Local\{5669B34C-D3C7-4B91-B4BF-E26BBF6B0FC6}
2012-07-24 07:32:13 -------- d-----w- C:\Users\owner\AppData\Roaming\GetRightToGo
2012-07-24 02:20:55 18944 ----a-r- C:\Users\owner\AppData\Roaming\Microsoft\Installer\{8F018A9E-56DE-4A79-A5EF-25F413F1D538}\IconBB6A16301.exe
2012-07-24 02:18:35 -------- d-----w- C:\Program Files (x86)\iNTERNET_TURBO
2012-07-23 16:59:25 -------- d-----w- C:\Users\owner\AppData\Local\{248D092A-0424-447D-AEC7-D771BCE2BB74}
2012-07-23 16:59:13 -------- d-----w- C:\Users\owner\AppData\Local\{B02B0141-AA53-4ECA-ACE4-FEAF38710C79}
2012-07-23 04:18:57 -------- d-----w- C:\Program Files (x86)\otshot
2012-07-23 04:17:29 -------- d-----w- C:\Users\owner\AppData\Roaming\ZalmanInstaller_otshot
2012-07-22 16:27:04 -------- d-----w- C:\Users\owner\AppData\Local\{EE3A0458-A5E6-453B-8615-E1B13730A100}
2012-07-22 16:26:46 -------- d-----w- C:\Users\owner\AppData\Local\{121FBE75-87B2-45F6-A3F2-06612663B978}
2012-07-21 14:38:23 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{3FE6CA07-15F9-4167-BA1C-FB3CE624AD05}\offreg.dll
2012-07-21 11:38:42 -------- d-----w- C:\Users\owner\AppData\Local\{F7AE7EB6-CF58-463B-8A3D-4AA3D8C2414C}
2012-07-21 11:38:26 -------- d-----w- C:\Users\owner\AppData\Local\{F01D86BA-01A0-4362-8637-E0BCD880C248}
2012-07-21 06:01:30 250912 ----a-w- C:\windows\SysWow64\kz.exe
2012-07-21 05:55:58 -------- d-----w- C:\Users\owner\AppData\Local\sdsvc_Win32
2012-07-21 05:55:33 -------- d-----w- C:\Users\owner\AppData\Local\AA
2012-07-21 05:55:28 -------- d-----w- C:\Users\owner\AppData\Roaming\SndaUpdate
2012-07-21 05:55:27 -------- d-----w- C:\Users\owner\AppData\Roaming\KuaiZip
2012-07-21 05:55:22 92304 ----a-w- C:\windows\System32\drivers\KuaiZipDrive.sys
2012-07-21 05:54:54 -------- d-----w- C:\Users\owner\AppData\Roaming\Softlink
2012-07-21 05:54:51 -------- d-----w- C:\Program Files\ソ・ケ
2012-07-21 05:54:45 -------- d-----w- C:\Users\owner\AppData\Local\SNDAService
2012-07-20 16:09:06 -------- d-----w- C:\Users\owner\AppData\Local\{B0B8209D-5314-4C7B-A7BB-7D056A11C8D8}
2012-07-20 16:08:54 -------- d-----w- C:\Users\owner\AppData\Local\{EC14024B-30A2-4198-8C23-F31C7BBAE536}
2012-07-19 16:49:03 -------- d-----w- C:\Users\owner\AppData\Local\{2F8784E6-4ABC-40C9-8ADC-01073AE9C644}
2012-07-19 16:48:50 -------- d-----w- C:\Users\owner\AppData\Local\{8CA3BDDE-DC7F-455D-91AA-6F5206CA2614}
2012-07-18 19:00:07 -------- d-----w- C:\Users\owner\AppData\Local\{8EFEDDEF-5001-4CA4-8514-F58F71A27ED2}
2012-07-18 13:42:27 -------- d-----w- C:\Users\owner\AppData\Local\{3917F342-E7EA-4CAE-BA0B-9D9FF6E2A8EA}
2012-07-18 13:42:16 -------- d-----w- C:\Users\owner\AppData\Local\{C2B29642-A4DB-4D7B-A9CD-0B8FC058F42D}
2012-07-17 15:50:45 -------- d-----w- C:\Users\owner\AppData\Local\{088B95A2-8D22-44DA-8A09-DC86659A8F27}
2012-07-17 15:50:31 -------- d-----w- C:\Users\owner\AppData\Local\{EF8EE69A-2277-411D-8519-A58B3F35437E}
2012-07-16 15:58:40 -------- d-----w- C:\Users\owner\AppData\Local\{D9A9D73A-CD74-4D0F-AEDF-7D4B79D843B2}
2012-07-16 15:58:27 -------- d-----w- C:\Users\owner\AppData\Local\{CF3FE875-6FDF-4F43-8BF7-0D0508E06E55}
2012-07-15 21:34:30 -------- d-----w- C:\Users\owner\AppData\Local\{7B70410D-05C3-4C2E-B07D-57984946BDEC}
2012-07-15 21:34:16 -------- d-----w- C:\Users\owner\AppData\Local\{D2AF4996-3292-4012-BFAB-DAB1022B4882}
2012-07-15 14:52:27 -------- d-----w- C:\Users\owner\AppData\Local\{138D1083-6056-4E0A-8E4B-8CCA5AF86C66}
2012-07-14 16:41:55 -------- d-----w- C:\Users\owner\AppData\Local\{2B0E2D00-ED0A-4B6C-96DD-FD458B22C49B}
2012-07-14 14:20:52 -------- d-----w- C:\Users\owner\AppData\Local\{9CE5E871-0916-40C3-8DD9-F5138AAE6580}
2012-07-14 14:20:41 -------- d-----w- C:\Users\owner\AppData\Local\{1B4577CD-A536-44A9-AB2D-481F2CACB08E}
2012-07-13 14:29:16 -------- d-----w- C:\Users\owner\AppData\Local\{B9857316-14CF-4C3F-8CA9-CE96CA8E3AE3}
2012-07-13 14:29:03 -------- d-----w- C:\Users\owner\AppData\Local\{D7F402BD-7353-48D9-A270-7B6896ECE0EB}
2012-07-13 12:12:30 -------- d-----w- C:\Users\owner\AppData\Local\{E5CAF545-85B9-41FF-B977-DE2EC3A80795}
2012-07-13 12:12:15 -------- d-----w- C:\Users\owner\AppData\Local\{1D6E3403-324D-4AF8-81BA-AF4B1BAD42C4}
2012-07-13 04:48:15 -------- d-----w- C:\Users\owner\AppData\Local\{3DBFBBA0-ACF8-4312-B39A-EA96E4B3E4AE}
2012-07-12 16:48:04 -------- d-----w- C:\Users\owner\AppData\Local\{FE5ECE5C-41B4-4D97-AE7A-0AF0FF360347}
2012-07-12 01:29:24 -------- d-----w- C:\Users\owner\AppData\Local\{38971941-4533-4B5F-AA49-901577996493}
2012-07-12 01:29:13 -------- d-----w- C:\Users\owner\AppData\Local\{DF66FB3D-D4EB-462D-8924-5079C8DADFD5}
2012-07-11 15:46:57 -------- d-----w- C:\Users\owner\AppData\Local\{BA8B5DDF-1683-4AF0-ADBD-4FA6274989DE}
2012-07-11 15:46:43 -------- d-----w- C:\Users\owner\AppData\Local\{233D0690-CBCA-4036-B436-9E72B126947D}
2012-07-10 15:02:00 -------- d-----w- C:\Users\owner\AppData\Local\{2271F842-A258-4AF0-9D5A-00F704439308}
2012-07-10 15:01:45 -------- d-----w- C:\Users\owner\AppData\Local\{79162FD5-E919-4A7A-8537-22381517B948}
2012-07-09 16:29:14 -------- d-----w- C:\Users\owner\AppData\Local\{A04B245C-1255-42FB-BCE7-A5EB8F2AD027}
2012-07-09 16:28:58 -------- d-----w- C:\Users\owner\AppData\Local\{B9AAA3FD-5B9B-4494-8E97-C3D46291C384}
2012-07-08 16:15:12 -------- d-----w- C:\Users\owner\AppData\Local\{154EC59C-0EFA-4865-B61A-292CE177E411}
2012-07-07 16:38:54 -------- d-----w- C:\Users\owner\AppData\Local\{8B398FF2-8C44-482C-BA96-E142A2C83C76}
2012-07-07 16:38:43 -------- d-----w- C:\Users\owner\AppData\Local\{BB99A983-5E3F-4C92-A3DA-6230BAB36438}
2012-07-06 22:56:48 -------- d-----w- C:\Users\owner\AppData\Local\{8CBF2879-2592-43F8-B19A-A70833E57BFC}
2012-07-06 22:56:36 -------- d-----w- C:\Users\owner\AppData\Local\{3D5F7105-6747-4118-BC1E-3014437A0D85}
2012-07-06 14:27:02 -------- d-----w- C:\Users\owner\AppData\Local\{4C1CC5D4-26E9-426F-91C5-167ACA457A47}
2012-07-06 14:26:50 -------- d-----w- C:\Users\owner\AppData\Local\{1F30D142-1575-43CD-A2D5-F109C0FABE51}
2012-07-05 13:26:38 -------- d-----w- C:\Users\owner\AppData\Local\{1F86A147-C793-4B34-A94E-06B8ABCC6978}
2012-07-05 13:26:27 -------- d-----w- C:\Users\owner\AppData\Local\{D38D1729-97D1-443F-85AA-E54F98C09B5C}
2012-07-05 04:07:04 -------- d-----w- C:\Users\owner\AppData\Local\{862F9F66-49B2-4479-A7C5-4EA53A3CA383}
2012-07-05 04:06:52 -------- d-----w- C:\Users\owner\AppData\Local\{0809FECC-52D4-4E8B-8C51-0B6C17FA98EB}
2012-07-04 13:45:29 -------- d-----w- C:\Users\owner\AppData\Local\{9646E7F6-1CFB-4ABE-BD76-E042D23CA9D2}
2012-07-03 11:59:17 -------- d-----w- C:\Program Files (x86)\Imagenomic
2012-07-03 11:49:23 -------- d-----w- C:\Program Files\Paint.NET
2012-07-03 11:48:37 -------- d-----w- C:\Users\owner\AppData\Local\Paint.NET
2012-07-03 11:01:06 -------- d-----w- C:\Users\owner\AppData\Local\{5B23782B-C5C5-40AD-8FEB-4DC1BE901E7E}
2012-07-03 11:00:24 -------- d-----w- C:\Users\owner\AppData\Local\{2FCDF48C-0FBD-45BE-9D2B-213038FF7F81}
2012-06-25 14:27:37 -------- d-----w- C:\Users\owner\AppData\Local\{66CB8D58-65A7-458A-BEF3-9BDC66CCB2D7}
2012-06-25 14:27:10 -------- d-----w- C:\Users\owner\AppData\Local\{24E5A9B2-1CC9-4B74-AB5E-DF422438A0D5}
.
==================== Find3M ====================
.
2012-07-03 18:46:44 24904 ----a-w- C:\windows\System32\drivers\mbam.sys
2012-07-03 16:21:52 958400 ----a-w- C:\windows\System32\drivers\aswSnx.sys
2012-07-03 16:21:52 71064 ----a-w- C:\windows\System32\drivers\aswMonFlt.sys
2012-07-03 16:21:52 54072 ----a-w- C:\windows\System32\drivers\aswRdr2.sys
2012-07-03 16:21:32 41224 ----a-w- C:\windows\avastSS.scr
2012-05-17 02:29:31 499712 ----a-w- C:\windows\SysWow64\msvcp71.dll
2012-05-17 02:29:31 348160 ----a-w- C:\windows\SysWow64\msvcr71.dll
.
============= FINISH: 15:05:58.56 ===============

Edited by JonJonz321, 24 July 2012 - 03:13 PM.


BC AdBot (Login to Remove)

 


#2 HelpBot

HelpBot

    Bleepin' Binary Bot


  • Bots
  • 12,697 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:13 AM

Posted 29 July 2012 - 03:15 PM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

Posted Image In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/462288 <<< CLICK THIS LINK



If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

Posted Image If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new DDS and GMER log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE


We also need a new log from the GMER anti-rootkit Scanner.

Please note that if you are running a 64-bit version of Windows, you should not bother creating a GMER log.

Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice


Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log


As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#3 JonJonz321

JonJonz321
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:13 PM

Posted 29 July 2012 - 10:24 PM

Well to reiterate, my start up was slow and I used advanced system care and detected a backdoor.frauder . I got rid of it but the start up is still slow. The screen turns black before it loads my desktop. It lasts about 1-2 minutes. I had a few disk scans, used spybot,and superantispyware free edition. I tried to use MBAM but it froze even in safe mode. Umm I ran TDSS killer and found a few infections but I didn't do anything. Oh, I'm using a windows 7 64 bit system.

here's my updated files


.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by owner at 22:22:01 on 2012-07-29
Microsoft Windows 7 Home Premium 6.1.7601.1.932.81.1033.18.3933.1733 [GMT -5:00]
.
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\windows\system32\wininit.exe
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\Program Files\Sandboxie\SbieSvc.exe
C:\Program Files\Tablet\Pen\Pen_TouchService.exe
C:\windows\system32\ngvpnmgr.exe
C:\windows\system32\svchost.exe -k NetworkService
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\windows\SYSTEM32\WISPTIS.EXE
C:\windows\system32\taskhost.exe
C:\windows\system32\Dwm.exe
C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
C:\windows\Explorer.EXE
C:\windows\system32\taskeng.exe
C:\windows\system32\taskeng.exe
C:\Program Files (x86)\IObit\Smart Defrag 2\SmartDefrag.exe
C:\Program Files (x86)\IObit\Game Booster\gbtray.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Motive\McciCMService.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Users\owner\AppData\Local\sdsvc_Win32\sdsvc.exe
C:\Program Files\Tablet\Pen\Pen_Tablet.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
C:\Program Files\Tablet\Pen\Pen_Tablet.exe
C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\igfxtray.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\windows\system32\igfxsrvc.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
C:\windows\system32\igfxext.exe
C:\Windows\System32\StikyNot.exe
C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe
C:\Program Files\Sandboxie\SbieCtrl.exe
C:\Program Files (x86)\Toshiba\Utilities\KeNotify.exe
C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\windows\SysWOW64\rundll32.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\windows\System32\svchost.exe -k secsvcs
C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASC.exe
C:\windows\splwow64.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\windows\system32\taskeng.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\system32\DllHost.exe
C:\windows\system32\DllHost.exe
C:\windows\SysWOW64\cmd.exe
C:\windows\system32\conhost.exe
C:\windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3197087
uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
uWindow Title =
mDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
uURLSearchHooks: YTNavAssistPlugin Class: {81017ea9-9aa8-4a6a-9734-7af40e7d593f} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll
uURLSearchHooks: IMVU Inc Toolbar: {90b49673-5506-483e-b92b-ca0265bd9ca8} - C:\Program Files (x86)\IMVU_Inc\prxtbIMVU.dll
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
mURLSearchHooks: IMVU Inc Toolbar: {90b49673-5506-483e-b92b-ca0265bd9ca8} - C:\Program Files (x86)\IMVU_Inc\prxtbIMVU.dll
mURLSearchHooks: YTNavAssistPlugin Class: {81017ea9-9aa8-4a6a-9734-7af40e7d593f} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll
mWinlogon: Userinit=userinit.exe,
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: IMVU Inc Toolbar: {90b49673-5506-483e-b92b-ca0265bd9ca8} - C:\Program Files (x86)\IMVU_Inc\prxtbIMVU.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll
TB: IMVU Inc Toolbar: {90b49673-5506-483e-b92b-ca0265bd9ca8} - C:\Program Files (x86)\IMVU_Inc\prxtbIMVU.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
TB: {93C338DE-5FB5-4FB5-AB4E-0EEDC0BD9F3A} - No File
TB: {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - No File
uRun: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe
uRun: [Advanced SystemCare 5] "C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" /AutoStart
uRun: [Google Update] "C:\Users\owner\AppData\Local\Google\Update\GoogleUpdate.exe" /c
uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
uRun: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe"
mRun: [SVPWUTIL] C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
mRun: [KeNotify] C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
mRun: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
mRun: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [BambooCore] C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun: [TkBellExe] "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MIF5BA~1\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MIF5BA~1\Office12\REFIEBAR.DLL
Trusted Zone: $talisma_url$
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{4AAC1865-70C9-4D56-A74C-C1609AA0102E} : DhcpNameServer = 192.168.1.254
TCP: Interfaces\{CA82EE73-F6D2-4937-8E6E-AFB944201E74}\4656071657C626C65756 : DhcpNameServer = 140.192.0.2 140.192.239.2
TCP: Interfaces\{CA82EE73-F6D2-4937-8E6E-AFB944201E74}\4656071657C677962756C6563737 : DhcpNameServer = 140.192.0.2 140.192.239.2
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
BHO-X64: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll
BHO-X64: 0x1 - No File
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
BHO-X64: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
BHO-X64: Increase performance and video formats for your HTML5 <video> - No File
BHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: IMVU Inc Toolbar: {90b49673-5506-483e-b92b-ca0265bd9ca8} - C:\Program Files (x86)\IMVU_Inc\prxtbIMVU.dll
BHO-X64: IMVU Inc - No File
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO-X64: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
TB-X64: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll
TB-X64: IMVU Inc Toolbar: {90b49673-5506-483e-b92b-ca0265bd9ca8} - C:\Program Files (x86)\IMVU_Inc\prxtbIMVU.dll
TB-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
TB-X64: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
TB-X64: {93C338DE-5FB5-4FB5-AB4E-0EEDC0BD9F3A} - No File
TB-X64: {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - No File
mRun-x64: [SVPWUTIL] C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
mRun-x64: [KeNotify] C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
mRun-x64: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
mRun-x64: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun-x64: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [BambooCore] C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
mRun-x64: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun-x64: [TkBellExe] "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot
mRun-x64: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
Hosts: 127.0.0.1 www.spywareinfo.com
.
============= SERVICES / DRIVERS ===============
.
R0 PxHlpa64;PxHlpa64;C:\windows\system32\Drivers\PxHlpa64.sys --> C:\windows\system32\Drivers\PxHlpa64.sys [?]
R0 SmartDefragDriver;SmartDefragDriver;C:\windows\system32\Drivers\SmartDefragDriver.sys --> C:\windows\system32\Drivers\SmartDefragDriver.sys [?]
R0 tos_sps64;TOSHIBA tos_sps64 Service;C:\windows\system32\DRIVERS\tos_sps64.sys --> C:\windows\system32\DRIVERS\tos_sps64.sys [?]
R1 aswKbd;aswKbd;C:\windows\system32\drivers\aswKbd.sys --> C:\windows\system32\drivers\aswKbd.sys [?]
R1 aswSnx;aswSnx;C:\windows\system32\drivers\aswSnx.sys --> C:\windows\system32\drivers\aswSnx.sys [?]
R1 aswSP;aswSP;C:\windows\system32\drivers\aswSP.sys --> C:\windows\system32\drivers\aswSP.sys [?]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R1 vwififlt;Virtual WiFi Filter Driver;C:\windows\system32\DRIVERS\vwififlt.sys --> C:\windows\system32\DRIVERS\vwififlt.sys [?]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2011-8-11 140672]
R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]
R2 AdvancedSystemCareService5;Advanced SystemCare Service 5;C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2011-11-18 913792]
R2 aswFsBlk;aswFsBlk;C:\windows\system32\drivers\aswFsBlk.sys --> C:\windows\system32\drivers\aswFsBlk.sys [?]
R2 aswMonFlt;aswMonFlt;\??\C:\windows\system32\drivers\aswMonFlt.sys --> C:\windows\system32\drivers\aswMonFlt.sys [?]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-7-6 44808]
R2 cfWiMAXService;ConfigFree WiMAX Service;C:\Program Files (x86)\Toshiba\ConfigFree\CFIWmxSvcs64.exe [2009-8-10 248688]
R2 ConfigFree Gadget Service;ConfigFree Gadget Service;C:\Program Files (x86)\Toshiba\ConfigFree\CFProcSRVC.exe [2009-7-14 42368]
R2 ConfigFree Service;ConfigFree Service;C:\Program Files (x86)\Toshiba\ConfigFree\CFSvcs.exe [2009-3-10 46448]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-9-28 655944]
R2 McciCMService64;McciCMService64;C:\Program Files\Common Files\Motive\McciCMService.exe [2012-4-18 517632]
R2 NgVpnMgr;Aventail VPN Client;C:\windows\system32\ngvpnmgr.exe --> C:\windows\system32\ngvpnmgr.exe [?]
R2 sdSvc;SdDataOptimize.;C:\Users\owner\AppData\Local\sdsvc_Win32\sdsvc.exe [2012-7-21 296240]
R2 TabletServicePen;TabletServicePen;C:\Program Files\Tablet\Pen\Pen_Tablet.exe [2012-4-5 6583160]
R2 TouchServicePen;Wacom Consumer Touch Service;C:\Program Files\Tablet\Pen\Pen_TouchService.exe [2012-4-5 528760]
R3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\windows\system32\DRIVERS\dtsoftbus01.sys --> C:\windows\system32\DRIVERS\dtsoftbus01.sys [?]
R3 MBAMProtector;MBAMProtector;\??\C:\windows\system32\drivers\mbam.sys --> C:\windows\system32\drivers\mbam.sys [?]
R3 NgLog;Aventail VPN Logging;C:\windows\system32\DRIVERS\nglog.sys --> C:\windows\system32\DRIVERS\nglog.sys [?]
R3 NgVpn;Aventail VPN Adapter;C:\windows\system32\DRIVERS\ngvpn.sys --> C:\windows\system32\DRIVERS\ngvpn.sys [?]
R3 NgWfp;Aventail VPN Callout;C:\windows\system32\DRIVERS\ngwfp.sys --> C:\windows\system32\DRIVERS\ngwfp.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\windows\system32\DRIVERS\Rt64win7.sys --> C:\windows\system32\DRIVERS\Rt64win7.sys [?]
R3 SbieDrv;SbieDrv;C:\Program Files\Sandboxie\SbieDrv.sys [2012-4-10 164528]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2009-8-3 137560]
R3 WinRing0_1_2_0;WinRing0_1_2_0;C:\Program Files (x86)\IObit\Game Booster\Driver\WinRing0x64.sys [2012-6-8 14544]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-7-4 135664]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-7-4 135664]
S3 NgFilter;Aventail VPN Filter;C:\windows\system32\DRIVERS\ngfilter.sys --> C:\windows\system32\DRIVERS\ngfilter.sys [?]
S3 npggsvc;nProtect GameGuard Service;C:\windows\system32\GameMon.des -service --> C:\windows\system32\GameMon.des -service [?]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\windows\system32\Drivers\RtsUStor.sys --> C:\windows\system32\Drivers\RtsUStor.sys [?]
S3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;C:\windows\system32\DRIVERS\RTL8187B.sys --> C:\windows\system32\DRIVERS\RTL8187B.sys [?]
S3 TMachInfo;TMachInfo;C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\TMachInfo.exe [2011-7-4 51512]
S3 TsUsbFlt;TsUsbFlt;C:\windows\system32\drivers\tsusbflt.sys --> C:\windows\system32\drivers\tsusbflt.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\system32\Wat\WatAdminSvc.exe --> C:\windows\system32\Wat\WatAdminSvc.exe [?]
.
=============== Created Last 30 ================
.
2012-07-28 15:47:55 -------- d-----w- C:\Users\owner\AppData\Local\{F68A14FA-CD39-4131-82F0-22C4DDB0252D}
2012-07-28 15:47:44 -------- d-----w- C:\Users\owner\AppData\Local\{584246DD-5C58-4357-95D7-4F36114DF517}
2012-07-28 01:41:49 -------- d-----w- C:\Users\owner\AppData\Local\{B903566A-1B0A-485E-833C-9FCDEAFC0C9A}
2012-07-28 01:41:37 -------- d-----w- C:\Users\owner\AppData\Local\{8189BC4A-9594-4BDF-A70B-9D9208CB9E2C}
2012-07-27 23:36:43 -------- d-----w- C:\Users\owner\AppData\Local\{C9A438AB-D625-455C-A141-588A8D20545F}
2012-07-27 23:36:30 -------- d-----w- C:\Users\owner\AppData\Local\{D884735C-DD36-47E4-B633-34B3B132524A}
2012-07-27 13:05:30 -------- d-----w- C:\Users\owner\AppData\Local\{78A92EA6-4752-480F-BC36-41A04F0BB40A}
2012-07-27 05:18:22 -------- d-----w- C:\Users\owner\AppData\Local\{231ABFA4-E45F-452E-824B-7BCF20022C07}
2012-07-27 05:18:10 -------- d-----w- C:\Users\owner\AppData\Local\{7427E760-F142-424C-9716-7906C8B287C0}
2012-07-27 05:12:47 -------- d-----w- C:\Users\owner\AppData\Local\{550FAA20-2423-4B1D-9A7B-4D9ACAC8FB04}
2012-07-27 05:12:36 -------- d-----w- C:\Users\owner\AppData\Local\{73D4EEB7-F820-4AF5-931F-F15120E8371B}
2012-07-27 04:35:39 -------- d-----w- C:\Users\owner\AppData\Local\{9CDB3969-B9E2-4CFA-977A-3DB7ABAAC42E}
2012-07-27 04:35:25 -------- d-----w- C:\Users\owner\AppData\Local\{3BC7DC13-0D86-4734-AB74-3DF3AE532C07}
2012-07-26 15:25:29 -------- d-----w- C:\Users\owner\AppData\Local\{7FD74ADA-6DBE-4D9A-AC5B-C7D5767961FF}
2012-07-26 15:25:15 -------- d-----w- C:\Users\owner\AppData\Local\{2FAB4403-82D5-4058-910A-2CF8A287A14F}
2012-07-25 22:51:50 -------- d-----w- C:\Users\owner\AppData\Local\visi_coupon
2012-07-25 22:48:44 -------- d-----w- C:\Users\owner\AppData\Local\{F77EAA95-D46C-4A69-8416-830FC24E99AA}
2012-07-25 16:40:49 -------- d-----w- C:\Users\owner\AppData\Local\{5B46B51A-E940-456A-854A-400422ADB921}
2012-07-25 16:40:36 -------- d-----w- C:\Users\owner\AppData\Local\{18D70C31-DF1C-4D40-A0CA-61363363C59B}
2012-07-24 18:29:13 -------- d-----w- C:\Users\owner\AppData\Roaming\SUPERAntiSpyware.com
2012-07-24 18:28:13 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com
2012-07-24 18:28:13 -------- d-----w- C:\Program Files\SUPERAntiSpyware
2012-07-24 17:53:25 -------- d-----w- C:\Users\owner\AppData\Local\{00A084E6-FE2A-4FC5-BCA6-89DCF8CB30E3}
2012-07-24 17:53:10 -------- d-----w- C:\Users\owner\AppData\Local\{5669B34C-D3C7-4B91-B4BF-E26BBF6B0FC6}
2012-07-24 07:32:13 -------- d-----w- C:\Users\owner\AppData\Roaming\GetRightToGo
2012-07-24 02:20:55 18944 ----a-r- C:\Users\owner\AppData\Roaming\Microsoft\Installer\{8F018A9E-56DE-4A79-A5EF-25F413F1D538}\IconBB6A16301.exe
2012-07-24 02:18:35 -------- d-----w- C:\Program Files (x86)\iNTERNET_TURBO
2012-07-23 16:59:25 -------- d-----w- C:\Users\owner\AppData\Local\{248D092A-0424-447D-AEC7-D771BCE2BB74}
2012-07-23 16:59:13 -------- d-----w- C:\Users\owner\AppData\Local\{B02B0141-AA53-4ECA-ACE4-FEAF38710C79}
2012-07-23 04:18:57 -------- d-----w- C:\Program Files (x86)\otshot
2012-07-23 04:17:29 -------- d-----w- C:\Users\owner\AppData\Roaming\ZalmanInstaller_otshot
2012-07-22 16:27:04 -------- d-----w- C:\Users\owner\AppData\Local\{EE3A0458-A5E6-453B-8615-E1B13730A100}
2012-07-22 16:26:46 -------- d-----w- C:\Users\owner\AppData\Local\{121FBE75-87B2-45F6-A3F2-06612663B978}
2012-07-21 14:38:23 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{3FE6CA07-15F9-4167-BA1C-FB3CE624AD05}\offreg.dll
2012-07-21 11:38:42 -------- d-----w- C:\Users\owner\AppData\Local\{F7AE7EB6-CF58-463B-8A3D-4AA3D8C2414C}
2012-07-21 11:38:26 -------- d-----w- C:\Users\owner\AppData\Local\{F01D86BA-01A0-4362-8637-E0BCD880C248}
2012-07-21 06:01:30 250912 ----a-w- C:\windows\SysWow64\kz.exe
2012-07-21 05:55:58 -------- d-----w- C:\Users\owner\AppData\Local\sdsvc_Win32
2012-07-21 05:55:33 -------- d-----w- C:\Users\owner\AppData\Local\AA
2012-07-21 05:55:28 -------- d-----w- C:\Users\owner\AppData\Roaming\SndaUpdate
2012-07-21 05:55:27 -------- d-----w- C:\Users\owner\AppData\Roaming\KuaiZip
2012-07-21 05:55:22 92304 ----a-w- C:\windows\System32\drivers\KuaiZipDrive.sys
2012-07-21 05:54:54 -------- d-----w- C:\Users\owner\AppData\Roaming\Softlink
2012-07-21 05:54:51 -------- d-----w- C:\Program Files\ソ・ケ
2012-07-21 05:54:45 -------- d-----w- C:\Users\owner\AppData\Local\SNDAService
2012-07-20 16:09:06 -------- d-----w- C:\Users\owner\AppData\Local\{B0B8209D-5314-4C7B-A7BB-7D056A11C8D8}
2012-07-20 16:08:54 -------- d-----w- C:\Users\owner\AppData\Local\{EC14024B-30A2-4198-8C23-F31C7BBAE536}
2012-07-19 16:49:03 -------- d-----w- C:\Users\owner\AppData\Local\{2F8784E6-4ABC-40C9-8ADC-01073AE9C644}
2012-07-19 16:48:50 -------- d-----w- C:\Users\owner\AppData\Local\{8CA3BDDE-DC7F-455D-91AA-6F5206CA2614}
2012-07-18 19:00:07 -------- d-----w- C:\Users\owner\AppData\Local\{8EFEDDEF-5001-4CA4-8514-F58F71A27ED2}
2012-07-18 13:42:27 -------- d-----w- C:\Users\owner\AppData\Local\{3917F342-E7EA-4CAE-BA0B-9D9FF6E2A8EA}
2012-07-18 13:42:16 -------- d-----w- C:\Users\owner\AppData\Local\{C2B29642-A4DB-4D7B-A9CD-0B8FC058F42D}
2012-07-17 15:50:45 -------- d-----w- C:\Users\owner\AppData\Local\{088B95A2-8D22-44DA-8A09-DC86659A8F27}
2012-07-17 15:50:31 -------- d-----w- C:\Users\owner\AppData\Local\{EF8EE69A-2277-411D-8519-A58B3F35437E}
2012-07-16 15:58:40 -------- d-----w- C:\Users\owner\AppData\Local\{D9A9D73A-CD74-4D0F-AEDF-7D4B79D843B2}
2012-07-16 15:58:27 -------- d-----w- C:\Users\owner\AppData\Local\{CF3FE875-6FDF-4F43-8BF7-0D0508E06E55}
2012-07-15 21:34:30 -------- d-----w- C:\Users\owner\AppData\Local\{7B70410D-05C3-4C2E-B07D-57984946BDEC}
2012-07-15 21:34:16 -------- d-----w- C:\Users\owner\AppData\Local\{D2AF4996-3292-4012-BFAB-DAB1022B4882}
2012-07-15 14:52:27 -------- d-----w- C:\Users\owner\AppData\Local\{138D1083-6056-4E0A-8E4B-8CCA5AF86C66}
2012-07-14 16:41:55 -------- d-----w- C:\Users\owner\AppData\Local\{2B0E2D00-ED0A-4B6C-96DD-FD458B22C49B}
2012-07-14 14:20:52 -------- d-----w- C:\Users\owner\AppData\Local\{9CE5E871-0916-40C3-8DD9-F5138AAE6580}
2012-07-14 14:20:41 -------- d-----w- C:\Users\owner\AppData\Local\{1B4577CD-A536-44A9-AB2D-481F2CACB08E}
2012-07-13 14:29:16 -------- d-----w- C:\Users\owner\AppData\Local\{B9857316-14CF-4C3F-8CA9-CE96CA8E3AE3}
2012-07-13 14:29:03 -------- d-----w- C:\Users\owner\AppData\Local\{D7F402BD-7353-48D9-A270-7B6896ECE0EB}
2012-07-13 12:12:30 -------- d-----w- C:\Users\owner\AppData\Local\{E5CAF545-85B9-41FF-B977-DE2EC3A80795}
2012-07-13 12:12:15 -------- d-----w- C:\Users\owner\AppData\Local\{1D6E3403-324D-4AF8-81BA-AF4B1BAD42C4}
2012-07-13 04:48:15 -------- d-----w- C:\Users\owner\AppData\Local\{3DBFBBA0-ACF8-4312-B39A-EA96E4B3E4AE}
2012-07-12 16:48:04 -------- d-----w- C:\Users\owner\AppData\Local\{FE5ECE5C-41B4-4D97-AE7A-0AF0FF360347}
2012-07-12 01:29:24 -------- d-----w- C:\Users\owner\AppData\Local\{38971941-4533-4B5F-AA49-901577996493}
2012-07-12 01:29:13 -------- d-----w- C:\Users\owner\AppData\Local\{DF66FB3D-D4EB-462D-8924-5079C8DADFD5}
2012-07-11 15:46:57 -------- d-----w- C:\Users\owner\AppData\Local\{BA8B5DDF-1683-4AF0-ADBD-4FA6274989DE}
2012-07-11 15:46:43 -------- d-----w- C:\Users\owner\AppData\Local\{233D0690-CBCA-4036-B436-9E72B126947D}
2012-07-10 15:02:00 -------- d-----w- C:\Users\owner\AppData\Local\{2271F842-A258-4AF0-9D5A-00F704439308}
2012-07-10 15:01:45 -------- d-----w- C:\Users\owner\AppData\Local\{79162FD5-E919-4A7A-8537-22381517B948}
2012-07-09 16:29:14 -------- d-----w- C:\Users\owner\AppData\Local\{A04B245C-1255-42FB-BCE7-A5EB8F2AD027}
2012-07-09 16:28:58 -------- d-----w- C:\Users\owner\AppData\Local\{B9AAA3FD-5B9B-4494-8E97-C3D46291C384}
2012-07-08 16:15:12 -------- d-----w- C:\Users\owner\AppData\Local\{154EC59C-0EFA-4865-B61A-292CE177E411}
2012-07-07 16:38:54 -------- d-----w- C:\Users\owner\AppData\Local\{8B398FF2-8C44-482C-BA96-E142A2C83C76}
2012-07-07 16:38:43 -------- d-----w- C:\Users\owner\AppData\Local\{BB99A983-5E3F-4C92-A3DA-6230BAB36438}
2012-07-06 22:56:48 -------- d-----w- C:\Users\owner\AppData\Local\{8CBF2879-2592-43F8-B19A-A70833E57BFC}
2012-07-06 22:56:36 -------- d-----w- C:\Users\owner\AppData\Local\{3D5F7105-6747-4118-BC1E-3014437A0D85}
2012-07-06 14:27:02 -------- d-----w- C:\Users\owner\AppData\Local\{4C1CC5D4-26E9-426F-91C5-167ACA457A47}
2012-07-06 14:26:50 -------- d-----w- C:\Users\owner\AppData\Local\{1F30D142-1575-43CD-A2D5-F109C0FABE51}
2012-07-05 13:26:38 -------- d-----w- C:\Users\owner\AppData\Local\{1F86A147-C793-4B34-A94E-06B8ABCC6978}
2012-07-05 13:26:27 -------- d-----w- C:\Users\owner\AppData\Local\{D38D1729-97D1-443F-85AA-E54F98C09B5C}
2012-07-05 04:07:04 -------- d-----w- C:\Users\owner\AppData\Local\{862F9F66-49B2-4479-A7C5-4EA53A3CA383}
2012-07-05 04:06:52 -------- d-----w- C:\Users\owner\AppData\Local\{0809FECC-52D4-4E8B-8C51-0B6C17FA98EB}
2012-07-04 13:45:29 -------- d-----w- C:\Users\owner\AppData\Local\{9646E7F6-1CFB-4ABE-BD76-E042D23CA9D2}
2012-07-03 11:59:17 -------- d-----w- C:\Program Files (x86)\Imagenomic
2012-07-03 11:49:23 -------- d-----w- C:\Program Files\Paint.NET
2012-07-03 11:48:37 -------- d-----w- C:\Users\owner\AppData\Local\Paint.NET
2012-07-03 11:01:06 -------- d-----w- C:\Users\owner\AppData\Local\{5B23782B-C5C5-40AD-8FEB-4DC1BE901E7E}
2012-07-03 11:00:24 -------- d-----w- C:\Users\owner\AppData\Local\{2FCDF48C-0FBD-45BE-9D2B-213038FF7F81}
.
==================== Find3M ====================
.
2012-07-03 18:46:44 24904 ----a-w- C:\windows\System32\drivers\mbam.sys
2012-07-03 16:21:52 958400 ----a-w- C:\windows\System32\drivers\aswSnx.sys
2012-07-03 16:21:52 71064 ----a-w- C:\windows\System32\drivers\aswMonFlt.sys
2012-07-03 16:21:52 54072 ----a-w- C:\windows\System32\drivers\aswRdr2.sys
2012-07-03 16:21:32 41224 ----a-w- C:\windows\avastSS.scr
2012-05-17 02:29:31 499712 ----a-w- C:\windows\SysWow64\msvcp71.dll
2012-05-17 02:29:31 348160 ----a-w- C:\windows\SysWow64\msvcr71.dll
.
============= FINISH: 22:22:55.02 ===============

Attached Files


Edited by JonJonz321, 29 July 2012 - 10:25 PM.


#4 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:01:13 AM

Posted 30 July 2012 - 11:37 AM

sorry for the wait, the forum has been very busy lately

please run the following:

download Farbar Recovery Scan Tool and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Choose your language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.
To enter System Recovery Options by using Windows installation disc:
  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Choose your language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.
On the System Recovery Options menu you will get the following options:
Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt
[*]Select Command Prompt
[*]In the command window type in notepad and press Enter.
[*]The notepad opens. Under File menu select Open.
[*]Select "Computer" and find your flash drive letter and close the notepad.
[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
Note: Replace letter e with the drive letter of your flash drive.
[*]The tool will start to run.
[*]When the tool opens click Yes to the disclaimer.
[*]Place a check next to List Drivers MD5 as well as the default check marks that are already there
[*]Press Scan button.
[*]FRST will let you know when the scan is complete and has written the FRST.txt to file, close out this message, then type the following into the search box:
services.exe
[*]now press the search button
[*]when the search is complete, search.txt will also be written to your USB
[*]type exit and reboot the computer normally
[*]please copy and paste both logs in your reply.(FRST.txt and Search.txt)[/list]

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#5 JonJonz321

JonJonz321
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:13 PM

Posted 30 July 2012 - 12:49 PM

Thank you for helping me. :lol:


Here is the FRST log

Scan result of Farbar Recovery Scan Tool Version: 25-07-2012 01
Ran by SYSTEM at 30-07-2012 12:23:32
Running from F:\
Windows 7 Home Premium (X64) OS Language: English(US)
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [] [x]
HKLM\...\Run: [IgfxTray] C:\windows\system32\igfxtray.exe [165912 2009-09-02] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] C:\windows\system32\hkcmd.exe [387608 2009-09-02] (Intel Corporation)
HKLM\...\Run: [Persistence] C:\windows\system32\igfxpers.exe [365592 2009-09-02] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7982112 2009-07-28] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1815848 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE [497504 2009-08-21] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe [508216 2009-07-28] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe [909624 2009-08-05] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2009-08-03] (TOSHIBA Corporation)
HKLM\...\Run: [TosNC] %ProgramFiles%\Toshiba\BulletinBoard\TosNcCore.exe [595816 2009-10-28] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] %ProgramFiles%\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [34648 2009-10-28] (TOSHIBA Corporation)
HKLM-x32\...\Run: [SVPWUTIL] C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL [352256 2009-08-12] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [KeNotify] C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe [34088 2009-01-13] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60 [1294136 2009-08-17] (TOSHIBA Corporation)
HKLM-x32\...\Run: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [498160 2009-07-12] ()
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-02] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2012-02-20] (Apple Inc.)
HKLM-x32\...\Run: [DivXUpdate] "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW [1259376 2011-07-28] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-18] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [BambooCore] C:\Program Files (x86)\Bamboo Dock\BambooCore.exe [646232 2011-09-26] ()
HKLM-x32\...\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui [4273976 2012-07-03] (AVAST Software)
HKLM-x32\...\Run: [TkBellExe] "c:\program files (x86)\real\realplayer\Update\realsched.exe" -osboot [296056 2012-05-16] (RealNetworks, Inc.)
HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-04-18] (Apple Inc.)
HKU\owner\...\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe [427520 2009-07-13] (Microsoft Corporation)
HKU\owner\...\Run: [Advanced SystemCare 5] "C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" /AutoStart [288128 2012-05-28] (IObit)
HKU\owner\...\Run: [Google Update] "C:\Users\owner\AppData\Local\Google\Update\GoogleUpdate.exe" /c [135664 2011-07-04] (Google Inc.)
HKU\owner\...\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background [4283256 2011-05-13] (Microsoft Corporation)
HKU\owner\...\Run: [SandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe" [668944 2012-04-10] (SANDBOXIE L.T.D)
Winlogon\Notify\igfxcui: igfxdev.dll (Intel Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

==================== Services (Whitelisted) ======

2 !SASCORE; "C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE" [140672 2011-08-11] (SUPERAntiSpyware.com)
2 AdvancedSystemCareService5; C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [913792 2012-05-26] (IObit)
2 avast! Antivirus; "C:\Program Files\AVAST Software\Avast\AvastSvc.exe" [44808 2012-07-03] (AVAST Software)
2 MBAMService; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe" [655944 2012-07-03] (Malwarebytes Corporation)
2 McciCMService64; "C:\Program Files\Common Files\Motive\McciCMService.exe" [517632 2012-01-25] (Alcatel-Lucent)
2 NgVpnMgr; C:\windows\system32\ngvpnmgr.exe [510024 2010-10-10] (Aventail Corporation)
2 SbieSvc; "C:\Program Files\Sandboxie\SbieSvc.exe" [97552 2012-04-10] (SANDBOXIE L.T.D)
2 sdSvc; C:\Users\owner\AppData\Local\sdsvc_Win32\sdsvc.exe [296240 2012-07-20] ()
3 stllssvr; "C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe" [74392 2009-04-30] (MicroVision Development, Inc.)

========================== Drivers (Whitelisted) =============

2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [25232 2012-07-03] (AVAST Software)
1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [28504 2012-03-06] (AVAST Software)
2 aswMonFlt; C:\Windows\System32\Drivers\aswMonFlt.sys [71064 2012-07-03] (AVAST Software)
1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [54072 2012-07-03] (AVAST Software)
1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [958400 2012-07-03] (AVAST Software)
1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [355856 2012-07-03] (AVAST Software)
1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [59728 2012-07-03] (AVAST Software)
3 dtsoftbus01; C:\Windows\System32\Drivers\dtsoftbus01.sys [270912 2011-09-23] (DT Soft Ltd)
3 MBAMProtector; \??\C:\windows\system32\drivers\mbam.sys [24904 2012-07-03] (Malwarebytes Corporation)
3 MREMP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS [43008 2011-09-09] (Printing Communications Assoc., Inc. (PCAUSA))
3 MRESP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS [40960 2011-09-09] (Printing Communications Assoc., Inc. (PCAUSA))
3 NgFilter; C:\Windows\System32\Drivers\NgFilter.sys [26136 2010-10-10] (Aventail Corporation)
3 NgLog; C:\Windows\System32\Drivers\NgLog.sys [31256 2010-10-10] (Aventail Corporation)
3 NgVpn; C:\Windows\System32\Drivers\NgVpn.sys [98840 2010-10-10] (Aventail Corporation)
3 NgWfp; C:\Windows\System32\Drivers\NgWfp.sys [28696 2010-10-10] (Aventail Corporation)
3 RTL8187B; C:\Windows\System32\Drivers\RTL8187B.sys [450048 2010-03-31] (Realtek Semiconductor Corporation )
1 SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
1 SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
3 SbieDrv; \??\C:\Program Files\Sandboxie\SbieDrv.sys [164528 2012-04-10] (SANDBOXIE L.T.D)
0 SmartDefragDriver; C:\Windows\System32\Drivers\SmartDefragDriver.sys [17720 2010-11-26] ()
3 MREMPR5; [x]
3 MRENDIS5; [x]
3 NPPTNT2; \??\C:\windows\system32\npptNT2.sys [x]
3 RtsUIR; C:\Windows\System32\DRIVERS\Rts516xIR.sys [x]
3 USBCCID; C:\Windows\System32\DRIVERS\RtsUCcid.sys [x]
3 X6va005; [x]
3 X6va006; [x]
3 X6va008; [x]
3 X6va009; [x]

========================== NetSvcs (Whitelisted) ===========


============ One Month Created Files and Folders ==============

2012-07-30 12:22 - 2012-07-30 12:23 - 00000000 ____D C:\FRST
2012-07-30 09:15 - 2012-07-30 09:15 - 01438391 ____A (Farbar) C:\Users\owner\Downloads\FRST64.exe
2012-07-30 09:15 - 2012-07-30 09:15 - 01438391 ____A (Farbar) C:\Users\owner\Downloads\FRST64 (2).exe
2012-07-30 09:15 - 2012-07-30 09:15 - 01438391 ____A (Farbar) C:\Users\owner\Downloads\FRST64 (1).exe
2012-07-30 07:29 - 2012-07-30 07:29 - 00000000 ____D C:\Users\owner\AppData\Local\{E691F8F0-1571-43ED-8899-0DB9CC46541D}
2012-07-30 07:29 - 2012-07-30 07:29 - 00000000 ____D C:\Users\owner\AppData\Local\{E0F09390-10BF-4E37-84AE-DF71333A52D8}
2012-07-30 07:26 - 2012-07-30 07:26 - 00000352 ____A C:\Windows\PFRO.log
2012-07-30 07:26 - 2012-07-30 07:26 - 00000056 ____A C:\Windows\setupact.log
2012-07-30 07:26 - 2012-07-30 07:26 - 00000000 ____A C:\Windows\setuperr.log
2012-07-29 22:07 - 2012-07-29 22:07 - 01103592 ____A (The Nielsen Company) C:\Users\owner\Downloads\netsight_setup_5.3.0.11_MP_Production_mid60151904485_p.exe
2012-07-29 20:03 - 2012-07-29 20:04 - 13729789 ____A C:\Users\owner\Downloads\Cheat Engine v6.1 And v6.2.rar
2012-07-29 19:59 - 2012-07-29 19:59 - 03345504 ____A (MiMedia, LLC) C:\Users\owner\Downloads\MiMedia_Installer_Windows.exe
2012-07-29 19:59 - 2012-07-29 19:59 - 03345504 ____A (MiMedia, LLC) C:\Users\owner\Downloads\MiMedia_Installer_Windows (1).exe
2012-07-29 19:17 - 2012-07-29 19:18 - 00607260 ____R (Swearware) C:\Users\owner\Downloads\dds.scr
2012-07-29 19:06 - 2012-07-29 19:14 - 60918509 ____A C:\Users\owner\Downloads\kuttsukiboshi1.mp4
2012-07-29 19:06 - 2012-07-29 19:13 - 47611957 ____A C:\Users\owner\Downloads\kuttsukiboshi2.mp4
2012-07-29 15:02 - 2012-07-29 20:58 - 00000000 ____D C:\Users\owner\Desktop\himekibleepaming
2012-07-29 15:01 - 2012-07-29 15:01 - 00000000 ____D C:\Users\owner\Downloads\C76-466-303
2012-07-28 23:16 - 2012-07-28 23:30 - 24785093 ____A C:\Users\owner\Downloads\Xration,_R_Hard_Core_(Ragnarok_Online).rar
2012-07-28 07:47 - 2012-07-28 07:48 - 00000000 ____D C:\Users\owner\AppData\Local\{F68A14FA-CD39-4131-82F0-22C4DDB0252D}
2012-07-28 07:47 - 2012-07-28 07:47 - 00000000 ____D C:\Users\owner\AppData\Local\{584246DD-5C58-4357-95D7-4F36114DF517}
2012-07-27 19:06 - 2012-07-27 19:25 - 174838545 ____A C:\Users\owner\Downloads\Virgin Island 122.zip
2012-07-27 18:54 - 2012-07-27 19:03 - 138885032 ____A C:\Users\owner\Downloads\Lenas Prostitution Story.part2.rar
2012-07-27 18:37 - 2012-07-27 18:55 - 209715200 ____A C:\Users\owner\Downloads\Lenas Prostitution Story.part1.rar
2012-07-27 18:27 - 2012-07-27 18:27 - 00000000 ____D C:\Users\owner\Downloads\015
2012-07-27 17:41 - 2012-07-27 17:42 - 00000000 ____D C:\Users\owner\AppData\Local\{B903566A-1B0A-485E-833C-9FCDEAFC0C9A}
2012-07-27 17:41 - 2012-07-27 17:41 - 00000000 ____D C:\Users\owner\AppData\Local\{8189BC4A-9594-4BDF-A70B-9D9208CB9E2C}
2012-07-27 16:34 - 2012-07-27 16:45 - 110329915 ____A C:\Users\owner\Downloads\RJ099467.zip
2012-07-27 15:36 - 2012-07-27 15:36 - 00000000 ____D C:\Users\owner\AppData\Local\{D884735C-DD36-47E4-B633-34B3B132524A}
2012-07-27 15:36 - 2012-07-27 15:36 - 00000000 ____D C:\Users\owner\AppData\Local\{C9A438AB-D625-455C-A141-588A8D20545F}
2012-07-27 11:17 - 2012-07-27 11:21 - 71073765 ____A C:\Users\owner\Downloads\RJ096241.part3.rar
2012-07-27 10:51 - 2012-07-27 11:06 - 200000000 ____A C:\Users\owner\Downloads\RJ096241.part2.rar
2012-07-27 10:39 - 2012-07-27 10:50 - 200000000 ____A C:\Users\owner\Downloads\RJ096241.part1.rar
2012-07-27 10:19 - 2012-07-27 10:29 - 146998510 ____A C:\Users\owner\Downloads\dw4game.part07.rar
2012-07-27 09:55 - 2012-07-27 10:13 - 209715200 ____A C:\Users\owner\Downloads\dw4game.part06.rar
2012-07-27 09:27 - 2012-07-27 09:42 - 209715200 ____A C:\Users\owner\Downloads\dw4game.part05.rar
2012-07-27 05:41 - 2012-07-27 06:04 - 174832967 ____A C:\Users\owner\Downloads\Virgin Island 1.2.zip
2012-07-27 05:39 - 2012-07-27 06:04 - 209715200 ____A C:\Users\owner\Downloads\dw4game.part04.rar
2012-07-27 05:05 - 2012-07-27 05:05 - 00000000 ____D C:\Users\owner\AppData\Local\{78A92EA6-4752-480F-BC36-41A04F0BB40A}
2012-07-26 22:41 - 2012-07-26 22:53 - 209715200 ____A C:\Users\owner\Downloads\dw4game.part03.rar
2012-07-26 22:27 - 2012-07-26 22:38 - 209715200 ____A C:\Users\owner\Downloads\dw4game.part02.rar
2012-07-26 22:12 - 2012-07-26 22:24 - 209715200 ____A C:\Users\owner\Downloads\dw4game.part01.rar
2012-07-26 21:53 - 2012-07-26 21:53 - 00000000 ____D C:\Users\owner\Downloads\HG120718-097938
2012-07-26 21:20 - 2012-07-26 21:24 - 81236731 ____A C:\Users\owner\Downloads\[BBS.2DJGAME.NET]RJ098667.rar
2012-07-26 21:18 - 2012-07-26 21:18 - 00000000 ____D C:\Users\owner\AppData\Local\{7427E760-F142-424C-9716-7906C8B287C0}
2012-07-26 21:18 - 2012-07-26 21:18 - 00000000 ____D C:\Users\owner\AppData\Local\{231ABFA4-E45F-452E-824B-7BCF20022C07}
2012-07-26 21:12 - 2012-07-26 21:12 - 00000000 ____D C:\Users\owner\AppData\Local\{73D4EEB7-F820-4AF5-931F-F15120E8371B}
2012-07-26 21:12 - 2012-07-26 21:12 - 00000000 ____D C:\Users\owner\AppData\Local\{550FAA20-2423-4B1D-9A7B-4D9ACAC8FB04}
2012-07-26 21:09 - 2012-07-26 21:09 - 00006576 ____N C:\bootsqm.dat
2012-07-26 20:35 - 2012-07-26 20:35 - 00000000 ____D C:\Users\owner\AppData\Local\{9CDB3969-B9E2-4CFA-977A-3DB7ABAAC42E}
2012-07-26 20:35 - 2012-07-26 20:35 - 00000000 ____D C:\Users\owner\AppData\Local\{3BC7DC13-0D86-4734-AB74-3DF3AE532C07}
2012-07-26 11:44 - 2012-07-26 11:44 - 01057920 ____A C:\Users\owner\Downloads\devilish-pet-salon.exe
2012-07-26 07:25 - 2012-07-26 07:25 - 00000000 ____D C:\Users\owner\AppData\Local\{7FD74ADA-6DBE-4D9A-AC5B-C7D5767961FF}
2012-07-26 07:25 - 2012-07-26 07:25 - 00000000 ____D C:\Users\owner\AppData\Local\{2FAB4403-82D5-4058-910A-2CF8A287A14F}
2012-07-25 20:54 - 2012-07-25 20:55 - 00000000 ____D C:\Users\owner\Downloads\iris-action
2012-07-25 17:02 - 2012-07-25 17:02 - 00789656 ____A () C:\Users\owner\Downloads\Otshot_installerAmazCell (1).exe
2012-07-25 16:46 - 2012-07-25 16:46 - 00000000 ____A C:\install.rdf
2012-07-25 14:51 - 2012-07-25 14:51 - 00000000 ____D C:\Users\owner\AppData\Local\visi_coupon
2012-07-25 14:48 - 2012-07-25 14:48 - 00000000 ____D C:\Users\owner\AppData\Local\{F77EAA95-D46C-4A69-8416-830FC24E99AA}
2012-07-25 08:53 - 2012-07-25 08:53 - 72445952 ____A C:\Windows\System32\config\SOFTWARE.iobit
2012-07-25 08:53 - 2012-07-25 08:53 - 15974400 ____A C:\Windows\System32\config\SYSTEM.iobit
2012-07-25 08:53 - 2012-07-25 08:53 - 05042176 ____A C:\Windows\System32\config\DEFAULT.iobit
2012-07-25 08:53 - 2012-07-25 08:53 - 00061440 ____A C:\Windows\System32\config\SAM.iobit
2012-07-25 08:53 - 2012-07-25 08:53 - 00024576 ____A C:\Windows\System32\config\SECURITY.iobit
2012-07-25 08:47 - 2012-07-25 08:50 - 46487319 ____A C:\Users\owner\Downloads\011.rar
2012-07-25 08:40 - 2012-07-25 08:41 - 00000000 ____D C:\Users\owner\AppData\Local\{5B46B51A-E940-456A-854A-400422ADB921}
2012-07-25 08:40 - 2012-07-25 08:40 - 00000000 ____D C:\Users\owner\AppData\Local\{18D70C31-DF1C-4D40-A0CA-61363363C59B}
2012-07-24 17:14 - 2012-07-24 17:19 - 43295856 ____A C:\Users\owner\Downloads\120411-1A-094002.rar
2012-07-24 16:45 - 2012-07-24 16:45 - 00607260 ____A (Swearware) C:\Users\owner\Downloads\dds (1).com
2012-07-24 12:09 - 2012-07-29 19:24 - 00032819 ____A C:\Users\owner\Desktop\DDS.txt
2012-07-24 12:08 - 2012-07-29 19:24 - 00014068 ____A C:\Users\owner\Desktop\Attach.txt
2012-07-24 11:56 - 2012-07-24 11:56 - 00607260 ____R (Swearware) C:\Users\owner\Downloads\dds.com
2012-07-24 11:42 - 2012-07-24 11:42 - 00000472 ____A C:\Users\owner\Downloads\defogger_disable.log
2012-07-24 11:42 - 2012-07-24 11:42 - 00000000 ____A C:\Users\owner\defogger_reenable
2012-07-24 11:28 - 2012-07-24 11:28 - 00050477 ____A C:\Users\owner\Downloads\Defogger.exe
2012-07-24 10:29 - 2012-07-24 10:29 - 00000000 ____D C:\Users\owner\AppData\Roaming\SUPERAntiSpyware.com
2012-07-24 10:28 - 2012-07-24 10:29 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2012-07-24 10:28 - 2012-07-24 10:28 - 00001819 ____A C:\Users\owner\Desktop\SUPERAntiSpyware Free Edition.lnk
2012-07-24 10:28 - 2012-07-24 10:28 - 00000000 ____D C:\Users\All Users\SUPERAntiSpyware.com
2012-07-24 10:26 - 2012-07-24 10:27 - 18757840 ____A (SUPERAntiSpyware.com) C:\Users\owner\Downloads\SUPERAntiSpyware.exe
2012-07-24 10:13 - 2012-07-24 10:14 - 02136664 ____A (Kaspersky Lab ZAO) C:\Users\owner\Downloads\tdsskiller.exe
2012-07-24 09:53 - 2012-07-24 09:53 - 00000000 ____D C:\Users\owner\AppData\Local\{5669B34C-D3C7-4B91-B4BF-E26BBF6B0FC6}
2012-07-24 09:53 - 2012-07-24 09:53 - 00000000 ____D C:\Users\owner\AppData\Local\{00A084E6-FE2A-4FC5-BCA6-89DCF8CB30E3}
2012-07-23 23:41 - 2012-07-23 23:41 - 00001287 ____A C:\Users\Public\Desktop\Uninstaller.lnk
2012-07-23 23:41 - 2012-07-23 23:41 - 00001236 ____A C:\Users\Public\Desktop\Advanced SystemCare 5.lnk
2012-07-23 23:32 - 2012-07-23 23:32 - 00367272 ____A (RegNow.com) C:\Users\owner\Downloads\Download_9.0.0.912sdasetup-regnow_201_Trial (1).exe
2012-07-23 23:32 - 2012-07-23 23:32 - 00000000 ____D C:\Users\owner\AppData\Roaming\GetRightToGo
2012-07-23 23:31 - 2012-07-23 23:31 - 00367272 ____A (RegNow.com) C:\Users\owner\Downloads\Download_9.0.0.912sdasetup-regnow_201_Trial.exe
2012-07-23 20:00 - 2012-07-23 20:13 - 173113088 ____A C:\Users\owner\Downloads\Virgin Island 110.zip
2012-07-23 18:18 - 2012-07-23 21:52 - 00000000 ____D C:\Program Files (x86)\iNTERNET_TURBO
2012-07-23 18:17 - 2012-07-23 18:19 - 00000191 ____A C:\Users\Public\debug.log
2012-07-23 18:16 - 2012-07-23 18:16 - 00341160 ____A (OpenInstall ) C:\Users\owner\Downloads\MightyMagoo_UnlockGames.exe
2012-07-23 17:32 - 2012-07-23 18:19 - 84992000 ____A C:\Users\owner\Downloads\GPTM23.part6.rar.crdownload
2012-07-23 14:38 - 2012-07-23 14:38 - 00009006 ____A C:\Users\owner\Documents\carribou.txt
2012-07-23 08:59 - 2012-07-23 08:59 - 00000000 ____D C:\Users\owner\AppData\Local\{B02B0141-AA53-4ECA-ACE4-FEAF38710C79}
2012-07-23 08:59 - 2012-07-23 08:59 - 00000000 ____D C:\Users\owner\AppData\Local\{248D092A-0424-447D-AEC7-D771BCE2BB74}
2012-07-22 20:18 - 2012-07-22 20:18 - 00000000 ____D C:\Program Files (x86)\otshot
2012-07-22 20:17 - 2012-07-22 20:19 - 00000000 ____D C:\Users\owner\AppData\Roaming\ZalmanInstaller_otshot
2012-07-22 20:16 - 2012-07-22 20:17 - 00789656 ____A () C:\Users\owner\Downloads\Otshot_installerAmazCell.exe
2012-07-22 08:27 - 2012-07-22 08:27 - 00000000 ____D C:\Users\owner\AppData\Local\{EE3A0458-A5E6-453B-8615-E1B13730A100}
2012-07-22 08:26 - 2012-07-22 08:26 - 00000000 ____D C:\Users\owner\AppData\Local\{121FBE75-87B2-45F6-A3F2-06612663B978}
2012-07-21 19:38 - 2012-07-21 19:38 - 00011380 ____A C:\Users\owner\Downloads\F4F9.tmp
2012-07-21 15:35 - 2012-07-21 17:24 - 456099951 ____A C:\Users\owner\Downloads\CYCD-02_02rayheng0595.mkv
2012-07-21 11:27 - 2012-07-21 13:54 - 619077483 ____A C:\Users\owner\Downloads\CYCD-02_01rayheng0595.mkv
2012-07-21 03:42 - 2012-07-21 03:42 - 00000000 ____D C:\Users\owner\Desktop\New folder (10)
2012-07-21 03:41 - 2012-07-21 03:41 - 00000000 ____D C:\Users\owner\Downloads\Mercenary Yuno
2012-07-21 03:38 - 2012-07-21 03:38 - 00000000 ____D C:\Users\owner\AppData\Local\{F7AE7EB6-CF58-463B-8A3D-4AA3D8C2414C}
2012-07-21 03:38 - 2012-07-21 03:38 - 00000000 ____D C:\Users\owner\AppData\Local\{F01D86BA-01A0-4362-8637-E0BCD880C248}
2012-07-20 22:01 - 2012-07-20 22:01 - 00250912 ____A C:\Windows\SysWOW64\kz.exe
2012-07-20 21:55 - 2012-07-20 21:57 - 00000000 ____D C:\Users\owner\AppData\Roaming\KuaiZip
2012-07-20 21:55 - 2012-07-20 21:55 - 00000000 ____D C:\Users\owner\AppData\Roaming\SndaUpdate
2012-07-20 21:55 - 2012-07-20 21:55 - 00000000 ____D C:\Users\owner\AppData\Local\sdsvc_Win32
2012-07-20 21:55 - 2012-07-20 21:55 - 00000000 ____D C:\Users\owner\AppData\Local\AA
2012-07-20 21:55 - 2012-03-16 01:15 - 00092304 ____A (KuaiZip International Inc) C:\Windows\System32\Drivers\KuaiZipDrive.sys
2012-07-20 21:54 - 2012-07-21 03:35 - 00000000 ____D C:\Program Files\?キ?
2012-07-20 21:54 - 2012-07-20 22:01 - 00000000 ____D C:\Users\owner\AppData\Local\SNDAService
2012-07-20 21:54 - 2012-07-20 21:54 - 00000000 ____D C:\Users\owner\AppData\Roaming\Softlink
2012-07-20 21:53 - 2012-07-20 21:54 - 06567208 ____A C:\Users\owner\Downloads\KuaiZip_Setup.exe
2012-07-20 21:45 - 2012-07-20 21:46 - 00000000 ____D C:\Users\owner\Downloads\savedata
2012-07-20 21:44 - 2012-07-20 21:44 - 00483656 ____A C:\Users\owner\Downloads\savedata.rar
2012-07-20 20:47 - 2012-07-20 21:43 - 00000000 ____D C:\Users\owner\Desktop\savedata
2012-07-20 19:29 - 2012-07-20 19:29 - 00314393 ____A C:\Users\owner\Downloads\120508 (2).zip
2012-07-20 14:57 - 2012-07-20 14:57 - 00000000 ____D C:\Users\owner\Downloads\ThatThing
2012-07-20 14:57 - 2012-03-17 20:41 - 00000000 ____D C:\Users\owner\Downloads\Cute Asian with Amazing Body_FXXXB
2012-07-20 14:56 - 2012-07-20 14:56 - 00000000 ____D C:\Users\owner\Downloads\012
2012-07-20 14:55 - 2012-07-20 14:58 - 00000000 ____D C:\Users\owner\Desktop\adobe fil;es
2012-07-20 08:09 - 2012-07-20 08:09 - 00000000 ____D C:\Users\owner\AppData\Local\{B0B8209D-5314-4C7B-A7BB-7D056A11C8D8}
2012-07-20 08:08 - 2012-07-20 08:09 - 00000000 ____D C:\Users\owner\AppData\Local\{EC14024B-30A2-4198-8C23-F31C7BBAE536}
2012-07-19 08:49 - 2012-07-19 08:49 - 00000000 ____D C:\Users\owner\AppData\Local\{2F8784E6-4ABC-40C9-8ADC-01073AE9C644}
2012-07-19 08:48 - 2012-07-19 08:49 - 00000000 ____D C:\Users\owner\AppData\Local\{8CA3BDDE-DC7F-455D-91AA-6F5206CA2614}
2012-07-19 07:00 - 2012-07-19 07:00 - 00569872 ____A C:\Users\Public\DynamicInstaller.exe
2012-07-18 21:45 - 2012-07-18 21:45 - 00000000 ____D C:\Users\owner\Downloads\scriptableQuickAtlas
2012-07-18 21:44 - 2012-07-18 21:44 - 05320134 ____A C:\Users\owner\Downloads\scriptableQuickAtlas.7z
2012-07-18 21:36 - 2011-05-15 08:32 - 00000000 ____D C:\Users\owner\Downloads\RJ077472
2012-07-18 21:12 - 2012-07-18 21:12 - 00000000 ____D C:\Users\owner\Downloads\008
2012-07-18 21:11 - 2012-07-18 21:11 - 00000000 ____D C:\Users\owner\Downloads\[BBS.2DJGAME.NET]RJ097948
2012-07-18 21:10 - 2012-07-20 22:10 - 00000000 ____D C:\Users\owner\Downloads\2G-097963-120630
2012-07-18 21:10 - 2012-07-18 21:36 - 00000000 ____D C:\Users\owner\Downloads\swishentai.com_120705-07
2012-07-18 21:10 - 2012-07-18 21:10 - 00000000 ____D C:\Users\owner\Downloads\???????(????????????)
2012-07-18 21:09 - 2012-07-18 21:09 - 00000000 ____D C:\Users\owner\Downloads\RJ097409
2012-07-18 21:09 - 2012-07-18 21:09 - 00000000 ____D C:\Users\owner\Downloads\RJ097324
2012-07-18 20:53 - 2012-07-20 20:13 - 00000000 ____D C:\Users\owner\Desktop\New folder (8)
2012-07-18 11:00 - 2012-07-18 11:00 - 00000000 ____D C:\Users\owner\AppData\Local\{8EFEDDEF-5001-4CA4-8514-F58F71A27ED2}
2012-07-18 05:42 - 2012-07-18 05:42 - 00000000 ____D C:\Users\owner\AppData\Local\{C2B29642-A4DB-4D7B-A9CD-0B8FC058F42D}
2012-07-18 05:42 - 2012-07-18 05:42 - 00000000 ____D C:\Users\owner\AppData\Local\{3917F342-E7EA-4CAE-BA0B-9D9FF6E2A8EA}
2012-07-17 07:50 - 2012-07-17 07:50 - 00000000 ____D C:\Users\owner\AppData\Local\{EF8EE69A-2277-411D-8519-A58B3F35437E}
2012-07-17 07:50 - 2012-07-17 07:50 - 00000000 ____D C:\Users\owner\AppData\Local\{088B95A2-8D22-44DA-8A09-DC86659A8F27}
2012-07-16 19:08 - 2012-07-16 19:09 - 00000000 ____D C:\Users\owner\Downloads\Save3
2012-07-16 19:07 - 2012-07-16 19:07 - 00019365 ____A C:\Users\owner\Downloads\Save3.zip
2012-07-16 07:58 - 2012-07-16 07:58 - 00000000 ____D C:\Users\owner\AppData\Local\{D9A9D73A-CD74-4D0F-AEDF-7D4B79D843B2}
2012-07-16 07:58 - 2012-07-16 07:58 - 00000000 ____D C:\Users\owner\AppData\Local\{CF3FE875-6FDF-4F43-8BF7-0D0508E06E55}
2012-07-15 23:39 - 2012-07-16 12:48 - 00131074 ____A C:\Users\owner\Desktop\Save3.rvdata
2012-07-15 13:34 - 2012-07-15 13:34 - 00000000 ____D C:\Users\owner\AppData\Local\{D2AF4996-3292-4012-BFAB-DAB1022B4882}
2012-07-15 13:34 - 2012-07-15 13:34 - 00000000 ____D C:\Users\owner\AppData\Local\{7B70410D-05C3-4C2E-B07D-57984946BDEC}
2012-07-15 06:52 - 2012-07-15 06:52 - 00000000 ____D C:\Users\owner\AppData\Local\{138D1083-6056-4E0A-8E4B-8CCA5AF86C66}
2012-07-14 15:58 - 2012-07-14 15:58 - 00000324 ____A C:\Users\owner\Downloads\PublicData.zip
2012-07-14 08:41 - 2012-07-14 08:41 - 00000000 ____D C:\Users\owner\AppData\Local\{2B0E2D00-ED0A-4B6C-96DD-FD458B22C49B}
2012-07-14 06:20 - 2012-07-14 06:21 - 00000000 ____D C:\Users\owner\AppData\Local\{9CE5E871-0916-40C3-8DD9-F5138AAE6580}
2012-07-14 06:20 - 2012-07-14 06:20 - 00000000 ____D C:\Users\owner\AppData\Local\{1B4577CD-A536-44A9-AB2D-481F2CACB08E}
2012-07-13 06:29 - 2012-07-13 06:29 - 00000000 ____D C:\Users\owner\AppData\Local\{D7F402BD-7353-48D9-A270-7B6896ECE0EB}
2012-07-13 06:29 - 2012-07-13 06:29 - 00000000 ____D C:\Users\owner\AppData\Local\{B9857316-14CF-4C3F-8CA9-CE96CA8E3AE3}
2012-07-13 04:12 - 2012-07-13 04:12 - 00000000 ____D C:\Users\owner\AppData\Local\{E5CAF545-85B9-41FF-B977-DE2EC3A80795}
2012-07-13 04:12 - 2012-07-13 04:12 - 00000000 ____D C:\Users\owner\AppData\Local\{1D6E3403-324D-4AF8-81BA-AF4B1BAD42C4}
2012-07-12 20:48 - 2012-07-12 20:48 - 00000000 ____D C:\Users\owner\AppData\Local\{3DBFBBA0-ACF8-4312-B39A-EA96E4B3E4AE}
2012-07-12 08:48 - 2012-07-12 20:48 - 00000000 ____D C:\Users\owner\AppData\Local\{FE5ECE5C-41B4-4D97-AE7A-0AF0FF360347}
2012-07-11 17:29 - 2012-07-11 17:29 - 00000000 ____D C:\Users\owner\AppData\Local\{DF66FB3D-D4EB-462D-8924-5079C8DADFD5}
2012-07-11 17:29 - 2012-07-11 17:29 - 00000000 ____D C:\Users\owner\AppData\Local\{38971941-4533-4B5F-AA49-901577996493}
2012-07-11 13:08 - 2012-07-11 13:09 - 00000000 ____D C:\Users\owner\Downloads\009
2012-07-11 07:46 - 2012-07-11 07:47 - 00000000 ____D C:\Users\owner\AppData\Local\{BA8B5DDF-1683-4AF0-ADBD-4FA6274989DE}
2012-07-11 07:46 - 2012-07-11 07:46 - 00000000 ____D C:\Users\owner\AppData\Local\{233D0690-CBCA-4036-B436-9E72B126947D}
2012-07-10 07:02 - 2012-07-10 07:02 - 00000000 ____D C:\Users\owner\AppData\Local\{2271F842-A258-4AF0-9D5A-00F704439308}
2012-07-10 07:01 - 2012-07-10 07:01 - 00000000 ____D C:\Users\owner\AppData\Local\{79162FD5-E919-4A7A-8537-22381517B948}
2012-07-09 23:01 - 2012-07-09 23:01 - 00000000 ____D C:\Users\owner\Downloads\Petite Korean Women Gangbanged by Black Men_FXXXB
2012-07-09 08:29 - 2012-07-09 08:29 - 00000000 ____D C:\Users\owner\AppData\Local\{A04B245C-1255-42FB-BCE7-A5EB8F2AD027}
2012-07-09 08:28 - 2012-07-09 08:29 - 00000000 ____D C:\Users\owner\AppData\Local\{B9AAA3FD-5B9B-4494-8E97-C3D46291C384}
2012-07-08 08:15 - 2012-07-08 08:15 - 00000000 ____D C:\Users\owner\AppData\Local\{154EC59C-0EFA-4865-B61A-292CE177E411}
2012-07-07 11:17 - 2012-07-07 11:17 - 00000000 ____A C:\Users\owner\Downloads\Unconfirmed 89490.crdownload
2012-07-07 08:38 - 2012-07-07 08:39 - 00000000 ____D C:\Users\owner\AppData\Local\{8B398FF2-8C44-482C-BA96-E142A2C83C76}
2012-07-07 08:38 - 2012-07-07 08:38 - 00000000 ____D C:\Users\owner\AppData\Local\{BB99A983-5E3F-4C92-A3DA-6230BAB36438}
2012-07-06 14:56 - 2012-07-06 14:56 - 00000000 ____D C:\Users\owner\AppData\Local\{8CBF2879-2592-43F8-B19A-A70833E57BFC}
2012-07-06 14:56 - 2012-07-06 14:56 - 00000000 ____D C:\Users\owner\AppData\Local\{3D5F7105-6747-4118-BC1E-3014437A0D85}
2012-07-06 06:27 - 2012-07-06 06:27 - 00000000 ____D C:\Users\owner\AppData\Local\{4C1CC5D4-26E9-426F-91C5-167ACA457A47}
2012-07-06 06:26 - 2012-07-06 06:27 - 00000000 ____D C:\Users\owner\AppData\Local\{1F30D142-1575-43CD-A2D5-F109C0FABE51}
2012-07-05 05:26 - 2012-07-05 05:26 - 00000000 ____D C:\Users\owner\AppData\Local\{D38D1729-97D1-443F-85AA-E54F98C09B5C}
2012-07-05 05:26 - 2012-07-05 05:26 - 00000000 ____D C:\Users\owner\AppData\Local\{1F86A147-C793-4B34-A94E-06B8ABCC6978}
2012-07-04 20:07 - 2012-07-04 20:07 - 00000000 ____D C:\Users\owner\AppData\Local\{862F9F66-49B2-4479-A7C5-4EA53A3CA383}
2012-07-04 20:06 - 2012-07-04 20:07 - 00000000 ____D C:\Users\owner\AppData\Local\{0809FECC-52D4-4E8B-8C51-0B6C17FA98EB}
2012-07-04 05:45 - 2012-07-04 05:45 - 00000000 ____D C:\Users\owner\AppData\Local\{9646E7F6-1CFB-4ABE-BD76-E042D23CA9D2}
2012-07-03 12:05 - 2012-07-03 12:05 - 00314393 ____A C:\Users\owner\Downloads\120508.zip
2012-07-03 12:05 - 2012-07-03 12:05 - 00314393 ____A C:\Users\owner\Downloads\120508 (1).zip
2012-07-03 11:52 - 2012-07-03 11:52 - 01040718 ____A C:\Users\owner\Downloads\Unshake15r1b.zip
2012-07-03 08:01 - 2012-07-03 08:01 - 00004104 ____A C:\Users\owner\.recently-used.xbel
2012-07-03 03:59 - 2012-07-03 03:59 - 00001105 ____A C:\Users\Public\Desktop\Noiseware Community Edition.lnk
2012-07-03 03:59 - 2012-07-03 03:59 - 00000000 ____D C:\Program Files (x86)\Imagenomic
2012-07-03 03:49 - 2012-07-03 03:49 - 00001187 ____A C:\Users\Public\Desktop\Paint.NET.lnk
2012-07-03 03:49 - 2012-07-03 03:49 - 00000000 ____D C:\Program Files\Paint.NET
2012-07-03 03:48 - 2012-07-03 09:49 - 00000000 ____D C:\Users\owner\AppData\Local\Paint.NET
2012-07-03 03:47 - 2012-07-03 03:47 - 00000000 ____D C:\Users\owner\Downloads\Paint.NET.3.5.10.Install
2012-07-03 03:44 - 2012-07-03 03:44 - 03730109 ____A C:\Users\owner\Downloads\Paint.NET.3.5.10.Install.zip
2012-07-03 03:38 - 2012-07-20 08:09 - 00000000 ____D C:\Users\owner\Desktop\New folder (9)
2012-07-03 03:01 - 2012-07-03 03:01 - 00000000 ____D C:\Users\owner\AppData\Local\{5B23782B-C5C5-40AD-8FEB-4DC1BE901E7E}
2012-07-03 03:00 - 2012-07-03 03:00 - 00000000 ____D C:\Users\owner\AppData\Local\{2FCDF48C-0FBD-45BE-9D2B-213038FF7F81}

============ 3 Months Modified Files ========================

2012-07-30 09:19 - 2012-01-13 18:08 - 01709537 ____A C:\Windows\WindowsUpdate.log
2012-07-30 09:18 - 2009-07-13 21:13 - 00726316 ____A C:\Windows\System32\PerfStringBackup.INI
2012-07-30 09:15 - 2012-07-30 09:15 - 01438391 ____A (Farbar) C:\Users\owner\Downloads\FRST64.exe
2012-07-30 09:15 - 2012-07-30 09:15 - 01438391 ____A (Farbar) C:\Users\owner\Downloads\FRST64 (2).exe
2012-07-30 09:15 - 2012-07-30 09:15 - 01438391 ____A (Farbar) C:\Users\owner\Downloads\FRST64 (1).exe
2012-07-30 08:42 - 2011-07-04 11:47 - 00000908 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4261894987-4138230488-1400607186-1001UA.job
2012-07-30 08:21 - 2011-07-04 11:36 - 00000898 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2012-07-30 07:36 - 2009-07-13 20:45 - 00016304 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-07-30 07:36 - 2009-07-13 20:45 - 00016304 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-07-30 07:26 - 2012-07-30 07:26 - 00000352 ____A C:\Windows\PFRO.log
2012-07-30 07:26 - 2012-07-30 07:26 - 00000056 ____A C:\Windows\setupact.log
2012-07-30 07:26 - 2012-07-30 07:26 - 00000000 ____A C:\Windows\setuperr.log
2012-07-30 07:26 - 2011-07-04 11:36 - 00000894 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2012-07-30 07:26 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-07-29 22:22 - 2012-05-28 17:16 - 00001870 ____A C:\Windows\Sandboxie.ini
2012-07-29 22:07 - 2012-07-29 22:07 - 01103592 ____A (The Nielsen Company) C:\Users\owner\Downloads\netsight_setup_5.3.0.11_MP_Production_mid60151904485_p.exe
2012-07-29 20:04 - 2012-07-29 20:03 - 13729789 ____A C:\Users\owner\Downloads\Cheat Engine v6.1 And v6.2.rar
2012-07-29 19:59 - 2012-07-29 19:59 - 03345504 ____A (MiMedia, LLC) C:\Users\owner\Downloads\MiMedia_Installer_Windows.exe
2012-07-29 19:59 - 2012-07-29 19:59 - 03345504 ____A (MiMedia, LLC) C:\Users\owner\Downloads\MiMedia_Installer_Windows (1).exe
2012-07-29 19:24 - 2012-07-24 12:09 - 00032819 ____A C:\Users\owner\Desktop\DDS.txt
2012-07-29 19:24 - 2012-07-24 12:08 - 00014068 ____A C:\Users\owner\Desktop\Attach.txt
2012-07-29 19:18 - 2012-07-29 19:17 - 00607260 ____R (Swearware) C:\Users\owner\Downloads\dds.scr
2012-07-29 19:14 - 2012-07-29 19:06 - 60918509 ____A C:\Users\owner\Downloads\kuttsukiboshi1.mp4
2012-07-29 19:13 - 2012-07-29 19:06 - 47611957 ____A C:\Users\owner\Downloads\kuttsukiboshi2.mp4
2012-07-29 13:42 - 2011-07-04 11:47 - 00000856 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4261894987-4138230488-1400607186-1001Core.job
2012-07-28 23:30 - 2012-07-28 23:16 - 24785093 ____A C:\Users\owner\Downloads\Xration,_R_Hard_Core_(Ragnarok_Online).rar
2012-07-27 19:25 - 2012-07-27 19:06 - 174838545 ____A C:\Users\owner\Downloads\Virgin Island 122.zip
2012-07-27 19:03 - 2012-07-27 18:54 - 138885032 ____A C:\Users\owner\Downloads\Lenas Prostitution Story.part2.rar
2012-07-27 18:55 - 2012-07-27 18:37 - 209715200 ____A C:\Users\owner\Downloads\Lenas Prostitution Story.part1.rar
2012-07-27 16:45 - 2012-07-27 16:34 - 110329915 ____A C:\Users\owner\Downloads\RJ099467.zip
2012-07-27 11:21 - 2012-07-27 11:17 - 71073765 ____A C:\Users\owner\Downloads\RJ096241.part3.rar
2012-07-27 11:06 - 2012-07-27 10:51 - 200000000 ____A C:\Users\owner\Downloads\RJ096241.part2.rar
2012-07-27 10:50 - 2012-07-27 10:39 - 200000000 ____A C:\Users\owner\Downloads\RJ096241.part1.rar
2012-07-27 10:29 - 2012-07-27 10:19 - 146998510 ____A C:\Users\owner\Downloads\dw4game.part07.rar
2012-07-27 10:13 - 2012-07-27 09:55 - 209715200 ____A C:\Users\owner\Downloads\dw4game.part06.rar
2012-07-27 09:42 - 2012-07-27 09:27 - 209715200 ____A C:\Users\owner\Downloads\dw4game.part05.rar
2012-07-27 06:04 - 2012-07-27 05:41 - 174832967 ____A C:\Users\owner\Downloads\Virgin Island 1.2.zip
2012-07-27 06:04 - 2012-07-27 05:39 - 209715200 ____A C:\Users\owner\Downloads\dw4game.part04.rar
2012-07-26 22:53 - 2012-07-26 22:41 - 209715200 ____A C:\Users\owner\Downloads\dw4game.part03.rar
2012-07-26 22:38 - 2012-07-26 22:27 - 209715200 ____A C:\Users\owner\Downloads\dw4game.part02.rar
2012-07-26 22:24 - 2012-07-26 22:12 - 209715200 ____A C:\Users\owner\Downloads\dw4game.part01.rar
2012-07-26 21:24 - 2012-07-26 21:20 - 81236731 ____A C:\Users\owner\Downloads\[BBS.2DJGAME.NET]RJ098667.rar
2012-07-26 21:09 - 2012-07-26 21:09 - 00006576 ____N C:\bootsqm.dat
2012-07-26 11:44 - 2012-07-26 11:44 - 01057920 ____A C:\Users\owner\Downloads\devilish-pet-salon.exe
2012-07-25 17:02 - 2012-07-25 17:02 - 00789656 ____A () C:\Users\owner\Downloads\Otshot_installerAmazCell (1).exe
2012-07-25 16:46 - 2012-07-25 16:46 - 00000000 ____A C:\install.rdf
2012-07-25 08:53 - 2012-07-25 08:53 - 72445952 ____A C:\Windows\System32\config\SOFTWARE.iobit
2012-07-25 08:53 - 2012-07-25 08:53 - 15974400 ____A C:\Windows\System32\config\SYSTEM.iobit
2012-07-25 08:53 - 2012-07-25 08:53 - 05042176 ____A C:\Windows\System32\config\DEFAULT.iobit
2012-07-25 08:53 - 2012-07-25 08:53 - 00061440 ____A C:\Windows\System32\config\SAM.iobit
2012-07-25 08:53 - 2012-07-25 08:53 - 00024576 ____A C:\Windows\System32\config\SECURITY.iobit
2012-07-25 08:50 - 2012-07-25 08:47 - 46487319 ____A C:\Users\owner\Downloads\011.rar
2012-07-24 17:19 - 2012-07-24 17:14 - 43295856 ____A C:\Users\owner\Downloads\120411-1A-094002.rar
2012-07-24 16:45 - 2012-07-24 16:45 - 00607260 ____A (Swearware) C:\Users\owner\Downloads\dds (1).com
2012-07-24 11:56 - 2012-07-24 11:56 - 00607260 ____R (Swearware) C:\Users\owner\Downloads\dds.com
2012-07-24 11:42 - 2012-07-24 11:42 - 00000472 ____A C:\Users\owner\Downloads\defogger_disable.log
2012-07-24 11:42 - 2012-07-24 11:42 - 00000000 ____A C:\Users\owner\defogger_reenable
2012-07-24 11:28 - 2012-07-24 11:28 - 00050477 ____A C:\Users\owner\Downloads\Defogger.exe
2012-07-24 10:28 - 2012-07-24 10:28 - 00001819 ____A C:\Users\owner\Desktop\SUPERAntiSpyware Free Edition.lnk
2012-07-24 10:27 - 2012-07-24 10:26 - 18757840 ____A (SUPERAntiSpyware.com) C:\Users\owner\Downloads\SUPERAntiSpyware.exe
2012-07-24 10:14 - 2012-07-24 10:13 - 02136664 ____A (Kaspersky Lab ZAO) C:\Users\owner\Downloads\tdsskiller.exe
2012-07-24 09:35 - 2012-05-09 04:57 - 00002009 ____A C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2012-07-23 23:42 - 2012-05-03 05:46 - 00001124 ____A C:\Users\Public\Desktop\bambam.lnk
2012-07-23 23:41 - 2012-07-23 23:41 - 00001287 ____A C:\Users\Public\Desktop\Uninstaller.lnk
2012-07-23 23:41 - 2012-07-23 23:41 - 00001236 ____A C:\Users\Public\Desktop\Advanced SystemCare 5.lnk
2012-07-23 23:32 - 2012-07-23 23:32 - 00367272 ____A (RegNow.com) C:\Users\owner\Downloads\Download_9.0.0.912sdasetup-regnow_201_Trial (1).exe
2012-07-23 23:31 - 2012-07-23 23:31 - 00367272 ____A (RegNow.com) C:\Users\owner\Downloads\Download_9.0.0.912sdasetup-regnow_201_Trial.exe
2012-07-23 20:13 - 2012-07-23 20:00 - 173113088 ____A C:\Users\owner\Downloads\Virgin Island 110.zip
2012-07-23 18:19 - 2012-07-23 18:17 - 00000191 ____A C:\Users\Public\debug.log
2012-07-23 18:19 - 2012-07-23 17:32 - 84992000 ____A C:\Users\owner\Downloads\GPTM23.part6.rar.crdownload
2012-07-23 18:16 - 2012-07-23 18:16 - 00341160 ____A (OpenInstall ) C:\Users\owner\Downloads\MightyMagoo_UnlockGames.exe
2012-07-23 14:38 - 2012-07-23 14:38 - 00009006 ____A C:\Users\owner\Documents\carribou.txt
2012-07-22 20:21 - 2012-05-29 06:28 - 00003012 ____A C:\user.js
2012-07-22 20:17 - 2012-07-22 20:16 - 00789656 ____A () C:\Users\owner\Downloads\Otshot_installerAmazCell.exe
2012-07-21 19:38 - 2012-07-21 19:38 - 00011380 ____A C:\Users\owner\Downloads\F4F9.tmp
2012-07-21 17:24 - 2012-07-21 15:35 - 456099951 ____A C:\Users\owner\Downloads\CYCD-02_02rayheng0595.mkv
2012-07-21 13:54 - 2012-07-21 11:27 - 619077483 ____A C:\Users\owner\Downloads\CYCD-02_01rayheng0595.mkv
2012-07-20 22:01 - 2012-07-20 22:01 - 00250912 ____A C:\Windows\SysWOW64\kz.exe
2012-07-20 21:54 - 2012-07-20 21:53 - 06567208 ____A C:\Users\owner\Downloads\KuaiZip_Setup.exe
2012-07-20 21:44 - 2012-07-20 21:44 - 00483656 ____A C:\Users\owner\Downloads\savedata.rar
2012-07-20 19:29 - 2012-07-20 19:29 - 00314393 ____A C:\Users\owner\Downloads\120508 (2).zip
2012-07-20 10:57 - 2011-08-02 18:17 - 00001887 ____A C:\Users\owner\Desktop\IMVU.lnk
2012-07-19 07:00 - 2012-07-19 07:00 - 00569872 ____A C:\Users\Public\DynamicInstaller.exe
2012-07-18 21:44 - 2012-07-18 21:44 - 05320134 ____A C:\Users\owner\Downloads\scriptableQuickAtlas.7z
2012-07-16 19:07 - 2012-07-16 19:07 - 00019365 ____A C:\Users\owner\Downloads\Save3.zip
2012-07-16 12:48 - 2012-07-15 23:39 - 00131074 ____A C:\Users\owner\Desktop\Save3.rvdata
2012-07-14 15:58 - 2012-07-14 15:58 - 00000324 ____A C:\Users\owner\Downloads\PublicData.zip
2012-07-11 12:53 - 2011-07-04 11:53 - 00002413 ____A C:\Users\owner\Desktop\Google Chrome.lnk
2012-07-07 17:29 - 2012-06-22 12:33 - 00020609 ____A C:\Users\owner\Documents\loan.txt
2012-07-07 11:17 - 2012-07-07 11:17 - 00000000 ____A C:\Users\owner\Downloads\Unconfirmed 89490.crdownload
2012-07-05 21:33 - 2012-04-19 14:07 - 00000000 ____A C:\Windows\SysWOW64\config.nt
2012-07-03 12:05 - 2012-07-03 12:05 - 00314393 ____A C:\Users\owner\Downloads\120508.zip
2012-07-03 12:05 - 2012-07-03 12:05 - 00314393 ____A C:\Users\owner\Downloads\120508 (1).zip
2012-07-03 11:52 - 2012-07-03 11:52 - 01040718 ____A C:\Users\owner\Downloads\Unshake15r1b.zip
2012-07-03 10:46 - 2011-07-05 04:24 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-07-03 08:21 - 2012-04-19 14:07 - 00958400 ____A (AVAST Software) C:\Windows\System32\Drivers\aswSnx.sys
2012-07-03 08:21 - 2012-04-19 14:07 - 00355856 ____A (AVAST Software) C:\Windows\System32\Drivers\aswSP.sys
2012-07-03 08:21 - 2012-04-19 14:07 - 00285328 ____A (AVAST Software) C:\Windows\System32\aswBoot.exe
2012-07-03 08:21 - 2012-04-19 14:07 - 00071064 ____A (AVAST Software) C:\Windows\System32\Drivers\aswMonFlt.sys
2012-07-03 08:21 - 2012-04-19 14:07 - 00059728 ____A (AVAST Software) C:\Windows\System32\Drivers\aswTdi.sys
2012-07-03 08:21 - 2012-04-19 14:07 - 00054072 ____A (AVAST Software) C:\Windows\System32\Drivers\aswRdr2.sys
2012-07-03 08:21 - 2012-04-19 14:07 - 00025232 ____A (AVAST Software) C:\Windows\System32\Drivers\aswFsBlk.sys
2012-07-03 08:21 - 2012-04-19 14:06 - 00227648 ____A (AVAST Software) C:\Windows\SysWOW64\aswBoot.exe
2012-07-03 08:21 - 2012-04-19 14:06 - 00041224 ____A (AVAST Software) C:\Windows\avastSS.scr
2012-07-03 08:01 - 2012-07-03 08:01 - 00004104 ____A C:\Users\owner\.recently-used.xbel
2012-07-03 03:59 - 2012-07-03 03:59 - 00001105 ____A C:\Users\Public\Desktop\Noiseware Community Edition.lnk
2012-07-03 03:49 - 2012-07-03 03:49 - 00001187 ____A C:\Users\Public\Desktop\Paint.NET.lnk
2012-07-03 03:44 - 2012-07-03 03:44 - 03730109 ____A C:\Users\owner\Downloads\Paint.NET.3.5.10.Install.zip
2012-06-24 14:53 - 2012-06-24 14:52 - 16494335 ____A C:\Users\owner\Downloads\[Yuzuki N Dash] Ane-Koi Ch 3 [ENG] v2.rar
2012-06-23 19:11 - 2012-06-23 19:11 - 00023436 ____A C:\Users\owner\Downloads\Save14.zip
2012-06-22 21:37 - 2012-06-22 21:37 - 00015218 ____A C:\Users\owner\Downloads\RJ079875.txt
2012-06-21 17:43 - 2012-06-21 17:41 - 00001415 ____A C:\Users\owner\Desktop\agth - Shortcut (11).lnk
2012-06-20 10:08 - 2012-06-20 10:07 - 15306204 ____A C:\Users\owner\Downloads\[NanoFate]_Magical_Girls_Sweet_Love_Panic_[MekiMeki_Oukoku][Nanoha_Doujin][Yuri][English].zip
2012-06-17 06:49 - 2012-06-17 06:49 - 00001949 ____A C:\Users\owner\Desktop\Elsword Voice Language Patcher by Shiyumi - Shortcut.lnk
2012-06-16 15:16 - 2012-06-16 15:16 - 00001158 ____A C:\Users\Public\Desktop\Elsword.lnk
2012-06-15 10:52 - 2012-06-15 10:52 - 00025177 ____A C:\Users\owner\Downloads\RJ088973 Slave Quest save.zip
2012-06-15 10:52 - 2012-06-15 10:52 - 00025177 ____A C:\Users\owner\Downloads\RJ088973 Slave Quest save (1).zip
2012-06-14 20:38 - 2012-06-14 20:38 - 00010956 ____A C:\Users\owner\Downloads\leane_renya.zip
2012-06-13 21:17 - 2012-06-13 21:17 - 00026009 ____A C:\Users\owner\Downloads\save.zip
2012-06-11 08:26 - 2012-06-11 08:26 - 00119887 ____A C:\Users\owner\Downloads\index (14).php
2012-06-11 08:25 - 2012-06-11 08:25 - 00158072 ____A C:\Users\owner\Downloads\index (13).php
2012-06-11 08:25 - 2012-06-11 08:25 - 00109639 ____A C:\Users\owner\Downloads\index (12).php
2012-06-11 08:24 - 2012-06-11 08:24 - 00152432 ____A C:\Users\owner\Downloads\index (11).php
2012-06-11 08:24 - 2012-06-11 08:24 - 00130341 ____A C:\Users\owner\Downloads\index (10).php
2012-06-11 08:24 - 2012-06-11 08:24 - 00072659 ____A C:\Users\owner\Downloads\index (9).php
2012-06-10 19:58 - 2012-06-10 19:58 - 00006072 ____A C:\Users\owner\Documents\jake.txt
2012-06-08 12:35 - 2012-06-08 12:35 - 00018404 ____A C:\Users\owner\Downloads\SakiQue.txt
2012-06-08 08:46 - 2011-09-22 16:15 - 00001171 ____A C:\Users\Public\Desktop\Game Booster 3.lnk
2012-06-08 08:46 - 2011-07-04 21:04 - 00001183 ____A C:\Users\Public\Desktop\Switch to Gaming Mode.lnk
2012-06-07 08:34 - 2012-06-07 08:34 - 00023386 ____A C:\Users\owner\Documents\interview.odt
2012-06-05 19:44 - 2012-06-05 19:44 - 01436721 ____A C:\Users\owner\Downloads\paint_tool_sai_pencil_brushes_by_beroleagle-d1lling.rar
2012-06-05 09:16 - 2012-06-04 22:53 - 00032274 ____A C:\Users\owner\Documents\finalstudyguide.odt
2012-06-03 20:22 - 2012-06-03 20:22 - 00000016 ____A C:\Users\owner\Documents\impregnanted.txt
2012-05-31 22:49 - 2012-05-31 22:49 - 00003020 ____A C:\Users\owner\Documents\dassada.txt
2012-05-30 22:54 - 2012-05-30 22:54 - 00000043 ____A C:\Users\owner\Downloads\SaveFile.txt
2012-05-30 18:10 - 2012-05-28 17:17 - 00001013 ____A C:\Users\owner\Desktop\Sandboxed Web Browser.lnk
2012-05-30 13:49 - 2012-05-30 13:49 - 00000020 ____A C:\Users\owner\Documents\discountcode.txt
2012-05-29 17:56 - 2012-05-29 17:56 - 00005146 ____A C:\Users\owner\Documents\vinch.txt
2012-05-29 17:46 - 2012-05-29 17:46 - 00421856 ____A C:\Users\owner\Downloads\DBO_Language_Patcher_(v1.02).zip
2012-05-29 00:40 - 2012-05-28 23:42 - 00015966 ____A C:\Users\owner\Documents\vincentcrea.txt
2012-05-29 00:01 - 2012-05-25 10:35 - 00017688 ____A C:\Users\owner\Documents\sourceanaly3.odt
2012-05-27 19:00 - 2012-05-27 19:00 - 02088759 ____A C:\Users\owner\Downloads\Zone - Faye Valentine.zip
2012-05-27 12:04 - 2012-05-21 23:45 - 00020961 ____A C:\Users\owner\Documents\artiststatement.odt
2012-05-24 09:54 - 2012-05-24 09:54 - 00000037 ____A C:\Users\owner\Documents\arcrylic.txt
2012-05-21 00:39 - 2012-05-21 00:39 - 00013285 ____A C:\Users\owner\Documents\miniintreeview.odt
2012-05-21 00:28 - 2012-05-20 08:24 - 00020191 ____A C:\Users\owner\Documents\dragonrevised.odt
2012-05-20 21:43 - 2012-05-20 21:43 - 00004069 ____A C:\Users\owner\Documents\amyanswer.txt
2012-05-20 21:43 - 2012-05-20 21:43 - 00000333 ____A C:\Users\owner\Documents\amysnwe2.txt
2012-05-17 08:14 - 2012-05-07 22:10 - 00024628 ____A C:\Users\owner\Documents\chinesefixation.odt
2012-05-16 18:29 - 2012-01-13 09:27 - 00198832 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll
2012-05-16 18:29 - 2011-11-18 18:54 - 00499712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
2012-05-16 18:29 - 2011-11-18 18:54 - 00348160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2012-05-16 18:29 - 2011-11-18 18:54 - 00272896 ____A (Progressive Networks) C:\Windows\SysWOW64\pncrt.dll
2012-05-16 18:29 - 2011-11-18 18:54 - 00006656 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5016.dll
2012-05-16 18:29 - 2011-11-18 18:54 - 00005632 ____A (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5032.dll
2012-05-14 18:44 - 2009-07-13 21:08 - 00032592 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2012-05-13 17:09 - 2012-04-01 18:12 - 00022187 ____A C:\Users\owner\Documents\306cha1.odt
2012-05-11 17:11 - 2012-05-11 17:11 - 00001847 ____A C:\Users\owner\Documents\graceperiod.txt
2012-05-11 17:05 - 2012-05-11 17:04 - 00001070 ____A C:\Users\owner\Documents\helping resolve.txt
2012-05-11 16:54 - 2012-05-11 16:53 - 00002179 ____A C:\Users\owner\Documents\deferment.txt
2012-05-11 16:53 - 2012-05-11 16:52 - 00002331 ____A C:\Users\owner\Documents\payment.txt
2012-05-11 16:42 - 2012-05-11 16:42 - 00003657 ____A C:\Users\owner\Documents\interestrates.txt
2012-05-11 16:42 - 2012-05-11 16:42 - 00002110 ____A C:\Users\owner\Documents\grace.txt
2012-05-10 18:46 - 2012-05-10 18:46 - 00567876 ____A C:\Users\owner\Downloads\102.zip
2012-05-10 17:49 - 2012-05-10 17:48 - 00529265 ____A C:\Users\owner\Downloads\epsxe170.zip
2012-05-10 12:38 - 2012-05-10 12:38 - 00000153 ____A C:\Users\owner\Documents\attt.txt
2012-05-09 21:58 - 2012-05-09 21:57 - 11324816 ____A C:\Users\owner\Downloads\[NanoFate]_About_the_Two_of_Them_[Ameiro_Nanashiki][Nanoha_Doujin][Yuri][English].zip
2012-05-07 21:28 - 2012-05-07 21:28 - 00025294 ____A C:\Users\owner\Documents\harvet.txt
2012-05-06 21:48 - 2012-05-06 21:48 - 00013864 ____A C:\Users\owner\Documents\jealousnv.txt
2012-05-06 15:35 - 2012-05-06 15:35 - 00014530 ____A C:\Users\owner\Documents\taima2.txt
2012-05-06 08:59 - 2012-05-06 08:59 - 00020585 ____A C:\Users\owner\Documents\last2chap.odt
2012-05-06 08:06 - 2012-05-06 07:52 - 00017883 ____A C:\Users\owner\Documents\306drawingblank.odt
2012-05-05 23:28 - 2012-05-05 23:21 - 00019812 ____A C:\Users\owner\Documents\306england.odt
2012-05-05 15:00 - 2012-05-05 14:56 - 00006578 ____A C:\Users\owner\Documents\taima.txt
2012-05-05 13:06 - 2012-05-05 13:04 - 16323971 ____A C:\Users\owner\Downloads\[FXXK] Super Hot Taiwanese GoGo Dancer.zip
2012-05-04 23:03 - 2012-05-04 23:03 - 00043390 ____A C:\Users\owner\Documents\almostcool.txt
2012-05-03 07:13 - 2012-05-01 22:48 - 00020801 ____A C:\Users\owner\Documents\summation2.odt
2012-05-02 23:49 - 2012-05-02 23:23 - 00008242 ____A C:\Users\owner\Documents\dylan.txt
2012-05-02 23:49 - 2012-05-02 22:21 - 00004190 ____A C:\Users\owner\Documents\xavier.txt

========================= Known DLLs (Whitelisted) ============


========================= Bamital & volsnap Check ============

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

========================= Memory info ======================

Percentage of memory in use: 14%
Total physical RAM: 3932.88 MB
Available physical RAM: 3345.42 MB
Total Pagefile: 3931.03 MB
Available Pagefile: 3343.25 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

======================= Partitions =========================

1 Drive c: (TI105756W0B) (Fixed) (Total:287.64 GB) (Free:168.3 GB) NTFS ==>[System with boot components (obtained from reading drive)]
2 Drive d: (System) (Fixed) (Total:1.46 GB) (Free:1.27 GB) NTFS ==>[System with boot components (obtained from reading drive)]
4 Drive f: (KINGSTON) (Removable) (Total:1.87 GB) (Free:1.66 GB) FAT
6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 298 GB 0 B
Disk 1 Online 1910 MB 0 B
Disk 2 No Media 0 B 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Recovery 1500 MB 1024 KB
Partition 2 Primary 287 GB 1501 MB
Partition 3 Primary 8 GB 289 GB

==================================================================================

Disk: 0
Partition 1
Type : 27
Hidden: Yes
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 D System NTFS Partition 1500 MB Healthy Hidden

==================================================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 C TI105756W0B NTFS Partition 287 GB Healthy

==================================================================================

Disk: 0
Partition 3
Type : 17 (Suspicious Type)
Hidden: Yes
Active: No

There is no volume associated with this partition.

==================================================================================

Partitions of Disk 1:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 1910 MB 31 KB

==================================================================================

Disk: 1
Partition 1
Type : 06
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 F KINGSTON FAT Removable 1910 MB Healthy

==================================================================================

==========================================================

Last Boot: 2012-07-21 06:21

======================= End Of Log ==========================



Here is the Search

Farbar Recovery Scan Tool Version: 25-07-2012 01
Ran by SYSTEM at 2012-07-30 12:26:33
Running from F:\

================== Search: "services.exe" ===================

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows\System32\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

====== End Of Search ======

#6 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:01:13 AM

Posted 30 July 2012 - 01:16 PM

Please run the following

Refer to the ComboFix User's Guide

  • Download ComboFix from the following location:

    Link

    * IMPORTANT !!! Place ComboFix.exe on your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
    You can get help on disabling your protection programs here
  • Double click on ComboFix.exe & follow the prompts.
  • Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  • When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


    ---------------------------------------------------------------------------------------------
  • Ensure your AntiVirus and AntiSpyware applications are re-enabled.

    ---------------------------------------------------------------------------------------------

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#7 JonJonz321

JonJonz321
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:13 PM

Posted 30 July 2012 - 02:05 PM

Here's the combofix post. I forgot to turn off Windows defender. Sorry, do you want me to run another?

ComboFix 12-07-30.01 - owner 0/2012 Mon 13:33:06.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.932.81.1033.18.3933.2531 [GMT -5:00]
Running from: c:\users\owner\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Microsoft
c:\microsoft\IMJP10\imjp10u.dic
c:\programdata\DynuEncrypt.dll
c:\users\owner\AppData\Roaming\FFSJ
c:\users\owner\AppData\Roaming\FFSJ\FFSJ.cfg
c:\users\Public\DynamicInstaller.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-06-28 to 2012-07-30 )))))))))))))))))))))))))))))))
.
.
2012-07-30 20:22 . 2012-07-30 20:23 -------- d-----w- C:\FRST
2012-07-30 18:46 . 2012-07-30 18:46 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-25 22:51 . 2012-07-25 22:51 -------- d-----w- c:\users\owner\AppData\Local\visi_coupon
2012-07-24 18:29 . 2012-07-24 18:29 -------- d-----w- c:\users\owner\AppData\Roaming\SUPERAntiSpyware.com
2012-07-24 18:28 . 2012-07-24 18:29 -------- d-----w- c:\program files\SUPERAntiSpyware
2012-07-24 18:28 . 2012-07-24 18:28 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2012-07-24 07:32 . 2012-07-24 07:32 -------- d-----w- c:\users\owner\AppData\Roaming\GetRightToGo
2012-07-24 02:20 . 2012-07-24 02:20 18944 ----a-r- c:\users\owner\AppData\Roaming\Microsoft\Installer\{8F018A9E-56DE-4A79-A5EF-25F413F1D538}\IconBB6A16301.exe
2012-07-24 02:18 . 2012-07-24 05:52 -------- d-----w- c:\program files (x86)\iNTERNET_TURBO
2012-07-23 04:18 . 2012-07-23 04:18 -------- d-----w- c:\program files (x86)\otshot
2012-07-23 04:17 . 2012-07-23 04:19 -------- d-----w- c:\users\owner\AppData\Roaming\ZalmanInstaller_otshot
2012-07-21 06:01 . 2012-07-21 06:01 250912 ----a-w- c:\windows\SysWow64\kz.exe
2012-07-21 05:55 . 2012-07-21 05:55 -------- d-----w- c:\users\owner\AppData\Local\sdsvc_Win32
2012-07-21 05:55 . 2012-07-21 05:55 -------- d-----w- c:\users\owner\AppData\Local\AA
2012-07-21 05:55 . 2012-07-21 05:55 -------- d-----w- c:\users\owner\AppData\Roaming\SndaUpdate
2012-07-21 05:55 . 2012-07-21 05:57 -------- d-----w- c:\users\owner\AppData\Roaming\KuaiZip
2012-07-21 05:55 . 2012-03-16 09:15 92304 ----a-w- c:\windows\system32\drivers\KuaiZipDrive.sys
2012-07-21 05:54 . 2012-07-21 05:54 -------- d-----w- c:\users\owner\AppData\Roaming\Softlink
2012-07-21 05:54 . 2012-07-21 11:35 -------- d-----w- c:\program files\ソ・ケ
2012-07-21 05:54 . 2012-07-21 06:01 -------- d-----w- c:\users\owner\AppData\Local\SNDAService
2012-07-03 11:59 . 2012-07-03 11:59 -------- d-----w- c:\program files (x86)\Imagenomic
2012-07-03 11:49 . 2012-07-03 11:49 -------- d-----w- c:\program files\Paint.NET
2012-07-03 11:48 . 2012-07-03 17:49 -------- d-----w- c:\users\owner\AppData\Local\Paint.NET
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-03 18:46 . 2011-07-05 12:24 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-03 16:21 . 2012-04-19 22:07 355856 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-07-03 16:21 . 2012-04-19 22:07 59728 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-07-03 16:21 . 2012-04-19 22:07 54072 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2012-07-03 16:21 . 2012-04-19 22:07 958400 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-07-03 16:21 . 2012-04-19 22:07 71064 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-07-03 16:21 . 2012-04-19 22:07 25232 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-07-03 16:21 . 2012-04-19 22:06 41224 ----a-w- c:\windows\avastSS.scr
2012-07-03 16:21 . 2012-04-19 22:06 227648 ----a-w- c:\windows\SysWow64\aswBoot.exe
2012-07-03 16:21 . 2012-04-19 22:07 285328 ----a-w- c:\windows\system32\aswBoot.exe
2012-05-17 02:29 . 2011-11-19 02:54 499712 ----a-w- c:\windows\SysWow64\msvcp71.dll
2012-05-17 02:29 . 2011-11-19 02:54 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll" [2012-06-11 1524056]
"{90b49673-5506-483e-b92b-ca0265bd9ca8}"= "c:\program files (x86)\IMVU_Inc\prxtbIMVU.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1]
[HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin]
.
[HKEY_CLASSES_ROOT\clsid\{90b49673-5506-483e-b92b-ca0265bd9ca8}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{90b49673-5506-483e-b92b-ca0265bd9ca8}]
2011-05-09 08:49 176936 ----a-w- c:\program files (x86)\IMVU_Inc\prxtbIMVU.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{90b49673-5506-483e-b92b-ca0265bd9ca8}"= "c:\program files (x86)\IMVU_Inc\prxtbIMVU.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{90b49673-5506-483e-b92b-ca0265bd9ca8}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced SystemCare 5"="c:\program files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" [2012-05-28 288128]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2012-04-10 668944]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SVPWUTIL"="c:\program files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe" [2009-08-12 352256]
"KeNotify"="c:\program files (x86)\TOSHIBA\Utilities\KeNotify.exe" [2009-01-14 34088]
"ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2009-08-17 1294136]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-07-13 498160]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"BambooCore"="c:\program files (x86)\Bamboo Dock\BambooCore.exe" [2011-09-27 646232]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-07-03 4273976]
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2012-05-17 296056]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0SmartDefragBootTime.exe
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-04 135664]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-04 135664]
R3 NgFilter;Aventail VPN Filter;c:\windows\system32\DRIVERS\ngfilter.sys [2010-10-10 26136]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-07-31 222208]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys [2010-03-31 450048]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-08-17 51512]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2009-08-04 137560]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-07-04 1255736]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\IObit\Game Booster\Driver\WinRing0x64.sys [2010-11-01 14544]
R3 X6va005;X6va005; [x]
R3 X6va006;X6va006; [x]
R3 X6va008;X6va008; [x]
R3 X6va009;X6va009; [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-07-12 55856]
S0 SmartDefragDriver;SmartDefragDriver;c:\windows\System32\Drivers\SmartDefragDriver.sys [2010-11-26 17720]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [2009-07-24 482384]
S1 aswKbd;aswKbd; [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2012-05-26 913792]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-07-03 71064]
S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2009-08-11 248688]
S2 ConfigFree Gadget Service;ConfigFree Gadget Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe [2009-07-15 42368]
S2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-03-11 46448]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944]
S2 McciCMService64;McciCMService64;c:\program files\Common Files\Motive\McciCMService.exe [2012-01-25 517632]
S2 NgVpnMgr;Aventail VPN Client;c:\windows\system32\ngvpnmgr.exe [2010-10-10 510024]
S2 sdSvc;SdDataOptimize.;c:\users\owner\AppData\Local\sdsvc_Win32\sdsvc.exe [2012-07-21 296240]
S2 TabletServicePen;TabletServicePen;c:\program files\Tablet\Pen\Pen_Tablet.exe [2011-09-08 6583160]
S2 TouchServicePen;Wacom Consumer Touch Service;c:\program files\Tablet\Pen\Pen_TouchService.exe [2011-09-08 528760]
S3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-09-24 270912]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-03 24904]
S3 NgLog;Aventail VPN Logging;c:\windows\system32\DRIVERS\nglog.sys [2010-10-10 31256]
S3 NgVpn;Aventail VPN Adapter;c:\windows\system32\DRIVERS\ngvpn.sys [2010-10-10 98840]
S3 NgWfp;Aventail VPN Callout;c:\windows\system32\DRIVERS\ngwfp.sys [2010-10-10 28696]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-05-23 215040]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-04 19:36]
.
2012-07-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-04 19:36]
.
2012-07-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4261894987-4138230488-1400607186-1001Core.job
- c:\users\owner\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-04 19:36]
.
2012-07-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4261894987-4138230488-1400607186-1001UA.job
- c:\users\owner\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-04 19:36]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-07-03 16:21 133400 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-02 165912]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-02 387608]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-02 365592]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-29 7982112]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2009-08-04 709976]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3197087
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
Trusted Zone: $talisma_url$
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.1.254
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{081d3cbe-4cb2-42f5-a343-14fdf38e1a22} - (no file)
URLSearchHooks-{93130a67-a674-4177-952a-7d803ce57924} - (no file)
URLSearchHooks-{93c338de-5fb5-4fb5-ab4e-0eedc0bd9f3a} - (no file)
URLSearchHooks-{09152f0b-739c-4dec-a245-1aa8a37594f1} - (no file)
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe
Toolbar-Locked - (no file)
WebBrowser-{90B49673-5506-483E-B92B-CA0265BD9CA8} - (no file)
WebBrowser-{93C338DE-5FB5-4FB5-AB4E-0EEDC0BD9F3A} - (no file)
HKLM-Run-(Default) - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE
HKLM-Run-SmoothView - c:\program files (x86)\Toshiba\SmoothView\SmoothView.exe
HKLM-Run-00TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe
HKLM-Run-TosNC - c:\program files (x86)\Toshiba\BulletinBoard\TosNcCore.exe
HKLM-Run-TosReelTimeMonitor - c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=hex:51,66,7a,6c,4c,1d,38,12,5c,be,8a,
eb,c9,8f,bc,54,f6,39,43,d0,22,43,0b,9c
"{90B49673-5506-483E-B92B-CA0265BD9CA8}"=hex:51,66,7a,6c,4c,1d,38,12,1d,95,a7,
94,34,1b,50,0d,c6,3d,89,42,60,e3,d8,bc
"{02478D38-C3F9-4EFB-9B51-7695ECA05670}"=hex:51,66,7a,6c,4c,1d,38,12,56,8e,54,
06,cb,8d,95,0b,e4,47,35,d5,e9,fe,12,64
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{3049C3E9-B461-4BC5-8870-4C09146192CA}"=hex:51,66,7a,6c,4c,1d,38,12,87,c0,5a,
34,53,fa,ab,0e,f7,66,0f,49,11,3f,d6,de
"{326E768D-4182-46FD-9C16-1449A49795F4}"=hex:51,66,7a,6c,4c,1d,38,12,e3,75,7d,
36,b0,0f,93,03,e3,00,57,09,a1,c9,d1,e0
"{53707962-6F74-2D53-2644-206D7942484F}"=hex:51,66,7a,6c,4c,1d,38,12,0c,7a,63,
57,46,21,3d,68,59,52,63,2d,7c,1c,0c,5b
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}"=hex:51,66,7a,6c,4c,1d,38,12,cf,4e,be,
f9,90,2f,b6,0a,e3,01,c5,b7,a9,7a,14,95
"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,
fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17
"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,
b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:92,e4,33,c7,6f,ba,cc,01
.
[HKEY_USERS\S-1-5-21-4261894987-4138230488-1400607186-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-4261894987-4138230488-1400607186-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
c:\program files (x86)\IObit\Game Booster\gbtray.exe
c:\program files (x86)\IObit\Smart Defrag 2\SmartDefrag.exe
c:\program files (x86)\Common Files\Motive\McciCMService.exe
c:\program files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
c:\program files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
.
**************************************************************************
.
Completion time: 2012-07-30 13:55:49 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-30 18:55
.
Pre-Run: 187,357,179,904 bytes free
Post-Run: 186,960,093,184 bytes free
.
- - End Of File - - B52DD6E565725C0F6CD2145907BE5B9D

#8 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:01:13 AM

Posted 30 July 2012 - 02:10 PM

please run the following:

  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <-- very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT


Go here to run an online scanner from ESET.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activeX control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan completes, press the LIST OF THREATS FOUND button
  • Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
  • Include the contents of this report in your next reply.
  • Press the BACK button.
  • Press Finish

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#9 JonJonz321

JonJonz321
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:13 PM

Posted 30 July 2012 - 02:32 PM

I have a problem with MBAM. It always freezes during the middle of the scan even if I use chameleon mode on it. What should I do? Continue with ESET? On a different note, I was petting my friends cat last night and it bit me. Interesting that your screen name is catbyte. :lmao:

#10 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:01:13 AM

Posted 30 July 2012 - 02:42 PM

try running MBAM in safe mode

To Enter Safemode
  • Go to Start> Shut off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY repeatedly,
  • this will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to Safemode
  • Then press the Enter Key on your Keyboard
  • go into your usual account


continue on with ESET if it still wont run

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#11 JonJonz321

JonJonz321
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:13 PM

Posted 30 July 2012 - 08:52 PM

Wow, that took so long. MBAM was just stuck on a file, it continued to run afterward. Two text files opened after, I'm posting the last one it opened after deleting the infections


Malwarebytes Anti-Malware (Trial) 1.62.0.1300
www.malwarebytes.org

Database version: v2012.07.30.10

Windows 7 Service Pack 1 x64 NTFS (Safe Mode)
Internet Explorer 9.0.8112.16421
owner :: OWNER-PC [administrator]

Protection: Disabled

7/30/2012 2:52:51 PM
mbam-log-2012-07-30 (16-10-01).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 369890
Time elapsed: 1 hour(s), 16 minute(s), 30 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 2
C:\Users\owner\AppData\Roaming\ZalmanInstaller_otshot\otshotcomponent0.exe (Adware.GamePlayLabs) -> No action taken.
C:\Users\owner\Downloads\MightyMagoo_UnlockGames.exe (PUP.BundleInstaller.OI) -> No action taken.

(end)


Here's the one from ESET


C:\GamesCampus\US\Carte\main.exe a variant of Win32/Packed.Themida application
C:\Program Files\???\AASDK.exe a variant of Win32/Adware.ShandaAdd.A application
C:\ProgramData\Tarma Installer\{2E1037EA-038A-425F-86B9-6CD19B8497E9}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application
C:\ProgramData\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application
C:\Users\All Users\Tarma Installer\{2E1037EA-038A-425F-86B9-6CD19B8497E9}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application
C:\Users\All Users\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application
C:\Users\owner\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@epicplay.com\components\epicPlayGames.dll a variant of Win32/Adware.Gamevance.BR application
C:\Users\owner\Downloads\MyBabylonTB.exe Win32/Toolbar.Babylon application
C:\Users\owner\Downloads\Translation Aggregator 0.4.9.r171\Translation Aggregator 0.4.9.r171\agth.dll probably a variant of Win32/AGTH.A application

#12 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:01:13 AM

Posted 30 July 2012 - 09:44 PM

Please do the following:

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

File::
C:\GamesCampus\US\Carte\main.exe
C:\Program Files\???\AASDK.exe 
C:\ProgramData\Tarma Installer\{2E1037EA-038A-425F-86B9-6CD19B8497E9}\_Setupx.dll 
C:\ProgramData\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll 
C:\Users\All Users\Tarma Installer\{2E1037EA-038A-425F-86B9-6CD19B8497E9}\_Setupx.dll a
C:\Users\All Users\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll a
C:\Users\owner\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@epicplay.com\components\epicPlayGames.dll 
C:\Users\owner\Downloads\MyBabylonTB.exe 
 
ClearJavaCache::

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"


Here's how to do that:

1.Click File;
2.Click Save As... Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save ...

Posted Image
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix may request an update; please allow it.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


NEXT

please do the following:

  • Please download MiniToolBox and save it to your desktop and run it.

    Checkmark following checkboxes:
  • Flush DNS
  • Report IE Proxy Settings
  • Report FF Proxy Settings
  • List content of Hosts
  • List installed programs.

Click Go and post the result (Result.txt) that pops up. A copy of result.txt will be saved in the same directory the tool is run.
NEXT

Please download Farbar Service Scanner and run it on the computer with the issue.
  • Make sure the following options are checked:
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center
    • Windows Update
    • Windows Defender
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#13 JonJonz321

JonJonz321
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:13 PM

Posted 30 July 2012 - 10:38 PM

Combofix

ComboFix 12-07-30.03 - owner 0/2012 Mon 22:06:46.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.932.81.1033.18.3933.2252 [GMT -5:00]
Running from: c:\users\owner\Desktop\ComboFix.exe
Command switches used :: c:\users\owner\Desktop\CFScript.txt
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\gamescampus\US\Carte\main.exe"
"c:\programdata\Tarma Installer\{2E1037EA-038A-425F-86B9-6CD19B8497E9}\_Setupx.dll"
"c:\programdata\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll"
"c:\users\All Users\Tarma Installer\{2E1037EA-038A-425F-86B9-6CD19B8497E9}\_Setupx.dll a"
"c:\users\All Users\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll a"
"c:\users\owner\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@epicplay.com\components\epicPlayGames.dll"
"c:\users\owner\Downloads\MyBabylonTB.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\gamescampus\US\Carte\main.exe
C:\Microsoft
c:\microsoft\IMJP10\imjp10u.dic
c:\programdata\Tarma Installer\{2E1037EA-038A-425F-86B9-6CD19B8497E9}\_Setupx.dll
c:\programdata\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll
c:\users\owner\AppData\Local\Temp\SAS69D.tmp
c:\users\owner\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@epicplay.com\components\epicPlayGames.dll
c:\users\owner\Downloads\MyBabylonTB.exe
.
Infected copy of c:\windows\SysWow64\userinit.exe was found and disinfected
Restored copy from - c:\windows\erdnt\cache86\userinit.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-06-28 to 2012-07-31 )))))))))))))))))))))))))))))))
.
.
2012-07-31 03:18 . 2012-07-31 03:18 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2012-07-31 03:18 . 2012-07-31 03:18 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-30 21:21 . 2012-07-30 21:21 -------- d-----w- c:\program files (x86)\ESET
2012-07-30 20:22 . 2012-07-30 20:23 -------- d-----w- C:\FRST
2012-07-30 19:26 . 2012-07-03 18:46 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-25 22:51 . 2012-07-25 22:51 -------- d-----w- c:\users\owner\AppData\Local\visi_coupon
2012-07-24 07:32 . 2012-07-24 07:32 -------- d-----w- c:\users\owner\AppData\Roaming\GetRightToGo
2012-07-24 02:20 . 2012-07-24 02:20 18944 ----a-r- c:\users\owner\AppData\Roaming\Microsoft\Installer\{8F018A9E-56DE-4A79-A5EF-25F413F1D538}\IconBB6A16301.exe
2012-07-24 02:18 . 2012-07-24 05:52 -------- d-----w- c:\program files (x86)\iNTERNET_TURBO
2012-07-23 04:18 . 2012-07-23 04:18 -------- d-----w- c:\program files (x86)\otshot
2012-07-23 04:17 . 2012-07-23 04:19 -------- d-----w- c:\users\owner\AppData\Roaming\ZalmanInstaller_otshot
2012-07-21 06:01 . 2012-07-21 06:01 250912 ----a-w- c:\windows\SysWow64\kz.exe
2012-07-21 05:55 . 2012-07-21 05:55 -------- d-----w- c:\users\owner\AppData\Local\sdsvc_Win32
2012-07-21 05:55 . 2012-07-21 05:55 -------- d-----w- c:\users\owner\AppData\Local\AA
2012-07-21 05:55 . 2012-07-21 05:55 -------- d-----w- c:\users\owner\AppData\Roaming\SndaUpdate
2012-07-21 05:55 . 2012-07-21 05:57 -------- d-----w- c:\users\owner\AppData\Roaming\KuaiZip
2012-07-21 05:55 . 2012-03-16 09:15 92304 ----a-w- c:\windows\system32\drivers\KuaiZipDrive.sys
2012-07-21 05:54 . 2012-07-21 05:54 -------- d-----w- c:\users\owner\AppData\Roaming\Softlink
2012-07-21 05:54 . 2012-07-21 11:35 -------- d-----w- c:\program files\ソ・ケ
2012-07-21 05:54 . 2012-07-21 06:01 -------- d-----w- c:\users\owner\AppData\Local\SNDAService
2012-07-03 11:59 . 2012-07-03 11:59 -------- d-----w- c:\program files (x86)\Imagenomic
2012-07-03 11:49 . 2012-07-03 11:49 -------- d-----w- c:\program files\Paint.NET
2012-07-03 11:48 . 2012-07-03 17:49 -------- d-----w- c:\users\owner\AppData\Local\Paint.NET
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-03 16:21 . 2012-04-19 22:07 355856 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-07-03 16:21 . 2012-04-19 22:07 59728 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-07-03 16:21 . 2012-04-19 22:07 54072 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2012-07-03 16:21 . 2012-04-19 22:07 958400 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-07-03 16:21 . 2012-04-19 22:07 71064 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2012-07-03 16:21 . 2012-04-19 22:07 25232 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-07-03 16:21 . 2012-04-19 22:06 41224 ----a-w- c:\windows\avastSS.scr
2012-07-03 16:21 . 2012-04-19 22:06 227648 ----a-w- c:\windows\SysWow64\aswBoot.exe
2012-07-03 16:21 . 2012-04-19 22:07 285328 ----a-w- c:\windows\system32\aswBoot.exe
2012-05-17 02:29 . 2011-11-19 02:54 499712 ----a-w- c:\windows\SysWow64\msvcp71.dll
2012-05-17 02:29 . 2011-11-19 02:54 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-07-30_18.50.11 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-04-19 04:38 . 2012-07-31 03:22 32768 c:\windows\Temp\Temporary Internet Files\Content.IE5\index.dat
- 2012-04-19 04:38 . 2012-07-30 18:50 32768 c:\windows\Temp\Temporary Internet Files\Content.IE5\index.dat
- 2012-04-19 04:38 . 2012-07-30 18:50 16384 c:\windows\Temp\History\History.IE5\index.dat
+ 2012-04-19 04:38 . 2012-07-31 03:22 16384 c:\windows\Temp\History\History.IE5\index.dat
- 2012-04-19 04:38 . 2012-07-30 18:50 32768 c:\windows\Temp\Cookies\index.dat
+ 2012-04-19 04:38 . 2012-07-31 03:22 32768 c:\windows\Temp\Cookies\index.dat
+ 2011-10-12 07:39 . 2012-07-31 03:21 16384 c:\windows\SysWOW64\%APPDATA%\Microsoft\Windows\IETldCache\index.dat
- 2011-10-12 07:39 . 2012-07-30 18:49 16384 c:\windows\SysWOW64\%APPDATA%\Microsoft\Windows\IETldCache\index.dat
+ 2009-12-01 04:30 . 2012-07-30 21:15 65904 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-07-30 21:15 46608 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-07-04 19:00 . 2012-07-30 21:15 11328 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4261894987-4138230488-1400607186-1001_UserData.bin
+ 2012-07-31 03:20 . 2012-07-31 03:20 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-07-30 18:47 . 2012-07-30 18:47 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-07-30 18:47 . 2012-07-30 18:47 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-07-31 03:20 . 2012-07-31 03:20 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-14 05:01 . 2012-07-31 03:19 355584 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2012-07-30 18:46 355584 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2011-07-05 05:05 . 2012-07-30 18:46 10086392 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4261894987-4138230488-1400607186-1001-8192.dat
+ 2011-07-05 05:05 . 2012-07-31 03:19 10086392 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4261894987-4138230488-1400607186-1001-8192.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files (x86)\Yahoo!\Companion\Installs\cpn2\yt.dll" [2012-06-11 1524056]
"{90b49673-5506-483e-b92b-ca0265bd9ca8}"= "c:\program files (x86)\IMVU_Inc\prxtbIMVU.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1]
[HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}]
[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin]
.
[HKEY_CLASSES_ROOT\clsid\{90b49673-5506-483e-b92b-ca0265bd9ca8}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{90b49673-5506-483e-b92b-ca0265bd9ca8}]
2011-05-09 08:49 176936 ----a-w- c:\program files (x86)\IMVU_Inc\prxtbIMVU.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{90b49673-5506-483e-b92b-ca0265bd9ca8}"= "c:\program files (x86)\IMVU_Inc\prxtbIMVU.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{90b49673-5506-483e-b92b-ca0265bd9ca8}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced SystemCare 5"="c:\program files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe" [2012-05-28 288128]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2012-04-10 668944]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"SVPWUTIL"="c:\program files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe" [2009-08-12 352256]
"KeNotify"="c:\program files (x86)\TOSHIBA\Utilities\KeNotify.exe" [2009-01-14 34088]
"ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2009-08-17 1294136]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-07-13 498160]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"BambooCore"="c:\program files (x86)\Bamboo Dock\BambooCore.exe" [2011-09-27 646232]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-07-03 4273976]
"TkBellExe"="c:\program files (x86)\real\realplayer\Update\realsched.exe" [2012-05-17 296056]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0SmartDefragBootTime.exe
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-04 135664]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-04 135664]
R3 NgFilter;Aventail VPN Filter;c:\windows\system32\DRIVERS\ngfilter.sys [2010-10-10 26136]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-07-31 222208]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys [2010-03-31 450048]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2009-08-17 51512]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2009-08-04 137560]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-07-04 1255736]
R3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files (x86)\IObit\Game Booster\Driver\WinRing0x64.sys [2010-11-01 14544]
R3 X6va005;X6va005; [x]
R3 X6va006;X6va006; [x]
R3 X6va008;X6va008; [x]
R3 X6va009;X6va009; [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-07-12 55856]
S0 SmartDefragDriver;SmartDefragDriver;c:\windows\System32\Drivers\SmartDefragDriver.sys [2010-11-26 17720]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [2009-07-24 482384]
S1 aswKbd;aswKbd; [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [2012-05-26 913792]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2012-07-03 71064]
S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2009-08-11 248688]
S2 ConfigFree Gadget Service;ConfigFree Gadget Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe [2009-07-15 42368]
S2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-03-11 46448]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-07-03 655944]
S2 McciCMService64;McciCMService64;c:\program files\Common Files\Motive\McciCMService.exe [2012-01-25 517632]
S2 NgVpnMgr;Aventail VPN Client;c:\windows\system32\ngvpnmgr.exe [2010-10-10 510024]
S2 sdSvc;SdDataOptimize.;c:\users\owner\AppData\Local\sdsvc_Win32\sdsvc.exe [2012-07-21 296240]
S2 TabletServicePen;TabletServicePen;c:\program files\Tablet\Pen\Pen_Tablet.exe [2011-09-08 6583160]
S2 TouchServicePen;Wacom Consumer Touch Service;c:\program files\Tablet\Pen\Pen_TouchService.exe [2011-09-08 528760]
S3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-09-24 270912]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-07-03 24904]
S3 NgLog;Aventail VPN Logging;c:\windows\system32\DRIVERS\nglog.sys [2010-10-10 31256]
S3 NgVpn;Aventail VPN Adapter;c:\windows\system32\DRIVERS\ngvpn.sys [2010-10-10 98840]
S3 NgWfp;Aventail VPN Callout;c:\windows\system32\DRIVERS\ngwfp.sys [2010-10-10 28696]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-05-23 215040]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-04 19:36]
.
2012-07-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-04 19:36]
.
2012-07-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4261894987-4138230488-1400607186-1001Core.job
- c:\users\owner\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-04 19:36]
.
2012-07-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4261894987-4138230488-1400607186-1001UA.job
- c:\users\owner\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-04 19:36]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-07-03 16:21 133400 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-02 165912]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-02 387608]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-02 365592]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-29 7982112]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"TPwrMain"="c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE" [BU]
"SmoothView"="c:\program files (x86)\Toshiba\SmoothView\SmoothView.exe" [BU]
"00TCrdMain"="c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe" [BU]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2009-08-04 709976]
"TosNC"="c:\program files (x86)\Toshiba\BulletinBoard\TosNcCore.exe" [BU]
"TosReelTimeMonitor"="c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe" [BU]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT3197087
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSNA&bmod=TSNA
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
Trusted Zone: $talisma_url$
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.1.254
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
WebBrowser-{90B49673-5506-483E-B92B-CA0265BD9CA8} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=hex:51,66,7a,6c,4c,1d,38,12,5c,be,8a,
eb,c9,8f,bc,54,f6,39,43,d0,22,43,0b,9c
"{90B49673-5506-483E-B92B-CA0265BD9CA8}"=hex:51,66,7a,6c,4c,1d,38,12,1d,95,a7,
94,34,1b,50,0d,c6,3d,89,42,60,e3,d8,bc
"{02478D38-C3F9-4EFB-9B51-7695ECA05670}"=hex:51,66,7a,6c,4c,1d,38,12,56,8e,54,
06,cb,8d,95,0b,e4,47,35,d5,e9,fe,12,64
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{3049C3E9-B461-4BC5-8870-4C09146192CA}"=hex:51,66,7a,6c,4c,1d,38,12,87,c0,5a,
34,53,fa,ab,0e,f7,66,0f,49,11,3f,d6,de
"{326E768D-4182-46FD-9C16-1449A49795F4}"=hex:51,66,7a,6c,4c,1d,38,12,e3,75,7d,
36,b0,0f,93,03,e3,00,57,09,a1,c9,d1,e0
"{53707962-6F74-2D53-2644-206D7942484F}"=hex:51,66,7a,6c,4c,1d,38,12,0c,7a,63,
57,46,21,3d,68,59,52,63,2d,7c,1c,0c,5b
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}"=hex:51,66,7a,6c,4c,1d,38,12,cf,4e,be,
f9,90,2f,b6,0a,e3,01,c5,b7,a9,7a,14,95
"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,
fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17
"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,
b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:92,e4,33,c7,6f,ba,cc,01
.
[HKEY_USERS\S-1-5-21-4261894987-4138230488-1400607186-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-4261894987-4138230488-1400607186-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10v_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash10v.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
c:\program files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
c:\program files (x86)\IObit\Smart Defrag 2\SmartDefrag.exe
c:\program files (x86)\IObit\Game Booster\gbtray.exe
c:\program files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
.
**************************************************************************
.
Completion time: 2012-07-30 22:27:32 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-31 03:27
ComboFix2.txt 2012-07-30 18:55
.
Pre-Run: 185,704,230,912 bytes free
Post-Run: 185,711,271,936 bytes free
.
- - End Of File - - 5154937EB43441CBEC288A1F7279636B

From mini tool bar

MiniToolBox by Farbar Version: 23-07-2012
Ran by owner (administrator) on 30-07-2012 at 22:35:37
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
***************************************************************************

========================= Flush DNS: ===================================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.
========================= Hosts content: =================================

127.0.0.1 localhost


=========================== Installed Programs ============================

Update for Microsoft Office 2007 (KB2508958)
Adobe AIR (Version: 3.2.0.2070)
Adobe Flash Player 10 ActiveX (Version: 10.3.183.5)
Adobe Reader X (10.1.3) (Version: 10.1.3)
Adobe Shockwave Player 11.6 (Version: 11.6.0.626)
Advanced SystemCare 5 (Version: 5.3.0)
AIM 7
Apple Application Support (Version: 2.1.7)
Apple Software Update (Version: 2.1.3.127)
Atlantica (Version: 31408)
avast! Free Antivirus (Version: 7.0.1456.0)
Aventail Connect (Version: 10.52.35)
Bamboo (Version: 5.2.5-5)
Bamboo Dock (Version: 4.0)
Bamboo Dock (Version: 4.0.0)
Carte 0.9.49 (Version: 0.9.49)
CCleaner (Version: 3.15)
CDisplay 1.8
Compatibility Pack for the 2007 Office system (Version: 12.0.6612.1000)
D3DX10 (Version: 15.4.2368.0902)
DAEMON Tools Lite (Version: 4.41.3.0173)
DivX Setup (Version: 2.6.1.3)
Download Updater (AOL LLC)
Elsword version v2.0613.1.1 (Version: v2.0613.1.1)
ESET Online Scanner v3
FBDownloader IE Add-on (Version: 1.0.3)
File Splitter and Joiner (FFSJ v3.2)
Game Booster 3 (Version: 3.5)
GIMP 2.6.11 (Version: 2.6.11)
Google Chrome (Version: 20.0.1132.57)
Google Earth (Version: 6.2.2.6613)
Google Update Helper (Version: 1.3.21.115)
Grand Chase
IMVU Avatar Chat Software
IMVU Inc Toolbar (Version: 6.8.5.1)
Intel® Graphics Media Accelerator Driver (Version: 8.15.10.1883)
IntelR Matrix Storage Manager
Japanese Fonts Support For Adobe Reader X (Version: 10.0.0)
Java Auto Updater (Version: 2.0.7.1)
Java™ 6 Update 31 (Version: 6.0.310)
Junk Mail filter update (Version: 15.4.3502.0922)
K-Lite Codec Pack 5.0.0 (64-bit) (Version: 5.0.0)
La Tale
Lunia
Malwarebytes Anti-Malware version 1.62.0.1300 (Version: 1.62.0.1300)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint Viewer 2007 (English) (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Suite Activation Assistant (Version: 2.9)
Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 4.1.10111.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Works (Version: 9.7.0621)
MSVCRT (Version: 15.4.2862.0708)
MSVCRT_amd64 (Version: 15.4.2862.0708)
Nexon Game Manager
Noiseware Community Edition (Version: 2.6.0.1)
OGPlanet Game Launcher (Version: 1.0.0)
OpenOffice.org 3.3 (Version: 3.3.9567)
Paint.NET v3.5.10 (Version: 3.60.0)
Pando Media Booster (Version: 2.6.0.7)
PlayReady PC Runtime amd64 (Version: 1.3.0)
QuickTime (Version: 7.72.80.56)
REACTOR (Version: 1.00.0000)
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0)
RealPlayer (Version: 15.0.4)
Realtek 8136 8168 8169 Ethernet Driver (Version: 1.00.0005)
Realtek High Definition Audio Driver (Version: 6.0.1.5904)
Realtek USB 2.0 Card Reader (Version: 6.1.7600.30101)
Realtek WLAN Driver (Version: 2.00.0006)
RealUpgrade 1.1 (Version: 1.1.0)
Revo Uninstaller 1.93 (Version: 1.93)
RGSS-RTP 1.03 (Version: 1.03)
RGSS-RTP Standard (Version: 1.0.0)
RGSS-RTP Standard (Version: 1.03)
Roxio Burn (Version: 1.2)
Roxio Express Labeler 3 (Version: 3.2.1)
Roxio Roxio Burn (Version: 1.0.0)
Roxio Update Manager (Version: 6.0.0)
RPG Maker 2000 1.05
RPG Maker 2003 v1.08
RPG MAKER VX Ace RTP (Version: 1.00)
RPG Maker VX RTP (Version: 1.02)
RPGXP (Version: 1.0.0)
RPGツクール2000 ランタイムパッケージ
Sandboxie 3.68 (64-bit) (Version: 3.68)
Skype? 5.5 (Version: 5.5.117)
Smart Defrag 2 (Version: 2.2)
Spybot - Search & Destroy (Version: 1.6.2)
Swiff Player 1.7.2 (Version: 1.7.2)
Synaptics Pointing Device Driver (Version: 13.2.6.1)
Tipard DVD to MP3 Converter
TOSHIBA Application Installer (Version: 9.0.1.0)
TOSHIBA Assist (Version: 3.00.09)
TOSHIBA Bulletin Board (Version: 1.5.05.64)
TOSHIBA ConfigFree (Version: 8.0.21)
TOSHIBA Disc Creator (Version: 2.1.0.1 for x64)
TOSHIBA DVD PLAYER (Version: 3.01.0.07-A)
TOSHIBA Extended Tiles for Windows Mobility Center (Version: )
TOSHIBA Extended Tiles for Windows Mobility Center (Version: 1.01.00)
TOSHIBA Flash Cards Support Utility (Version: 1.63.0.4C)
TOSHIBA Hardware Setup (Version: 1.63.0.11C)
TOSHIBA HDD/SSD Alert (Version: 3.1.64.0)
TOSHIBA Media Controller (Version: 1.0.65)
TOSHIBA Quality Application (Version: 1.0.1)
TOSHIBA Recovery Media Creator (Version: 2.1.0.4 for x64)
TOSHIBA ReelTime (Version: 1.5.07.64)
TOSHIBA Service Station (Version: 2.1.33)
TOSHIBA Speech System Applications (Version: 1.00.2518)
TOSHIBA Speech System SR Engine(U.S.) Version1.0
TOSHIBA Speech System TTS Engine(U.S.) Version1.0
TOSHIBA Supervisor Password (Version: 1.63.0.7C)
TOSHIBA Value Added Package (Version: 1.2.26.64)
ToshibaRegistration (Version: 1.0.3)
Trickster Online (Version: 7.97)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition
Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Utility Common Driver (Version: 1.0.50.27C)
VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0)
VLC media player 1.1.11 (Version: 1.1.11)
WebTablet FB Plugin (Version: 2.0.0.1)
WebTablet IE Plugin (Version: 1.1.0.12)
WebTablet Netscape Plugin (Version: 1.1.0.10)
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3555.0308)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3555.0308)
Windows Live Mail (Version: 15.4.3502.0922)
Windows Live Messenger (Version: 15.4.3538.0513)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (Version: 15.4.3502.0922)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live Photo Gallery (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3508.1109)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live Sync (Version: 14.0.8089.726)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)
Windows Live Writer (Version: 15.4.3502.0922)
Windows Live Writer Resources (Version: 15.4.3502.0922)
WinRAR 4.01 (64-bit) (Version: 4.01.0)
Wonderland Online (Version: 6.0.0)
Yahoo! Messenger
Yahoo! Software Update
Yahoo! Toolbar
小影の伝説
闘姫狂華 (Version: 1.0.0)

**** End of log ****
Farbar Service Scanner Version: 26-07-2012
Ran by owner (administrator) on 30-07-2012 at 22:36:34
Running from "C:\Users\owner\Downloads"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============

sharedaccess Service is not running. Checking service configuration:
The start type of sharedaccess service is set to Auto
The ImagePath of sharedaccess service is OK.
The ServiceDll of sharedaccess service is OK.


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

#14 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:01:13 AM

Posted 31 July 2012 - 08:23 AM

looks good,

Your Java is out of date, so go to Start > Control Panel > Programs and Features > scroll down to the Java installation and Remove it, now download the latest Java version 7 update 5 and install it: http://java.com/en/download/index.jsp


please advise how the computer is running now and if there are any outstanding issues

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#15 JonJonz321

JonJonz321
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:13 PM

Posted 31 July 2012 - 10:02 AM

Thanks alot, not much is happening but startup is a bit slow. There is no more black screen which is good. I think the slow start up is a problem that deals with how much space I have left. Maybe I just need to defrag. I think that's it. ^^ Thanks very much.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users