Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

bts.scour.com redirect virus +++


  • This topic is locked This topic is locked
39 replies to this topic

#1 Kalidevi

Kalidevi

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:08:36 PM

Posted 11 September 2012 - 12:02 PM

Sorry so long, but you asked for the details. I gave as much as I could.

I have a toshiba satellite A135-S4527 labtop running Windows 7, which I purchased used.
I believe it had a rootkit already when I purchased it, because shortly thereafter I noticed odd behavior. The start menu would open and close very fast (flickering up and down) and it would try to close my browser window. This only happened periodically (every 2 mos).

Then, a lady I used to work for kept sending me emails with two of the same attachments. I was concerned they were a virus. Like a dummy, I didn't have avg up and running (and I know better).

I finally got AVG, but it did not detect anything. I also got adaware and spybot, which also didn't detect anything.
Periodically when visiting a web page, I would be taken to a page not found nginx page. I checked my browser settings, but everything looked fine. None of the scans picked it up, not even malwarebytes.

I found a panda online security scan and it found something and cleaned it, so I thought it was taken care of.

Also, twice my computer's clock was reset to April of 2004.

A few months later, I was searching jobs. When I opened one of the listings, I realized it was a bad site (perhaps hacked). I closed it immediately, but then started noticing odd things. My computer got really slow, kept freezing, programs not responding.

Explorer would stop responding, so I'd have to restart it. Windows Audio Service periodically disables itself and my audio devices are deleted, so I have to enable the Windows Audio Service twice and it will reinstall the devices.

Then I started noticing that when surfing the nets, certain keywords were double underlined and hyperlinked. When hovering these links, they all said "EasyInline" on the top left corner, so I researched it. I found it was an add-on (which I didn't install, so I say it's spyware), so I went through the firefox add-ons and removed it. It worked fine for a very short time. Hours later, the hyperlinks started again, this time they said "kontera". At this point, I really just wanted this all done and over with, as I have a ton of work to do and it's been taking too much of my time. However, the computer is slowed down, so it's taking me a long time to get my work done, so I hire someone to remotely clean my system. This person had rave reviews, so I figured I'd give it a shot.

He remotely installed Advanced System Care 5, tdsskiller, Vipre, and CCleaner. He ran CCleaner, then ran the Advanced System Care 5. My system showed to be in poor condition, so he ran the app, which then cleaned everything up and installed all the windows updates that I was missing. This took a long time, so he asked if I would reboot the computer when it was done and test it and then he would finish the following day, which I agreed.

Once Advanced System Care 5 was finished, I rebooted. Everything seemed to be running great. I was surfing the web, while chatting with my aunt. I stepped away to go to the rest room and when I got back, there was some Live Security Platinum running a scan (scam). I knew it was a bogus app and not safe, so I tried to shut it down through task manager, but I couldn't open task manager, or any other app for that matter, so I did a hard reboot and tried restarting in safemode. It wouldn't allow me to start in safe mode. By this point it was very late, so I shut it down and went to bed.

When I got up the next morning and started the computer, it gave me a message that it didn't shut down properly and gave me the option to start in safemode. Thank God!
I ran malwarebytes, which found and cleaned 7 issues (mostly having to do with the Live Security Platinum). I then rebooted and ran malwarebytes in normal mode. Again, it found and cleaned 7 issues. I ran malwarebytes one more time and it came up clean. Not realizing that this hacker posing as tech support was the one who did it, I updated him. He claimed that the cleaning process must've uncovered a hidden virus. It hit me later that it was him who installed this into my machine, because since dealing with him, I had that and a multitude of other things crop up. Well, he checked my machine again, this time doing a deep scan with Vipre. The scan was taking a long time and I had to step away to make dinner. The scan ran for hours, so he left. I let it finish over night. I came back and it had found a 3 issues, I don't remember exactly what, so I cleaned it.

I thought everything was fine. I was surfing the web and then realized the double underlined keyword hyperlinks were back. Although this time when I hovered, the image wasn't available (it showed an x, like when an image doesn't properly load).

I looked in the add/remove programs and found the application responsible, yontoo, but it wouldn't let me uninstall it, so I downloaded and used RevoUninstaller to sucessfully uninstall it and clean up the registry and other scattered files.

Thankfully, the hyperlinks and ads went away. While surfing the web, again the browser started acting funny. This time the window moved up and down and I ended up with two scrollbars. I noticed that all apps were acting this way, as I was working in photoshop and it moved up in down in the same way (literally, I don't know how else to describe it, the whole window quickly moved up, then back down). I kept feeling like I was hacked.

Then I noticed that when I click a link through a google search, it tried to redirect me to a bts.scour.com site. I knew it was a problem, but I couldn't find any processes related to bts.scour.com in the task manager, nor any of the files in appdata folder or any registry keys. I'm at a loss at to how to get rid of this thing!

Other things I noticed.......several instances of iexplore.exe process keep running in task manager (sometimes 2, sometimes 6...), although no ie window is open. I end the process, but it immediately starts itself again.

Another thing I noticed, which may be unrelated, is that explorer.exe was running 2 or 3 instances too.

Worse problems and why I'm working in safemode at this moment, the internet slowed to a crawl. When I tried to visit facebook, it loaded, then reloaded a phishy screen saying that I was locked out of my account and asking me to fill out a form giving my name, address and credit card. I knew this was a fake, so of course I quickly closed the tab.

I restarted my puter in safemode and ran malwarebytes, but nothing showed. I also ran vipre quickscan, to no avail.

I came here and opened an account followed directions and the following are my scans, (remember, I ran these scans in safemode):

dds.txt:

.
DDS (Ver_2011-08-26.01) - NTFSx86 NETWORK
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.5.1
Run by Admin at 11:22:06 on 2012-09-11
Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.2038.396 [GMT -4:00]
.
AV: Lavasoft Ad-Aware *Disabled/Outdated* {445B48C3-0FA4-6B16-8F07-6506F305D800}
AV: Symantec Endpoint Protection *Enabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
AV: Sunbelt VIPRE *Disabled/Updated* {BE5DD172-7F42-7948-1A60-E6A720288F81}
AV: AVG Internet Security 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: Lavasoft Ad-Aware *Disabled/Outdated* {FF3AA927-299E-6498-B5B7-5E74888292BD}
SP: AVG Internet Security 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Sunbelt VIPRE *Disabled/Updated* {053C3096-5978-76C6-20D0-DDD55BAFC53C}
SP: Symantec Endpoint Protection *Enabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
FW: Sunbelt VIPRE *Disabled* {86665057-352D-7810-313F-4F92DEFBC8FA}
FW: Symantec Endpoint Protection *Enabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}
FW: AVG Internet Security 2012 *Disabled* {621CC794-9486-F902-D092-0484E8EA828B}
FW: Lavasoft Ad-Aware *Disabled* {7C60C9E6-45CB-6A4E-A458-CC330DD69F7B}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe
C:\Program Files\Sunbelt Software\VIPRE\SBPIMSvc.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\Explorer.EXE
C:\Windows\system32\ctfmon.exe
C:\Windows\helppane.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
C:\Program Files\Sunbelt Software\VIPRE\SBAMSvc.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Users\Admin\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
C:\Windows\notepad.exe
C:\Windows\system32\taskmgr.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Cobian Backup 11\Cobian.exe
C:\Program Files\Cobian Backup 11\cbInterface.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uSearch Bar = Preserve
uStart Page = hxxp://www.att.net/
uInternet Settings,ProxyOverride = *.local
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital

imaging\smart web printing\hpswp_printenhancer.dll
BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files\adobe\/Adobe

Contribute CS4/contributeieplugin.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common

files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-

4c09146192ca} - c:\programdata\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg

\avg2012\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot -

search & destroy\SDHelper.dll
BHO: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - c:\program files

\adawaretb\adawareDx.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:

\progra~1\micros~1\office14\GROOVEEX.DLL
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files

\oracle\javafx 2.1 runtime\bin\ssv.dll
BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure

search\12.2.5.32\AVG Secure Search_toolbar.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program

files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:

\progra~1\micros~1\office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files

\oracle\javafx 2.1 runtime\bin\jp2ssv.dll
BHO: YouTube Downloader Toolbar: {f3fee66e-e034-436a-86e4-9690573bee8a} - c:\program files

\youtube downloader toolbar\ie\5.9\youtubedownloaderToolbarIE.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files

\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital

imaging\smart web printing\hpswp_BHO.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe

\acrobat\activex\AcroIEFavClient.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe

Contribute CS4/contributeieplugin.dll
TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure

search\12.2.5.32\AVG Secure Search_toolbar.dll
TB: YouTube Downloader Toolbar: {f3fee66e-e034-436a-86e4-9690573bee8a} - c:\program files\youtube

downloader toolbar\ie\5.9\youtubedownloaderToolbarIE.dll
TB: Ad-Aware Security Toolbar: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - c:\program files

\adawaretb\adawareDx.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
{e7df6bff-55a5-4eb7-a673-4ed3e9456d39}
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital

imaging\smart web printing\hpswp_bho.dll
uRun: [RESTART_STICKY_NOTES] c:\windows\system32\StikyNot.exe
uRun: [AdobeBridge]
uRun: [Advanced SystemCare 5] "c:\program files\iobit\advanced systemcare 5\ASCTray.exe"

/AutoStart
uRun: [SmartRAM] "c:\program files\iobit\advanced systemcare 5\Suo10_SmartRAM.exe" /m
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [<NO NAME>]
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [ndnti] "c:\windows\system32\rundll32.exe" "c:\users\admin\appdata\roaming\ndnti.dll",_New
mRun: [SBAMTray] "c:\program files\sunbelt software\vipre\SBAMTray.exe"
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\google~1.lnk - c:\program

files\google\google calendar sync\GoogleCalendarSync.exe
uPolicies-explorer: HideSCAHealth = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program

files\microsoft office\office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program

files\microsoft office\office14\ONBttnIELinkedNotes.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program

files\hp\digital imaging\smart web printing\hpswp_BHO.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program

files\spybot - search & destroy\SDHelper.dll
Trusted Zone: $talisma_url$
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} -

hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29

-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29

-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29

-windows-i586.cab
DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} - file:///C:/Program%20Files/Bejeweled

%202/Images/armhelper.ocx
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} -

hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{741C39CB-F5E7-47F4-BAF3-DEEAB5A2857D} : DhcpNameServer = 192.168.1.254
TCP: Interfaces\{741C39CB-F5E7-47F4-BAF3-DEEAB5A2857D}\0353A5430313631343237303 : DhcpNameServer

= 192.168.1.1 192.168.1.1
TCP: Interfaces\{741C39CB-F5E7-47F4-BAF3-

DEEAB5A2857D}\4427E2023536F6474702F40756E60275966696C20254E6A6F69702A392 : DhcpNameServer =

192.168.0.1
TCP: Interfaces\{741C39CB-F5E7-47F4-BAF3-

DEEAB5A2857D}\6496275626F69702D457379636027427F65707D27657563747 : DhcpNameServer = 65.32.5.74

65.32.5.75
TCP: Interfaces\{741C39CB-F5E7-47F4-BAF3-DEEAB5A2857D}\D45646964756272716E65616E6 :

DhcpNameServer = 10.71.0.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files

\microsoft shared\office14\MSOXMLMF.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg

\avg2012\avgpp.dll
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg

secure search\viprotocolinstaller\12.2.6\ViProtocol.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: igfxcui - igfxdev.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:

\progra~1\micros~1\office14\GROOVEEX.DLL
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files

\superantispyware\SASSEH.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\admin\appdata\roaming\mozilla\firefox\profiles\ccer6qi7.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-

8&ilc=12&type=937811&p=
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\progra~1\micros~1\office14\NPAUTHZ.DLL
FF - plugin: c:\progra~1\micros~1\office14\NPSPWRAP.DLL
FF - plugin: c:\program files\amazon\mp3 downloader\npAmazonMP3DownloaderPlugin.dll
FF - plugin: c:\program files\common files\avg secure search\sitesafetyinstaller

\12.2.6\npsitesafety.dll
FF - plugin: c:\program files\common files\motive\npMotive.dll
FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nprpplugin.dll
FF - plugin: c:\program files\oracle\javafx 2.1 runtime\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprpplugin.dll
FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins

\nprpchromebrowserrecordext.dll
FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins

\nprphtml5videoshim.dll
FF - plugin: c:\users\admin\appdata\local\google\update\1.3.21.115\npGoogleUpdate3.dll
FF - plugin: c:\users\admin\appdata\roaming\mozilla\firefox\profiles\ccer6qi7.default\extensions

\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\users\admin\appdata\roaming\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\users\admin\appdata\roaming\mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_4_402_265.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npmproxy.dll
.
---- FIREFOX POLICIES ----
FF - user.js: extentions.y2layers.installId - 61f77aba-70fc-4e3f-beeb-d638c40210ad
FF - user.js: extentions.y2layers.defaultEnableAppsList - Buzzdock,Buzzdock,
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: security.csp.enable - false
.
============= SERVICES / DRIVERS ===============
.
.
=============== Created Last 30 ================
.
2012-09-11 04:21:27 -------- d-----w- c:\program files\Cobian Backup 11
2012-09-09 21:17:17 -------- d-s---w- C:\ComboFix
2012-09-09 21:11:38 -------- d-----w- c:\users\admin\appdata\roaming

\SUPERAntiSpyware.com
2012-09-09 21:10:38 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2012-09-09 21:10:38 -------- d-----w- c:\program files\SUPERAntiSpyware
2012-09-09 19:38:14 -------- d-sh--w- C:\$RECYCLE.BIN
2012-09-09 18:21:17 -------- d-----w- c:\program files\VS Revo Group
2012-09-07 22:40:00 -------- d-----w- c:\users\admin\appdata\roaming\Sunbelt
2012-09-07 22:39:29 -------- d-----w- c:\programdata\Sunbelt
2012-09-07 22:27:33 78936 ----a-w- c:\windows\system32\drivers\sbtis.sys
2012-09-07 22:26:49 -------- d-----w- c:\program files\Sunbelt Software
2012-09-07 19:40:15 129176 ----a-w- c:\program files\mozilla firefox\plugins

\nprpplugin.dll
2012-09-07 19:40:14 11776 ----a-w- c:\program files\mozilla firefox\plugins

\nprjplug.dll
2012-09-07 19:40:13 150736 ----a-w- c:\program files\mozilla firefox\plugins

\nppl3260.dll
2012-09-07 19:40:11 103792 ----a-w- c:\program files\mozilla firefox\plugins

\nppdf32.dll
2012-09-07 19:40:10 163256 ----a-w- c:\program files\mozilla firefox\plugins\np-

mswmp.dll
2012-09-07 15:14:14 54272 ----a-w- c:\windows\system32\fAjGFAs.exe
2012-09-07 03:55:06 -------- d-----w- c:\users\admin\appdata\local\{CBBBD7BF-

F89F-11E1-8270-B8AC6F996F26}
2012-09-07 03:54:56 646656 ----a-w- c:\users\admin\appdata\roaming\ndnti.dll
2012-09-07 03:52:55 -------- d-----w- c:\programdata

\036DFF8E0045EF49005944AB4F147C45
2012-09-07 02:40:23 492032 ----a-w- c:\windows\system32\win32spl.dll
2012-09-07 02:40:23 316928 ----a-w- c:\windows\system32\spoolsv.exe
2012-09-07 02:39:28 2344448 ----a-w- c:\windows\system32\win32k.sys
2012-09-07 02:37:55 41472 ----a-w- c:\windows\system32\browcli.dll
2012-09-07 02:37:55 102912 ----a-w- c:\windows\system32\browser.dll
2012-09-07 02:37:18 400896 ----a-w- c:\windows\system32\srcore.dll
2012-09-07 02:36:30 768512 ----a-w- c:\windows\system32\localspl.dll
2012-09-07 02:33:59 1389568 ----a-w- c:\windows\system32\msxml6.dll
2012-09-07 02:33:59 1236992 ----a-w- c:\windows\system32\msxml3.dll
2012-09-07 02:33:11 139264 ----a-w- c:\windows\system32\cryptsvc.dll
2012-09-07 02:33:11 1156608 ----a-w- c:\windows\system32\crypt32.dll
2012-09-07 02:33:11 103936 ----a-w- c:\windows\system32\cryptnet.dll
2012-09-07 02:31:17 67440 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-09-07 02:31:17 369336 ----a-w- c:\windows\system32\drivers\cng.sys
2012-09-07 02:31:17 225280 ----a-w- c:\windows\system32\schannel.dll
2012-09-07 02:31:17 219136 ----a-w- c:\windows\system32\ncrypt.dll
2012-09-07 02:31:17 134000 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-09-07 02:29:45 987136 ----a-w- c:\program files\common files\system\ado

\msado15.dll
2012-09-07 02:29:00 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-09-07 02:29:00 57856 ----a-w- c:\windows\system32\rdpwsx.dll
2012-09-07 02:29:00 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-09-07 02:28:32 177152 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-09-07 02:23:36 163328 ----a-w- c:\windows\system32\profsvc.dll
2012-09-07 02:22:45 2342400 ----a-w- c:\windows\system32\msi.dll
2012-09-07 02:16:16 3958128 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-09-07 02:16:16 3902320 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-09-07 00:11:12 56688 ----a-w- c:\windows\system32\drivers\partmgr.sys
2012-09-07 00:10:34 1287024 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-09-07 00:03:23 739840 ----a-w- c:\windows\system32\d2d1.dll
2012-09-07 00:03:23 218624 ----a-w- c:\windows\system32\d3d10_1core.dll
2012-09-07 00:03:23 161792 ----a-w- c:\windows\system32\d3d10_1.dll
2012-09-07 00:03:23 1170944 ----a-w- c:\windows\system32\d3d10warp.dll
2012-09-07 00:03:23 1074176 ----a-w- c:\windows\system32\DWrite.dll
2012-09-06 23:59:03 989184 ----a-w- c:\program files\windows journal\JNTFiltr.dll
2012-09-06 23:59:03 969216 ----a-w- c:\program files\windows journal\JNWDRV.dll
2012-09-06 23:59:03 1221632 ----a-w- c:\program files\windows journal\NBDoc.DLL
2012-09-06 23:59:02 936960 ----a-w- c:\program files\common files\microsoft shared

\ink\journal.dll
2012-09-06 23:57:54 5120 ----a-w- c:\windows\system32\wmi.dll
2012-09-06 23:57:54 19312 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-09-06 23:57:54 172544 ----a-w- c:\windows\system32\wintrust.dll
2012-09-06 23:57:54 158720 ----a-w- c:\windows\system32\imagehlp.dll
2012-09-06 23:56:28 826368 ----a-w- c:\windows\system32\rdpcore.dll
2012-09-06 23:56:28 24064 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-09-06 23:50:33 442880 ----a-w- c:\windows\system32\ntshrui.dll
2012-09-06 23:49:54 478208 ----a-w- c:\windows\system32\timedate.cpl
2012-09-06 23:49:00 1288984 ----a-w- c:\windows\system32\ntdll.dll
2012-09-06 23:48:33 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-09-06 23:48:33 1328640 ----a-w- c:\windows\system32\quartz.dll
2012-09-06 23:47:54 67072 ----a-w- c:\windows\system32\packager.dll
2012-09-06 23:42:59 2048 ----a-w- c:\windows\system32\tzres.dll
2012-09-06 23:41:10 38912 ----a-w- c:\windows\system32\csrsrv.dll
2012-09-06 23:40:53 534528 ----a-w- c:\windows\system32\EncDec.dll
2012-09-06 23:40:11 708608 ----a-w- c:\program files\common files\system\wab32.dll
2012-09-06 23:39:52 75776 ----a-w- c:\windows\system32\psisrndr.ax
2012-09-06 23:39:52 72704 ----a-w- c:\windows\system32\Mpeg2Data.ax
2012-09-06 23:39:52 59904 ----a-w- c:\windows\system32\MSDvbNP.ax
2012-09-06 23:39:52 465408 ----a-w- c:\windows\system32\psisdecd.dll
2012-09-06 23:39:52 204288 ----a-w- c:\windows\system32\MSNP.ax
2012-09-06 23:39:28 571904 ----a-w- c:\windows\system32\oleaut32.dll
2012-09-06 23:39:28 233472 ----a-w- c:\windows\system32\oleacc.dll
2012-09-06 23:23:54 222720 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2012-09-06 23:23:23 294912 ----a-w- c:\windows\system32\umpnpmgr.dll
2012-09-06 23:23:03 86528 ----a-w- c:\windows\system32\SearchFilterHost.exe
2012-09-06 23:23:03 666624 ----a-w- c:\windows\system32\mssvp.dll
2012-09-06 23:23:03 59392 ----a-w- c:\windows\system32\msscntrs.dll
2012-09-06 23:23:03 428032 ----a-w- c:\windows\system32\SearchIndexer.exe
2012-09-06 23:23:03 337408 ----a-w- c:\windows\system32\mssph.dll
2012-09-06 23:23:03 197120 ----a-w- c:\windows\system32\mssphtb.dll
2012-09-06 23:23:03 164352 ----a-w- c:\windows\system32\SearchProtocolHost.exe
2012-09-06 23:23:03 1553920 ----a-w- c:\windows\system32\tquery.dll
2012-09-06 23:23:03 1401856 ----a-w- c:\windows\system32\mssrch.dll
2012-09-06 23:21:32 26496 ----a-w- c:\windows\system32\drivers\Diskdump.sys
2012-09-06 23:21:13 442880 ----a-w- c:\windows\system32\XpsPrint.dll
2012-09-06 23:19:07 31232 ----a-w- c:\windows\system32\prevhost.exe
2012-09-06 23:18:47 2614784 ----a-w- c:\windows\explorer.exe
2012-09-06 23:18:23 288256 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2012-09-06 23:17:58 802304 ----a-w- c:\windows\system32\FntCache.dll
2012-09-06 23:17:04 728448 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2012-09-06 23:17:04 219008 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2012-09-06 23:17:04 107520 ----a-w- c:\windows\system32\cdd.dll
2012-09-06 23:16:40 276992 ----a-w- c:\windows\system32\wcncsvc.dll
2012-09-06 23:16:17 80384 ----a-w- c:\windows\system32\davclnt.dll
2012-09-06 23:16:17 73728 ----a-w- c:\windows\system32\wscsvc.dll
2012-09-06 23:16:17 51200 ----a-w- c:\windows\system32\wscapi.dll
2012-09-06 23:16:17 350720 ----a-w- c:\windows\system32\winhttp.dll
2012-09-06 23:16:17 204800 ----a-w- c:\windows\system32\WebClnt.dll
2012-09-06 23:16:17 204288 ----a-w- c:\windows\system32\upnp.dll
2012-09-06 23:16:17 14336 ----a-w- c:\windows\system32\slwga.dll
2012-09-06 23:14:00 417792 ----a-w- c:\windows\system32\msdri.dll
2012-09-06 23:13:08 190976 ----a-w- c:\windows\system32\drivers\ks.sys
2012-09-06 23:13:08 146304 ----a-w- c:\windows\system32\drivers\usbvideo.sys
2012-09-06 23:12:52 84992 ----a-w- c:\windows\system32\drivers\sdbus.sys
2012-09-06 23:12:52 12800 ----a-w- c:\windows\system32\drivers\sffp_sd.sys
2012-09-06 23:12:10 194488 ----a-w- c:\windows\system32\drivers\fvevol.sys
2012-09-06 23:11:02 85504 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2012-09-06 23:11:02 85504 ----a-w- c:\windows\system32\secproc_ssp.dll
2012-09-06 23:11:02 369152 ----a-w- c:\windows\system32\secproc.dll
2012-09-06 23:11:02 365568 ----a-w- c:\windows\system32\secproc_isv.dll
2012-09-06 23:11:02 324608 ----a-w- c:\windows\system32\RMActivate_isv.exe
2012-09-06 23:11:02 320512 ----a-w- c:\windows\system32\RMActivate.exe
2012-09-06 23:11:02 280064 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2012-09-06 23:11:02 277504 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2012-09-06 23:07:00 22400 ----a-w- c:\windows\system32\RegistryDefragBootTime.exe
2012-09-06 22:51:18 -------- d-----w- c:\programdata\IObit
2012-09-06 22:50:34 -------- d-----w- c:\users\admin\appdata\roaming\IObit
2012-09-06 22:50:15 -------- d-----w- c:\program files\IObit
2012-09-06 22:46:01 -------- d-----w- c:\windows\pss
2012-09-06 22:32:04 -------- d-----w- c:\program files\CCleaner
2012-08-31 20:23:16 -------- d-----w- c:\programdata\McAfee Security Scan
2012-08-31 20:22:15 -------- d-----w- c:\program files\McAfee Security Scan
2012-08-30 16:16:27 27496 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
2012-08-23 03:12:07 -------- d-----w- c:\users\admin\appdata\roaming\Ashampoo
2012-08-23 03:11:21 -------- d-----w- c:\users\admin\appdata\local\ashampoo
2012-08-23 03:11:21 -------- d-----w- c:\programdata\ashampoo
2012-08-23 03:11:04 -------- d-----w- c:\program files\Ashampoo
2012-08-23 02:51:47 -------- d-----w- c:\programdata\Tarma Installer
2012-08-18 04:35:17 -------- d-----w- c:\users\admin\appdata\local\Opera
2012-08-18 04:33:24 -------- d-----w- c:\program files\Opera Mobile Emulator
2012-08-14 00:00:00 60304 ----a-w- c:\users\admin\g2mdlhlpx.exe
.
==================== Find3M ====================
.
2012-09-07 02:35:40 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-09-07 02:35:40 1800704 ----a-w- c:\windows\system32\jscript9.dll
2012-09-07 02:35:40 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-09-07 02:35:40 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
2012-09-07 02:35:40 1129472 ----a-w- c:\windows\system32\wininet.dll
2012-08-31 20:21:48 696520 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-31 20:21:47 73416 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-06 02:06:30 772544 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-07-06 02:06:20 687544 ----a-w- c:\windows\system32\deployJava1.dll
2012-07-03 17:46:44 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-26 01:32:39 125488 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2012-06-22 15:02:16 27424 ----a-w- c:\windows\system32\drivers\hitmanpro36.sys
2012-06-21 04:43:49 0 ----a-w- c:\users\admin\appdata\roaming\adaware-

installer-reboot-required.tmp
.
============= FINISH: 11:23:40.75 ===============

Attached Files


Edited by Kalidevi, 11 September 2012 - 12:04 PM.


BC AdBot (Login to Remove)

 


#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:09:36 PM

Posted 11 September 2012 - 12:21 PM

Greetings and Welcome to The Forums!!


My name is Gringo and I'll be glad to help you with your computer problems.

  • Please do not run any tools unless instructed to do so.
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
  • Please do not attach logs or use code boxes, just copy and paste the text.
    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
  • Please read every post completely before doing anything.
    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
  • Please provide feedback about your experience as we go.
    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.
NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of hartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

:multiple Anti Virus programs:

It looks like you are operating your computer with multiple Anti Virus programs running in memory at once:

AV: Lavasoft Ad-Aware
AV: Symantec Endpoint Protection
AV: Sunbelt VIPRE
AV: AVG Internet Security 2012


Anti-virus programs take up an enormous amount of your computer's resources when they are actively scanning your computer. Having two anti-virus programs running at the same time can cause your computer to run very slow, become unstable and even, in rare cases, crash.

Please remove all but one of them.

Security Check

  • Download Security Check by screen317 from here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.



Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 Kalidevi

Kalidevi
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:08:36 PM

Posted 11 September 2012 - 01:05 PM

Thank you, Gringo!

I realized that the gmer scan didn't finish, as it was frozen. Should I redo it?

Which of the above AV due you recommend? I've been wanting to uninstall the symantec, as I keep disabling it and it keeps enabling itself. Plus, I've always had more luck with AVG than symantec.

I will follow the instructions you gave now and post the info you requested. Again, thank you!

Bright Blessings,
Jacqui

#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:09:36 PM

Posted 11 September 2012 - 03:09 PM

Hello

uninstall all of them for now and I will give you a better one later



Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#5 Kalidevi

Kalidevi
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:08:36 PM

Posted 13 September 2012 - 01:43 PM

Sorry it took so long. I was trying to make a backup before I started working the steps......finally got it to work.

As per your request, the following is the log from Security Check:

Results of screen317's Security Check version 0.99.50
Windows 7 x86 (UAC is disabled!)
Out of date service pack!!
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
AVG Internet Security 2012
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
MVPS Hosts File
Spybot - Search & Destroy
SUPERAntiSpyware
Malwarebytes Anti-Malware version 1.62.0.1300
CCleaner
JavaFX 2.1.1
Java™ 6 Update 29
Java™ 7 Update 5
Java version out of Date!
Adobe Flash Player 11.4.402.265
Adobe Reader X 10.0.1 Adobe Reader out of Date!
Mozilla Firefox (15.0.1)
````````Process Check: objlist.exe by Laurent````````
Norton ccSvcHst.exe
Spybot Teatimer.exe is disabled!
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````


BTW, I now noticed the redirect changed to http://meta.7search.com/........

After sending an email to facebook phish reporting, I noticed the facebook false header disappeared. This false header was telling me I was locked out of my facebook account and asking me for my name, address, mobile phone #, and credit card #. I have a feeling they saw the email, because I told facebook I had a clue who it was and wanted to get them caught. Last night I did a screen capture of it to send to facebook. I think the hackers are watching me and are aware of my trying to report them. (I noticed signs of someone remotely connecting to my computer (screen flickering black for a few seconds) and so I shut it down, but they may have done it overnight after the backup was done.

Now, I will move on to the combofix.

Again, thank you for your assistance. I greatly appreciate it!

God bless!

#6 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:09:36 PM

Posted 13 September 2012 - 03:23 PM

I will be waiting for the combofix report



gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#7 Kalidevi

Kalidevi
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:08:36 PM

Posted 13 September 2012 - 05:21 PM

The following is the Combofix log:

ComboFix 12-09-13.03 - Admin 09/13/2012 17:51:05.1.2 - x86
Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.2038.1257 [GMT -4:00]
Running from: c:\users\Admin\Desktop\ComboFix.exe
AV: AVG Internet Security 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
FW: AVG Internet Security 2012 *Disabled* {621CC794-9486-F902-D092-0484E8EA828B}
SP: AVG Internet Security 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Admin\AppData\Roaming\ndnti.dll
c:\users\Admin\Documents\~WRL0005.tmp
c:\users\Admin\Documents\~WRL0226.tmp
c:\users\Admin\Documents\~WRL0376.tmp
c:\users\Admin\Documents\~WRL1336.tmp
c:\users\Admin\Documents\~WRL1378.tmp
c:\users\Admin\Documents\~WRL1560.tmp
c:\users\Admin\Documents\~WRL1767.tmp
c:\users\Admin\Documents\~WRL2597.tmp
c:\users\Admin\Documents\~WRL2667.tmp
c:\users\Admin\Documents\~WRL2733.tmp
c:\users\Admin\Favorites\Games.url
c:\users\Admin\g2mdlhlpx.exe
c:\windows\system32\drivers\etc\hosts.txt
.
.
((((((((((((((((((((((((( Files Created from 2012-08-13 to 2012-09-13 )))))))))))))))))))))))))))))))
.
.
2012-09-13 22:04 . 2012-09-13 22:04 -------- d-----w- c:\users\Admin\AppData\Local\temp
2012-09-13 22:04 . 2012-09-13 22:04 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-09-13 17:04 . 2012-09-13 17:04 -------- d-----w- c:\users\Admin\AppData\Local\Avg2013
2012-09-13 16:32 . 2012-09-13 16:32 -------- d-----w- c:\users\Admin\AppData\Roaming\TuneUp Software
2012-09-13 16:12 . 2012-09-13 16:12 -------- d-----w- c:\users\Admin\AppData\Local\MFAData
2012-09-13 09:15 . 2012-09-13 09:15 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{406BEEA9-4050-4B16-93F6-B938CC2D0C9B}\offreg.dll
2012-09-11 22:10 . 2012-09-11 22:10 -------- d-----w- c:\users\Admin\AppData\Roaming\GFI Software
2012-09-11 20:07 . 2012-08-28 05:50 7022536 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{406BEEA9-4050-4B16-93F6-B938CC2D0C9B}\mpengine.dll
2012-09-11 19:32 . 2012-09-11 19:32 -------- d-----w- c:\program files\Runtime Software
2012-09-11 19:21 . 2012-09-11 19:21 -------- d-----w- c:\users\Admin\AppData\Local\AVG Secure Search
2012-09-11 19:21 . 2012-09-11 19:21 -------- d-----w- c:\programdata\AVG Secure Search
2012-09-11 19:20 . 2012-09-11 19:20 27496 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
2012-09-11 19:20 . 2012-09-11 19:20 -------- d-----w- c:\program files\Common Files\AVG Secure Search
2012-09-11 19:20 . 2012-09-11 19:21 -------- d-----w- c:\program files\AVG Secure Search
2012-09-11 18:45 . 2012-09-11 18:45 -------- d-----w- c:\programdata\GFI Software
2012-09-11 04:21 . 2012-09-13 14:43 -------- d-----w- c:\program files\Cobian Backup 11
2012-09-10 16:03 . 2012-09-10 16:03 -------- d-----w- c:\windows\Sun
2012-09-09 21:11 . 2012-09-09 21:11 -------- d-----w- c:\users\Admin\AppData\Roaming\SUPERAntiSpyware.com
2012-09-09 21:10 . 2012-09-09 21:21 -------- d-----w- c:\program files\SUPERAntiSpyware
2012-09-09 21:10 . 2012-09-09 21:10 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2012-09-09 18:21 . 2012-09-09 18:21 -------- d-----w- c:\program files\VS Revo Group
2012-09-07 15:14 . 2012-09-07 15:14 54272 ----a-w- c:\windows\system32\fAjGFAs.exe
2012-09-07 03:55 . 2012-09-07 03:55 -------- d-----w- c:\users\Admin\AppData\Local\{CBBBD7BF-F89F-11E1-8270-B8AC6F996F26}
2012-09-07 03:52 . 2012-09-07 03:54 -------- d-----w- c:\programdata\036DFF8E0045EF49005944AB4F147C45
2012-09-07 02:40 . 2012-09-07 02:40 492032 ----a-w- c:\windows\system32\win32spl.dll
2012-09-07 02:40 . 2012-09-07 02:40 316928 ----a-w- c:\windows\system32\spoolsv.exe
2012-09-07 02:39 . 2012-09-07 02:39 2344448 ----a-w- c:\windows\system32\win32k.sys
2012-09-07 02:37 . 2012-09-07 02:37 41472 ----a-w- c:\windows\system32\browcli.dll
2012-09-07 02:37 . 2012-09-07 02:37 102912 ----a-w- c:\windows\system32\browser.dll
2012-09-07 02:37 . 2012-09-07 02:37 400896 ----a-w- c:\windows\system32\srcore.dll
2012-09-07 02:36 . 2012-09-07 02:36 768512 ----a-w- c:\windows\system32\localspl.dll
2012-09-07 02:33 . 2012-09-07 02:33 1389568 ----a-w- c:\windows\system32\msxml6.dll
2012-09-07 02:33 . 2012-09-07 02:33 1236992 ----a-w- c:\windows\system32\msxml3.dll
2012-09-07 02:33 . 2012-09-07 02:33 139264 ----a-w- c:\windows\system32\cryptsvc.dll
2012-09-07 02:33 . 2012-09-07 02:33 1156608 ----a-w- c:\windows\system32\crypt32.dll
2012-09-07 02:33 . 2012-09-07 02:33 103936 ----a-w- c:\windows\system32\cryptnet.dll
2012-09-07 02:31 . 2012-09-07 02:31 219136 ----a-w- c:\windows\system32\ncrypt.dll
2012-09-07 02:31 . 2012-09-07 02:31 67440 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-09-07 02:31 . 2012-09-07 02:31 369336 ----a-w- c:\windows\system32\drivers\cng.sys
2012-09-07 02:31 . 2012-09-07 02:31 225280 ----a-w- c:\windows\system32\schannel.dll
2012-09-07 02:31 . 2012-09-07 02:31 134000 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-09-07 02:29 . 2012-09-07 02:29 987136 ----a-w- c:\program files\Common Files\System\ado\msado15.dll
2012-09-07 02:29 . 2012-09-07 02:29 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-09-07 02:29 . 2012-09-07 02:29 57856 ----a-w- c:\windows\system32\rdpwsx.dll
2012-09-07 02:29 . 2012-09-07 02:29 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-09-07 02:28 . 2012-09-07 02:28 177152 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-09-07 02:23 . 2012-09-07 02:23 163328 ----a-w- c:\windows\system32\profsvc.dll
2012-09-07 02:22 . 2012-09-07 02:22 2342400 ----a-w- c:\windows\system32\msi.dll
2012-09-07 02:16 . 2012-09-07 02:16 3958128 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-09-07 02:16 . 2012-09-07 02:16 3902320 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-09-07 00:11 . 2012-09-07 00:11 56688 ----a-w- c:\windows\system32\drivers\partmgr.sys
2012-09-07 00:10 . 2012-09-07 00:10 1287024 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-09-07 00:03 . 2012-09-07 00:03 739840 ----a-w- c:\windows\system32\d2d1.dll
2012-09-07 00:03 . 2012-09-07 00:03 218624 ----a-w- c:\windows\system32\d3d10_1core.dll
2012-09-07 00:03 . 2012-09-07 00:03 161792 ----a-w- c:\windows\system32\d3d10_1.dll
2012-09-07 00:03 . 2012-09-07 00:03 1170944 ----a-w- c:\windows\system32\d3d10warp.dll
2012-09-07 00:03 . 2012-09-07 00:03 1074176 ----a-w- c:\windows\system32\DWrite.dll
2012-09-06 23:59 . 2012-09-06 23:59 989184 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
2012-09-06 23:59 . 2012-09-06 23:59 969216 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
2012-09-06 23:59 . 2012-09-06 23:59 1221632 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2012-09-06 23:59 . 2012-09-06 23:59 936960 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-09-06 23:57 . 2012-09-06 23:57 5120 ----a-w- c:\windows\system32\wmi.dll
2012-09-06 23:57 . 2012-09-06 23:57 19312 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-09-06 23:57 . 2012-09-06 23:57 172544 ----a-w- c:\windows\system32\wintrust.dll
2012-09-06 23:57 . 2012-09-06 23:57 158720 ----a-w- c:\windows\system32\imagehlp.dll
2012-09-06 23:56 . 2012-09-06 23:56 826368 ----a-w- c:\windows\system32\rdpcore.dll
2012-09-06 23:56 . 2012-09-06 23:56 24064 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-09-06 23:50 . 2012-09-06 23:50 442880 ----a-w- c:\windows\system32\ntshrui.dll
2012-09-06 23:49 . 2012-09-06 23:49 478208 ----a-w- c:\windows\system32\timedate.cpl
2012-09-06 23:49 . 2012-09-06 23:49 1288984 ----a-w- c:\windows\system32\ntdll.dll
2012-09-06 23:48 . 2012-09-06 23:48 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-09-06 23:48 . 2012-09-06 23:48 1328640 ----a-w- c:\windows\system32\quartz.dll
2012-09-06 23:47 . 2012-09-06 23:47 67072 ----a-w- c:\windows\system32\packager.dll
2012-09-06 23:42 . 2012-09-06 23:42 2048 ----a-w- c:\windows\system32\tzres.dll
2012-09-06 23:41 . 2012-09-06 23:41 38912 ----a-w- c:\windows\system32\csrsrv.dll
2012-09-06 23:40 . 2012-09-06 23:40 534528 ----a-w- c:\windows\system32\EncDec.dll
2012-09-06 23:40 . 2012-09-06 23:40 708608 ----a-w- c:\program files\Common Files\System\wab32.dll
2012-09-06 23:39 . 2012-09-06 23:39 75776 ----a-w- c:\windows\system32\psisrndr.ax
2012-09-06 23:39 . 2012-09-06 23:39 72704 ----a-w- c:\windows\system32\Mpeg2Data.ax
2012-09-06 23:39 . 2012-09-06 23:39 59904 ----a-w- c:\windows\system32\MSDvbNP.ax
2012-09-06 23:39 . 2012-09-06 23:39 465408 ----a-w- c:\windows\system32\psisdecd.dll
2012-09-06 23:39 . 2012-09-06 23:39 204288 ----a-w- c:\windows\system32\MSNP.ax
2012-09-06 23:39 . 2012-09-06 23:39 571904 ----a-w- c:\windows\system32\oleaut32.dll
2012-09-06 23:39 . 2012-09-06 23:39 233472 ----a-w- c:\windows\system32\oleacc.dll
2012-09-06 23:23 . 2012-09-06 23:23 222720 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2012-09-06 23:23 . 2012-09-06 23:23 294912 ----a-w- c:\windows\system32\umpnpmgr.dll
2012-09-06 23:23 . 2012-09-06 23:23 86528 ----a-w- c:\windows\system32\SearchFilterHost.exe
2012-09-06 23:23 . 2012-09-06 23:23 666624 ----a-w- c:\windows\system32\mssvp.dll
2012-09-06 23:23 . 2012-09-06 23:23 59392 ----a-w- c:\windows\system32\msscntrs.dll
2012-09-06 23:23 . 2012-09-06 23:23 428032 ----a-w- c:\windows\system32\SearchIndexer.exe
2012-09-06 23:23 . 2012-09-06 23:23 337408 ----a-w- c:\windows\system32\mssph.dll
2012-09-06 23:23 . 2012-09-06 23:23 197120 ----a-w- c:\windows\system32\mssphtb.dll
2012-09-06 23:23 . 2012-09-06 23:23 164352 ----a-w- c:\windows\system32\SearchProtocolHost.exe
2012-09-06 23:23 . 2012-09-06 23:23 1553920 ----a-w- c:\windows\system32\tquery.dll
2012-09-06 23:23 . 2012-09-06 23:23 1401856 ----a-w- c:\windows\system32\mssrch.dll
2012-09-06 23:21 . 2012-09-06 23:21 26496 ----a-w- c:\windows\system32\drivers\Diskdump.sys
2012-09-06 23:21 . 2012-09-06 23:21 442880 ----a-w- c:\windows\system32\XpsPrint.dll
2012-09-06 23:19 . 2012-09-06 23:19 31232 ----a-w- c:\windows\system32\prevhost.exe
2012-09-06 23:18 . 2012-09-06 23:18 2614784 ----a-w- c:\windows\explorer.exe
2012-09-06 23:18 . 2012-09-06 23:18 288256 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2012-09-06 23:17 . 2012-09-06 23:17 802304 ----a-w- c:\windows\system32\FntCache.dll
2012-09-06 23:17 . 2012-09-06 23:17 728448 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2012-09-06 23:17 . 2012-09-06 23:17 219008 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2012-09-06 23:17 . 2012-09-06 23:17 107520 ----a-w- c:\windows\system32\cdd.dll
2012-09-06 23:16 . 2012-09-06 23:16 276992 ----a-w- c:\windows\system32\wcncsvc.dll
2012-09-06 23:16 . 2012-09-06 23:16 80384 ----a-w- c:\windows\system32\davclnt.dll
2012-09-06 23:16 . 2012-09-06 23:16 73728 ----a-w- c:\windows\system32\wscsvc.dll
2012-09-06 23:16 . 2012-09-06 23:16 51200 ----a-w- c:\windows\system32\wscapi.dll
2012-09-06 23:16 . 2012-09-06 23:16 350720 ----a-w- c:\windows\system32\winhttp.dll
2012-09-06 23:16 . 2012-09-06 23:16 204800 ----a-w- c:\windows\system32\WebClnt.dll
2012-09-06 23:16 . 2012-09-06 23:16 204288 ----a-w- c:\windows\system32\upnp.dll
2012-09-06 23:16 . 2012-09-06 23:16 14336 ----a-w- c:\windows\system32\slwga.dll
2012-09-06 23:14 . 2012-09-06 23:14 417792 ----a-w- c:\windows\system32\msdri.dll
2012-09-06 23:13 . 2012-09-06 23:13 190976 ----a-w- c:\windows\system32\drivers\ks.sys
2012-09-06 23:13 . 2012-09-06 23:13 146304 ----a-w- c:\windows\system32\drivers\usbvideo.sys
2012-09-06 23:12 . 2012-09-06 23:12 84992 ----a-w- c:\windows\system32\drivers\sdbus.sys
2012-09-06 23:12 . 2012-09-06 23:12 12800 ----a-w- c:\windows\system32\drivers\sffp_sd.sys
2012-09-06 23:12 . 2012-09-06 23:12 194488 ----a-w- c:\windows\system32\drivers\fvevol.sys
2012-09-06 23:11 . 2012-09-06 23:11 85504 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2012-09-06 23:11 . 2012-09-06 23:11 85504 ----a-w- c:\windows\system32\secproc_ssp.dll
2012-09-06 23:11 . 2012-09-06 23:11 369152 ----a-w- c:\windows\system32\secproc.dll
2012-09-06 23:11 . 2012-09-06 23:11 365568 ----a-w- c:\windows\system32\secproc_isv.dll
2012-09-06 23:11 . 2012-09-06 23:11 324608 ----a-w- c:\windows\system32\RMActivate_isv.exe
2012-09-06 23:11 . 2012-09-06 23:11 320512 ----a-w- c:\windows\system32\RMActivate.exe
2012-09-06 23:11 . 2012-09-06 23:11 280064 ----a-w- c:\windows\system32\RMActivate_ssp.exe
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-31 20:21 . 2012-04-02 13:24 696520 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-31 20:21 . 2011-05-14 06:17 73416 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-06 02:06 . 2012-08-09 23:44 772544 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-07-06 02:06 . 2012-02-14 06:12 687544 ----a-w- c:\windows\system32\deployJava1.dll
2012-07-03 17:46 . 2012-06-20 23:58 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-22 15:02 . 2012-06-22 15:02 27424 ----a-w- c:\windows\system32\drivers\hitmanpro36.sys
2012-09-06 01:27 . 2012-09-09 17:46 266720 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-09-11 19:20 1734240 ----a-w- c:\program files\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\12.2.5.34\AVG Secure Search_toolbar.dll" [2012-09-11 1734240]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Advanced SystemCare 5"="c:\program files\IObit\Advanced SystemCare 5\ASCTray.exe" [2012-05-28 288128]
"SmartRAM"="c:\program files\IObit\Advanced SystemCare 5\Suo10_SmartRAM.exe" [2012-07-31 428928]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-09-09 4780928]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-24 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-24 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-24 150552]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2012-09-11 947808]
"ROC_ROC_NT"="c:\program files\AVG Secure Search\ROC_ROC_NT.exe" [2012-09-11 856160]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Google Calendar Sync.lnk - c:\program files\Google\Google Calendar Sync\GoogleCalendarSync.exe [2011-4-8 542264]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^hueyPROTray.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\hueyPROTray.lnk
backup=c:\windows\pss\hueyPROTray.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
backup=c:\windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^Admin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Screen Clipper and Launcher.lnk]
path=c:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2010 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-Aware Antivirus]
c:\program files\Ad-Aware Antivirus\AdAwareLauncher --windows-run [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2009-10-03 03:32 640376 ----a-w- c:\program files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Acrobat Speed Launcher]
2009-10-03 08:08 38768 ----a-w- c:\program files\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37 843712 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-01-30 15:45 35736 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2008-08-14 11:58 611712 ----a-w- c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe_ID0ENQBO]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG_TRAY]
2012-04-05 09:12 2587008 ----a-w- c:\program files\AVG\AVG2012\avgtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 18:54 91520 ----a-w- c:\program files\Microsoft Office\Office14\BCSSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2012-02-13 08:06 3481408 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2011-11-23 05:22 136176 ----atw- c:\users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2011-05-10 07:41 49208 ----a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KeNotify]
2009-01-14 02:33 34088 ----a-w- c:\program files\TOSHIBA\Utilities\KeNotify.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]
2010-05-20 20:27 119152 ----a-w- c:\program files\Microsoft LifeCam\LifeExp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2012-07-03 17:46 462920 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 20:07 2260480 ------w- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-01-17 15:07 252296 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2012-07-19 14:10 296096 ----a-w- c:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vProt]
2012-09-11 19:20 947808 ----a-w- c:\program files\AVG Secure Search\vprot.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VX3000]
2010-05-20 20:27 762736 ----a-w- c:\windows\vVX3000.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys [x]
R3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\DRIVERS\avgidsfilterx.sys [x]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
R3 hitmanpro36;Hitman Pro 3.5 Support Driver;c:\windows\system32\drivers\hitmanpro36.sys [x]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x]
R3 sbwtis;sbwtis;c:\windows\system32\DRIVERS\sbwtis.sys [x]
R3 TIDHOOK;TIDHOOK;c:\users\Admin\AppData\Local\Temp\fx432nkc.tmp\tidhook.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [x]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [x]
S2 AdvancedSystemCareService5;Advanced SystemCare Service 5;c:\program files\IObit\Advanced SystemCare 5\ASCService.exe [x]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;c:\program files\Norton PC Checkup\Engine\2.0.17.20\SymcPCCULaunchSvc.exe [x]
S2 PCCUJobMgr;Common Client Job Manager Service;c:\program files\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe [x]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [x]
S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [x]
S2 vToolbarUpdater12.2.6;vToolbarUpdater12.2.6;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-09-13 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 20:21]
.
2012-09-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1258058369-331007624-1848368994-1005Core.job
- c:\users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-23 05:22]
.
2012-09-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1258058369-331007624-1848368994-1005UA.job
- c:\users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-23 05:22]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.att.net/
uInternet Settings,ProxyOverride = *.local
Trusted Zone: $talisma_url$
TCP: DhcpNameServer = 192.168.1.254
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\12.2.6\ViProtocol.dll
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ccer6qi7.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - prefs.js: network.proxy.type - 0
FF - user.js: extentions.y2layers.installId - 61f77aba-70fc-4e3f-beeb-d638c40210ad
FF - user.js: extentions.y2layers.defaultEnableAppsList - Buzzdock,Buzzdock,
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: security.csp.enable - false
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
HKCU-Run-AdobeBridge - (no file)
HKLM-Run-ndnti - c:\users\Admin\AppData\Roaming\ndnti.dll
MSConfigStartUp-Ad-Aware Browsing Protection - c:\programdata\Ad-Aware Browsing Protection\adawarebp.exe
MSConfigStartUp-ndnti - c:\users\Admin\AppData\Roaming\ndnti.dll
MSConfigStartUp-pxbNfNp - c:\users\Admin\AppData\Local\Temp\pxbNfNp.exe
MSConfigStartUp-ROC_ROC_JULY_P1 - c:\program files\AVG Secure Search\ROC_ROC_JULY_P1.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCCUJobMgr]
"ImagePath"="\"c:\program files\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe\" /s \"PCCUJobMgr\" /m \"c:\program files\Norton PC Checkup\Engine\2.0.17.20\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-09-13 18:08:13
ComboFix-quarantined-files.txt 2012-09-13 22:08
.
Pre-Run: 26,852,196,352 bytes free
Post-Run: 26,803,396,608 bytes free
.
- - End Of File - - 7E1C2560AD41A4774E15A0B139F913D8


BTW, I was wrong, the facebook "header" came back. So far no redirects yet, but I posted just as soon as the log finished. I did try to recreate by doing a google search and clicking search results, but so far so good. I have screenshot of the facebook "header". It only does it for the url http://www.facebook.com, but not if I put in a profile url such as http://www.facebook.com/JacquiBensusan.


Thanks!

Edited by Kalidevi, 13 September 2012 - 05:29 PM.


#8 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:09:36 PM

Posted 13 September 2012 - 05:37 PM

Hello

-AdwCleaner-

  • Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Delete.
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#9 Kalidevi

Kalidevi
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:08:36 PM

Posted 13 September 2012 - 05:56 PM

Here is the adwcleaner log:

# AdwCleaner v2.001 - Logfile created 09/13/2012 at 18:47:22
# Updated 09/09/2012 by Xplode
# Operating system : Windows 7 Professional (32 bits)
# User : Admin - XYZ-PC
# Boot Mode : Normal
# Running from : C:\Users\Admin\Desktop\adwcleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

File Deleted : C:\Program Files\Mozilla Firefox\searchplugins\avg-secure-search.xml
Folder Deleted : C:\Program Files\AVG Secure Search
Folder Deleted : C:\Program Files\Common Files\AVG Secure Search
Folder Deleted : C:\Program Files\YouTube Downloader Toolbar
Folder Deleted : C:\ProgramData\AVG Secure Search
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\Users\Admin\AppData\Local\AVG Secure Search
Folder Deleted : C:\Users\Admin\AppData\LocalLow\AVG Secure Search
Folder Deleted : C:\Users\Admin\AppData\LocalLow\Search Settings

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Search Settings
Key Deleted : HKCU\Software\AVG Secure Search
Key Deleted : HKCU\Software\IGearSettings
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKCU\Software\Search Settings
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKLM\Software\AVG Secure Search
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj
Key Deleted : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Key Deleted : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Key Deleted : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Key Deleted : HKLM\Software\Search Settings
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]
Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

Restored : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Restored : [HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Restored : [HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]
Restored : [HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes - DefaultScope]

-\\ Mozilla Firefox v15.0.1 (en-US)

Profile name : default
File : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ccer6qi7.default\prefs.js

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ccer6qi7.default\user.js ... Deleted !

[OK] File is clean.

*************************

AdwCleaner[S1].txt - [5823 octets] - [13/09/2012 18:47:22]

########## EOF - C:\AdwCleaner[S1].txt - [5883 octets] ##########

Eww that yontoo is bad news! I had to use Revo uninstaller to remove it and I still see entries in the registry for it. ugh.

Edited by Kalidevi, 13 September 2012 - 05:57 PM.


#10 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:09:36 PM

Posted 14 September 2012 - 01:26 AM

Hello

Lets get a deeper look into the system and see if something shows up.

Download and run OTL

Download OTL by Old Timer and save it to your Desktop.
  • Double click on OTL.exe to run it.
  • Under Output, ensure that Minimal Output is selected.
  • Under Extra Registry section, select Use SafeList.
  • Click the Scan All Users checkbox.
  • Click on Run Scan at the top left hand corner.
  • When done, two Notepad files will open.
    • OTL.txt <-- Will be opened and the that I need posted back here
    • Extra.txt <-- Will be minimized - save this one on your desktop in case I ask for it later
  • Please post the contents of OTL.txt in your next reply.

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#11 Kalidevi

Kalidevi
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:08:36 PM

Posted 14 September 2012 - 10:43 AM

OTL log:

OTL logfile created on: 9/14/2012 11:26:23 AM - Run 1
OTL by OldTimer - Version 3.2.61.4 Folder = C:\Users\Admin\Desktop
Professional (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.45 Gb Available Physical Memory | 72.60% Memory free
3.98 Gb Paging File | 2.67 Gb Available in Paging File | 67.04% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 110.32 Gb Total Space | 26.62 Gb Free Space | 24.13% Space Free | Partition Type: NTFS
Drive D: | 449.13 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: XYZ-PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Admin\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
PRC - C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\IObit\Advanced SystemCare 5\Suo10_SmartRAM.exe (IObit)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe (IObit)
PRC - C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe (IObit)
PRC - C:\Program Files\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\Norton PC Checkup\Engine\2.0.17.20\SymcPCCULaunchSvc.exe (Symantec Corporation)
PRC - C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe (Google)
PRC - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files\Microsoft LifeCam\MSCamS32.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)


========== Modules (No Company Name) ==========

MOD - C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll ()
MOD - C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll ()
MOD - C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL ()
MOD - C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll ()
MOD - C:\Program Files\FileZilla FTP Client\fzshellext.dll ()
MOD - C:\Program Files\IObit\Advanced SystemCare 5\madexcept_.bpl ()
MOD - C:\Program Files\IObit\Advanced SystemCare 5\madbasic_.bpl ()
MOD - C:\Program Files\IObit\Advanced SystemCare 5\maddisAsm_.bpl ()
MOD - C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF ()
MOD - C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll ()


========== Services (SafeList) ==========

SRV - (vToolbarUpdater12.2.6) -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\12.2.6\ToolbarUpdater.exe File not found
SRV - (SBSDWSCService) -- C:\Program Files\Spybot File not found
SRV - (!SASCORE) -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AdvancedSystemCareService5) -- C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe (IObit)
SRV - (PCCUJobMgr) -- C:\Program Files\Norton PC Checkup\Engine\2.0.17.20\ccSvcHst.exe (Symantec Corporation)
SRV - (Norton PC Checkup Application Launcher) -- C:\Program Files\Norton PC Checkup\Engine\2.0.17.20\SymcPCCULaunchSvc.exe (Symantec Corporation)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (TeamViewer6) -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (WatAdminSvc) -- C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (MSCamSvc) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe (Microsoft Corporation)
SRV - (Microsoft SharePoint Workspace Audit Service) -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (Adobe Version Cue CS4) -- C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe (Adobe Systems Incorporated)


========== Driver Services (SafeList) ==========

DRV - (TIDHOOK) -- C:\Users\Admin\AppData\Local\Temp\fx432nkc.tmp\tidhook.sys File not found
DRV - (SBRE) -- C:\Windows\system32\drivers\SBREdrv.sys File not found
DRV - (MRENDIS5) -- C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS File not found
DRV - (MREMPR5) -- C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS File not found
DRV - (Lavasoft Kernexplorer) -- C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys File not found
DRV - (hwdatacard) -- system32\DRIVERS\ewusbmdm.sys File not found
DRV - (huawei_enumerator) -- system32\DRIVERS\ew_jubusenum.sys File not found
DRV - (ewusbnet) -- system32\DRIVERS\ewusbnet.sys File not found
DRV - (ew_hwusbdev) -- system32\DRIVERS\ew_hwusbdev.sys File not found
DRV - (catchme) -- C:\Users\Admin\AppData\Local\Temp\catchme.sys File not found
DRV - (avgtp) -- C:\Windows\System32\drivers\avgtpx86.sys (AVG Technologies)
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (hitmanpro36) -- C:\Windows\System32\drivers\hitmanpro36.sys ()
DRV - (dtsoftbus01) -- C:\Windows\System32\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV - (AVGIDSFilter) -- C:\Windows\System32\drivers\avgidsfilterx.sys (AVG Technologies CZ, s.r.o. )
DRV - (sbwtis) -- C:\Windows\System32\drivers\sbwtis.sys (GFI Software)
DRV - (MREMP50) -- C:\Program Files\Common Files\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MRESP50) -- C:\Program Files\Common Files\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (SASDIFSV) -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (VX3000) -- C:\Windows\System32\drivers\VX3000.sys (Microsoft Corporation)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (TVALZ) -- C:\Windows\System32\drivers\TVALZ_O.SYS (TOSHIBA Corporation)
DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (WSDPrintDevice) -- C:\Windows\System32\drivers\WSDPrint.sys (Microsoft Corporation)
DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (LSI Corp)
DRV - (LPCFilter) -- C:\Windows\System32\drivers\LPCFilter.sys (COMPAL ELECTRONIC INC.)
DRV - (tifm21) -- C:\Windows\System32\drivers\tifm21.sys (Texas Instruments)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7


IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-1258058369-331007624-1848368994-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.att.net/
IE - HKU\S-1-5-21-1258058369-331007624-1848368994-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-1258058369-331007624-1848368994-1005\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1258058369-331007624-1848368994-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1258058369-331007624-1848368994-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&ilc=12&type=937811"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..extensions.enabledAddons: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.119
FF - prefs.js..extensions.enabledAddons: {C3949AC2-4B17-43ee-B4F1-D26B9D42404D}:15.0.5
FF - prefs.js..extensions.enabledAddons: {CBBBD7BF-F89F-11E1-8270-B8AC6F996F26}:2.0.14
FF - prefs.js..keyword.URL: "http://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q="
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Motive.com/NpMotive,version=1.0: C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.5.109: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.5.109: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.5.109: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.5.109: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.5.109: C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Admin\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Admin\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/03/31 23:17:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012/07/07 09:19:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{C3949AC2-4B17-43ee-B4F1-D26B9D42404D}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/07/19 10:13:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/09/11 15:06:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/09/07 15:40:16 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/03/31 23:17:47 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{CBBBD7BF-F89F-11E1-8270-B8AC6F996F26}: C:\Users\Admin\AppData\Local\{CBBBD7BF-F89F-11E1-8270-B8AC6F996F26}\ [2012/09/06 23:55:06 | 000,000,000 | ---D | M]

[2011/04/16 16:13:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\Mozilla\Extensions
[2012/09/13 18:52:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ccer6qi7.default\extensions
[2012/07/09 14:00:11 | 000,000,000 | ---D | M] (Bitdefender QuickScan) -- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ccer6qi7.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
[2012/06/21 00:28:05 | 000,000,000 | ---D | M] (Lavasoft Search Plugin) -- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ccer6qi7.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack
[2012/09/09 13:46:36 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/07/19 10:13:04 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\PROGRAMDATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
[2012/09/06 23:55:06 | 000,000,000 | ---D | M] (Mozilla Safe Browsing) -- C:\USERS\ADMIN\APPDATA\LOCAL\{CBBBD7BF-F89F-11E1-8270-B8AC6F996F26}
[2012/09/05 21:27:05 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/07/19 10:11:29 | 000,129,176 | ---- | M] (RealPlayer) -- C:\Program Files\mozilla firefox\plugins\nprpplugin.dll
[2012/09/05 21:26:22 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/09/05 21:26:22 | 000,002,253 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/09/13 18:04:26 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll ()
O3 - HKU\S-1-5-21-1258058369-331007624-1848368994-1005\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-1258058369-331007624-1848368994-1005\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ROC_ROC_NT] "C:\Program Files\AVG Secure Search\ROC_ROC_NT.exe" / /PROMPT /CMPID=ROC_NT File not found
O4 - HKLM..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe" File not found
O4 - HKU\S-1-5-21-1258058369-331007624-1848368994-1005..\Run: [Advanced SystemCare 5] C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe (IObit)
O4 - HKU\S-1-5-21-1258058369-331007624-1848368994-1005..\Run: [SmartRAM] C:\Program Files\IObit\Advanced SystemCare 5\Suo10_SmartRAM.exe (IObit)
O4 - HKU\S-1-5-21-1258058369-331007624-1848368994-1005..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1258058369-331007624-1848368994-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1258058369-331007624-1848368994-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1258058369-331007624-1848368994-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O15 - HKU\S-1-5-21-1258058369-331007624-1848368994-1005\..Trusted Domains: $talisma_url$ ([]https in Trusted sites)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 10.5.1)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 10.5.1)
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} file:///C:/Program%20Files/Bejeweled%202/Images/armhelper.ocx (ArmHelper Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{741C39CB-F5E7-47F4-BAF3-DEEAB5A2857D}: DhcpNameServer = 192.168.1.254
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2009/09/23 06:20:27 | 000,863,012 | R--- | M] () - D:\autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2009/09/23 06:21:55 | 000,862,237 | R--- | M] () - D:\autorun_min.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/09/14 11:11:46 | 000,599,552 | ---- | C] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe
[2012/09/13 18:08:20 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/09/13 18:08:17 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\temp
[2012/09/13 17:47:34 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/09/13 17:47:34 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/09/13 17:47:34 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/09/13 13:04:06 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Avg2013
[2012/09/13 12:32:23 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\TuneUp Software
[2012/09/13 12:12:12 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\MFAData
[2012/09/11 18:10:52 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\GFI Software
[2012/09/11 15:32:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Runtime Software
[2012/09/11 15:32:51 | 000,000,000 | ---D | C] -- C:\Program Files\Runtime Software
[2012/09/11 15:20:49 | 000,027,496 | ---- | C] (AVG Technologies) -- C:\Windows\System32\drivers\avgtpx86.sys
[2012/09/11 14:49:48 | 004,749,794 | R--- | C] (Swearware) -- C:\Users\Admin\Desktop\ComboFix.exe
[2012/09/11 14:45:56 | 000,000,000 | ---D | C] -- C:\ProgramData\GFI Software
[2012/09/11 00:21:27 | 000,000,000 | ---D | C] -- C:\Program Files\Cobian Backup 11
[2012/09/10 12:03:18 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2012/09/09 17:11:38 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\SUPERAntiSpyware.com
[2012/09/09 17:10:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2012/09/09 17:10:38 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2012/09/09 17:10:38 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2012/09/09 14:21:17 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2012/09/09 14:21:17 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
[2012/09/08 18:54:50 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/09/08 18:53:44 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2012/09/07 15:39:50 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012/09/06 23:55:06 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\{CBBBD7BF-F89F-11E1-8270-B8AC6F996F26}
[2012/09/06 23:52:55 | 000,000,000 | ---D | C] -- C:\ProgramData\036DFF8E0045EF49005944AB4F147C45
[2012/09/06 22:57:28 | 000,000,000 | R--D | C] -- C:\Users\Admin\Links
[2012/09/06 22:39:28 | 002,344,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012/09/06 22:37:55 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browcli.dll
[2012/09/06 22:37:18 | 000,400,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\srcore.dll
[2012/09/06 22:35:40 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012/09/06 22:35:40 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012/09/06 22:35:40 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012/09/06 22:35:40 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012/09/06 22:35:40 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012/09/06 22:35:40 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012/09/06 22:35:40 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012/09/06 22:31:17 | 000,219,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2012/09/06 22:29:00 | 000,129,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll
[2012/09/06 22:29:00 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll
[2012/09/06 22:29:00 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdrmemptylst.exe
[2012/09/06 22:16:16 | 003,958,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2012/09/06 22:16:16 | 003,902,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2012/09/06 20:03:23 | 001,170,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2012/09/06 20:03:23 | 001,074,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2012/09/06 20:03:23 | 000,739,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2012/09/06 20:03:23 | 000,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2012/09/06 20:03:23 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2012/09/06 19:56:28 | 000,826,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcore.dll
[2012/09/06 19:49:54 | 000,478,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\timedate.cpl
[2012/09/06 19:48:33 | 001,328,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll
[2012/09/06 19:48:33 | 000,514,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll
[2012/09/06 19:47:54 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\packager.dll
[2012/09/06 19:42:59 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2012/09/06 19:41:10 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\csrsrv.dll
[2012/09/06 19:40:53 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll
[2012/09/06 19:39:52 | 000,465,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisdecd.dll
[2012/09/06 19:39:52 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSNP.ax
[2012/09/06 19:39:52 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisrndr.ax
[2012/09/06 19:39:52 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Mpeg2Data.ax
[2012/09/06 19:39:52 | 000,059,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSDvbNP.ax
[2012/09/06 19:24:22 | 000,169,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll
[2012/09/06 19:24:21 | 000,271,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
[2012/09/06 19:24:21 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
[2012/09/06 19:24:21 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
[2012/09/06 19:24:21 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2012/09/06 19:24:21 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2012/09/06 19:24:21 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/09/06 19:24:21 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2012/09/06 19:24:21 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2012/09/06 19:24:21 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2012/09/06 19:24:21 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
[2012/09/06 19:23:03 | 001,553,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tquery.dll
[2012/09/06 19:23:03 | 001,401,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssrch.dll
[2012/09/06 19:23:03 | 000,666,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssvp.dll
[2012/09/06 19:23:03 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssph.dll
[2012/09/06 19:23:03 | 000,197,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mssphtb.dll
[2012/09/06 19:23:03 | 000,059,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msscntrs.dll
[2012/09/06 19:21:32 | 000,026,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\Diskdump.sys
[2012/09/06 19:21:13 | 000,442,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2012/09/06 19:19:07 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\prevhost.exe
[2012/09/06 19:18:47 | 002,614,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe
[2012/09/06 19:18:23 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll
[2012/09/06 19:17:04 | 000,219,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\dxgmms1.sys
[2012/09/06 19:17:04 | 000,107,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2012/09/06 19:16:17 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wscapi.dll
[2012/09/06 19:16:17 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\slwga.dll
[2012/09/06 19:14:00 | 000,417,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdri.dll
[2012/09/06 19:13:08 | 000,190,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\ks.sys
[2012/09/06 19:11:02 | 000,369,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc.dll
[2012/09/06 19:11:02 | 000,365,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_isv.dll
[2012/09/06 19:11:02 | 000,324,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_isv.exe
[2012/09/06 19:11:02 | 000,320,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate.exe
[2012/09/06 19:11:02 | 000,280,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp.exe
[2012/09/06 19:11:02 | 000,277,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp_isv.exe
[2012/09/06 19:11:02 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp_isv.dll
[2012/09/06 19:11:02 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp.dll
[2012/09/06 19:07:00 | 000,022,400 | ---- | C] (IObit) -- C:\Windows\System32\RegistryDefragBootTime.exe
[2012/09/06 18:51:18 | 000,000,000 | ---D | C] -- C:\ProgramData\IObit
[2012/09/06 18:50:34 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\IObit
[2012/09/06 18:50:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced SystemCare 5
[2012/09/06 18:50:15 | 000,000,000 | ---D | C] -- C:\Program Files\IObit
[2012/09/06 18:46:01 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2012/09/06 18:32:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012/09/06 18:32:04 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012/09/06 18:30:55 | 002,211,928 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Admin\Desktop\TDSSKiller.exe
[2012/09/06 18:30:54 | 001,932,256 | ---- | C] (Symantec Corporation) -- C:\Users\Admin\Desktop\fixTDSS.exe
[2012/09/06 18:17:41 | 000,000,000 | ---D | C] -- C:\Users\Admin\Desktop\Tech Support
[2012/09/06 16:29:00 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\Fonts
[2012/09/05 20:38:53 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\Boomers
[2012/09/02 22:40:31 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\Marketing
[2012/08/28 15:03:01 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\Makki
[2012/08/28 13:53:02 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\Prospective Clients
[2012/08/23 20:09:32 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\BlueCheetah
[2012/08/23 18:32:20 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\Tiah
[2012/08/22 23:12:07 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Roaming\Ashampoo
[2012/08/22 23:11:21 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\ashampoo
[2012/08/22 23:11:21 | 000,000,000 | ---D | C] -- C:\ProgramData\ashampoo
[2012/08/22 23:11:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo
[2012/08/22 23:11:04 | 000,000,000 | ---D | C] -- C:\Program Files\Ashampoo
[2012/08/18 00:40:13 | 000,000,000 | ---D | C] -- C:\Users\Admin\Documents\Mobile
[2012/08/18 00:35:17 | 000,000,000 | ---D | C] -- C:\Users\Admin\AppData\Local\Opera
[2012/08/18 00:33:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera Mobile Emulator
[2012/08/18 00:33:24 | 000,000,000 | ---D | C] -- C:\Program Files\Opera Mobile Emulator

========== Files - Modified Within 30 Days ==========

[2012/09/14 11:16:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/09/14 11:11:57 | 000,599,552 | ---- | M] (OldTimer Tools) -- C:\Users\Admin\Desktop\OTL.exe
[2012/09/14 11:04:34 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1258058369-331007624-1848368994-1005UA.job
[2012/09/13 23:17:26 | 000,021,120 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/09/13 23:17:26 | 000,021,120 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/09/13 19:46:01 | 000,000,856 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1258058369-331007624-1848368994-1005Core.job
[2012/09/13 18:50:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/09/13 18:50:17 | 1602,838,528 | -HS- | M] () -- C:\hiberfil.sys
[2012/09/13 18:40:08 | 000,512,399 | ---- | M] () -- C:\Users\Admin\Desktop\adwcleaner.exe
[2012/09/13 18:21:25 | 000,717,514 | ---- | M] () -- C:\Users\Admin\Desktop\facebook hack.psd
[2012/09/13 18:14:30 | 000,042,729 | ---- | M] () -- C:\Users\Admin\Desktop\facebook-hack.png
[2012/09/13 18:04:26 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012/09/13 18:01:09 | 000,000,000 | ---- | M] () -- C:\Users\Admin\AppData\Local\
[2012/09/13 17:45:41 | 004,749,794 | R--- | M] (Swearware) -- C:\Users\Admin\Desktop\ComboFix.exe
[2012/09/13 13:57:48 | 000,627,082 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/09/13 13:57:48 | 000,107,366 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/09/13 00:57:04 | 000,697,973 | ---- | M] () -- C:\Users\Admin\Desktop\facebook hack.jpg
[2012/09/12 21:03:42 | 000,010,663 | ---- | M] () -- C:\Users\Admin\Desktop\kaida3.html
[2012/09/11 15:32:53 | 000,001,072 | ---- | M] () -- C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\DriveImage XML.lnk
[2012/09/11 15:32:53 | 000,001,048 | ---- | M] () -- C:\Users\Public\Desktop\DriveImage XML.lnk
[2012/09/11 15:20:49 | 000,027,496 | ---- | M] (AVG Technologies) -- C:\Windows\System32\drivers\avgtpx86.sys
[2012/09/11 14:49:18 | 000,854,156 | ---- | M] () -- C:\Users\Admin\Desktop\SecurityCheck.exe
[2012/09/11 14:07:03 | 422,714,598 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012/09/11 11:27:23 | 000,302,592 | ---- | M] () -- C:\Users\Admin\Desktop\tzgzzwwz.exe
[2012/09/11 11:20:15 | 000,000,000 | ---- | M] () -- C:\Users\Admin\defogger_reenable
[2012/09/10 23:46:18 | 002,691,504 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/09/10 19:12:16 | 000,042,904 | ---- | M] () -- C:\Users\Admin\Desktop\redirect.html
[2012/09/10 12:20:22 | 000,207,282 | ---- | M] () -- C:\Windows\hpwins28.dat
[2012/09/09 17:11:02 | 000,001,932 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012/09/09 14:21:20 | 000,001,193 | ---- | M] () -- C:\Users\Admin\Desktop\Revo Uninstaller.lnk
[2012/09/09 12:58:32 | 000,124,869 | ---- | M] () -- C:\Users\Admin\Desktop\bookmarks-2012-09-09.json
[2012/09/08 13:45:28 | 004,338,692 | ---- | M] () -- C:\Users\Admin\Documents\Windows_Tweaks_for_Dummies_eBook.pdf
[2012/09/07 11:14:14 | 000,054,272 | ---- | M] () -- C:\Windows\System32\fAjGFAs.exe
[2012/09/06 22:39:28 | 002,344,448 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012/09/06 22:37:55 | 000,041,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\browcli.dll
[2012/09/06 22:37:18 | 000,400,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\srcore.dll
[2012/09/06 22:35:40 | 002,382,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012/09/06 22:35:40 | 001,800,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012/09/06 22:35:40 | 001,427,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012/09/06 22:35:40 | 000,231,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012/09/06 22:35:40 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012/09/06 22:35:40 | 000,142,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012/09/06 22:35:40 | 000,065,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012/09/06 22:31:18 | 000,219,136 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2012/09/06 22:29:00 | 000,129,536 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll
[2012/09/06 22:29:00 | 000,057,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll
[2012/09/06 22:29:00 | 000,008,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\rdrmemptylst.exe
[2012/09/06 22:16:16 | 003,958,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2012/09/06 22:16:16 | 003,902,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2012/09/06 20:03:23 | 001,170,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2012/09/06 20:03:23 | 001,074,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2012/09/06 20:03:23 | 000,739,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2012/09/06 20:03:23 | 000,218,624 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2012/09/06 20:03:23 | 000,161,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2012/09/06 19:56:28 | 000,826,368 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\rdpcore.dll
[2012/09/06 19:49:54 | 000,478,208 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\timedate.cpl
[2012/09/06 19:47:54 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\packager.dll
[2012/09/06 19:42:59 | 000,002,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2012/09/06 19:41:10 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\csrsrv.dll
[2012/09/06 19:39:52 | 000,465,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\psisdecd.dll
[2012/09/06 19:39:52 | 000,204,288 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MSNP.ax
[2012/09/06 19:39:52 | 000,075,776 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\psisrndr.ax
[2012/09/06 19:39:52 | 000,072,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\Mpeg2Data.ax
[2012/09/06 19:39:52 | 000,059,904 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MSDvbNP.ax
[2012/09/06 19:24:22 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
[2012/09/06 19:24:22 | 000,169,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll
[2012/09/06 19:24:21 | 000,006,144 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
[2012/09/06 19:24:21 | 000,005,120 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
[2012/09/06 19:24:21 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
[2012/09/06 19:24:21 | 000,004,608 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
[2012/09/06 19:24:21 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
[2012/09/06 19:24:21 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
[2012/09/06 19:24:21 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
[2012/09/06 19:24:21 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
[2012/09/06 19:24:21 | 000,004,096 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,584 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
[2012/09/06 19:24:21 | 000,003,072 | -H-- | M] (Microsoft Corporation) -- C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
[2012/09/06 19:23:03 | 001,553,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\tquery.dll
[2012/09/06 19:23:03 | 001,401,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mssrch.dll
[2012/09/06 19:23:03 | 000,666,624 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mssvp.dll
[2012/09/06 19:23:03 | 000,337,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mssph.dll
[2012/09/06 19:23:03 | 000,197,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mssphtb.dll
[2012/09/06 19:23:03 | 000,059,392 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscntrs.dll
[2012/09/06 19:21:32 | 000,026,496 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\Diskdump.sys
[2012/09/06 19:21:13 | 000,442,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2012/09/06 19:19:07 | 000,031,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\prevhost.exe
[2012/09/06 19:18:48 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
[2012/09/06 19:18:23 | 000,288,256 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll
[2012/09/06 19:17:04 | 000,219,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\dxgmms1.sys
[2012/09/06 19:17:04 | 000,107,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2012/09/06 19:16:17 | 000,051,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wscapi.dll
[2012/09/06 19:16:17 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\slwga.dll
[2012/09/06 19:14:00 | 000,417,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msdri.dll
[2012/09/06 19:13:08 | 000,190,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\ks.sys
[2012/09/06 19:11:02 | 000,369,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\secproc.dll
[2012/09/06 19:11:02 | 000,365,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\secproc_isv.dll
[2012/09/06 19:11:02 | 000,324,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_isv.exe
[2012/09/06 19:11:02 | 000,320,512 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RMActivate.exe
[2012/09/06 19:11:02 | 000,280,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp.exe
[2012/09/06 19:11:02 | 000,277,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp_isv.exe
[2012/09/06 19:11:02 | 000,085,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp_isv.dll
[2012/09/06 19:11:02 | 000,085,504 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp.dll
[2012/09/06 18:50:34 | 000,001,201 | ---- | M] () -- C:\Users\Public\Desktop\Uninstaller.lnk
[2012/09/06 18:50:34 | 000,001,150 | ---- | M] () -- C:\Users\Public\Desktop\Advanced SystemCare 5.lnk
[2012/09/06 18:32:08 | 000,000,936 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012/09/06 18:14:41 | 004,096,083 | ---- | M] () -- C:\Users\Admin\Desktop\Google Redirect Fix.zip
[2012/08/31 16:21:48 | 000,696,520 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012/08/31 16:21:47 | 000,073,416 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012/08/27 17:37:20 | 000,233,278 | ---- | M] () -- C:\Users\Admin\Documents\AYURVEDIC DIETARY PRINIPALS FOR PUJA.pdf
[2012/08/26 22:45:40 | 001,939,236 | ---- | M] () -- C:\Users\Admin\Documents\michael-laitman_bail-yourself-out-how-you-can-emerge-strong-from-the-world-crisis.pdf
[2012/08/24 13:28:40 | 002,211,928 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Admin\Desktop\TDSSKiller.exe

========== Files Created - No Company Name ==========

[2012/09/13 18:39:46 | 000,512,399 | ---- | C] () -- C:\Users\Admin\Desktop\adwcleaner.exe
[2012/09/13 18:14:29 | 000,042,729 | ---- | C] () -- C:\Users\Admin\Desktop\facebook-hack.png
[2012/09/13 17:47:34 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/09/13 17:47:34 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/09/13 17:47:34 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/09/13 17:47:34 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/09/13 17:47:34 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/09/13 00:58:07 | 000,717,514 | ---- | C] () -- C:\Users\Admin\Desktop\facebook hack.psd
[2012/09/13 00:48:24 | 000,697,973 | ---- | C] () -- C:\Users\Admin\Desktop\facebook hack.jpg
[2012/09/12 21:03:20 | 000,010,663 | ---- | C] () -- C:\Users\Admin\Desktop\kaida3.html
[2012/09/11 15:32:53 | 000,001,072 | ---- | C] () -- C:\Users\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\DriveImage XML.lnk
[2012/09/11 15:32:53 | 000,001,048 | ---- | C] () -- C:\Users\Public\Desktop\DriveImage XML.lnk
[2012/09/11 14:48:59 | 000,854,156 | ---- | C] () -- C:\Users\Admin\Desktop\SecurityCheck.exe
[2012/09/11 14:07:03 | 422,714,598 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012/09/11 11:31:45 | 000,302,592 | ---- | C] () -- C:\Users\Admin\Desktop\tzgzzwwz.exe
[2012/09/11 11:20:15 | 000,000,000 | ---- | C] () -- C:\Users\Admin\defogger_reenable
[2012/09/10 19:12:11 | 000,042,904 | ---- | C] () -- C:\Users\Admin\Desktop\redirect.html
[2012/09/09 17:11:02 | 000,001,932 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2012/09/09 14:21:20 | 000,001,193 | ---- | C] () -- C:\Users\Admin\Desktop\Revo Uninstaller.lnk
[2012/09/09 13:46:40 | 000,001,071 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/09/09 12:58:32 | 000,124,869 | ---- | C] () -- C:\Users\Admin\Desktop\bookmarks-2012-09-09.json
[2012/09/08 13:44:37 | 004,338,692 | ---- | C] () -- C:\Users\Admin\Documents\Windows_Tweaks_for_Dummies_eBook.pdf
[2012/09/07 11:14:14 | 000,054,272 | ---- | C] () -- C:\Windows\System32\fAjGFAs.exe
[2012/09/06 23:55:06 | 000,000,000 | ---- | C] () -- C:\Users\Admin\AppData\Local\
[2012/09/06 18:50:34 | 000,001,201 | ---- | C] () -- C:\Users\Public\Desktop\Uninstaller.lnk
[2012/09/06 18:50:34 | 000,001,150 | ---- | C] () -- C:\Users\Public\Desktop\Advanced SystemCare 5.lnk
[2012/09/06 18:32:08 | 000,000,936 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012/08/27 17:37:20 | 000,233,278 | ---- | C] () -- C:\Users\Admin\Documents\AYURVEDIC DIETARY PRINIPALS FOR PUJA.pdf
[2012/08/26 22:45:25 | 001,939,236 | ---- | C] () -- C:\Users\Admin\Documents\michael-laitman_bail-yourself-out-how-you-can-emerge-strong-from-the-world-crisis.pdf
[2012/06/22 11:02:13 | 000,027,424 | ---- | C] () -- C:\Windows\System32\drivers\hitmanpro36.sys
[2012/06/17 12:33:42 | 000,001,277 | ---- | C] () -- C:\Windows\wininit.ini
[2012/04/02 23:44:41 | 000,027,136 | ---- | C] () -- C:\Windows\System32\QTUninst.dll
[2012/03/16 13:32:33 | 000,000,000 | ---- | C] () -- C:\Windows\System32\msrating.dll
[2012/03/13 22:35:22 | 000,000,000 | ---- | C] () -- C:\Users\Admin\AppData\Roaming\bibstats
[2011/12/05 11:23:41 | 000,000,426 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2011/10/19 22:33:02 | 000,020,992 | ---- | C] () -- C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/07/11 00:45:23 | 000,000,064 | ---- | C] () -- C:\Windows\System32\rp_stats.dat
[2011/07/11 00:45:23 | 000,000,044 | ---- | C] () -- C:\Windows\System32\rp_rules.dat
[2011/04/11 03:45:47 | 000,005,762 | ---- | C] () -- C:\Users\Admin\.recently-used.xbel
[2011/04/01 00:03:10 | 000,000,418 | ---- | C] () -- C:\Windows\hpwmdl28.dat.temp
[2011/03/31 23:03:22 | 000,207,282 | ---- | C] () -- C:\Windows\hpwins28.dat
[2011/03/11 01:04:42 | 000,004,096 | -H-- | C] () -- C:\Users\Admin\AppData\Local\keyfile3.drm

========== Alternate Data Streams ==========

@Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:C7F04040
@Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:57DC3B52
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84
@Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:DFC5A2B2

< End of report >

#12 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:09:36 PM

Posted 14 September 2012 - 04:32 PM

Hello

Run this custom script and when it is complete I need to know how the computer is doing

Run OTL Script

  • Double-click OTL.exe to start the program.
  • Copy and Paste the following code into the Posted Image textbox. Do not include the word Code
    :OTL
    FF - user.js - File not found
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
    O3 - HKU\S-1-5-21-1258058369-331007624-1848368994-1005\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
    O4 - HKLM..\Run: [ROC_ROC_NT] "C:\Program Files\AVG Secure Search\ROC_ROC_NT.exe" / /PROMPT /CMPID=ROC_NT File not found
    O4 - HKLM..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe" File not found
    @Alternate Data Stream - 146 bytes -> C:\ProgramData\TEMP:C7F04040
    @Alternate Data Stream - 137 bytes -> C:\ProgramData\TEMP:57DC3B52
    @Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84
    @Alternate Data Stream - 105 bytes -> C:\ProgramData\TEMP:DFC5A2B2  
    :Files
    ipconfig /flushdns /c
    :Commands
    [PURITY]
    [emptyjava]
    [EMPTYFLASH]
    
  • Then click the Run Fix button at the top.
  • Click Posted Image.
  • OTL may ask to reboot the machine. Please do so if asked.
  • The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.

Let me know How things are doing

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#13 Kalidevi

Kalidevi
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:08:36 PM

Posted 14 September 2012 - 06:21 PM

I ran script. It's still doing the same thing on facebook. This bugger is quite stealthy.

#14 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:09:36 PM

Posted 14 September 2012 - 06:41 PM

Hello Kalidevi



In which browser does this happen


gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#15 Kalidevi

Kalidevi
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:08:36 PM

Posted 14 September 2012 - 09:37 PM

Happy Friday, Gringo!

Firefox.

Hari Om!
Kalidevi




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users