Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

ZeroAccess rootkit infection?


  • This topic is locked This topic is locked
25 replies to this topic

#1 VVerbon

VVerbon

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:03:18 AM

Posted 06 August 2013 - 08:24 AM

When I run Rkill.exe it gives me two alerts:

ALERT: ZEROACCESS rootkit symptoms found!

ALERT: ZEROACCESS Reparse Point/Junction found!

(and a whole list of things)

I have tried all sorts of things for the past days but cannot seem to get rid of this. Don't really notice much on my PC, just that I cannot download any file in IE, it keeps giving the message that the file contains a virus and is deleted (annoying though...). In Chrome I can download stuff. I have run various malware scanners, most of them don't show up anything. Spyhunter (paid version) keeps finding an 'unknown rootkit' with a file GoogleUpdate.exe. It cannot however delete it, everytime it keeps coming back. I have googled this update.exe and subsequently tried tdsskiller.exe but that one says I am not infected. When I google Zero acces rootkit it gives me other suggestions, so it seems like there are 2 rootkit infections on my pc. Any idea what I can do to get this off my pc?

Any advice is welcome.

Thanx

 

----

 

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16635  BrowserJavaVersion: 10.13.2
Run by Paho at 15:19:43 on 2013-08-06
Microsoft Windows 7 Professional   6.1.7601.1.1252.31.1043.18.4014.1646 [GMT 2:00]
.
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe
C:\Program Files (x86)\Livedrive\Livedrive.exe
C:\Users\Paho\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Livedrive\VSSService.exe
C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe
C:\Windows\System32\svchost.exe -k LPDService
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PrivacyIconClient.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Windows\System32\Notepad.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Windows\System32\MsSpellCheckingFacility.exe
C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
C:\Windows\splwow64.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.paragliding.nl/
uSearch Bar = Preserve
mWinlogon: Userinit = userinit.exe,
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
BHO: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
EB: Developer Tools: {1A6FE369-F28C-4AD9-A3E6-2BCB50807CF1} - C:\Program Files (x86)\Internet Explorer\iedvtool.dll
uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
uRun: [googletalk] C:\Users\Paho\AppData\Roaming\Google\Google Talk\googletalk.exe /autostart
uRun: [HP Officejet Pro 8600 (NET)] "C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe" -deviceID "CN2BOCWGX705KC:NW" -scfn "HP Officejet Pro 8600 (NET)" -AutoStart 1
uRun: [Livedrive] "C:\Program Files (x86)\Livedrive\Livedrive.exe" /setup
mRun: [IMSS] "C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
mRun: [emsisoft anti-malware] "c:\program files (x86)\emsisoft anti-malware\a2guard.exe" /d=60
StartupFolder: C:\Users\Paho\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\Paho\AppData\Roaming\Dropbox\bin\Dropbox.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:221
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
TCP: Interfaces\{99BB2B3D-3C4A-403E-B2A7-FA266FE21917} : NameServer = 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
SSODL: WebCheck - <orphaned>
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll
STS: Virtual Storage Mount Notification - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-mStart Page = about:blank
x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-BHO: BrowserHelper Class: {EDF48A39-1442-463F-9F4E-F376A78D034A} - C:\Program Files (x86)\Livedrive\ExplorerExtensions.dll
x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
x64-SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\System32\CbFsMntNtf3.dll
x64-STS: Virtual Storage Mount Notification - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\System32\CbFsMntNtf3.dll
.
============= SERVICES / DRIVERS ===============
.
R1 A2DDA;A2 Direct Disk Access Support Driver;C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [2013-8-6 26176]
R1 a2injectiondriver;a2injectiondriver;C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [2013-8-6 44688]
R1 a2util;a-squared Malware-IDS utility driver;C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [2013-8-6 17384]
R1 CbFs;CbFs;C:\Windows\System32\drivers\cbfs.sys [2012-3-20 191960]
R1 cbfs3;cbfs3;C:\Windows\System32\drivers\cbfs3.sys [2013-4-3 352008]
R2 a2AntiMalware;Emsisoft Anti-Malware 8.0 - Service;C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [2013-8-6 2938408]
R2 LivedriveVSSService;Livedrive VSS Service;C:\Program Files (x86)\Livedrive\VSSService.exe [2013-5-15 210584]
R2 SpyHunter 4 Service;SpyHunter 4 Service;C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [2013-6-27 1025408]
R2 TeamViewer8;TeamViewer 8;C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [2013-1-28 3467768]
R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2012-3-14 2655768]
R3 a2acc;a2acc;C:\Program Files (x86)\Emsisoft Anti-Malware\a2accx64.sys [2013-8-6 66320]
R3 cleanhlp;cleanhlp;C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [2013-8-6 57032]
R3 esgiguard;esgiguard;C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [2011-3-2 13088]
R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2011-9-28 317440]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2011-2-10 82432]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2011-2-10 181760]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 dmvsc;dmvsc;C:\Windows\System32\drivers\dmvsc.sys [2011-4-12 71168]
S3 EsgScanner;EsgScanner;C:\Windows\System32\drivers\EsgScanner.sys [2013-8-6 22704]
S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 27136]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-21 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-21 31232]
S3 WatAdminSvc;Windows Activation Technologies-service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-3-13 1255736]
.
=============== Created Last 30 ================
.
2013-08-06 11:33:20 22704 ----a-w- C:\Windows\System32\drivers\EsgScanner.sys
2013-08-06 11:33:15 110080 ----a-r- C:\Users\Paho\AppData\Roaming\Microsoft\Installer\{8AE3CFB6-78B2-4F55-A7BE-618FCFF43A03}\IconF7A21AF7.exe
2013-08-06 11:33:15 110080 ----a-r- C:\Users\Paho\AppData\Roaming\Microsoft\Installer\{8AE3CFB6-78B2-4F55-A7BE-618FCFF43A03}\IconD7F16134.exe
2013-08-06 11:33:15 110080 ----a-r- C:\Users\Paho\AppData\Roaming\Microsoft\Installer\{8AE3CFB6-78B2-4F55-A7BE-618FCFF43A03}\Icon1226A4C5.exe
2013-08-06 11:20:26 27256 ----a-w- C:\Windows\System32\drivers\FixZeroAccess.sys
2013-08-06 10:09:17 -------- d-----w- C:\Program Files (x86)\Emsisoft Anti-Malware
2013-08-01 12:46:16 -------- d-----w- C:\sh4ldr
2013-08-01 12:46:16 -------- d-----w- C:\Program Files (x86)\Enigma Software Group
2013-08-01 12:40:38 -------- d-----w- C:\Users\Paho\AppData\Roaming\Philipp Winterberg
2013-08-01 12:02:57 -------- d-----w- C:\Program Files\Enigma Software Group
2013-08-01 12:01:31 -------- d-----w- C:\Windows\System32\appmgmt
2013-08-01 12:01:10 -------- d-----w- C:\Windows\8AE3CFB678B24F55A7BE618FCFF43A03.TMP
2013-08-01 12:01:10 -------- d-----w- C:\Program Files (x86)\Common Files\Wise Installation Wizard
2013-08-01 11:49:31 -------- d-----w- C:\Program Files (x86)\ESET
2013-08-01 11:10:48 -------- d-----w- C:\Users\Paho\AppData\Roaming\Malwarebytes
2013-08-01 11:10:39 -------- d-----w- C:\ProgramData\Malwarebytes
2013-08-01 11:10:37 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-01 09:53:58 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
2013-08-01 09:52:54 17272 ----a-w- C:\Windows\System32\sdnclean64.exe
2013-08-01 09:52:49 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-08-01 09:25:24 -------- d-----w- C:\Users\Paho\AppData\Local\FuzeZip
2013-07-31 09:04:43 -------- d-----w- C:\Users\Paho\AppData\Roaming\Wise Registry Cleaner
2013-07-31 09:04:29 -------- d-----w- C:\Program Files (x86)\Wise
2013-07-31 09:04:19 -------- d-----w- C:\Users\Paho\AppData\Local\Programs
2013-07-31 09:01:29 -------- d-----w- C:\Program Files\CCleaner
2013-07-31 08:45:52 -------- d-----w- C:\ProgramData\BDLogging
2013-07-31 08:45:30 511328 ----a-w- C:\Windows\capicom.dll
2013-07-31 08:45:28 1721576 ----a-w- C:\Windows\System32\WdfCoInstaller01009.dll
2013-07-31 08:31:25 -------- d-----w- C:\Program Files\Common Files\Bitdefender
2013-07-31 08:30:31 -------- d-----w- C:\Users\Paho\AppData\Roaming\QuickScan
2013-07-30 06:56:26 9460976 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A9AE7100-27F6-4B82-85A4-111D466D961F}\mpengine.dll
2013-07-17 06:49:11 -------- d-----w- C:\Users\Paho\AppData\Roaming\Ysrip
2013-07-17 06:49:11 -------- d-----w- C:\Users\Paho\AppData\Roaming\Cyduaz
2013-07-11 15:45:59 817664 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
2013-07-11 15:45:59 1767936 ----a-w- C:\Windows\SysWow64\wininet.dll
2013-07-11 15:45:59 1084928 ----a-w- C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll
2013-07-11 15:45:59 108032 ----a-w- C:\Program Files (x86)\Internet Explorer\jsdebuggeride.dll
2013-07-11 15:45:58 2241024 ----a-w- C:\Windows\System32\wininet.dll
2013-07-11 08:00:18 1643520 ----a-w- C:\Windows\System32\DWrite.dll
2013-07-11 08:00:18 1247744 ----a-w- C:\Windows\SysWow64\DWrite.dll
.
==================== Find3M  ====================
.
2013-06-12 10:43:06 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-12 10:43:06 692104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-06-11 23:43:00 2877440 ----a-w- C:\Windows\SysWow64\jscript9.dll
2013-06-11 23:42:58 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll
2013-06-11 23:42:58 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll
2013-06-11 23:25:16 3958784 ----a-w- C:\Windows\System32\jscript9.dll
2013-06-11 23:25:13 67072 ----a-w- C:\Windows\System32\iesetup.dll
2013-06-11 23:25:13 136704 ----a-w- C:\Windows\System32\iesysprep.dll
2013-06-11 22:51:45 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe
2013-06-11 22:50:58 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-07 03:22:18 2706432 ----a-w- C:\Windows\System32\mshtml.tlb
2013-06-07 02:37:52 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2013-06-05 03:34:27 3153920 ----a-w- C:\Windows\System32\win32k.sys
2013-06-04 06:00:13 624128 ----a-w- C:\Windows\System32\qedit.dll
2013-06-04 04:53:07 509440 ----a-w- C:\Windows\SysWow64\qedit.dll
2013-05-13 05:51:01 184320 ----a-w- C:\Windows\System32\cryptsvc.dll
2013-05-13 05:51:00 1464320 ----a-w- C:\Windows\System32\crypt32.dll
2013-05-13 05:51:00 139776 ----a-w- C:\Windows\System32\cryptnet.dll
2013-05-13 05:50:40 52224 ----a-w- C:\Windows\System32\certenc.dll
2013-05-13 04:45:55 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll
2013-05-13 04:45:55 1160192 ----a-w- C:\Windows\SysWow64\crypt32.dll
2013-05-13 04:45:55 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll
2013-05-13 03:43:55 1192448 ----a-w- C:\Windows\System32\certutil.exe
2013-05-13 03:08:10 903168 ----a-w- C:\Windows\SysWow64\certutil.exe
2013-05-13 03:08:06 43008 ----a-w- C:\Windows\SysWow64\certenc.dll
2013-05-10 05:49:27 30720 ----a-w- C:\Windows\System32\cryptdlg.dll
2013-05-10 03:20:54 24576 ----a-w- C:\Windows\SysWow64\cryptdlg.dll
.
============= FINISH: 15:20:08,36 ===============
 

 

Attached Files



BC AdBot (Login to Remove)

 


#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:09:18 PM

Posted 06 August 2013 - 11:20 AM


Hello VVerbon

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.


Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

  • Please do not run any tools unless instructed to do so.
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
  • Please do not attach logs or use code boxes, just copy and paste the text.
    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
  • Please read every post completely before doing anything.
    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
  • Please provide feedback about your experience as we go.
    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.
NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.


These are the programs I would like you to run next, if you have any problems with one of these just skip it and move on to the next one.

-AdwCleaner-

Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Delete.
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
-Junkware-Removal-Tool-

Please download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
When they are complete let me have the two reports and let me know how things are running.

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 VVerbon

VVerbon
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:03:18 AM

Posted 07 August 2013 - 08:35 AM

Hi Gringo,

 

Appreciate your help, thanks.

 

Downloaded Adw cleaner, this is the result:

 

# AdwCleaner v2.306 - Verslag gemaakt op 07/08/2013 om 15:18:29
# Geactualiseerd op 19/07/2013 door Xplode
# Besturingssysteem : Windows 7 Professional Service Pack 1 (64 bits)
# Gebruiker : Paho - PAHO-PC
# Opstarten Modus : Normale modus
# Gelanceerd vanaf : C:\Users\Paho\Downloads\AdwCleaner.exe
# Optie [Verwijderen]

***** [Diensten] *****

***** [Files / Mappen] *****

***** [Register] *****

Sleutel Verwijderd : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Sleutel Verwijderd : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Sleutel Verwijderd : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Sleutel Verwijderd : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Sleutel Verwijderd : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Sleutel Verwijderd : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3614D305-2DBB-4991-9297-750DD60FFC73}
Sleutel Verwijderd : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Sleutel Verwijderd : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Sleutel Verwijderd : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

***** [Browsers] *****

-\\ Internet Explorer v10.0.9200.16635

[OK] Het register bevat geen enkele ongeoorloofde invoer.

-\\ Google Chrome v28.0.1500.95

File : C:\Users\Paho\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] De file bevat geen enkele ongeoorloofde invoer.

*************************

AdwCleaner[S1].txt - [1676 octets] - [07/08/2013 15:18:29]

########## EOF - C:\AdwCleaner[S1].txt - [1736 octets] ##########

 

It switched to dutch language as you can see.

 

Verwijderd = deleted

De file bevat geen enkele ongeoorloofde invoer = The file did not contain any unauthorised input

 

Tried to run the JRT.exe but that program doesn't seem to work. Run as admin or run in a normal way: for a split second a black window appears and then it closes down, apart from that nothing seems to happen. Or is that all that should happen and I just have to wait?

 

Computer is running quite smoothly but still cannot download anything in IE.

 

Regards,

 

Vincent



#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:09:18 PM

Posted 07 August 2013 - 11:31 AM


Hello Vincent

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"
  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#5 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:09:18 PM

Posted 10 August 2013 - 01:00 AM



Hello

48 Hour bump

It has been more than 48 hours since my last post.
  • do you still need help with this?
  • do you need more time?
  • are you having problems following my instructions?
  • if after 48hrs you have not replied to this thread then it will have to be closed!
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#6 VVerbon

VVerbon
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:03:18 AM

Posted 10 August 2013 - 10:05 AM

Hi Gringo,

 

Sorry for my late reply, I wasn't home for the last two days.

 

I have a laptop running next to the main comp so I can always see the instructions, no worries.

 

I ran Combofix.exe, pls see below for the report:

 

 

ComboFix 13-08-09.02 - Paho 10-08-2013  16:48:54.1.4 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.31.1043.18.4014.2932 [GMT 2:00]
Gestart vanuit: c:\users\Paho\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Nieuw herstelpunt werd aangemaakt
.
.
((((((((((((((((((((((((((((((((((   Andere Verwijderingen   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Paho\AppData\Roaming\Cyduaz
c:\users\Paho\AppData\Roaming\Cyduaz\asem.odd
c:\windows\wininit.ini
.
.
((((((((((((((((((((   Bestanden Gemaakt van 2013-07-10 to 2013-08-10  ))))))))))))))))))))))))))))))
.
.
2013-08-10 14:51 . 2013-08-10 14:51 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-08-07 11:49 . 2013-08-07 11:49 -------- d-----w- c:\program files (x86)\Livedrive
2013-08-07 11:49 . 2013-08-07 11:49 -------- d-----w- C:\AI_RecycleBin
2013-08-07 09:04 . 2013-08-07 13:24 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird
2013-08-01 12:01 . 2013-08-01 12:01 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard
2013-08-01 11:49 . 2013-08-02 19:06 -------- d-----w- c:\program files (x86)\ESET
2013-08-01 11:10 . 2013-08-01 11:10 -------- d-----w- c:\users\Paho\AppData\Roaming\Malwarebytes
2013-08-01 11:10 . 2013-08-02 19:06 -------- d-----w- c:\programdata\Malwarebytes
2013-08-01 11:10 . 2013-08-06 11:06 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-08-01 09:53 . 2013-08-01 10:14 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2013-08-01 09:52 . 2009-01-25 11:14 17272 ----a-w- c:\windows\system32\sdnclean64.exe
2013-08-01 09:52 . 2013-08-06 12:16 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2
2013-08-01 09:25 . 2013-08-01 09:26 -------- d-----w- c:\users\Paho\AppData\Local\FuzeZip
2013-07-31 09:04 . 2013-08-05 07:33 -------- d-----w- c:\users\Paho\AppData\Roaming\Wise Registry Cleaner
2013-07-31 09:04 . 2013-08-02 19:06 -------- d-----w- c:\program files (x86)\Wise
2013-07-31 09:04 . 2013-07-31 09:04 -------- d-----w- c:\users\Paho\AppData\Local\Programs
2013-07-31 09:01 . 2013-08-02 19:06 -------- d-----w- c:\program files\CCleaner
2013-07-31 08:45 . 2013-07-31 08:45 -------- d-----w- c:\programdata\BDLogging
2013-07-31 08:45 . 2007-04-11 09:11 511328 ----a-w- c:\windows\capicom.dll
2013-07-31 08:45 . 2009-07-14 23:21 1721576 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
2013-07-31 08:31 . 2013-07-31 08:52 -------- d-----w- c:\program files\Common Files\Bitdefender
2013-07-31 08:30 . 2013-07-31 08:30 -------- d-----w- c:\users\Paho\AppData\Roaming\QuickScan
2013-07-30 06:56 . 2013-07-02 08:34 9460976 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A9AE7100-27F6-4B82-85A4-111D466D961F}\mpengine.dll
2013-07-17 06:49 . 2013-08-01 11:13 -------- d-----w- c:\users\Paho\AppData\Roaming\Ysrip
2013-07-11 15:45 . 2013-06-11 23:43 1767936 ----a-w- c:\windows\SysWow64\wininet.dll
2013-07-11 15:45 . 2013-06-11 23:43 817664 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
2013-07-11 15:45 . 2013-06-11 23:43 108032 ----a-w- c:\program files (x86)\Internet Explorer\jsdebuggeride.dll
2013-07-11 15:45 . 2013-06-11 23:26 1084928 ----a-w- c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
2013-07-11 15:45 . 2013-06-11 23:26 1365504 ----a-w- c:\windows\system32\urlmon.dll
2013-07-11 15:45 . 2013-06-11 23:25 53248 ----a-w- c:\windows\system32\jsproxy.dll
2013-07-11 15:45 . 2013-06-11 23:26 2241024 ----a-w- c:\windows\system32\wininet.dll
2013-07-11 15:45 . 2013-06-11 23:25 19238912 ----a-w- c:\windows\system32\mshtml.dll
2013-07-11 15:45 . 2013-06-11 23:25 15404032 ----a-w- c:\windows\system32\ieframe.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((   Find3M Rapport   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-12 10:43 . 2012-04-11 06:54 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-12 10:43 . 2012-03-16 14:42 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-05 03:34 . 2013-07-11 08:01 3153920 ----a-w- c:\windows\system32\win32k.sys
2013-06-04 06:00 . 2013-07-11 08:01 624128 ----a-w- c:\windows\system32\qedit.dll
2013-06-04 04:53 . 2013-07-11 08:01 509440 ----a-w- c:\windows\SysWow64\qedit.dll
2013-05-13 05:51 . 2013-06-12 07:11 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2013-05-13 05:51 . 2013-06-12 07:11 1464320 ----a-w- c:\windows\system32\crypt32.dll
2013-05-13 05:51 . 2013-06-12 07:11 139776 ----a-w- c:\windows\system32\cryptnet.dll
2013-05-13 05:50 . 2013-06-12 07:11 52224 ----a-w- c:\windows\system32\certenc.dll
2013-05-13 04:45 . 2013-06-12 07:11 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2013-05-13 04:45 . 2013-06-12 07:11 1160192 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-05-13 04:45 . 2013-06-12 07:11 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2013-05-13 03:43 . 2013-06-12 07:11 1192448 ----a-w- c:\windows\system32\certutil.exe
2013-05-13 03:08 . 2013-06-12 07:11 903168 ----a-w- c:\windows\SysWow64\certutil.exe
2013-05-13 03:08 . 2013-06-12 07:11 43008 ----a-w- c:\windows\SysWow64\certenc.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Opstartpunten   )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Paho\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Paho\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Paho\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Paho\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EldosIconOverlay]
@="{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}"
[HKEY_CLASSES_ROOT\CLSID\{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}]
2012-11-10 08:55 158056 ----a-w- c:\windows\SysWOW64\CbFsMntNtf3.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-03-16 39408]
"googletalk"="c:\users\Paho\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"HP Officejet Pro 8600 (NET)"="c:\program files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe" [2011-09-09 2676584]
"Livedrive"="c:\program files (x86)\Livedrive\Livedrive.exe" [2013-07-29 1814680]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IMSS"="c:\program files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe" [2010-10-08 112152]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2012-01-03 36760]
"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2012-01-03 815512]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-03-24 49208]
"emsisoft anti-malware"="c:\program files (x86)\emsisoft anti-malware\a2guard.exe" [2013-07-02 2928040]
.
c:\users\Paho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Paho\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ   autocheck autochk *\0\0sdnclean64.exe
.
R2 ?etadpug;Google Update Service (gupdate);c:\program files (x86)\Google\Desktop\Install\{69770430-264e-085f-8b99-b47a89b497cc}\   \...\???\{69770430-264e-085f-8b99-b47a89b497cc}\GoogleUpdate.exe <;c:\program files (x86)\Google\Desktop\Install\{69770430-264e-085f-8b99-b47a89b497cc}\   \...\???\{69770430-264e-085f-8b99-b47a89b497cc}\GoogleUpdate.exe < [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 gupdate;Google Update-service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 EsgScanner;EsgScanner;c:\windows\system32\DRIVERS\EsgScanner.sys;c:\windows\SYSNATIVE\DRIVERS\EsgScanner.sys [x]
R3 gupdatem;Google Update-service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows Activation Technologies-service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S1 A2DDA;A2 Direct Disk Access Support Driver;c:\program files (x86)\Emsisoft Anti-Malware\a2ddax64.sys;c:\program files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [x]
S1 a2injectiondriver;a2injectiondriver;c:\program files (x86)\Emsisoft Anti-Malware\a2dix64.sys;c:\program files (x86)\Emsisoft Anti-Malware\a2dix64.sys [x]
S1 a2util;a-squared Malware-IDS utility driver;c:\program files (x86)\Emsisoft Anti-Malware\a2util64.sys;c:\program files (x86)\Emsisoft Anti-Malware\a2util64.sys [x]
S1 CbFs;CbFs;c:\windows\system32\drivers\cbfs.sys;c:\windows\SYSNATIVE\drivers\cbfs.sys [x]
S1 cbfs3;cbfs3;c:\windows\system32\drivers\cbfs3.sys;c:\windows\SYSNATIVE\drivers\cbfs3.sys [x]
S2 a2AntiMalware;Emsisoft Anti-Malware 8.0 - Service;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe [x]
S2 LivedriveVSSService;Livedrive VSS Service;c:\program files (x86)\Livedrive\VSSService.exe;c:\program files (x86)\Livedrive\VSSService.exe [x]
S2 SpyHunter 4 Service;SpyHunter 4 Service;c:\progra~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE;c:\progra~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [x]
S3 a2acc;a2acc;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [x]
S3 cleanhlp;cleanhlp;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [x]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
.
.
--- Andere Services/Drivers In Geheugen ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-08-05 08:21 1173456 ----a-w- c:\program files (x86)\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe
.
Inhoud van de 'Gedeelde Taken' map
.
2013-08-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 10:43]
.
2013-08-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-16 13:31]
.
2013-08-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-16 13:31]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BackupOverlay]
@="{B44A5D93-1351-41A1-BD91-5E92435D8ECD}"
[HKEY_CLASSES_ROOT\CLSID\{B44A5D93-1351-41A1-BD91-5E92435D8ECD}]
2013-07-29 09:38 1245848 ----a-w- c:\program files (x86)\Livedrive\Extensions.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Paho\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Paho\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Paho\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Paho\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EldosIconOverlay]
@="{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}"
[HKEY_CLASSES_ROOT\CLSID\{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}]
2012-11-10 08:55 190312 ----a-w- c:\windows\System32\CbFsMntNtf3.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\LivedriveDownloadOverlay]
@="{CBCDB610-6B68-4EE9-B7A2-1282FD0C9292}"
[HKEY_CLASSES_ROOT\CLSID\{CBCDB610-6B68-4EE9-B7A2-1282FD0C9292}]
2013-07-29 09:38 1245848 ----a-w- c:\program files (x86)\Livedrive\Extensions.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\LivedriveSharedOverlay]
@="{84CEF1E4-1356-4063-845F-05047F4DD52C}"
[HKEY_CLASSES_ROOT\CLSID\{84CEF1E4-1356-4063-845F-05047F4DD52C}]
2013-07-29 09:38 1245848 ----a-w- c:\program files (x86)\Livedrive\Extensions.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\LivedriveSyncedOverlay]
@="{42058329-2FBF-4B33-8E52-3BE5754DE0C1}"
[HKEY_CLASSES_ROOT\CLSID\{42058329-2FBF-4B33-8E52-3BE5754DE0C1}]
2013-07-29 09:38 1245848 ----a-w- c:\program files (x86)\Livedrive\Extensions.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\LivedriveUploadOverlay]
@="{39A1715A-E4CD-4F1E-B5C4-36B5DB80124E}"
[HKEY_CLASSES_ROOT\CLSID\{39A1715A-E4CD-4F1E-B5C4-36B5DB80124E}]
2013-07-29 09:38 1245848 ----a-w- c:\program files (x86)\Livedrive\Extensions.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-08-26 12681320]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-02-14 170264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-02-14 398616]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-02-14 440600]
.
------- Bijkomende Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.paragliding.nl/
mLocal Page = c:\windows\SYSTEM32\blank.htm
TCP: Interfaces\{99BB2B3D-3C4A-403E-B2A7-FA266FE21917}: NameServer = 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
.
- - - - ORPHANS VERWIJDERD - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
SafeBoot-35546836.sys
SafeBoot-CleanHlp
SafeBoot-CleanHlp.sys
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
WebBrowser-{87775FDB-6972-41F9-AE51-8326E38CB206} - (no file)
.
.
Binary file temp00 matches
.
--------------------- VERGRENDELDE REGISTER SLEUTELS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Andere Aktieve Processen ------------------------
.
c:\users\Paho\AppData\Roaming\Dropbox\bin\Dropbox.exe
c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Common Files\Java\Java Update\jucheck.exe
.
**************************************************************************
.
Voltooingstijd: 2013-08-10  16:59:35 - machine werd herstart
ComboFix-quarantined-files.txt  2013-08-10 14:59
.
Pre-Run: 18.437.218.304 bytes beschikbaar
Post-Run: 18.303.995.904 bytes beschikbaar
.
- - End Of File - - 6A43D459FD21F8FAB1436AA0CBC07180
D41D8CD98F00B204E9800998ECF8427E
 

As before I don't notice much but unfortunately still cannot download a single file through IE.

 

Thanks,

 

Vincent

 



#7 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:09:18 PM

Posted 10 August 2013 - 12:39 PM


Hello Vincent



Please download Farbar Recovery Scan Tool and save it to your desktop.


Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#8 VVerbon

VVerbon
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:03:18 AM

Posted 12 August 2013 - 06:56 AM

Pls see below for a copy of FRST.txt and Addition.txt as requested.

 

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-08-2013 02
Ran by Paho (administrator) on 12-08-2013 13:51:27
Running from C:\Users\Paho\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: Dutch Standard
Internet Explorer Version 10
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(Enigma Software Group USA, LLC.) C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE
() C:\Program Files (x86)\Livedrive\VSSService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Google) C:\Users\Paho\AppData\Roaming\Google\Google Talk\googletalk.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe
(Livedrive Internet Ltd) C:\Program Files (x86)\Livedrive\Livedrive.exe
(Dropbox, Inc.) C:\Users\Paho\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PrivacyIconClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
 
==================== Registry (Whitelisted) ==================
 
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12681320 2011-08-26] (Realtek Semiconductor)
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-03-16] (Google Inc.)
HKCU\...\Run: [googletalk] - C:\Users\Paho\AppData\Roaming\Google\Google Talk\googletalk.exe [3739648 2007-01-01] (Google)
HKCU\...\Run: [HP Officejet Pro 8600 (NET)] - C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe [2676584 2011-09-09] (Hewlett-Packard Co.)
HKCU\...\Run: [Livedrive] - C:\Program Files (x86)\Livedrive\Livedrive.exe [1814680 2013-07-29] (Livedrive Internet Ltd)
HKLM-x32\...\Run: [IMSS] - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe [112152 2010-10-08] (Intel Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-01-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [36760 2012-01-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [815512 2012-01-03] (Adobe Systems Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-03-24] (Hewlett-Packard)
HKLM-x32\...\Run: [emsisoft anti-malware] - c:\program files (x86)\emsisoft anti-malware\a2guard.exe [2928040 2013-07-02] (Emsisoft GmbH)
Startup: C:\Users\Paho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Paho\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\Windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
BootExecute: autocheck autochk * sdnclean64.exe
 
==================== Internet (Whitelisted) ====================
 
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.paragliding.nl/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: BrowserHelper Class - {EDF48A39-1442-463F-9F4E-F376A78D034A} - C:\Program Files (x86)\Livedrive\ExplorerExtensions.dll (Livedrive Internet Ltd)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - No Name - {87775FDB-6972-41F9-AE51-8326E38CB206} -  No File
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 195.241.77.55 195.241.77.58
 
Chrome: 
=======
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Java™ Platform SE 7 U13) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Java Deployment Toolkit 7.0.130.20) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Extension: (Google Docs) - C:\Users\Paho\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\Paho\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\Paho\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Paho\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Gmail) - C:\Users\Paho\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM-x32\...\Chrome\Extension: [cjofdnhdkbflacojpfpkchgafjahijbb] - C:\Users\Paho\AppData\Local\Temp\ccex.crx
CHR StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
==================== Services (Whitelisted) =================
 
R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [2938408 2013-07-02] (Emsisoft GmbH)
R2 LivedriveVSSService; C:\Program Files (x86)\Livedrive\VSSService.exe [210584 2013-07-29] ()
R2 LPDSVC; C:\Windows\system32\lpdsvc.dll [45568 2009-07-14] (Microsoft Corporation)
R2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [1025408 2013-06-27] (Enigma Software Group USA, LLC.)
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] ()
U2 *etadpug; "C:\Program Files (x86)\Google\Desktop\Install\{69770430-264e-085f-8b99-b47a89b497cc}\   \...\???\{69770430-264e-085f-8b99-b47a89b497cc}\GoogleUpdate.exe" < <==== ATTENTION (ZeroAccess)
 
==================== Drivers (Whitelisted) ====================
 
R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [66320 2012-04-30] (Emsisoft GmbH)
R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [66320 2012-04-30] (Emsisoft GmbH)
R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH)
R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH)
R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [44688 2012-04-30] (Emsisoft GmbH)
R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [44688 2012-04-30] (Emsisoft GmbH)
R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [17384 2013-03-28] (Emsisoft GmbH)
R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [17384 2013-03-28] (Emsisoft GmbH)
R1 CbFs; C:\Windows\system32\drivers\cbfs.sys [191960 2010-02-16] (EldoS Corporation)
R1 CbFs; C:\Windows\system32\drivers\cbfs.sys [191960 2010-02-16] (EldoS Corporation)
R1 cbfs3; C:\Windows\system32\drivers\cbfs3.sys [352008 2012-11-10] (EldoS Corporation)
R3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57032 2013-07-02] (Emsisoft GmbH)
R3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57032 2013-07-02] (Emsisoft GmbH)
R3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
R3 TPM; C:\Windows\System32\DRIVERS\tpm.sys [27136 2008-02-10] (Winbond Electronics Corp.)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
 
==================== NetSvcs (Whitelisted) ===================
 
 
==================== One Month Created Files and Folders ========
 
2013-08-12 13:50 - 2013-08-12 13:50 - 01575246 _____ (Farbar) C:\Users\Paho\Desktop\FRST64.exe
2013-08-10 16:59 - 2013-08-10 16:59 - 00023510 _____ C:\ComboFix.txt
2013-08-10 16:47 - 2013-08-10 16:59 - 00000000 ____D C:\Qoobox
2013-08-10 16:47 - 2013-08-10 16:59 - 00000000 ____D C:\ComboFix
2013-08-10 16:47 - 2013-08-10 16:55 - 00000000 ____D C:\Windows\erdnt
2013-08-10 16:47 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-10 16:47 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-10 16:47 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-10 16:47 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-10 16:47 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-10 16:47 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-10 16:47 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-10 16:47 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-10 16:46 - 2013-08-10 16:46 - 05102523 ____R (Swearware) C:\Users\Paho\Desktop\ComboFix.exe
2013-08-10 16:45 - 2013-08-10 16:46 - 05102523 _____ (Swearware) C:\Users\Paho\Downloads\ComboFix.exe
2013-08-07 15:31 - 2013-08-07 15:31 - 00003110 _____ C:\Windows\System32\Tasks\{AF57EA69-FCB4-4B65-AB4F-2521CC6BD65B}
2013-08-07 15:30 - 2013-08-07 15:30 - 00563461 _____ (Oleg N. Scherbakov) C:\Users\Paho\Desktop\JRT (1).exe
2013-08-07 15:30 - 2013-08-07 15:30 - 00003118 _____ C:\Windows\System32\Tasks\{4DD9A82F-7C24-46BC-8C99-7FE00303AE9C}
2013-08-07 15:25 - 2013-08-07 15:25 - 00563461 _____ (Oleg N. Scherbakov) C:\Users\Paho\Downloads\JRT.exe
2013-08-07 15:22 - 2013-08-07 15:22 - 00001799 _____ C:\Users\Paho\Desktop\AdwCleaner[S1].txt
2013-08-07 15:18 - 2013-08-07 15:18 - 00001799 _____ C:\AdwCleaner[S1].txt
2013-08-07 15:17 - 2013-08-07 15:17 - 00666633 _____ C:\Users\Paho\Downloads\AdwCleaner.exe
2013-08-07 13:49 - 2013-08-07 13:49 - 00000000 ____D C:\Program Files (x86)\Livedrive
2013-08-07 13:49 - 2013-08-07 13:49 - 00000000 ____D C:\AI_RecycleBin
2013-08-07 11:04 - 2013-08-07 15:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-06 15:18 - 2013-08-06 15:18 - 00688992 ____R (Swearware) C:\Users\Paho\Desktop\dds.com
2013-08-06 14:16 - 2013-08-10 16:53 - 00002852 _____ C:\Windows\PFRO.log
2013-08-06 13:33 - 2013-08-06 13:33 - 00003320 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2013-08-06 13:33 - 2013-08-06 13:33 - 00002252 _____ C:\Users\Paho\Desktop\SpyHunter.lnk
2013-08-06 13:33 - 2013-08-06 13:33 - 00000000 ____D C:\Users\Paho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-08-06 13:33 - 2012-06-22 12:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2013-08-06 13:20 - 2013-08-06 13:20 - 00027256 _____ (Symantec Corporation) C:\Windows\system32\Drivers\FixZeroAccess.sys
2013-08-06 13:19 - 2013-08-06 13:19 - 01805736 _____ (Symantec Corporation) C:\Users\Paho\Downloads\FixZeroAccess.exe
2013-08-06 13:11 - 2013-08-12 09:13 - 00000672 _____ C:\Windows\setupact.log
2013-08-06 13:11 - 2013-08-06 13:11 - 00000000 _____ C:\Windows\setuperr.log
2013-08-06 12:54 - 2013-08-06 12:54 - 01893504 _____ (Bleeping Computer, LLC) C:\Users\Paho\Downloads\rkill.exe
2013-08-06 12:37 - 2013-08-06 12:37 - 02240864 _____ (Kaspersky Lab ZAO) C:\Users\Paho\Downloads\tdsskiller.exe
2013-08-06 12:10 - 2013-08-06 12:10 - 00001091 _____ C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2013-08-06 12:09 - 2013-08-12 13:14 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware
2013-08-06 12:09 - 2013-08-06 12:09 - 00000000 ____D C:\Users\Paho\Documents\Anti-Malware
2013-08-06 12:05 - 2013-08-06 12:09 - 187041336 _____ (Emsisoft GmbH                                               ) C:\Users\Paho\Downloads\EmsisoftAntiMalwareSetup.exe
2013-08-02 12:29 - 2013-08-12 11:12 - 00000422 ____N C:\spyhunter.log
2013-08-02 10:30 - 2013-08-12 09:13 - 00000301 _____ C:\sh4_service.log
2013-08-01 15:11 - 2013-08-01 14:56 - 00008192 _____ C:\shldr.mbr
2013-08-01 14:46 - 2013-08-01 14:56 - 00000000 ____D C:\sh4ldr
2013-08-01 14:46 - 2013-08-01 14:46 - 00000000 ____D C:\Program Files (x86)\Enigma Software Group
2013-08-01 14:40 - 2013-08-02 09:50 - 00000000 ____D C:\Users\Paho\AppData\Roaming\Philipp Winterberg
2013-08-01 14:07 - 2013-08-01 14:07 - 00000000 _____ C:\autoexec.bat
2013-08-01 14:04 - 2012-11-02 16:23 - 00285747 _____ C:\shldr
2013-08-01 14:02 - 2013-08-01 14:02 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-08-01 14:01 - 2013-08-06 13:33 - 00000000 ____D C:\Windows\8AE3CFB678B24F55A7BE618FCFF43A03.TMP
2013-08-01 14:01 - 2013-08-01 14:44 - 00000000 ____D C:\Windows\system32\appmgmt
2013-08-01 14:00 - 2013-08-01 14:00 - 00726464 _____ (Enigma Software Group USA, LLC.) C:\Users\Paho\Downloads\SpyHunter-Installer.exe
2013-08-01 13:49 - 2013-08-02 21:06 - 00000000 ____D C:\Program Files (x86)\ESET
2013-08-01 13:10 - 2013-08-06 13:06 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-01 13:10 - 2013-08-02 21:06 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-01 13:10 - 2013-08-01 13:10 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Paho\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-01 13:10 - 2013-08-01 13:10 - 00000000 ____D C:\Users\Paho\AppData\Roaming\Malwarebytes
2013-08-01 11:53 - 2013-08-01 12:14 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-08-01 11:53 - 2013-08-01 11:53 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-08-01 11:52 - 2013-08-06 14:16 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-08-01 11:52 - 2009-01-25 13:14 - 00017272 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2013-08-01 11:50 - 2013-08-01 11:51 - 37672592 _____ (Safer-Networking Ltd.                                       ) C:\Users\Paho\Downloads\spybotsd-2.1.21-SR2.exe
2013-08-01 11:28 - 2013-08-06 13:06 - 00000000 ____D C:\Users\Paho\Downloads\backups
2013-08-01 11:25 - 2013-08-01 11:26 - 00000000 ____D C:\Users\Paho\AppData\Local\FuzeZip
2013-08-01 11:24 - 2013-08-01 11:24 - 00388608 _____ (Trend Micro Inc.) C:\Users\Paho\Downloads\HijackThis.exe
2013-07-31 11:04 - 2013-08-05 09:33 - 00000000 ____D C:\Users\Paho\AppData\Roaming\Wise Registry Cleaner
2013-07-31 11:04 - 2013-08-02 21:06 - 00000000 ____D C:\Program Files (x86)\Wise
2013-07-31 11:04 - 2013-07-31 11:04 - 00001227 _____ C:\Users\Public\Desktop\Wise Registry Cleaner.lnk
2013-07-31 11:01 - 2013-08-02 21:06 - 00000000 ____D C:\Program Files\CCleaner
2013-07-31 11:01 - 2013-07-31 11:01 - 00002770 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-07-31 11:01 - 2013-07-31 11:01 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-07-31 10:46 - 2013-07-31 10:46 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_avchv_01009.Wdf
2013-07-31 10:45 - 2013-07-31 10:45 - 00000000 ____D C:\ProgramData\BDLogging
2013-07-31 10:45 - 2009-07-15 01:21 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01009.dll
2013-07-31 10:45 - 2007-04-11 11:11 - 00511328 _____ (Microsoft Corporation) C:\Windows\capicom.dll
2013-07-31 10:31 - 2013-07-31 10:52 - 00000000 ____D C:\Program Files\Common Files\Bitdefender
2013-07-31 10:30 - 2013-07-31 10:30 - 00000000 ____D C:\Users\Paho\AppData\Roaming\QuickScan
2013-07-17 08:49 - 2013-08-01 13:13 - 00000000 ____D C:\Users\Paho\AppData\Roaming\Ysrip
 
==================== One Month Modified Files and Folders =======
 
2013-08-12 13:50 - 2013-08-12 13:50 - 01575246 _____ (Farbar) C:\Users\Paho\Desktop\FRST64.exe
2013-08-12 13:48 - 2012-03-16 16:10 - 00000000 ___RD C:\Users\Paho\Dropbox
2013-08-12 13:42 - 2012-03-16 16:09 - 00000000 ____D C:\Users\Paho\AppData\Roaming\Dropbox
2013-08-12 13:31 - 2012-03-13 18:42 - 01365895 _____ C:\Windows\WindowsUpdate.log
2013-08-12 13:20 - 2012-03-16 15:31 - 00001052 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-12 13:14 - 2013-08-06 12:09 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware
2013-08-12 13:13 - 2012-04-11 08:54 - 00000940 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-12 12:59 - 2012-03-20 16:02 - 00000000 ___HD C:\Users\Paho\AppData\Local\Livedrive
2013-08-12 11:12 - 2013-08-02 12:29 - 00000422 ____N C:\spyhunter.log
2013-08-12 09:21 - 2009-07-14 06:45 - 00022080 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-12 09:21 - 2009-07-14 06:45 - 00022080 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-12 09:19 - 2011-04-12 15:00 - 00711650 _____ C:\Windows\system32\perfh013.dat
2013-08-12 09:19 - 2011-04-12 15:00 - 00138500 _____ C:\Windows\system32\perfc013.dat
2013-08-12 09:19 - 2009-07-14 07:13 - 01578096 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-12 09:13 - 2013-08-06 13:11 - 00000672 _____ C:\Windows\setupact.log
2013-08-12 09:13 - 2013-08-02 10:30 - 00000301 _____ C:\sh4_service.log
2013-08-12 09:13 - 2012-03-16 15:31 - 00001048 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-12 09:13 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-12 08:37 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-08-10 16:59 - 2013-08-10 16:59 - 00023510 _____ C:\ComboFix.txt
2013-08-10 16:59 - 2013-08-10 16:47 - 00000000 ____D C:\Qoobox
2013-08-10 16:59 - 2013-08-10 16:47 - 00000000 ____D C:\ComboFix
2013-08-10 16:55 - 2013-08-10 16:47 - 00000000 ____D C:\Windows\erdnt
2013-08-10 16:53 - 2013-08-06 14:16 - 00002852 _____ C:\Windows\PFRO.log
2013-08-10 16:53 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-08-10 16:47 - 2009-07-14 07:08 - 00032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-10 16:46 - 2013-08-10 16:46 - 05102523 ____R (Swearware) C:\Users\Paho\Desktop\ComboFix.exe
2013-08-10 16:46 - 2013-08-10 16:45 - 05102523 _____ (Swearware) C:\Users\Paho\Downloads\ComboFix.exe
2013-08-08 09:00 - 2012-10-16 12:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-07 15:31 - 2013-08-07 15:31 - 00003110 _____ C:\Windows\System32\Tasks\{AF57EA69-FCB4-4B65-AB4F-2521CC6BD65B}
2013-08-07 15:30 - 2013-08-07 15:30 - 00563461 _____ (Oleg N. Scherbakov) C:\Users\Paho\Desktop\JRT (1).exe
2013-08-07 15:30 - 2013-08-07 15:30 - 00003118 _____ C:\Windows\System32\Tasks\{4DD9A82F-7C24-46BC-8C99-7FE00303AE9C}
2013-08-07 15:25 - 2013-08-07 15:25 - 00563461 _____ (Oleg N. Scherbakov) C:\Users\Paho\Downloads\JRT.exe
2013-08-07 15:24 - 2013-08-07 11:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-07 15:22 - 2013-08-07 15:22 - 00001799 _____ C:\Users\Paho\Desktop\AdwCleaner[S1].txt
2013-08-07 15:18 - 2013-08-07 15:18 - 00001799 _____ C:\AdwCleaner[S1].txt
2013-08-07 15:17 - 2013-08-07 15:17 - 00666633 _____ C:\Users\Paho\Downloads\AdwCleaner.exe
2013-08-07 13:49 - 2013-08-07 13:49 - 00000000 ____D C:\Program Files (x86)\Livedrive
2013-08-07 13:49 - 2013-08-07 13:49 - 00000000 ____D C:\AI_RecycleBin
2013-08-07 13:49 - 2013-06-07 19:25 - 00000000 __SHD C:\Windows\SysWOW64\AI_RecycleBin
2013-08-07 13:08 - 2012-04-21 09:07 - 00000000 ____D C:\Program Files (x86)\ImgBurn
2013-08-07 11:33 - 2012-03-16 18:08 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2013-08-06 15:18 - 2013-08-06 15:18 - 00688992 ____R (Swearware) C:\Users\Paho\Desktop\dds.com
2013-08-06 14:16 - 2013-08-01 11:52 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-08-06 13:33 - 2013-08-06 13:33 - 00003320 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2013-08-06 13:33 - 2013-08-06 13:33 - 00002252 _____ C:\Users\Paho\Desktop\SpyHunter.lnk
2013-08-06 13:33 - 2013-08-06 13:33 - 00000000 ____D C:\Users\Paho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-08-06 13:33 - 2013-08-01 14:01 - 00000000 ____D C:\Windows\8AE3CFB678B24F55A7BE618FCFF43A03.TMP
2013-08-06 13:20 - 2013-08-06 13:20 - 00027256 _____ (Symantec Corporation) C:\Windows\system32\Drivers\FixZeroAccess.sys
2013-08-06 13:19 - 2013-08-06 13:19 - 01805736 _____ (Symantec Corporation) C:\Users\Paho\Downloads\FixZeroAccess.exe
2013-08-06 13:11 - 2013-08-06 13:11 - 00000000 _____ C:\Windows\setuperr.log
2013-08-06 13:06 - 2013-08-01 13:10 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-06 13:06 - 2013-08-01 11:28 - 00000000 ____D C:\Users\Paho\Downloads\backups
2013-08-06 12:54 - 2013-08-06 12:54 - 01893504 _____ (Bleeping Computer, LLC) C:\Users\Paho\Downloads\rkill.exe
2013-08-06 12:37 - 2013-08-06 12:37 - 02240864 _____ (Kaspersky Lab ZAO) C:\Users\Paho\Downloads\tdsskiller.exe
2013-08-06 12:10 - 2013-08-06 12:10 - 00001091 _____ C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2013-08-06 12:09 - 2013-08-06 12:09 - 00000000 ____D C:\Users\Paho\Documents\Anti-Malware
2013-08-06 12:09 - 2013-08-06 12:05 - 187041336 _____ (Emsisoft GmbH                                               ) C:\Users\Paho\Downloads\EmsisoftAntiMalwareSetup.exe
2013-08-05 10:34 - 2012-03-16 16:12 - 00000000 ____D C:\Users\Paho\AppData\Roaming\FileZilla
2013-08-05 09:33 - 2013-07-31 11:04 - 00000000 ____D C:\Users\Paho\AppData\Roaming\Wise Registry Cleaner
2013-08-02 21:07 - 2012-03-13 18:42 - 00000000 ___HD C:\Users\Paho
2013-08-02 21:06 - 2013-08-01 13:49 - 00000000 ____D C:\Program Files (x86)\ESET
2013-08-02 21:06 - 2013-08-01 13:10 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-02 21:06 - 2013-07-31 11:04 - 00000000 ____D C:\Program Files (x86)\Wise
2013-08-02 21:06 - 2013-07-31 11:01 - 00000000 ____D C:\Program Files\CCleaner
2013-08-02 21:06 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-08-02 21:06 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\AppCompat
2013-08-02 09:50 - 2013-08-01 14:40 - 00000000 ____D C:\Users\Paho\AppData\Roaming\Philipp Winterberg
2013-08-01 14:56 - 2013-08-01 15:11 - 00008192 _____ C:\shldr.mbr
2013-08-01 14:56 - 2013-08-01 14:46 - 00000000 ____D C:\sh4ldr
2013-08-01 14:46 - 2013-08-01 14:46 - 00000000 ____D C:\Program Files (x86)\Enigma Software Group
2013-08-01 14:44 - 2013-08-01 14:01 - 00000000 ____D C:\Windows\system32\appmgmt
2013-08-01 14:07 - 2013-08-01 14:07 - 00000000 _____ C:\autoexec.bat
2013-08-01 14:02 - 2013-08-01 14:02 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-08-01 14:00 - 2013-08-01 14:00 - 00726464 _____ (Enigma Software Group USA, LLC.) C:\Users\Paho\Downloads\SpyHunter-Installer.exe
2013-08-01 13:13 - 2013-07-17 08:49 - 00000000 ____D C:\Users\Paho\AppData\Roaming\Ysrip
2013-08-01 13:10 - 2013-08-01 13:10 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Paho\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-01 13:10 - 2013-08-01 13:10 - 00000000 ____D C:\Users\Paho\AppData\Roaming\Malwarebytes
2013-08-01 12:14 - 2013-08-01 11:53 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-08-01 11:53 - 2013-08-01 11:53 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-08-01 11:51 - 2013-08-01 11:50 - 37672592 _____ (Safer-Networking Ltd.                                       ) C:\Users\Paho\Downloads\spybotsd-2.1.21-SR2.exe
2013-08-01 11:33 - 2012-03-16 17:13 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-01 11:26 - 2013-08-01 11:25 - 00000000 ____D C:\Users\Paho\AppData\Local\FuzeZip
2013-08-01 11:24 - 2013-08-01 11:24 - 00388608 _____ (Trend Micro Inc.) C:\Users\Paho\Downloads\HijackThis.exe
2013-07-31 11:04 - 2013-07-31 11:04 - 00001227 _____ C:\Users\Public\Desktop\Wise Registry Cleaner.lnk
2013-07-31 11:02 - 2012-03-16 16:27 - 00000000 ____D C:\Users\Paho\AppData\Roaming\uTorrent
2013-07-31 11:02 - 2012-03-16 16:06 - 00000000 ____D C:\Windows\Minidump
2013-07-31 11:02 - 2012-03-13 19:39 - 00000000 ____D C:\Windows\Panther
2013-07-31 11:01 - 2013-07-31 11:01 - 00002770 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-07-31 11:01 - 2013-07-31 11:01 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-07-31 10:52 - 2013-07-31 10:31 - 00000000 ____D C:\Program Files\Common Files\Bitdefender
2013-07-31 10:46 - 2013-07-31 10:46 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_avchv_01009.Wdf
2013-07-31 10:45 - 2013-07-31 10:45 - 00000000 ____D C:\ProgramData\BDLogging
2013-07-31 10:30 - 2013-07-31 10:30 - 00000000 ____D C:\Users\Paho\AppData\Roaming\QuickScan
2013-07-31 08:28 - 2012-03-16 15:31 - 00000000 ___HD C:\Users\Paho\AppData\Local\Google
2013-07-31 08:28 - 2012-03-16 15:31 - 00000000 ____D C:\Program Files (x86)\Google
 
Files to move or delete:
====================
ZeroAccess:
C:\Users\Paho\AppData\Local\Google\Desktop\Install\{69770430-264e-085f-8b99-b47a89b497cc}
ZeroAccess:
C:\Program Files (x86)\Google\Desktop\Install\{69770430-264e-085f-8b99-b47a89b497cc}
 
==================== Bamital & volsnap Check =================
 
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
C:\Program Files\Windows Defender\mpsvc.dll => ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Windows Defender
 
 
LastRegBack: 2013-08-02 10:47
 
==================== End Of Log ============================

 

 

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-08-2013 02
Ran by Paho at 2013-08-12 13:51:44
Running from C:\Users\Paho\Desktop
Boot Mode: Normal
==========================================================
 
 
==================== Installed Programs =======================
 
   
 Update for Microsoft Office 2007 (KB2508958) (x32)
µTorrent (x32 Version: 3.1.3)
Adobe Acrobat X Pro - English, Français, Deutsch (x32 Version: 10.1.2)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Basissoftware voor HP Officejet Pro 8600 (Version: 25.0.619.0)
Dropbox (HKCU Version: 2.0.22)
eaner (Version: 4.04)
EasyResize (x32)
Emsisoft Anti-Malware (x32 Version: 8.0)
ESET Online Scanner v3 (x32)
FileZilla Client 3.5.3 (HKCU Version: 3.5.3)
Google Chrome (x32 Version: 28.0.1500.95)
Google Talk (remove only) (HKCU)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0)
Google Toolbar for Internet Explorer (x32 Version: 7.5.4209.2358)
Google Update Helper (x32 Version: 1.3.21.153)
HP FWUpdateEDO2 (x32 Version: 1.2.0.0)
HP Update (x32 Version: 5.003.000.004)
HPDiagnosticAlert (x32 Version: 1.00.0000)
I.R.I.S. OCR (x32 Version: 12.3.4.0)
ImgBurn (x32 Version: 2.5.5.0)
Intel® Management Engine Components (x32 Version: 7.0.0.1118)
Java 7 Update 13 (x32 Version: 7.0.130)
Java Auto Updater (x32 Version: 2.1.9.0)
JavaFX 2.1.1 (x32 Version: 2.1.1)
Livedrive (Version: 1.14.2.0)
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile NLD Language Pack (Version: 4.0.30319)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Access MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Access Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Groove MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Groove Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Publisher MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
MozBackup 1.5.1 (x32)
Mozilla Maintenance Service (x32 Version: 17.0.8)
Mozilla Thunderbird 17.0.8 (x86 nl) (x32 Version: 17.0.8)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6449)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.34.1)
SpyHunter (Version: 4.14.5.4268)
swMSM (x32 Version: 12.0.0.1)
Taalpakket voor Microsoft .NET Framework 4 Client Profile - NLD (Version: 4.0.30319)
TeamViewer 8 (x32 Version: 8.0.16642)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (x32)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update for Microsoft Office Access 2007 Help (KB963663) (x32)
Update for Microsoft Office Excel 2007 Help (KB963678) (x32)
Update for Microsoft Office Infopath 2007 Help (KB963662) (x32)
Update for Microsoft Office OneNote 2007 Help (KB963670) (x32)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32)
Update for Microsoft Office Outlook 2007 Help (KB963677) (x32)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817563) 32-Bit Edition (x32)
Update for Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update for Microsoft Office Publisher 2007 Help (KB963667) (x32)
Update for Microsoft Office Script Editor Help (KB963671) (x32)
Update for Microsoft Office Word 2007 Help (KB963665) (x32)
VLC media player 2.0.0 (x32 Version: 2.0.0)
Wise Registry Cleaner 7.82 (x32 Version: 7.82)
 
==================== Restore Points  =========================
 
07-08-2013 11:48:44 Livedrive is geïnstalleerd
10-08-2013 14:47:59 ComboFix created restore point
12-08-2013 11:31:06 Windows Update
 
==================== Hosts content: ==========================
 
2009-07-14 04:34 - 2013-08-10 16:55 - 00000086 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
127.0.0.1       quibus1.quibuspublic # LMS GENERATED LINE
 
 
==================== Scheduled Tasks (whitelisted) =============
 
Task: {0958EDC1-A965-4AFC-8787-1BC59515ABDB} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-07-22] (Piriform Ltd)
Task: {11B1150B-7AC7-4052-8782-805DDE050BB4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-16] (Google Inc.)
Task: {1B21126E-C82A-414D-96EB-4ED8A73FDD57} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe [2013-06-27] (Enigma Software Group USA, LLC.)
Task: {2219861B-4C9A-472A-A56E-05E420DA3B53} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {478CD481-5A16-4F2F-B689-601E5BB27DE9} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] ()
Task: {C2295F68-FA02-44F5-8525-08D82AB0EB2F} - System32\Tasks\hpUrlLauncher.exe_{C4A9DA45-E626-4947-A261-B06A4C0D9469} => C:\Program Files\HP\HP Officejet Pro 8600\Bin\utils\hpUrlLauncher.exe [2011-09-09] (Hewlett-Packard Co.)
Task: {F2A82CAC-DE67-45F6-8DF1-18194E5C9DAD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-16] (Google Inc.)
Task: {FCBBDB66-B78B-44B0-8CA2-8A9AD7A95BEE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-12] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (08/12/2013 00:58:14 PM) (Source: VSS) (User: )
Description: Fout in de Volume Shadow Copy-service: onverwachte fout bij het uitvoeren van een query voor de IVssWriterCallback-interface. hr = 0x80070005, Toegang geweigerd.
.
Dit wordt vaak veroorzaakt door onjuiste beveiligingsinstellingen in het writer- of requestorproces.
 
 
Bewerking:
   Schrijvergegevens verzamelen
 
Context:
   Klasse-id van schrijver: {e8132975-6f93-4464-a53e-1050253ae220}
   Naam van schrijver: System Writer
   Instantie-id van schrijver: {efd730f8-4bab-4fe7-ba9d-d3a762175304}
 
Error: (08/12/2013 00:58:11 PM) (Source: VSS) (User: )
Description: Fout in de Volume Shadow Copy-service: onverwachte fout bij het uitvoeren van een query voor de IVssWriterCallback-interface. hr = 0x80070005, Toegang geweigerd.
.
Dit wordt vaak veroorzaakt door onjuiste beveiligingsinstellingen in het writer- of requestorproces.
 
 
Bewerking:
   Schrijvergegevens verzamelen
 
Context:
   Klasse-id van schrijver: {e8132975-6f93-4464-a53e-1050253ae220}
   Naam van schrijver: System Writer
   Instantie-id van schrijver: {efd730f8-4bab-4fe7-ba9d-d3a762175304}
 
Error: (08/12/2013 11:17:34 AM) (Source: VSS) (User: )
Description: Fout in de Volume Shadow Copy-service: onverwachte fout bij het uitvoeren van een query voor de IVssWriterCallback-interface. hr = 0x80070005, Toegang geweigerd.
.
Dit wordt vaak veroorzaakt door onjuiste beveiligingsinstellingen in het writer- of requestorproces.
 
 
Bewerking:
   Schrijvergegevens verzamelen
 
Context:
   Klasse-id van schrijver: {e8132975-6f93-4464-a53e-1050253ae220}
   Naam van schrijver: System Writer
   Instantie-id van schrijver: {efd730f8-4bab-4fe7-ba9d-d3a762175304}
 
Error: (08/12/2013 11:17:12 AM) (Source: VSS) (User: )
Description: Fout in de Volume Shadow Copy-service: onverwachte fout bij het uitvoeren van een query voor de IVssWriterCallback-interface. hr = 0x80070005, Toegang geweigerd.
.
Dit wordt vaak veroorzaakt door onjuiste beveiligingsinstellingen in het writer- of requestorproces.
 
 
Bewerking:
   Schrijvergegevens verzamelen
 
Context:
   Klasse-id van schrijver: {e8132975-6f93-4464-a53e-1050253ae220}
   Naam van schrijver: System Writer
   Instantie-id van schrijver: {efd730f8-4bab-4fe7-ba9d-d3a762175304}
 
Error: (08/12/2013 10:21:14 AM) (Source: Application Hang) (User: )
Description: Het programma IEXPLORE.EXE, versie 10.0.9200.16635 reageert niet meer op Windows en is afgesloten. Als u wilt zien of er meer informatie over het probleem beschikbaar is, raadpleegt u de probleemgeschiedenis in het onderdeel Onderhoudscentrum in het Configuratiescherm.
 
Proces-id: 7ec
 
Starttijd: 01ce972da5f1b084
 
Eindtijd: 13
 
Toepassingspad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
 
Rapport-id:
 
Error: (08/12/2013 10:17:10 AM) (Source: VSS) (User: )
Description: Fout in de Volume Shadow Copy-service: onverwachte fout bij het uitvoeren van een query voor de IVssWriterCallback-interface. hr = 0x80070005, Toegang geweigerd.
.
Dit wordt vaak veroorzaakt door onjuiste beveiligingsinstellingen in het writer- of requestorproces.
 
 
Bewerking:
   Schrijvergegevens verzamelen
 
Context:
   Klasse-id van schrijver: {e8132975-6f93-4464-a53e-1050253ae220}
   Naam van schrijver: System Writer
   Instantie-id van schrijver: {efd730f8-4bab-4fe7-ba9d-d3a762175304}
 
Error: (08/12/2013 09:17:59 AM) (Source: VSS) (User: )
Description: Fout in de Volume Shadow Copy-service: onverwachte fout bij het uitvoeren van een query voor de IVssWriterCallback-interface. hr = 0x80070005, Toegang geweigerd.
.
Dit wordt vaak veroorzaakt door onjuiste beveiligingsinstellingen in het writer- of requestorproces.
 
 
Bewerking:
   Schrijvergegevens verzamelen
 
Context:
   Klasse-id van schrijver: {e8132975-6f93-4464-a53e-1050253ae220}
   Naam van schrijver: System Writer
   Instantie-id van schrijver: {efd730f8-4bab-4fe7-ba9d-d3a762175304}
 
Error: (08/12/2013 09:17:06 AM) (Source: VSS) (User: )
Description: Fout in de Volume Shadow Copy-service: onverwachte fout bij het uitvoeren van een query voor de IVssWriterCallback-interface. hr = 0x80070005, Toegang geweigerd.
.
Dit wordt vaak veroorzaakt door onjuiste beveiligingsinstellingen in het writer- of requestorproces.
 
 
Bewerking:
   Schrijvergegevens verzamelen
 
Context:
   Klasse-id van schrijver: {e8132975-6f93-4464-a53e-1050253ae220}
   Naam van schrijver: System Writer
   Instantie-id van schrijver: {efd730f8-4bab-4fe7-ba9d-d3a762175304}
 
Error: (08/12/2013 09:15:06 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (08/12/2013 09:14:01 AM) (Source: VSS) (User: )
Description: Fout in de Volume Shadow Copy-service: onverwachte fout bij het uitvoeren van een query voor de IVssWriterCallback-interface. hr = 0x80070005, Toegang geweigerd.
.
Dit wordt vaak veroorzaakt door onjuiste beveiligingsinstellingen in het writer- of requestorproces.
 
 
Bewerking:
   Schrijvergegevens verzamelen
 
Context:
   Klasse-id van schrijver: {e8132975-6f93-4464-a53e-1050253ae220}
   Naam van schrijver: System Writer
   Instantie-id van schrijver: {efd730f8-4bab-4fe7-ba9d-d3a762175304}
 
 
System errors:
=============
Error: (08/12/2013 01:31:48 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT AUTHORITY)
Description: Installatiefout: de volgende update kan niet worden geïnstalleerd, foutcode 0x80070643: Definition Update for Windows Defender - KB915597 (Definition 1.155.1859.0).
 
Error: (08/12/2013 00:57:56 PM) (Source: Disk) (User: )
Description: Het stuurprogramma heeft een controllerfout gevonden in \Device\Harddisk1\DR1.
 
Error: (08/12/2013 11:17:20 AM) (Source: Disk) (User: )
Description: Het stuurprogramma heeft een controllerfout gevonden in \Device\Harddisk1\DR1.
 
Error: (08/12/2013 11:17:20 AM) (Source: Disk) (User: )
Description: Het stuurprogramma heeft een controllerfout gevonden in \Device\Harddisk1\DR1.
 
Error: (08/12/2013 11:17:19 AM) (Source: Disk) (User: )
Description: Het stuurprogramma heeft een controllerfout gevonden in \Device\Harddisk1\DR1.
 
Error: (08/12/2013 11:17:19 AM) (Source: Disk) (User: )
Description: Het stuurprogramma heeft een controllerfout gevonden in \Device\Harddisk1\DR1.
 
Error: (08/12/2013 11:17:18 AM) (Source: Disk) (User: )
Description: Het stuurprogramma heeft een controllerfout gevonden in \Device\Harddisk1\DR1.
 
Error: (08/12/2013 09:13:24 AM) (Source: Service Control Manager) (User: )
Description: De WinDefend-service is gestopt met de volgende foutcode: 
%%5.
 
Error: (08/12/2013 08:26:11 AM) (Source: Service Control Manager) (User: )
Description: De WinDefend-service is gestopt met de volgende foutcode: 
%%5.
 
Error: (08/10/2013 05:06:10 PM) (Source: Disk) (User: )
Description: Het stuurprogramma heeft een controllerfout gevonden in \Device\Harddisk1\DR1.
 
 
Microsoft Office Sessions:
=========================
Error: (06/18/2013 01:18:29 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 3000 seconds with 600 seconds of active time.  This session ended with a crash.
 
Error: (05/10/2013 00:00:11 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 10196 seconds with 360 seconds of active time.  This session ended with a crash.
 
Error: (10/25/2012 02:08:03 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6662.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 3110 seconds with 0 seconds of active time.  This session ended with a crash.
 
 
CodeIntegrity Errors:
===================================
  Date: 2013-08-10 16:51:42.649
  Description: De integriteit van de kopie van het bestand \Device\HarddiskVolume2\ComboFix\catchme.sys kan niet worden geverifieerd omdat de bestands-hash niet is gevonden op het systeem. Tijdens een recente hardware- of softwarewijziging is mogelijk een bestand geïnstalleerd dat onjuist ondertekend of beschadigd is, of dat mogelijk kwaadwillende software van een onbekende bron is.
 
  Date: 2013-08-10 16:51:42.602
  Description: De integriteit van de kopie van het bestand \Device\HarddiskVolume2\ComboFix\catchme.sys kan niet worden geverifieerd omdat de bestands-hash niet is gevonden op het systeem. Tijdens een recente hardware- of softwarewijziging is mogelijk een bestand geïnstalleerd dat onjuist ondertekend of beschadigd is, of dat mogelijk kwaadwillende software van een onbekende bron is.
 
  Date: 2012-03-13 17:45:10.215
  Description: De integriteit van de kopie van het bestand \Device\HarddiskVolume2\Windows\System32\drivers\nusb3xhc.sys kan niet worden geverifieerd omdat de bestands-hash niet is gevonden op het systeem. Tijdens een recente hardware- of softwarewijziging is mogelijk een bestand geïnstalleerd dat onjuist ondertekend of beschadigd is, of dat mogelijk kwaadwillende software van een onbekende bron is.
 
  Date: 2012-03-13 17:45:10.200
  Description: De integriteit van de kopie van het bestand \Device\HarddiskVolume2\Windows\System32\drivers\nusb3xhc.sys kan niet worden geverifieerd omdat de bestands-hash niet is gevonden op het systeem. Tijdens een recente hardware- of softwarewijziging is mogelijk een bestand geïnstalleerd dat onjuist ondertekend of beschadigd is, of dat mogelijk kwaadwillende software van een onbekende bron is.
 
 
==================== Memory info =========================== 
 
Percentage of memory in use: 28%
Total physical RAM: 4013.75 MB
Available physical RAM: 2877.26 MB
Total Pagefile: 8025.68 MB
Available Pagefile: 5811.66 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
 
==================== Drives ================================
 
Drive c: () (Fixed) (Total:59.53 GB) (Free:17.07 GB) NTFS (Disk=0 Partition=2)
Drive e: (ELEMENTS) (Fixed) (Total:465.64 GB) (Free:445.46 GB) FAT32 (Disk=1 Partition=1)
 
==================== MBR & Partition Table ==================
 
==================== End Of Log ============================

 

Let me know if I need to translate certain dutch parts.



#9 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:09:18 PM

Posted 12 August 2013 - 08:48 PM

Hello VVerbon



I need you to download this script I have made for you --> Attached File  fixlist.txt   403bytes   16 downloads

It needs to be saved Next to the "Farbar Recovery Scan Tool" (FRST) program (If asked to overwrite existing one please allow)

Run FRST again but this time press the Fix button just once and wait.


When finished, it will make a log (fixlog.txt) next to FRST. Please copy and paste the content of this file to your reply.


NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system


Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#10 VVerbon

VVerbon
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:03:18 AM

Posted 13 August 2013 - 09:43 AM

Hi Gringo,

 

You fixed it!

 

I have downloaded the file, then ran FRST but it said my version was out of date and I had better download the latest version, which I did. After that I ran FRST and clicked just once on Fix. Here's the log:

 

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-08-2013
Ran by Paho at 2013-08-13 16:30:46 Run:1
Running from C:\Users\Paho\Desktop
Boot Mode: Normal
==============================================
 
C:\Users\Paho\AppData\Local\Google\Desktop\Install\{69770430-264e-085f-8b99-b47a89b497cc}  => Moved successfully.
C:\Program Files (x86)\Google\Desktop\Install\{69770430-264e-085f-8b99-b47a89b497cc}  => Moved successfully.
"C:\Program Files\Windows Defender" => Deleting reparse point and unlocking started.
"C:\Program Files\Windows Defender\MpAsDesc.dll" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MpClient.dll" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MpCmdRun.exe" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MpCommu.dll" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MpEvMsg.dll" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MpOAV.dll" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MpRTP.dll" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MpSvc.dll" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MSASCui.exe" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MsMpCom.dll" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MsMpLics.dll" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MsMpRes.dll" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\nl-NL" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender" => Deleting reparse point and unlocking completed.
"C:\Program Files\Microsoft Security Client" => Not Found
"C:\Windows\system64" => Not Found
 
=========  Dir /b /a:l "C:\Program Files" /s =========
 
C:\Program Files\Windows NT\Bureau-accessoires
 
========= End of CMD: =========
 
 
==== End of Fixlog ====

 

Now I can download files again in IE, thanks a lot!

 

So I presume that means the malware is gone now?

 



#11 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:09:18 PM

Posted 13 August 2013 - 01:06 PM


Hello VVerbon

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Please start by opening Notepad and copy/paste the text in the box into the window:

ClearJavaCache::


 
Save it to your desktop as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe
CFScriptB-4.gif
This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"
  • In your next post I need the following
    • report from Combofix
    • let me know of any problems you may have had
    • How is the computer doing now after running the script?
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#12 VVerbon

VVerbon
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:03:18 AM

Posted 15 August 2013 - 08:27 AM

Ran Combofix as requested and below is the report:

 

ComboFix 13-08-14.02 - Paho 15-08-2013  15:14:47.2.4 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.31.1043.18.4014.2505 [GMT 2:00]
Gestart vanuit: C:\Users\Paho\Desktop\ComboFix.exe
gebruikte Opdracht switches :: C:\Users\Paho\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Nieuw herstelpunt werd aangemaakt

((((((((((((((((((((((((((((((((((   Andere Verwijderingen   )))))))))))))))))))))))))))))))))))))))))))))))))

---- Voorgaande Run -------

C:\Users\Paho\AppData\Roaming\Cyduaz\asem.odd
C:\Windows\wininit.ini

((((((((((((((((((((   Bestanden Gemaakt van 2013-07-15 to 2013-08-15  ))))))))))))))))))))))))))))))

2013-08-15 13:17:48 . 2013-08-15 13:17:48 -------- d-----w- C:\Users\Default\AppData\Local\temp
2013-08-15 07:18:35 . 2013-08-15 07:18:35 76232 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{BC581980-DA6B-4846-A381-CD3411D65EC7}\offreg.dll
2013-08-15 07:11:08 . 2013-07-02 08:34:28 9460976 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{BC581980-DA6B-4846-A381-CD3411D65EC7}\mpengine.dll
2013-08-12 11:51:00 . 2013-08-12 11:51:00 -------- d-----w- C:\FRST
2013-08-07 11:49:30 . 2013-08-07 11:49:32 -------- d-----w- C:\Program Files (x86)\Livedrive
2013-08-07 11:49:26 . 2013-08-07 11:49:33 -------- d-----w- C:\AI_RecycleBin
2013-08-07 09:04:30 . 2013-08-07 13:24:28 -------- d-----w- C:\Program Files (x86)\Mozilla Thunderbird
2013-08-01 12:01:10 . 2013-08-01 12:01:10 -------- d-----w- C:\Program Files (x86)\Common Files\Wise Installation Wizard
2013-08-01 11:49:31 . 2013-08-02 19:06:16 -------- d-----w- C:\Program Files (x86)\ESET
2013-08-01 11:10:48 . 2013-08-01 11:10:48 -------- d-----w- C:\Users\Paho\AppData\Roaming\Malwarebytes
2013-08-01 11:10:39 . 2013-08-02 19:06:05 -------- d-----w- C:\ProgramData\Malwarebytes
2013-08-01 11:10:37 . 2013-08-06 11:06:54 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-01 09:53:58 . 2013-08-01 10:14:02 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
2013-08-01 09:52:54 . 2009-01-25 11:14:02 17272 ----a-w- C:\Windows\system32\sdnclean64.exe
2013-08-01 09:52:49 . 2013-08-06 12:16:36 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-08-01 09:25:24 . 2013-08-01 09:26:09 -------- d-----w- C:\Users\Paho\AppData\Local\FuzeZip
2013-07-31 09:04:43 . 2013-08-05 07:33:58 -------- d-----w- C:\Users\Paho\AppData\Roaming\Wise Registry Cleaner
2013-07-31 09:04:29 . 2013-08-02 19:06:19 -------- d-----w- C:\Program Files (x86)\Wise
2013-07-31 09:04:19 . 2013-07-31 09:04:19 -------- d-----w- C:\Users\Paho\AppData\Local\Programs
2013-07-31 09:01:29 . 2013-08-02 19:06:21 -------- d-----w- C:\Program Files\CCleaner
2013-07-31 08:45:52 . 2013-07-31 08:45:52 -------- d-----w- C:\ProgramData\BDLogging
2013-07-31 08:45:30 . 2007-04-11 09:11:20 511328 ----a-w- C:\Windows\capicom.dll
2013-07-31 08:45:28 . 2009-07-14 23:21:12 1721576 ----a-w- C:\Windows\system32\WdfCoInstaller01009.dll
2013-07-31 08:31:25 . 2013-07-31 08:52:57 -------- d-----w- C:\Program Files\Common Files\Bitdefender
2013-07-31 08:30:31 . 2013-07-31 08:30:38 -------- d-----w- C:\Users\Paho\AppData\Roaming\QuickScan
2013-07-17 06:49:11 . 2013-08-01 11:13:02 -------- d-----w- C:\Users\Paho\AppData\Roaming\Ysrip
.

(((((((((((((((((((((((((((((((((((((((   Find3M Rapport   ))))))))))))))))))))))))))))))))))))))))))))))))))))

2013-06-12 10:43:06 . 2012-04-11 06:54:43 692104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-06-12 10:43:06 . 2012-03-16 14:42:12 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-11 23:43:37 . 2013-07-11 15:45:59 1767936 ----a-w- C:\Windows\SysWow64\wininet.dll
2013-06-11 23:43:00 . 2013-07-11 15:46:00 2877440 ----a-w- C:\Windows\SysWow64\jscript9.dll
2013-06-11 23:42:58 . 2013-07-11 15:46:05 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll
2013-06-11 23:42:58 . 2013-07-11 15:46:05 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll
2013-06-11 23:26:36 . 2013-07-11 15:46:05 51712 ----a-w- C:\Windows\system32\ie4uinit.exe
2013-06-11 23:26:20 . 2013-07-11 15:45:58 2241024 ----a-w- C:\Windows\system32\wininet.dll
2013-06-11 23:26:13 . 2013-07-11 15:45:59 1365504 ----a-w- C:\Windows\system32\urlmon.dll
2013-06-11 23:25:30 . 2013-07-11 15:45:57 19238912 ----a-w- C:\Windows\system32\mshtml.dll
2013-06-11 23:25:29 . 2013-07-11 15:46:03 603136 ----a-w- C:\Windows\system32\msfeeds.dll
2013-06-11 23:25:16 . 2013-07-11 15:46:01 855552 ----a-w- C:\Windows\system32\jscript.dll
2013-06-11 23:25:16 . 2013-07-11 15:46:00 3958784 ----a-w- C:\Windows\system32\jscript9.dll
2013-06-11 23:25:16 . 2013-07-11 15:45:59 53248 ----a-w- C:\Windows\system32\jsproxy.dll
2013-06-11 23:25:13 . 2013-07-11 15:46:05 67072 ----a-w- C:\Windows\system32\iesetup.dll
2013-06-11 23:25:13 . 2013-07-11 15:46:05 526336 ----a-w- C:\Windows\system32\ieui.dll
2013-06-11 23:25:13 . 2013-07-11 15:46:05 39936 ----a-w- C:\Windows\system32\iernonce.dll
2013-06-11 23:25:13 . 2013-07-11 15:46:05 136704 ----a-w- C:\Windows\system32\iesysprep.dll
2013-06-11 23:25:13 . 2013-07-11 15:46:04 2648576 ----a-w- C:\Windows\system32\iertutil.dll
2013-06-11 23:25:13 . 2013-07-11 15:45:57 15404032 ----a-w- C:\Windows\system32\ieframe.dll
2013-06-11 22:51:45 . 2013-07-11 15:46:05 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe
2013-06-11 22:50:58 . 2013-07-11 15:46:05 89600 ----a-w- C:\Windows\system32\RegisterIEPKEYs.exe
2013-06-07 03:22:18 . 2013-07-11 15:46:06 2706432 ----a-w- C:\Windows\system32\mshtml.tlb
2013-06-07 02:37:52 . 2013-07-11 15:46:05 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2013-06-05 03:34:27 . 2013-07-11 08:01:31 3153920 ----a-w- C:\Windows\system32\win32k.sys
2013-06-04 06:00:13 . 2013-07-11 08:01:44 624128 ----a-w- C:\Windows\system32\qedit.dll
2013-06-04 04:53:07 . 2013-07-11 08:01:44 509440 ----a-w- C:\Windows\SysWow64\qedit.dll

(((((((((((((((((((((((((((((((((((((   Reg Opstartpunten   )))))))))))))))))))))))))))))))))))))))))))))))))))

*Nota* lege verwijzingen & legitieme standaard verwijzingen worden niet getoond
REGEDIT4

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36:40 130736 ----a-w- C:\Users\Paho\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36:40 130736 ----a-w- C:\Users\Paho\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36:40 130736 ----a-w- C:\Users\Paho\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36:40 130736 ----a-w- C:\Users\Paho\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EldosIconOverlay]
@="{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}"
[HKEY_CLASSES_ROOT\CLSID\{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}]
2012-11-10 08:55:20 158056 ----a-w- C:\Windows\SysWOW64\CbFsMntNtf3.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-03-16 13:32:09 39408]
"googletalk"="C:\Users\Paho\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 21:22:02 3739648]
"HP Officejet Pro 8600 (NET)"="C:\Program Files\HP\HP Officejet Pro 8600\Bin\ScanToPCActivationApp.exe" [2011-09-09 15:27:42 2676584]
"Livedrive"="C:\Program Files (x86)\Livedrive\Livedrive.exe" [2013-07-29 09:34:30 1814680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IMSS"="C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe" [2010-10-08 14:21:46 112152]
"Adobe ARM"="C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 13:10:44 843712]
"Adobe Acrobat Speed Launcher"="C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2012-01-03 13:10:50 36760]
"Acrobat Assistant 8.0"="C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2012-01-03 13:10:50 815512]
"SunJavaUpdateSched"="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 07:04:54 252848]
"HP Software Update"="C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-03-24 12:13:50 49208]

C:\Users\Paho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - C:\Users\Paho\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ    autocheck autochk *\0\0sdnclean64.exe

R2 ?etadpug;Google Update Service (gupdate);C:\Program Files (x86)\Google\Desktop\Install\{69770430-264e-085f-8b99-b47a89b497cc}\   \...\???\{69770430-264e-085f-8b99-b47a89b497cc}\GoogleUpdate.exe <;C:\Program Files (x86)\Google\Desktop\Install\{69770430-264e-085f-8b99-b47a89b497cc}\   \...\???\{69770430-264e-085f-8b99-b47a89b497cc}\GoogleUpdate.exe < [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 gupdate;Google Update-service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe;C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [x]
R3 cleanhlp;cleanhlp;C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys;C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [x]
R3 dmvsc;dmvsc;C:\Windows\system32\drivers\dmvsc.sys;C:\Windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 EsgScanner;EsgScanner;C:\Windows\system32\DRIVERS\EsgScanner.sys;C:\Windows\SYSNATIVE\DRIVERS\EsgScanner.sys [x]
R3 gupdatem;Google Update-service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe;C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [x]
R3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys;C:\Windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys;C:\Windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows Activation Technologies-service;C:\Windows\system32\Wat\WatAdminSvc.exe;C:\Windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S1 CbFs;CbFs;C:\Windows\system32\drivers\cbfs.sys;C:\Windows\SYSNATIVE\drivers\cbfs.sys [x]
S1 cbfs3;cbfs3;C:\Windows\system32\drivers\cbfs3.sys;C:\Windows\SYSNATIVE\drivers\cbfs3.sys [x]
S2 LivedriveVSSService;Livedrive VSS Service;C:\Program Files (x86)\Livedrive\VSSService.exe;C:\Program Files (x86)\Livedrive\VSSService.exe [x]
S2 SpyHunter 4 Service;SpyHunter 4 Service;C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE;C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [x]
S2 TeamViewer8;TeamViewer 8;C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [x]
S3 esgiguard;esgiguard;C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys;C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S3 IntcDAud;Intel® Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys;C:\Windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\system32\DRIVERS\nusb3hub.sys;C:\Windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\system32\DRIVERS\nusb3xhc.sys;C:\Windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{2D46B6DC-2207-486B-B523-A557E6D54B47}]
start [BU]

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-08-05 08:21:35 1173456 ----a-w- C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe

Inhoud van de 'Gedeelde Taken' map

2013-08-15 C:\Windows\Tasks\Adobe Flash Player Updater.job
- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 06:54:43 . 2013-06-12 10:43:43]

2013-08-15 C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-16 13:31:36 . 2012-03-16 13:31:29]

2013-08-15 C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-16 13:31:36 . 2012-03-16 13:31:29]

--------- X64 Entries -----------

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\BackupOverlay]
@="{B44A5D93-1351-41A1-BD91-5E92435D8ECD}"
[HKEY_CLASSES_ROOT\CLSID\{B44A5D93-1351-41A1-BD91-5E92435D8ECD}]
2013-07-29 09:38:06 1245848 ----a-w- C:\Program Files (x86)\Livedrive\Extensions.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36:40 164016 ----a-w- C:\Users\Paho\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36:40 164016 ----a-w- C:\Users\Paho\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36:40 164016 ----a-w- C:\Users\Paho\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36:40 164016 ----a-w- C:\Users\Paho\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EldosIconOverlay]
@="{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}"
[HKEY_CLASSES_ROOT\CLSID\{5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC}]
2012-11-10 08:55:40 190312 ----a-w- C:\Windows\System32\CbFsMntNtf3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\LivedriveDownloadOverlay]
@="{CBCDB610-6B68-4EE9-B7A2-1282FD0C9292}"
[HKEY_CLASSES_ROOT\CLSID\{CBCDB610-6B68-4EE9-B7A2-1282FD0C9292}]
2013-07-29 09:38:06 1245848 ----a-w- C:\Program Files (x86)\Livedrive\Extensions.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\LivedriveSharedOverlay]
@="{84CEF1E4-1356-4063-845F-05047F4DD52C}"
[HKEY_CLASSES_ROOT\CLSID\{84CEF1E4-1356-4063-845F-05047F4DD52C}]
2013-07-29 09:38:06 1245848 ----a-w- C:\Program Files (x86)\Livedrive\Extensions.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\LivedriveSyncedOverlay]
@="{42058329-2FBF-4B33-8E52-3BE5754DE0C1}"
[HKEY_CLASSES_ROOT\CLSID\{42058329-2FBF-4B33-8E52-3BE5754DE0C1}]
2013-07-29 09:38:06 1245848 ----a-w- C:\Program Files (x86)\Livedrive\Extensions.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\LivedriveUploadOverlay]
@="{39A1715A-E4CD-4F1E-B5C4-36B5DB80124E}"
[HKEY_CLASSES_ROOT\CLSID\{39A1715A-E4CD-4F1E-B5C4-36B5DB80124E}]
2013-07-29 09:38:06 1245848 ----a-w- C:\Program Files (x86)\Livedrive\Extensions.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-08-26 16:18:00 12681320]
"IgfxTray"="C:\Windows\system32\igfxtray.exe" [2012-02-14 17:55:02 170264]
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2012-02-14 17:55:02 398616]
"Persistence"="C:\Windows\system32\igfxpers.exe" [2012-02-14 17:55:02 440600]

------- Bijkomende Scan -------

uLocal Page = C:\Windows\system32\blank.htm
uStart Page = hxxp://www.paragliding.nl/
mLocal Page = C:\Windows\SYSTEM32\blank.htm
TCP: DhcpNameServer = 192.168.1.254 195.241.77.55 195.241.77.58
TCP: Interfaces\{99BB2B3D-3C4A-403E-B2A7-FA266FE21917}: DhcpNameServer = 192.168.1.254 195.241.77.55 195.241.77.58

- - - - ORPHANS VERWIJDERD - - - -

Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Toolbar-Locked - (no file)
WebBrowser-{87775FDB-6972-41F9-AE51-8326E38CB206} - (no file)

 

Comp is very unresponsive for the first 15 mins after start-up, programs are stalling and nothing works. After about 15 mins or so it suddenly is normal and everything runs smoothly.



#13 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:09:18 PM

Posted 15 August 2013 - 12:53 PM


Hello VVerbon

I would like to see a report that combofix makes.

extra combofix report
  • push the "windows key" + "R" (between the "Ctrl" button and "Alt" Button)
  • please copy and past the following into the box
C:\Qoobox\Add-Remove Programs.txt
  • click ok
copy and paste the report into this topic for me to review

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#14 VVerbon

VVerbon
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:03:18 AM

Posted 16 August 2013 - 02:57 AM

 Update for Microsoft Office 2007 (KB2508958)
Adobe Acrobat X Pro - English, Français, Deutsch
Adobe Flash Player 11 ActiveX
µTorrent
Dropbox
EasyResize
ESET Online Scanner v3
FileZilla Client 3.5.3
Google Chrome
Google Talk (remove only)
Google Toolbar for Internet Explorer
Google Update Helper
HP FWUpdateEDO2
HP Update
HPDiagnosticAlert
I.R.I.S. OCR
ImgBurn
Intel® Management Engine Components
Java 7 Update 13
Java Auto Updater
JavaFX 2.1.1
Microsoft .NET Framework 1.1
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
MozBackup 1.5.1
Mozilla Maintenance Service
Mozilla Thunderbird 17.0.8 (x86 nl)
Realtek High Definition Audio Driver
Renesas Electronics USB 3.0 Host Controller Driver
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628)
Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687309) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2597971) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition
Security Update for Taalpakket voor Microsoft .NET Framework 4 Client Profile - NLD (KB2518870)
swMSM
TeamViewer 8
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817563) 32-Bit Edition
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VLC media player 2.0.0
Wise Registry Cleaner 7.82
 



#15 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:09:18 PM

Posted 16 August 2013 - 12:34 PM


Hello

:P2P Warning!:

IMPORTANT I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

Please note that as long as you are using any form of Peer-to-Peer networking and downloading files from non-documented sources, you can expect infestations of malware to occur
Once upon a time, P2P file sharing was fairly safe. That is no longer true. P2P programs form a direct conduit on to your computer, their security measures are easily circumvented and malware writers are increasingly exploiting them to spread their wares on to your computer. Further to that, if your P2P program is not configured correctly, your computer may be sharing more files than you realize. There have been cases where people's passwords, address books and other personal, private, and financial details have been exposed to a file sharing network by a badly configured program.

Please read these short reports on the dangers of peer-2-peer programs and file sharing.These logs are looking allot better. But we still have some work to do.


uninstall some programs

NOTE** Because of the cleanup process some of the programs I have listed may not be in add/remove anymore this is fine just move to the next item on the list.

You can remove these programs using add/remove or you can use the free uninstaller from Revo (it does allot better of a job
  • Programs to remove

    • µTorrent
      Java 7 Update 13
      JavaFX 2.1.1



  • Please download and install Revo Uninstaller Free
  • Double click Revo Uninstaller to run it.
  • From the list of programs double click on The Program to remove
  • When prompted if you want to uninstall click Yes.
  • Be sure the Moderate option is selected then click Next.
  • The program will run, If prompted again click Yes
  • when the built-in uninstaller is finished click on Next.
  • Once the program has searched for leftovers click Next.
  • Check/tick the bolded items only on the list then click Delete
  • when prompted click on Yes and then on next.
  • put a check on any folders that are found and select delete
  • when prompted select yes then on next
  • Once done click Finish.
.



Install Java:

Please go here to install Java
  • click on the Free Java Download Button
  • click on Agree and start Free download
  • click on Run
  • click on run again
  • click on install
  • when install is complete click on close
Clean Out Temp Files
  • This small application you may want to keep and use once a week to keep the computer clean.

    Download CCleaner from here CCleaner
    • Run the installer to install the application.
    • When it gives you the option to install Yahoo toolbar uncheck the box next to it.
    • Run CCleaner. (make sure under Windows tab all the boxes of Internet Explorer and Windows explorer are checked. Under System check Empty Recycle Bin and Temporary Files. Under Application tab all the boxes should be checked).
    • Click Run Cleaner.
    • Close CCleaner.
: Malwarebytes' Anti-Malware :
  • Please download Malwarebytes' Anti-Malware to your desktop.
  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to
    • Update Malwarebytes' Anti-Malware
    • and Launch Malwarebytes' Anti-Malware
  • then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.
  • When completed, a log will open in Notepad. please copy and paste the log into your next reply
    • If you accidently close it, the log file is saved here and will be named like this:
    • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.



Download HijackThis
  • Go Here to download HijackThis program
  • Save HijackThis to your desktop.
  • Right Click on Hijackthis and select "Run as Admin" (XP users just need to double click to run)
  • Click on "Do A system scan and save a logfile" (if you do not see "Do A system scan and save a logfile" then click on main menu)
  • copy and paste hijackthis report into the topic
"information and logs"
  • In your next post I need the following
    • Log From MBAM
    • report from Hijackthis
    • let me know of any problems you may have had
    • How is the computer doing now?
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users