Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Computer affected with ZeroAccess


  • This topic is locked This topic is locked
10 replies to this topic

#1 amandaDOUCET28

amandaDOUCET28

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:06:48 PM

Posted 26 August 2013 - 11:58 AM

I have been having trouble with downloading files from the internet. Every file I try to open or save to the computer shows an error message stating that the file has a virus and has been deleted.  I have run everything that was recommended to determine the issue according to the info given to me in my post here  http://www.bleepingcomputer.com/forums/t/505526/error-stating-that-all-new-downloads-have-a-virus-and-have-been-deleted/ I am not a computer technical person so all of this is very over my head. Thank you for all the help I have received to this point!

I ran the DSS tool and these are the results

dss log

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16660
Run by Owner at 11:42:16 on 2013-08-26
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.3999.2163 [GMT -5:00]
.
AV: Trend Micro AntiVirus *Enabled/Updated* {48929DFC-7A52-A34F-8351-C4DBEDBD9C50}
SP: Trend Micro AntiVirus *Disabled/Updated* {F3F37C18-5C68-ACC1-B9E1-FFA9963AD6ED}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b87ff64c8b56b7db

\STacSV64.exe
C:\Windows\system32\Hpservice.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_b87ff64c8b56b7db

\AESTSr64.exe
C:\Program Files\LSI SoftModem\agr64svc.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\DefaultTab\DefaultTabSearch.exe
C:\Users\Owner\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Fast Free Converter\FastFreeConverterUpdt.exe
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe
C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\taskeng.exe
c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
C:\Program Files (x86)\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files (x86)\Adobe\Elements 10 Organizer\ElementsOrganizerSyncAgent.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\apdproxy.exe
C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\ProgramData\WeCareReminder\ReminderHelper.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe
C:\Windows\system32\Macromed\Flash\FlashUtil64_11_8_800_94_ActiveX.exe
C:\Program Files (x86)\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\Windows\System32\MsSpellCheckingFacility.exe
C:\Program Files (x86)\Google\Update\Install\{FB85B75A-92BE-4FBA-9128-

D999AC77E423}\GoogleToolbarInstaller_updater_signed.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Windows\System32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uSearch Bar = hxxp://www.google.com/ie
uSearch Page = hxxp://www.google.com
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?

TYPE=3&tp=iehome&locale=en_US&c=94&bd=bestbuy&pf=cnnb
uDefault_Search_URL = hxxp://www.google.com/ie
uProxyOverride = <local>;*.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
uURLSearchHooks: FCToolbarURLSearchHook Class: {f78bf7a8-cf12-4de7-a6da-c463d1b539a7} - C:

\Program Files (x86)\Dogpile Bundle Toolbar\Helper.dll
uURLSearchHooks: <No Name>:  - LocalServer32 - <no file>
mWinlogon: Userinit = userinit.exe,
BHO: MRI_DISABLED - <orphaned>
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files

(x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: AOL Toolbar Loader: {3ef64538-8b54-4573-b48f-4d34b0238ab2} - C:\Program Files (x86)\AOL

Toolbar\aoltb.dll
BHO: Fast Free Converter 4.0: {4B72B1CE-C6E4-4089-89AF-1D01198E8B88} - C:\Program Files

(x86)\Fast Free Converter\FastFreeConverter\FastFreeConverter.dll
BHO: ArcadeWeb Class: {78919608-B066-4B5A-B248-38E12A783E05} -
BHO: DefaultTab Browser Helper: {7F6AFBF1-E065-4627-A2FD-810366367D01} - C:\Users\Owner\AppData

\Roaming\DefaultTab\DefaultTab\DefaultTabBHO.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files

(x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Search Toolbar: {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files (x86)\Search

Toolbar\SearchToolbar.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files

(x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program

Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype

\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Dogpile Bundle Toolbar BHO: {BFE4B5CB-63F7-4A51-9266-6167655D5B4F} - C:\Program Files

(x86)\Dogpile Bundle Toolbar\Toolbar.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -
BHO: WeCareReminder Class: {D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} - C:\ProgramData

\WeCareReminder\IEHelperv2.5.0.dll
BHO: HP Network Check Helper: {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files

(x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll
BHO: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common

Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google

Toolbar\GoogleToolbar_32.dll
TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files

\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Dogpile Bundle Toolbar: {C80BDEB2-8735-44C6-BD55-A1CCD555667A} - C:\Program Files

(x86)\Dogpile Bundle Toolbar\Toolbar.dll
TB: AOL Toolbar: {BA00B7B1-0351-477A-B948-23E3EE5A73D4} - C:\Program Files (x86)\AOL Toolbar

\aoltb.dll
TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files

\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Search Toolbar: {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files (x86)\Search

Toolbar\SearchToolbar.dll
TB: Dogpile Bundle Toolbar: {C80BDEB2-8735-44C6-BD55-A1CCD555667A} - C:\Program Files

(x86)\Dogpile Bundle Toolbar\Toolbar.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} -
TB: AOL Toolbar: {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - C:\Program Files (x86)\AOL Toolbar

\aoltb.dll
TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google

Toolbar\GoogleToolbar_32.dll
EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - C:\Program Files (x86)\HP

\Digital Imaging\Smart Web Printing\hpswp_bho.dll
EB: MRI_DISABLED - <orphaned>
uRun: [HPADVISOR] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN
uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe

\LightScribeControlPanel.exe -hidden
uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
uRun: [Messenger (Yahoo!)] "C:\PROGRA~2\Yahoo!\Messenger\YahooMessenger.exe" -quiet
uRun: [Search Protection] C:\Program Files (x86)\Yahoo!\Search Protection\SearchProtection.exe
uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
uRun: [PhotoshopElements8SyncAgent] C:\Program Files (x86)\Adobe\Elements 10 Organizer

\ElementsOrganizerSyncAgent.exe
uRun: [AdobeBridge] <no file>
mRun: [HPCam_Menu] "c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer

\MUIStartMenu.exe" "c:\Program Files (x86)\Hewlett-Packard\Media\Webcam" UpdateWithCreateOnce

"Software\Hewlett-Packard\Media\Webcam"
mRun: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe

/Start
mRun: [UpdatePRCShortCut] "C:\Program Files (x86)\Hewlett-Packard\Recovery\MUITransfer

\MUIStartMenu.exe" "C:\Program Files (x86)\Hewlett-Packard\Recovery" UpdateWithCreateOnce

"Software\CyberLink\PowerRecover"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
mRun: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant

\HPWAMain.exe
mRun: [Nikon Transfer Monitor] C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [Adobe Photo Downloader] "C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\apdproxy.exe"
mRun: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat

\Acrobat_sl.exe"
mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe"
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader

\Reader_sl.exe"
mRun: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support

\AppleSyncNotifier.exe
mRun: [AW TrayIcon] RunDll32.exe "C:\Program Files (x86)\ArcadeWeb\arcadeweb32.dll", RunTrayIcon
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support

\APSDaemon.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
mRun: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager

\CS6ServiceManager.exe" -launchedbylogin
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
dRunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1

/errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
StartupFolder: C:\Users\Owner\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup

\ROLLER~1.LNK - C:\Users\Owner\AppData\Local\Temp\{AC697783-2D91-4EE4-AA9F-

6EEB55AF3EE3}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
uPolicies-System: WallpaperStyle = 2
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: PromptOnSecureDesktop = dword:0
mPolicies-System: WallpaperStyle = 2
IE: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr/200
IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat

\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX

\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX

\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX

\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000
IE: StumbleUpon PhotoBlog It! - StumbleUponIEBar.dll/blogimage
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program

Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support

Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program

Files (x86)\Microsoft Office\Office12\ONBttnIE.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program

Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program

Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} -

hxxp://www.worldwinner.com/games/v47/shared/FunGamesLoader.cab
DPF: {62969CF2-0F7A-433B-A221-FD8818C06C2F} -

hxxp://www.worldwinner.com/games/v49/blockwerx/blockwerx.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} -

hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} -

hxxp://www.worldwinner.com/games/shared/wwlaunch.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14

-windows-i586.cab
DPF: {8F6E7FB2-E56B-4F66-A4E1-9765D2565280} -

hxxp://www.worldwinner.com/games/launcher/ie/v2.22.01.0/iewwload.cab
DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14

-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14

-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} -

hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{E47759E7-E309-405B-A1AD-01B48F621521} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{E47759E7-E309-405B-A1AD-01B48F621521}\2456C6B696E6E233447393 : DHCPNameServer =

192.168.2.1
TCP: Interfaces\{E47759E7-E309-405B-A1AD-01B48F621521}\2535944454032353 : DHCPNameServer =

192.168.5.1 208.67.222.222 208.67.220.220
TCP: Interfaces\{E47759E7-E309-405B-A1AD-01B48F621521}\2656C6B696E6534376 : DHCPNameServer =

192.168.2.1 208.180.42.100 208.180.42.68
TCP: Interfaces\{E47759E7-E309-405B-A1AD-01B48F621521}\47865644D27457563747F575966696 :

DHCPNameServer = 8.8.8.8 8.8.4.4 4.2.2.2
TCP: Interfaces\{E47759E7-E309-405B-A1AD-01B48F621521}\84F6C69646169702140513 : DHCPNameServer =

192.168.0.1 4.2.2.4 4.2.2.5
TCP: Interfaces\{E47759E7-E309-405B-A1AD-01B48F621521}\84F6C69646169702140523 : DHCPNameServer =

192.168.0.1 4.2.2.4 4.2.2.5
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files

(x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common

Files\Skype\Skype4COM.dll
SSODL: WebCheck - <orphaned>
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files

\LightScribe\LSRunOnce.exe"
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome

\Application\29.0.1547.57\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --

system-level --multi-install --chrome
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program

Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files

(x86)\Google\Google Toolbar\GoogleToolbar_64.dll
x64-BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program

Files\Java\jre6\bin\jp2ssv.dll
x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google

\Google Toolbar\GoogleToolbar_64.dll
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe /background
x64-Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
x64-Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
x64-Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe
x64-Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA

\UpdaterStartupUtility.exe"
x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-

1_6_0_14-windows-i586.cab
x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - <orphaned>
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
============= SERVICES / DRIVERS ===============
.
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2012-7-10 55856]
R2 AdobeActiveFileMonitor10.0;Adobe Active File Monitor V10;C:\Program Files (x86)\Adobe\Elements

10 Organizer\PhotoshopElementsFileAgent.exe [2011-9-14 169624]
R2 AESTFilters;Andrea ST Filters Service;C:\Windows\System32\DriverStore\FileRepository

\stwrt64.inf_amd64_neutral_b87ff64c8b56b7db\AESTSr64.exe [2010-4-1 89600]
R2 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-6-15 249648]
R2 DefaultTabSearch;DefaultTabSearch;C:\Program Files (x86)\DefaultTab\DefaultTabSearch.exe

[2013-2-11 572928]
R2 DefaultTabUpdate;DefaultTabUpdate;C:\Users\Owner\AppData\Roaming\DefaultTab\DefaultTab

\DTUpdate.exe [2012-10-10 107520]
R2 FastFreeConverterUpdt;FastFreeConverterUpdt;C:\Program Files (x86)\Fast Free Converter

\FastFreeConverterUpdt.exe [2012-11-26 687104]
R2 HP Support Assistant Service;HP Support Assistant Service;C:\Program Files (x86)\Hewlett-

Packard\HP Support Framework\HPSA_Service.exe [2012-9-27 86528]
R2 hpsrv;HP Service;C:\Windows\System32\hpservice.exe [2009-7-8 30520]
R2 tmpreflt;tmpreflt;C:\Windows\System32\drivers\tmpreflt.sys [2013-6-25 42768]
R2 TmProxy;Trend Micro Proxy Service;C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

[2010-1-9 900360]
R3 Com4QLBEx;Com4QLBEx;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons

\Com4QLBEx.exe [2009-8-9 228408]
R3 enecir;ENE CIR Receiver;C:\Windows\System32\drivers\enecir.sys [2009-6-29 70656]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;C:\Windows\System32\drivers

\IntcHdmi.sys [2010-4-1 139264]
R3 NETw5s64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;C:

\Windows\System32\drivers\NETw5s64.sys [2010-1-13 7675392]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows

\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows

\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-4-19 161384]
S3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-7-7

195336]
S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App

\GamesAppService.exe [2010-10-12 206072]
S3 NETw1v64;Intel® Wireless WiFi Link 1000 Series Adapter Driver for Windows Vista 64 Bit;C:

\Windows\System32\drivers\NETw1v64.sys [2009-8-25 7058432]
S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:

\Windows\System32\drivers\netw5v64.sys [2009-6-10 5434368]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2009

-8-25 216576]
S3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2010-6-23 344680]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\System32\drivers\VSTAZL6.SYS [2009-7-13 292864]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\System32\drivers\VSTDPV6.SYS [2009-7-13 1485312]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\System32\drivers\VSTCNXT6.SYS [2009-7-13 740864]
S3 StumbleUponUpdateService;StumbleUponUpdateService;C:\Program Files (x86)\StumbleUpon

\StumbleUponUpdateService.exe [2010-4-7 120232]
S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard

\SwitchBoard.exe [2010-2-19 517096]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-6-30 59392]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-12-13 54784]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe

[2010-2-25 1255736]
S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\drivers\wdcsam64.sys [2008-5-6 14464]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows

\System32\drivers\yk62x64.sys [2009-6-10 389120]
.
=============== Created Last 30 ================
.
2013-08-26 02:48:04 -------- d-----w- C:\AdwCleaner
2013-08-25 08:26:43 -------- d-----w- C:\Windows\System32\MRT
2013-08-25 06:56:15 -------- d-----w- C:\Users\Owner\AppData\Local\Programs
2013-08-25 06:43:46 -------- d-----w- C:\Users\Owner\AppData\Local\{052CFAFB-

1DDF-4BEE-BE4F-FF81C6FDE842}
2013-08-25 06:38:24 -------- d-sh--w- C:\found.001
2013-08-23 05:39:20 -------- d-----w- C:\Users\Owner\AppData\Local\{AA4FE9DC-

9421-4A41-83E6-0D6955BFECF9}
2013-08-23 05:38:14 824 ----a-w- C:\Windows\System32\drivers\etc\tmvsthfss.bin
2013-08-23 01:04:11 224256 ----a-w- C:\Windows\System32\wintrust.dll
2013-08-23 01:04:11 184320 ----a-w- C:\Windows\System32\cryptsvc.dll
2013-08-23 01:04:11 175104 ----a-w- C:\Windows\SysWow64\wintrust.dll
2013-08-23 01:04:11 1472512 ----a-w- C:\Windows\System32\crypt32.dll
2013-08-23 01:04:11 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll
2013-08-23 01:04:11 139776 ----a-w- C:\Windows\System32\cryptnet.dll
2013-08-23 01:04:11 1166848 ----a-w- C:\Windows\SysWow64\crypt32.dll
2013-08-23 01:04:11 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll
2013-08-23 01:03:48 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2013-08-23 01:03:48 2048 ----a-w- C:\Windows\System32\tzres.dll
2013-08-23 01:03:29 1888768 ----a-w- C:\Windows\System32\WMVDECOD.DLL
2013-08-23 01:03:29 1620992 ----a-w- C:\Windows\SysWow64\WMVDECOD.DLL
2013-08-23 01:03:22 1217024 ----a-w- C:\Windows\System32\rpcrt4.dll
2013-08-23 01:03:21 663552 ----a-w- C:\Windows\SysWow64\rpcrt4.dll
2013-08-23 01:03:14 624128 ----a-w- C:\Windows\System32\qedit.dll
2013-08-23 01:03:14 509440 ----a-w- C:\Windows\SysWow64\qedit.dll
2013-08-23 01:03:11 39936 ----a-w- C:\Windows\System32\drivers\tssecsrv.sys
2013-08-23 01:02:47 3153920 ----a-w- C:\Windows\System32\win32k.sys
2013-08-23 01:02:40 936448 ----a-w- C:\Program Files (x86)\Common Files\Microsoft

Shared\ink\journal.dll
2013-08-23 01:02:40 1367040 ----a-w- C:\Program Files\Common Files\Microsoft Shared

\ink\journal.dll
2013-08-23 01:02:32 1910208 ----a-w- C:\Windows\System32\drivers\tcpip.sys
2013-08-23 01:02:25 1643520 ----a-w- C:\Windows\System32\DWrite.dll
2013-08-23 01:02:25 1247744 ----a-w- C:\Windows\SysWow64\DWrite.dll
.
==================== Find3M  ====================
.
2013-08-22 02:22:02 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-08-22 02:22:02 692104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-07-26 05:13:37 2241024 ----a-w- C:\Windows\System32\wininet.dll
2013-07-26 05:12:08 3958784 ----a-w- C:\Windows\System32\jscript9.dll
2013-07-26 05:12:04 136704 ----a-w- C:\Windows\System32\iesysprep.dll
2013-07-26 05:12:03 67072 ----a-w- C:\Windows\System32\iesetup.dll
2013-07-26 03:35:08 2706432 ----a-w- C:\Windows\System32\mshtml.tlb
2013-07-26 03:13:24 1767936 ----a-w- C:\Windows\SysWow64\wininet.dll
2013-07-26 03:12:04 2877440 ----a-w- C:\Windows\SysWow64\jscript9.dll
2013-07-26 03:12:00 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll
2013-07-26 03:12:00 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll
2013-07-26 02:49:14 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2013-07-26 02:39:38 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe
2013-07-26 01:59:38 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe
2013-06-29 20:05:18 128512 ----a-w- C:\Windows\RegBootClean64.exe
2013-06-29 20:05:18 12800 ----a-w- C:\Windows\DCEBoot64.exe
.
============= FINISH: 11:44:04.54 ===============

 

 

Attached Files



BC AdBot (Login to Remove)

 


#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,773 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:07:48 PM

Posted 27 August 2013 - 12:14 PM





Hello amandaDOUCET28

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

  • Please do not run any tools unless instructed to do so.
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
  • Please do not attach logs or use code boxes, just copy and paste the text.
    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
  • Please read every post completely before doing anything.
    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
  • Please provide feedback about your experience as we go.
    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.
NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

I would like you to run this program for me.

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 amandaDOUCET28

amandaDOUCET28
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:06:48 PM

Posted 27 August 2013 - 07:04 PM

I will try this as soon as I get kiddos to bed tonight, thank you.

Amanda



#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,773 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:07:48 PM

Posted 27 August 2013 - 08:47 PM

No problem and I will look for you later



gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#5 amandaDOUCET28

amandaDOUCET28
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:06:48 PM

Posted 27 August 2013 - 11:41 PM

Just finished running

FRST log results

can result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-08-2013
Ran by Owner (administrator) on 27-08-2013 23:35:34
Running from C:\Users\Owner\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository

\stwrt64.inf_amd64_neutral_b87ff64c8b56b7db\STacSV64.exe
(Hewlett-Packard) C:\Windows\system32\Hpservice.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\BM\TMBMSRV.exe
() C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository

\stwrt64.inf_amd64_neutral_b87ff64c8b56b7db\AESTSr64.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support

\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files (x86)\DefaultTab\DefaultTabSearch.exe
() C:\Users\Owner\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe
() C:\Program Files (x86)\Fast Free Converter\FastFreeConverterUpdt.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
(Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jusched.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe

\LightScribeControlPanel.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(CyberLink) c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
(CyberLink Corp.) c:\Program Files (x86)\Hewlett-Packard\Media\DVD\DVDAgent.exe
(Yahoo! Inc) C:\Program Files (x86)\Yahoo!\Search Protection\SearchProtection.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 10 Organizer

\ElementsOrganizerSyncAgent.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick

Launch Buttons\QLBCtrl.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Java\jre6\bin\jusched.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
(Nikon Corporation) C:\Program Files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Photoshop Elements 5.0\apdproxy.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 10 Organizer

\PhotoshopElementsFileAgent.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework

\hpsa_service.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick

Launch Buttons\Com4QLBEx.exe
() C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe
(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\Messenger\ymsgr_tray.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates

Notifier.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(We-Care.com) C:\ProgramData\WeCareReminder\ReminderHelper.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash

\FlashUtil64_11_8_800_94_ActiveX.exe
(Google Inc.) C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\SwitchBoard

\SwitchBoard.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager

\CS6ServiceManager.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1814312 2010-04-01]

(Synaptics Incorporated)
HKLM\...\Run: [SmartMenu] - C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe [610872

2009-07-21] ()
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Java\jre6\bin\jusched.exe [171520 2009-08-

09] (Sun Microsystems, Inc.)
HKLM\...\Run: [UfSeAgnt.exe] - C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe

[973952 2008-12-29] (Trend Micro Inc.)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [456192 2010-04-01] (IDT,

Inc.)
HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe

[186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA

\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] C:\$Recycle.Bin\S-1-5-18\

$62c84f77987b450cf5fd00ddcaad417b\n. ATTENTION! ====> ZeroAccess?
HKCU\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe

[1668664 2009-10-25] (Hewlett-Packard)
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe

\LightScribeControlPanel.exe [2363392 2009-06-17] (Hewlett-Packard Company)
HKCU\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [4240760

2010-11-10] (Microsoft Corporation)
HKCU\...\Run: [Messenger (Yahoo!)] - C:\PROGRA~2\Yahoo!\Messenger\YahooMessenger.exe [5244216

2009-11-10] (Yahoo! Inc.)
HKCU\...\Run: [Search Protection] - C:\Program Files (x86)\Yahoo!\Search Protection

\SearchProtection.exe [111856 2009-02-23] (Yahoo! Inc)
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier

\GoogleToolbarNotifier.exe [39408 2010-11-10] (Google Inc.)
HKCU\...\Run: [PhotoshopElements8SyncAgent] - C:\Program Files (x86)\Adobe\Elements 10 Organizer

\ElementsOrganizerSyncAgent.exe [1954456 2011-09-14] (Adobe Systems Incorporated)
HKCU\...\Run: [AdobeBridge] -  [x]
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype

Technologies S.A.)
HKCR\...409d6c4515e9\InprocServer32: [Default-shell32] C:\Users\Owner\AppData\Local\Temp\srsahjp

\sqyoity\wow64.dll ATTENTION! ====> ZeroAccess?
HKCU\...\Policies\system: [WallpaperStyle] 2
MountPoints2: {1b97d966-8fba-11e0-b968-f6053be19e81} - F:\TL_Bootstrap.exe
MountPoints2: {e0a55bbb-48a1-11df-9844-806e6f6e6963} - E:\AutoStart.exe
HKLM-x32\...\Run: [HPCam_Menu] - c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer

\MUIStartMenu.exe [218408 2009-02-25] (CyberLink Corp.)
HKLM-x32\...\Run: [QlbCtrl.exe] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons

\QlbCtrl.exe [323640 2009-11-24] ( Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [UpdatePRCShortCut] - C:\Program Files (x86)\Hewlett-Packard\Recovery

\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Java\jre6\bin\jusched.exe [148888

2009-08-09] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update

\HPWuSchd2.exe [54576 2008-12-08] (Hewlett-Packard)
HKLM-x32\...\Run: [WirelessAssistant] - C:\Program Files (x86)\Hewlett-Packard\HP Wireless

Assistant\HPWAMain.exe [498744 2009-07-23] (Hewlett-Packard)
HKLM-x32\...\Run: [Nikon Transfer Monitor] - C:\Program Files (x86)\Common Files\Nikon\Monitor

\NkMonitor.exe [479232 2009-02-24] (Nikon Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[932288 2010-09-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Photo Downloader] - C:\Program Files (x86)\Adobe\Photoshop Elements

5.0\apdproxy.exe [61440 2006-09-14] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat

10.0\Acrobat\Acrobat_sl.exe [36760 2011-01-30] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat

\Acrotray.exe [821144 2011-01-30] (Adobe Systems Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader

10.0\Reader\Reader_sl.exe [35736 2011-01-30] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device

Support\AppleSyncNotifier.exe [59240 2011-09-27] (Apple Inc.)
HKLM-x32\...\Run: [AW TrayIcon] - RunDll32.exe "C:\Program Files (x86)\ArcadeWeb

\arcadeweb32.dll", RunTrayIcon [x]
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application

Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2011-10

-24] (Apple Inc.)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard

\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - C:\Program Files (x86)\Common Files\Adobe

\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-

05-31] (Apple Inc.)
HKU\Default\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor

\HPAdvisor.exe [1668664 2009-10-25] (Hewlett-Packard)
HKU\Default\...\Policies\system: [WallpaperStyle] 2
HKU\Default User\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor

\HPAdvisor.exe [1668664 2009-10-25] (Hewlett-Packard)
HKU\Default User\...\Policies\system: [WallpaperStyle] 2
Startup: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

\RollerCoaster Tycoon 3 Registration.lnk
ShortcutTarget: RollerCoaster Tycoon 3 Registration.lnk -> C:\Users\Owner\AppData\Local\Temp

\{AC697783-2D91-4EE4-AA9F-6EEB55AF3EE3}\{907B4640-266B-4A21-92FB-CD1A86CD0F63}\ATR1.exe (No File)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?

ocid=UP74DHP&pc=UP74&dt=042013
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_US&c=94&bd=bestbuy&pf=cnnb
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Restore =

http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_US&c=94&bd=bestbuy&pf=cnnb
URLSearchHook: (No Name) - {f78bf7a8-cf12-4de7-a6da-c463d1b539a7} -  No File
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {0809851D-6B6B-49C8-93A3-D43B32E2A276} URL = http://www.ask.com/web?q=

{searchterms}&l=dis&o=ushpl
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0809851D-6B6B-49C8-93A3-D43B32E2A276} URL = http://www.ask.com/web?q=

{searchterms}&l=dis&o=ushpl
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL =

http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2438727
SearchScopes: HKCU - DefaultScope {86356C2B-90A8-42E5-9E3F-A23327DA6153} URL =

http://www.bing.com/search?FORM=UP74DF&PC=UP74&dt=042013&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKCU - {00E3EDBD-9BD9-42D7-BA93-8B5DE4C739EF} URL =

http://ws.infospace.com/playsushi_tbar/ws/redir?_iceUrl=true& user_id=%userid&tool_id=60231&qkw=

{searchTerms}
SearchScopes: HKCU - {0809851D-6B6B-49C8-93A3-D43B32E2A276} URL = http://www.ask.com/web?q=

{searchterms}&l=dis&o=ushpl
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL =

http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2438727
SearchScopes: HKCU - {DECA3892-BA8F-44b8-A993-A466AD694AE4} URL =

http://search.yahoo.com/search?p={searchTerms}
SearchScopes: HKCU - {EA2F8311-576D-4753-A041-1600F1F58179} URL =

http://www.mysearchresults.com/search?&c=2641&t=03&q={searchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files

\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files

(x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files

\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files

(x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: AOL Toolbar Loader - {3ef64538-8b54-4573-b48f-4d34b0238ab2} - C:\Program Files (x86)\AOL

Toolbar\aoltb.dll (AOL Inc.)
BHO-x32: Fast Free Converter 4.0 - {4B72B1CE-C6E4-4089-89AF-1D01198E8B88} - C:

\PROGRA~2\FASTFR~1\FASTFR~1\FASTFR~1.DLL (Fast Free Converter)
BHO-x32: ArcadeWeb Class - {78919608-B066-4B5A-B248-38E12A783E05} - C:\Program Files

(x86)\ArcadeWeb\arcadeweb32.dll No File
BHO-x32: DefaultTab Browser Helper - {7F6AFBF1-E065-4627-A2FD-810366367D01} - C:\Users\Owner

\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabBHO.dll (Search Results LLC.)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program

Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Search Toolbar - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files (x86)\Search

Toolbar\SearchToolbar.dll ()
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files

(x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:

\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems

Incorporated)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files

(x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Dogpile Bundle Toolbar BHO - {BFE4B5CB-63F7-4A51-9266-6167655D5B4F} - C:\Program Files

(x86)\Dogpile Bundle Toolbar\Toolbar.dll ()
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files

(x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: WeCareReminder Class - {D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} - C:\ProgramData

\WeCareReminder\IEHelperv2.5.0.dll (We-Care.com)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files

(x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll

(Hewlett-Packard)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files

(x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files

(x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files

(x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Search Toolbar - {9D425283-D487-4337-BAB6-AB8354A81457} - C:\Program Files

(x86)\Search Toolbar\SearchToolbar.dll ()
Toolbar: HKLM-x32 - Dogpile Bundle Toolbar - {C80BDEB2-8735-44C6-BD55-A1CCD555667A} - C:\Program

Files (x86)\Dogpile Bundle Toolbar\Toolbar.dll ()
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files

(x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - AOL Toolbar - {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - C:\Program Files

(x86)\AOL Toolbar\aoltb.dll (AOL Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files

(x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files

(x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Toolbar: HKCU - No Name - {C80BDEB2-8735-44C6-BD55-A1CCD555667A} -  No File
Toolbar: HKCU - No Name - {BA00B7B1-0351-477A-B948-23E3EE5A73D4} -  No File
DPF: HKLM-x32 {1A1F56AA-3401-46F9-B277-D57F3421F821}

http://www.worldwinner.com/games/v47/shared/FunGamesLoader.cab
DPF: HKLM-x32 {62969CF2-0F7A-433B-A221-FD8818C06C2F}

http://www.worldwinner.com/games/v49/blockwerx/blockwerx.cab
DPF: HKLM-x32 {8100D56A-5661-482C-BEE8-AFECE305D968}

http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: HKLM-x32 {8A94C905-FF9D-43B6-8708-F0F22D22B1CB}

http://www.worldwinner.com/games/shared/wwlaunch.cab
DPF: HKLM-x32 {8F6E7FB2-E56B-4F66-A4E1-9765D2565280}

http://www.worldwinner.com/games/launcher/ie/v2.22.01.0/iewwload.cab
DPF: HKLM-x32 {9C23D886-43CB-43DE-B2DB-112A68D7E10A}

http://lads.myspace.com/upload/MySpaceUploader2.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7}

http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files (x86)\Common

Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files

(x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype

\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}

{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}

{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}

{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?

{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&

{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application

\29.0.1547.57\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application

\29.0.1547.57\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application

\29.0.1547.57\gcswf32.dll No File
CHR Plugin: (ArcadeWeb Plugin) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default

\Extensions\hgailgaldchajpkkmbjdlbimhdnmmgld\arcadewebchrome.dll (ArcadeWeb)
CHR Plugin: (Skype Toolbars) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default

\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\npSkypeChromePlugin.dll (Skype

Technologies S.A.)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll

(Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.140.8) - C:\Program Files (x86)\Java\jre6\bin

\new_plugin\npdeploytk.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java™ Platform SE 6 U14) - C:\Program Files (x86)\Java\jre6\bin\new_plugin

\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll

(Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll

(Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll

(Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll

(Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll

(Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll

(Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll

(Apple Inc.)
CHR Plugin: (NPCIG.dll) - C:\Program Files (x86)\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON

INC.)
CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll

No File
CHR Plugin: (WildTangent Games App Presence Detector) - C:\Program Files (x86)\WildTangent Games

\App\BrowserIntegration\Registered\11\NP_wtapp.dll No File
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins

\npitunes.dll ()
CHR Plugin: (BrowserPlus (from Yahoo!) v2.9.8) - C:\Users\Owner\AppData\Local\Yahoo!\BrowserPlus

\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight

\4.1.10111.0\npctrl.dll No File
CHR Extension: (Entanglement) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default

\Extensions\aciahcmjmecflokailenpkdchphgkefd\2.7.9_0
CHR Extension: (SavingsApp) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default

\Extensions\bbohlimhkgnnphbdkghkbcjojoafohoa\1.23.95_0
CHR Extension: () - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions

\hgailgaldchajpkkmbjdlbimhdnmmgld\arcadewebchrome.dll
CHR Extension: (We-Care.com Reminder) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data

\Default\Extensions\ippkomaaonokjnfjoikaemidanojkfmm\1.0.0.34_0
CHR Extension: (DefaultTab) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default

\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc\1.1.19_0
CHR Extension: (Skype Click to Call) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data

\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0
CHR Extension: (Poppit) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default

\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi\2.2_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\Owner\AppData\Local\Google\Chrome\User

Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR HKLM-x32\...\Chrome\Extension: [bbohlimhkgnnphbdkghkbcjojoafohoa] - C:\Users\Owner\AppData

\Local\SavingsApp\Chrome\SavingsApp.crx
CHR HKLM-x32\...\Chrome\Extension: [ippkomaaonokjnfjoikaemidanojkfmm] - C:\ProgramData

\WeCareReminder\\wecarereminderro.crx
CHR HKLM-x32\...\Chrome\Extension: [kdidombaedgpfiiedeimiebkmbilgmlc] - C:\Program Files

(x86)\DefaultTab\DefaultTab.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files

(x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx

==================== Services (Whitelisted) =================

R2 AdobeActiveFileMonitor10.0; C:\Program Files (x86)\Adobe\Elements 10 Organizer

\PhotoshopElementsFileAgent.exe [169624 2011-09-14] (Adobe Systems Incorporated)
R2 AdobeActiveFileMonitor5.0; C:\Program Files (x86)\Adobe\Photoshop Elements

5.0\PhotoshopElementsFileAgent.exe [102400 2006-09-14] ()
R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository

\stwrt64.inf_amd64_neutral_b87ff64c8b56b7db\AESTSr64.exe [89600 2010-04-01] (Andrea Electronics

Corporation)
R2 DefaultTabSearch; C:\Program Files (x86)\DefaultTab\DefaultTabSearch.exe [572928 2013-02-11]

()
R2 DefaultTabUpdate; C:\Users\Owner\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe [107520

2012-10-10] ()
R2 FastFreeConverterUpdt; C:\Program Files (x86)\Fast Free Converter\FastFreeConverterUpdt.exe

[687104 2012-11-26] ()
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-01-21] ()
R2 SfCtlCom; C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe [833872 2008-12-29]

(Trend Micro Inc.)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository

\stwrt64.inf_amd64_neutral_b87ff64c8b56b7db\STacSV64.exe [240640 2010-04-01] (IDT, Inc.)
S3 StumbleUponUpdateService; C:\Program Files (x86)\StumbleUpon\StumbleUponUpdateService.exe

[120232 2010-04-07] (stumbleupon.com)
R2 TMBMServer; C:\Program Files\Trend Micro\BM\TMBMSRV.exe [564488 2008-12-29] (Trend Micro Inc.)
R2 TmProxy; C:\Program Files\Trend Micro\Internet Security\TmProxy.exe [900360 2008-12-29] (Trend

Micro Inc.)

==================== Drivers (Whitelisted) ====================

S1 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-13] (Brother Industries Ltd.)
R2 tmpreflt; C:\Windows\System32\DRIVERS\tmpreflt.sys [42768 2011-07-12] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [96784 2008-12-29] (Trend Micro Inc.)
R2 tmxpflt; C:\Windows\System32\DRIVERS\tmxpflt.sys [342288 2011-07-12] (Trend Micro Inc.)
S3 usbbus; C:\Windows\System32\DRIVERS\lgx64bus.sys [17920 2008-11-11] (LG Electronics Inc.)
S3 UsbDiag; C:\Windows\System32\DRIVERS\lgx64diag.sys [27136 2008-11-11] (LG Electronics Inc.)
S3 USBModem; C:\Windows\System32\DRIVERS\lgx64modem.sys [33792 2008-11-11] (LG Electronics Inc.)
R2 vsapint; C:\Windows\System32\DRIVERS\vsapint.sys [2077456 2011-07-12] (Trend Micro Inc.)
U4 eabfiltr;
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [x]
U2 TMAgent;
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-08-27 23:19 - 2013-08-27 23:19 - 01579080 _____ (Farbar) C:\Users\Owner\Desktop\FRST64.exe
2013-08-26 11:44 - 2013-08-26 11:46 - 00015778 _____ C:\Users\Owner\Desktop\attach.txt
2013-08-26 11:44 - 2013-08-26 11:45 - 00026621 _____ C:\Users\Owner\Desktop\dds.txt
2013-08-26 11:41 - 2013-08-26 11:41 - 00688992 ____R (Swearware) C:\Users\Owner\Desktop\dds.com
2013-08-25 22:06 - 2013-08-25 22:06 - 00028293 _____ C:\Users\Owner\Documents\Result.txt
2013-08-25 22:03 - 2013-08-25 22:03 - 00760937 _____ (Farbar) C:\Users\Owner\Documents

\MiniToolBox.exe
2013-08-25 21:52 - 2013-08-25 21:52 - 00004858 _____ C:\Users\Owner\Documents\FSS.txt
2013-08-25 21:48 - 2013-08-25 21:49 - 00000000 ____D C:\AdwCleaner
2013-08-25 21:44 - 2013-08-25 21:44 - 00001924 _____ C:\Users\Owner\Documents\tdsskiller -

Shortcut.lnk
2013-08-25 11:14 - 2013-08-25 11:14 - 00358507 _____ (Farbar) C:\Users\Owner\Documents\FSS.exe
2013-08-25 11:13 - 2013-08-25 11:13 - 00994642 _____ C:\Users\Owner\Documents\AdwCleaner.exe
2013-08-25 11:12 - 2013-08-25 11:12 - 02748256 _____ (Kaspersky Lab ZAO) C:\Users\Owner

\Documents\tdsskiller.exe
2013-08-25 03:36 - 2013-07-26 00:13 - 02241024 _____ (Microsoft Corporation) C:\Windows

\system32\wininet.dll
2013-08-25 03:36 - 2013-07-26 00:13 - 01365504 _____ (Microsoft Corporation) C:\Windows

\system32\urlmon.dll
2013-08-25 03:36 - 2013-07-26 00:13 - 00051712 _____ (Microsoft Corporation) C:\Windows

\system32\ie4uinit.exe
2013-08-25 03:36 - 2013-07-26 00:12 - 19239424 _____ (Microsoft Corporation) C:\Windows

\system32\mshtml.dll
2013-08-25 03:36 - 2013-07-26 00:12 - 15405056 _____ (Microsoft Corporation) C:\Windows

\system32\ieframe.dll
2013-08-25 03:36 - 2013-07-26 00:12 - 03958784 _____ (Microsoft Corporation) C:\Windows

\system32\jscript9.dll
2013-08-25 03:36 - 2013-07-26 00:12 - 02647040 _____ (Microsoft Corporation) C:\Windows

\system32\iertutil.dll
2013-08-25 03:36 - 2013-07-26 00:12 - 00855552 _____ (Microsoft Corporation) C:\Windows

\system32\jscript.dll
2013-08-25 03:36 - 2013-07-26 00:12 - 00603136 _____ (Microsoft Corporation) C:\Windows

\system32\msfeeds.dll
2013-08-25 03:36 - 2013-07-26 00:12 - 00526336 _____ (Microsoft Corporation) C:\Windows

\system32\ieui.dll
2013-08-25 03:36 - 2013-07-26 00:12 - 00136704 _____ (Microsoft Corporation) C:\Windows

\system32\iesysprep.dll
2013-08-25 03:36 - 2013-07-26 00:12 - 00067072 _____ (Microsoft Corporation) C:\Windows

\system32\iesetup.dll
2013-08-25 03:36 - 2013-07-26 00:12 - 00053760 _____ (Microsoft Corporation) C:\Windows

\system32\jsproxy.dll
2013-08-25 03:36 - 2013-07-26 00:12 - 00039936 _____ (Microsoft Corporation) C:\Windows

\system32\iernonce.dll
2013-08-25 03:36 - 2013-07-25 22:35 - 02706432 _____ (Microsoft Corporation) C:\Windows

\system32\mshtml.tlb
2013-08-25 03:36 - 2013-07-25 22:13 - 01767936 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\wininet.dll
2013-08-25 03:36 - 2013-07-25 22:13 - 01141248 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\urlmon.dll
2013-08-25 03:36 - 2013-07-25 22:12 - 14329344 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\mshtml.dll
2013-08-25 03:36 - 2013-07-25 22:12 - 02877440 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\jscript9.dll
2013-08-25 03:36 - 2013-07-25 22:12 - 02048512 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\iertutil.dll
2013-08-25 03:36 - 2013-07-25 22:12 - 00690688 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\jscript.dll
2013-08-25 03:36 - 2013-07-25 22:12 - 00493056 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\msfeeds.dll
2013-08-25 03:36 - 2013-07-25 22:12 - 00391168 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\ieui.dll
2013-08-25 03:36 - 2013-07-25 22:12 - 00109056 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\iesysprep.dll
2013-08-25 03:36 - 2013-07-25 22:12 - 00061440 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\iesetup.dll
2013-08-25 03:36 - 2013-07-25 22:12 - 00039936 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\jsproxy.dll
2013-08-25 03:36 - 2013-07-25 22:11 - 13761024 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\ieframe.dll
2013-08-25 03:36 - 2013-07-25 22:11 - 00033280 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\iernonce.dll
2013-08-25 03:36 - 2013-07-25 21:49 - 02706432 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\mshtml.tlb
2013-08-25 03:36 - 2013-07-25 21:39 - 00089600 _____ (Microsoft Corporation) C:\Windows

\system32\RegisterIEPKEYs.exe
2013-08-25 03:36 - 2013-07-25 20:59 - 00071680 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\RegisterIEPKEYs.exe
2013-08-25 03:26 - 2013-08-25 03:30 - 00000000 ____D C:\Windows\system32\MRT
2013-08-25 01:56 - 2013-08-25 01:56 - 00001073 _____ C:\Users\Public\Desktop\Malwarebytes Anti-

Malware.lnk
2013-08-25 01:43 - 2013-08-25 01:43 - 00000000 ____D C:\Users\Owner\AppData\Local\{052CFAFB-

1DDF-4BEE-BE4F-FF81C6FDE842}
2013-08-25 01:38 - 2013-08-25 01:38 - 00000000 __SHD C:\found.001
2013-08-23 00:39 - 2013-08-23 00:39 - 00000000 ____D C:\Users\Owner\AppData\Local\{AA4FE9DC-9421

-4A41-83E6-0D6955BFECF9}
2013-08-23 00:38 - 2013-08-25 21:08 - 00000824 _____ C:\Windows\system32\Drivers\etc

\tmvsthfss.bin
2013-08-22 21:25 - 2013-08-22 21:25 - 00000258 __RSH C:\Users\Owner\ntuser.pol
2013-08-22 20:04 - 2013-07-09 00:52 - 00224256 _____ (Microsoft Corporation) C:\Windows

\system32\wintrust.dll
2013-08-22 20:04 - 2013-07-09 00:46 - 01472512 _____ (Microsoft Corporation) C:\Windows

\system32\crypt32.dll
2013-08-22 20:04 - 2013-07-09 00:46 - 00184320 _____ (Microsoft Corporation) C:\Windows

\system32\cryptsvc.dll
2013-08-22 20:04 - 2013-07-09 00:46 - 00139776 _____ (Microsoft Corporation) C:\Windows

\system32\cryptnet.dll
2013-08-22 20:04 - 2013-07-08 23:52 - 00175104 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\wintrust.dll
2013-08-22 20:04 - 2013-07-08 23:46 - 01166848 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\crypt32.dll
2013-08-22 20:04 - 2013-07-08 23:46 - 00140288 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\cryptsvc.dll
2013-08-22 20:04 - 2013-07-08 23:46 - 00103936 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\cryptnet.dll
2013-08-22 20:03 - 2013-07-25 04:25 - 01888768 _____ (Microsoft Corporation) C:\Windows

\system32\WMVDECOD.DLL
2013-08-22 20:03 - 2013-07-25 03:57 - 01620992 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\WMVDECOD.DLL
2013-08-22 20:03 - 2013-07-18 20:58 - 00002048 _____ (Microsoft Corporation) C:\Windows

\system32\tzres.dll
2013-08-22 20:03 - 2013-07-18 20:41 - 00002048 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\tzres.dll
2013-08-22 20:03 - 2013-07-09 00:51 - 01217024 _____ (Microsoft Corporation) C:\Windows

\system32\rpcrt4.dll
2013-08-22 20:03 - 2013-07-08 23:52 - 00663552 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\rpcrt4.dll
2013-08-22 20:03 - 2013-06-14 23:32 - 00039936 _____ (Microsoft Corporation) C:\Windows

\system32\Drivers\tssecsrv.sys
2013-08-22 20:03 - 2013-06-04 01:00 - 00624128 _____ (Microsoft Corporation) C:\Windows

\system32\qedit.dll
2013-08-22 20:03 - 2013-06-03 23:53 - 00509440 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\qedit.dll
2013-08-22 20:02 - 2013-07-06 01:03 - 01910208 _____ (Microsoft Corporation) C:\Windows

\system32\Drivers\tcpip.sys
2013-08-22 20:02 - 2013-06-04 22:34 - 03153920 _____ (Microsoft Corporation) C:\Windows

\system32\win32k.sys
2013-08-22 20:02 - 2013-04-09 18:34 - 01247744 _____ (Microsoft Corporation) C:\Windows

\SysWOW64\DWrite.dll
2013-08-22 20:02 - 2013-04-02 17:51 - 01643520 _____ (Microsoft Corporation) C:\Windows

\system32\DWrite.dll

==================== One Month Modified Files and Folders =======

2013-08-27 23:35 - 2013-08-27 23:35 - 00000000 ____D C:\FRST
2013-08-27 23:19 - 2013-08-27 23:19 - 01579080 _____ (Farbar) C:\Users\Owner\Desktop\FRST64.exe
2013-08-27 22:55 - 2012-11-17 23:37 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player

Updater.job
2013-08-27 22:55 - 2009-08-25 03:35 - 01662559 _____ C:\Windows\WindowsUpdate.log
2013-08-27 22:42 - 2010-11-10 22:58 - 00000896 _____ C:\Windows\Tasks

\GoogleUpdateTaskMachineUA.job
2013-08-27 22:05 - 2009-07-14 00:13 - 00726444 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-27 22:04 - 2012-02-02 14:53 - 00000000 ____D C:\Users\Owner\Documents\Printables
2013-08-27 21:42 - 2010-11-10 22:58 - 00000892 _____ C:\Windows\Tasks

\GoogleUpdateTaskMachineCore.job
2013-08-26 22:56 - 2010-02-11 00:04 - 00000000 ____D C:\Users\Owner\AppData\Local\Google
2013-08-26 11:46 - 2013-08-26 11:44 - 00015778 _____ C:\Users\Owner\Desktop\attach.txt
2013-08-26 11:45 - 2013-08-26 11:44 - 00026621 _____ C:\Users\Owner\Desktop\dds.txt
2013-08-26 11:41 - 2013-08-26 11:41 - 00688992 ____R (Swearware) C:\Users\Owner\Desktop\dds.com
2013-08-26 11:16 - 2012-08-01 10:18 - 00003186 _____ C:\Windows\System32\Tasks

\HPCeeScheduleForOwner
2013-08-26 11:16 - 2012-08-01 10:18 - 00000332 _____ C:\Windows\Tasks\HPCeeScheduleForOwner.job
2013-08-26 11:16 - 2010-01-04 13:02 - 00000000 ____D C:\Users\Owner\AppData\Local\Adobe
2013-08-25 22:34 - 2010-12-26 01:10 - 00001121 _____ C:\WildTangent Games App - hp.lnk
2013-08-25 22:34 - 2010-12-26 01:09 - 00002522 ____N C:\Users\Public\Desktop\WildTangent Games

App - hp.lnk
2013-08-25 22:34 - 2010-12-26 01:09 - 00000000 ____D C:\Program Files (x86)\WildTangent Games
2013-08-25 22:06 - 2013-08-25 22:06 - 00028293 _____ C:\Users\Owner\Documents\Result.txt
2013-08-25 22:03 - 2013-08-25 22:03 - 00760937 _____ (Farbar) C:\Users\Owner\Documents

\MiniToolBox.exe
2013-08-25 21:52 - 2013-08-25 21:52 - 00004858 _____ C:\Users\Owner\Documents\FSS.txt
2013-08-25 21:49 - 2013-08-25 21:48 - 00000000 ____D C:\AdwCleaner
2013-08-25 21:44 - 2013-08-25 21:44 - 00001924 _____ C:\Users\Owner\Documents\tdsskiller -

Shortcut.lnk
2013-08-25 21:08 - 2013-08-23 00:38 - 00000824 _____ C:\Windows\system32\Drivers\etc

\tmvsthfss.bin
2013-08-25 21:08 - 2013-06-21 00:10 - 00000824 _____ C:\Windows\system32\Drivers\etc

\tmvsthfud.bin
2013-08-25 21:08 - 2009-07-13 23:51 - 00081555 _____ C:\Windows\setupact.log
2013-08-25 11:14 - 2013-08-25 11:14 - 00358507 _____ (Farbar) C:\Users\Owner\Documents\FSS.exe
2013-08-25 11:13 - 2013-08-25 11:13 - 00994642 _____ C:\Users\Owner\Documents\AdwCleaner.exe
2013-08-25 11:12 - 2013-08-25 11:12 - 02748256 _____ (Kaspersky Lab ZAO) C:\Users\Owner

\Documents\tdsskiller.exe
2013-08-25 11:01 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\rescache
2013-08-25 09:13 - 2010-10-02 01:47 - 00000000 ____D C:\Windows\Minidump
2013-08-25 08:19 - 2010-10-27 12:40 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Skype
2013-08-25 08:18 - 2010-01-11 11:47 - 00012972 _____ C:\Windows\TMFilter.log
2013-08-25 04:24 - 2009-07-13 23:45 - 00023248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012

-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-25 04:24 - 2009-07-13 23:45 - 00023248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012

-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-25 04:17 - 2010-01-04 10:59 - 00000000 ____D C:\Users\Owner\Tracing
2013-08-25 04:15 - 2009-07-14 00:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-25 04:14 - 2009-07-13 23:45 - 05164664 _____ C:\Windows\system32\FNTCACHE.DAT
2013-08-25 04:13 - 2013-03-14 14:27 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-08-25 04:13 - 2013-03-14 14:27 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-08-25 03:31 - 2009-12-27 04:11 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-25 03:30 - 2013-08-25 03:26 - 00000000 ____D C:\Windows\system32\MRT
2013-08-25 01:57 - 2011-03-07 19:02 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-

Malware
2013-08-25 01:56 - 2013-08-25 01:56 - 00001073 _____ C:\Users\Public\Desktop\Malwarebytes Anti-

Malware.lnk
2013-08-25 01:44 - 2011-03-29 11:54 - 00000000 ____D C:\Users\Owner\AppData\Local\Windows Live
2013-08-25 01:43 - 2013-08-25 01:43 - 00000000 ____D C:\Users\Owner\AppData\Local\{052CFAFB-

1DDF-4BEE-BE4F-FF81C6FDE842}
2013-08-25 01:38 - 2013-08-25 01:38 - 00000000 __SHD C:\found.001
2013-08-23 00:44 - 2010-11-29 10:59 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Apple

Computer
2013-08-23 00:44 - 2010-11-29 10:59 - 00000000 ____D C:\Users\Owner\AppData\Local\Apple Computer
2013-08-23 00:39 - 2013-08-23 00:39 - 00000000 ____D C:\Users\Owner\AppData\Local\{AA4FE9DC-9421

-4A41-83E6-0D6955BFECF9}
2013-08-22 21:25 - 2013-08-22 21:25 - 00000258 __RSH C:\Users\Owner\ntuser.pol
2013-08-22 21:25 - 2009-12-06 06:56 - 00000000 ____D C:\Users\Owner
2013-08-22 21:25 - 2009-07-13 22:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2013-08-22 21:25 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\GroupPolicy
2013-08-22 20:11 - 2009-08-09 02:00 - 00000000 ___HD C:\Program Files (x86)\InstallShield

Installation Information
2013-08-22 20:07 - 2010-01-05 11:30 - 00000000 ____D C:\Users\Owner\AppData\Roaming\Atari
2013-08-22 19:51 - 2011-01-09 19:54 - 00002062 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-21 23:06 - 2010-01-04 23:34 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-08-21 23:05 - 2011-12-21 21:33 - 00000000 _____ C:\Windows

\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-08-21 21:37 - 2010-11-10 22:58 - 00003892 _____ C:\Windows\System32\Tasks

\GoogleUpdateTaskMachineUA
2013-08-21 21:37 - 2010-11-10 22:58 - 00003640 _____ C:\Windows\System32\Tasks

\GoogleUpdateTaskMachineCore
2013-08-21 21:30 - 2011-01-25 14:00 - 00010240 _____ C:\Users\Owner\AppData\Local\DCBC2A71-70D8-

4DAN-EHR8-E0D61DEA3FDF.ini
2013-08-21 21:22 - 2012-11-17 23:37 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows

\SysWOW64\FlashPlayerApp.exe
2013-08-21 21:22 - 2012-11-17 23:37 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows

\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-21 21:22 - 2012-11-17 23:37 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player

Updater
2013-08-05 16:14 - 2010-07-04 22:46 - 78161360 _____ (Microsoft Corporation) C:\Windows

\system32\MRT.exe

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-4049356392-2155339390-2406819620-1000\$62c84f77987b450cf5fd00ddcaad417b

ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$62c84f77987b450cf5fd00ddcaad417b

Files to move or delete:
====================
C:\Users\Owner\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Owner\AppData\Local\Temp\ose00000.exe
C:\Users\Owner\AppData\Local\Temp\HP Support Framework\HPSF_Config1.dll
C:\Users\Owner\AppData\Local\Temp\D842E697-5708-44BF-82C7-58E3196C1D2E\CbsProvider.dll
C:\Users\Owner\AppData\Local\Temp\D842E697-5708-44BF-82C7-58E3196C1D2E\CompatProvider.dll
C:\Users\Owner\AppData\Local\Temp\D842E697-5708-44BF-82C7-58E3196C1D2E\DismCore.dll
C:\Users\Owner\AppData\Local\Temp\D842E697-5708-44BF-82C7-58E3196C1D2E\DismCorePS.dll
C:\Users\Owner\AppData\Local\Temp\D842E697-5708-44BF-82C7-58E3196C1D2E\DismHost.exe
C:\Users\Owner\AppData\Local\Temp\D842E697-5708-44BF-82C7-58E3196C1D2E\DismProv.dll
C:\Users\Owner\AppData\Local\Temp\D842E697-5708-44BF-82C7-58E3196C1D2E\DmiProvider.dll
C:\Users\Owner\AppData\Local\Temp\D842E697-5708-44BF-82C7-58E3196C1D2E\FolderProvider.dll
C:\Users\Owner\AppData\Local\Temp\D842E697-5708-44BF-82C7-58E3196C1D2E\IntlProvider.dll
C:\Users\Owner\AppData\Local\Temp\D842E697-5708-44BF-82C7-58E3196C1D2E\LogProvider.dll
C:\Users\Owner\AppData\Local\Temp\D842E697-5708-44BF-82C7-58E3196C1D2E\MsiProvider.dll
C:\Users\Owner\AppData\Local\Temp\D842E697-5708-44BF-82C7-58E3196C1D2E\OSProvider.dll
C:\Users\Owner\AppData\Local\Temp\D842E697-5708-44BF-82C7-58E3196C1D2E\SmiProvider.dll
C:\Users\Owner\AppData\Local\Temp\D842E697-5708-44BF-82C7-58E3196C1D2E\TransmogProvider.dll
C:\Users\Owner\AppData\Local\Temp\D842E697-5708-44BF-82C7-58E3196C1D2E\UnattendProvider.dll
C:\Users\Owner\AppData\Local\Temp\D842E697-5708-44BF-82C7-58E3196C1D2E\wdscore.dll
C:\Users\Owner\AppData\Local\Temp\D842E697-5708-44BF-82C7-58E3196C1D2E\WimProvider.dll
C:\Users\Owner\AppData\Local\Temp\89174111-208F-4B29-9DC7-AF53C690A492\CbsProvider.dll
C:\Users\Owner\AppData\Local\Temp\89174111-208F-4B29-9DC7-AF53C690A492\CompatProvider.dll
C:\Users\Owner\AppData\Local\Temp\89174111-208F-4B29-9DC7-AF53C690A492\DismCore.dll
C:\Users\Owner\AppData\Local\Temp\89174111-208F-4B29-9DC7-AF53C690A492\DismCorePS.dll
C:\Users\Owner\AppData\Local\Temp\89174111-208F-4B29-9DC7-AF53C690A492\DismHost.exe
C:\Users\Owner\AppData\Local\Temp\89174111-208F-4B29-9DC7-AF53C690A492\DismProv.dll
C:\Users\Owner\AppData\Local\Temp\89174111-208F-4B29-9DC7-AF53C690A492\DmiProvider.dll
C:\Users\Owner\AppData\Local\Temp\89174111-208F-4B29-9DC7-AF53C690A492\FolderProvider.dll
C:\Users\Owner\AppData\Local\Temp\89174111-208F-4B29-9DC7-AF53C690A492\IntlProvider.dll
C:\Users\Owner\AppData\Local\Temp\89174111-208F-4B29-9DC7-AF53C690A492\LogProvider.dll
C:\Users\Owner\AppData\Local\Temp\89174111-208F-4B29-9DC7-AF53C690A492\MsiProvider.dll
C:\Users\Owner\AppData\Local\Temp\89174111-208F-4B29-9DC7-AF53C690A492\OSProvider.dll
C:\Users\Owner\AppData\Local\Temp\89174111-208F-4B29-9DC7-AF53C690A492\SmiProvider.dll
C:\Users\Owner\AppData\Local\Temp\89174111-208F-4B29-9DC7-AF53C690A492\TransmogProvider.dll
C:\Users\Owner\AppData\Local\Temp\89174111-208F-4B29-9DC7-AF53C690A492\UnattendProvider.dll
C:\Users\Owner\AppData\Local\Temp\89174111-208F-4B29-9DC7-AF53C690A492\wdscore.dll
C:\Users\Owner\AppData\Local\Temp\89174111-208F-4B29-9DC7-AF53C690A492\WimProvider.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
C:\Program Files\Windows Defender\mpsvc.dll => ATTENTION: ZeroAccess. Use

DeleteJunctionsIndirectory: C:\Program Files\Windows Defender

LastRegBack: 2013-08-22 10:38

==================== End Of Log ============================

 

Attached Files



#6 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,773 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:07:48 PM

Posted 28 August 2013 - 12:43 AM

Hello amandaDOUCET28



I need you to download this script I have made for you --> Attached File  fixlist.txt   519bytes   5 downloads

It needs to be saved Next to the "Farbar Recovery Scan Tool" (FRST) program (If asked to overwrite existing one please allow)

Run FRST again but this time press the Fix button just once and wait.


When finished, it will make a log (fixlog.txt) next to FRST. Please copy and paste the content of this file to your reply.


NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system


Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#7 amandaDOUCET28

amandaDOUCET28
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:06:48 PM

Posted 28 August 2013 - 08:23 PM

working on this now, kids are finally in bed!



#8 amandaDOUCET28

amandaDOUCET28
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:06:48 PM

Posted 28 August 2013 - 08:35 PM

not sure if I did it right, this is the log that came up,

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 28-08-2013
Ran by Owner at 2013-08-28 20:26:29 Run:1
Running from C:\Users\Owner\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] C:\$Recycle.Bin\S-1-5-18\$62c84f77987b450cf5fd00ddcaad417b\n. ATTENTION! ====> ZeroAccess?
HKCR\...409d6c4515e9\InprocServer32: [Default-shell32] C:\Users\Owner\AppData\Local\Temp\srsahjp\sqyoity\wow64.dll ATTENTION! ====> ZeroAccess?
DeleteJunctionsInDirectory: C:\Program Files\Windows Defender
DeleteJunctionsInDirectory: C:\Program Files\Microsoft Security Client
DeleteJunctionsIndirectory: C:\Windows\system64
cmd: Dir /b /a:l "C:\Program Files" /s

*****************

HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default => Value was restored successfully.
HKCU\Software\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} => Key deleted successfully.
"C:\Program Files\Windows Defender" => Deleting reparse point and unlocking started.
"C:\Program Files\Windows Defender\en-US" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MpAsDesc.dll" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MpClient.dll" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MpCmdRun.exe" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MpCommu.dll" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MpEvMsg.dll" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MpOAV.dll" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MpRTP.dll" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MpSvc.dll" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MSASCui.exe" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MsMpCom.dll" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MsMpLics.dll" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender\MsMpRes.dll" => Deleting reparse point and unlocking done.
"C:\Program Files\Windows Defender" => Deleting reparse point and unlocking completed.
"C:\Program Files\Microsoft Security Client" => Not Found
"C:\Windows\system64" => Not Found

=========  Dir /b /a:l "C:\Program Files" /s =========

File Not Found

========= End of CMD: =========

==== End of Fixlog ====



#9 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,773 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:07:48 PM

Posted 28 August 2013 - 08:44 PM



Hello amandaDOUCET28

These are the programs I would like you to run next, if you have any problems with one of these just skip it and move on to the next one.

-AdwCleaner-

Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Delete.
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
-Junkware-Removal-Tool-

Please download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
When they are complete let me have the two reports and let me know how things are running.

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#10 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,773 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:07:48 PM

Posted 31 August 2013 - 12:56 PM



Hello

48 Hour bump

It has been more than 48 hours since my last post.
  • do you still need help with this?
  • do you need more time?
  • are you having problems following my instructions?
  • if after 48hrs you have not replied to this thread then it will have to be closed!
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#11 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,773 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:07:48 PM

Posted 05 September 2013 - 12:19 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users