Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

May have a Rootkit taking up hard disk space


  • This topic is locked This topic is locked
26 replies to this topic

#1 ummhasan

ummhasan

  • Members
  • 155 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan
  • Local time:10:20 AM

Posted 26 August 2013 - 09:30 PM

Hello All, I have followed the preparation guide and attached are my two DDS files.

 

I was directed here by my previous forum post after going through multiple steps and not resolving the unusual large amount of disk space being used.

 

This is my young sons computer and there was a lot of malware on it which seems to have been removed from those processes in my last forum post. However, this pc has 37.2gb available and only 11.3 available. I only have standard programs installed that I am aware of - the largest being MS Office, which should only take 3gb at most. The vista install, maybe 15gb, all other programs shouldn't take much space. Even if the total installed programs and os equal 20 gb, I should still have 17gb available. There is an unaccounted 6gb at least.

 

I did follow a previous malwarebytes post of how to remove malware and rootkits (before getting to this point), so I do have those programs and logs already on this system as well as have already ran mbar to get rid of rootkits - but - I probably did something wrong in the process.

 

Thanks for your time.


Edited by ummhasan, 26 August 2013 - 10:22 PM.


BC AdBot (Login to Remove)

 


#2 ummhasan

ummhasan
  • Topic Starter

  • Members
  • 155 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan
  • Local time:10:20 AM

Posted 28 August 2013 - 06:10 PM

Can anyone help me make sure I don't have a root kit infection please? I already went through the steps in the guided root kit document.  Thanks



#3 HelpBot

HelpBot

    Bleepin' Binary Bot


  • Bots
  • 12,626 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:20 AM

Posted 31 August 2013 - 09:55 PM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

step1.gif In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/505742 <<< CLICK THIS LINK



If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

step2.gifIf you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new DDS log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from the following link if you no longer have it available and save it to your destop.

    DDS.com Download Link
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control can be found HERE.

As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#4 ummhasan

ummhasan
  • Topic Starter

  • Members
  • 155 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan
  • Local time:10:20 AM

Posted 01 September 2013 - 02:58 PM

My problem: I have a 40gb hard drive with 37.2gb available (without anything installed). Now, the only things I have installed are the OS (Vista Business, SP2, 32bit), Microsoft Office, and other basic things such as Adobe reader. all programs that come with Visa business install, foxit reader, and Norton (recently reinstalled). With only these basic programs on a 40gb hard drive, I'm showing only 9.87gb currently availbale. Based on this, I believe I have a rootkit infection taking up hard drive space.

 

I am reattaching my DDS logs.



#5 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:20 AM

Posted 01 September 2013 - 11:04 PM





Hello ummhasan

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

  • Please do not run any tools unless instructed to do so.
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
  • Please do not attach logs or use code boxes, just copy and paste the text.
    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
  • Please read every post completely before doing anything.
    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
  • Please provide feedback about your experience as we go.
    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.
NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

I would like you to run this program for me.

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#6 ummhasan

ummhasan
  • Topic Starter

  • Members
  • 155 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan
  • Local time:10:20 AM

Posted 02 September 2013 - 12:09 AM

Hello Gringo and thanks so much for your help and time!

 

The FRST Log:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 02-09-2013 02
Ran by Admin (administrator) on HASAN on 02-09-2013 00:59:43
Running from C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FUK4MQWT
Microsoft® Windows Vista™ Business  Service Pack 2 (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Microsoft Corporation) C:\Program Files\Windows Live\Family Safety\fsssvc.exe
(Logitech Inc.) C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\ccSvcHst.exe
() C:\Program Files\CyberLink\Shared files\RichVideo.exe
(Safer Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\ccSvcHst.exe
(D-Link) C:\Program Files\D-Link\RangeBooster G WUA-2340\AirPlusCFG.exe
(Realtek Semiconductor Corp.) C:\Windows\SOUNDMAN.EXE
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil32_11_8_800_94_ActiveX.exe
(Microsoft Corporation) \\?\C:\Windows\system32\wbem\WMIADAP.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [D-Link RangeBooster G WUA-2340] - C:\Program Files\D-Link\RangeBooster G WUA-2340\AirPlusCFG.exe [1667072 2008-09-23] (D-Link)
HKLM\...\Run: [SoundMan] - C:\Windows\SOUNDMAN.EXE [604704 2009-04-14] (Realtek Semiconductor Corp.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
Winlogon\Notify\WgaLogon: WgaLogon.dll (Microsoft Corporation)
HKLM\...\Policies\Explorer: [HonorAutoRunSetting] 1
HKLM\...\Policies\Explorer: [NoDrives] 0
HKCU\...\Policies\Explorer: [NoDrives] 0
HKU\Default\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)
HKU\Default User\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)
HKU\Guest\...\Run: [WindowsWelcomeCenter] - C:\Windows\System32\oobefldr.dll [ 2009-04-11] (Microsoft Corporation)
HKU\Mom\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [ 2008-01-20] (Microsoft Corporation)
HKU\Mom\...\Run: [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [x]

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
SearchScopes: HKCU - {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = http://nortonsafe.search.ask.com/web?q={SEARCHTERMS}&o=15527&prt=360&chn=S1122&geo=US&ver=20&locale=en_US&tpr=111
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Security Suite\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Security Suite\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_17-windows-i586.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} -  No File
Tcpip\Parameters: [DhcpNameServer] 75.75.76.76 75.75.75.75

========================== Services (Whitelisted) =================

S3 jswpsapi; C:\Program Files\D-Link\RangeBooster G WUA-2340\JSWUtilVst\jswpsapi.exe [954368 2008-05-19] (Atheros Communications, Inc.)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 N360; C:\Program Files\Norton Security Suite\Engine\20.4.0.40\diMaster.dll [556336 2013-05-29] (Symantec Corporation)
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [173616 2007-02-07] ()
R2 SBSDWSCService; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S2 vToolbarUpdater15.4.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe [x]

==================== Drivers (Whitelisted) ====================

S3 A5AGU; C:\Windows\System32\DRIVERS\AGUx86.sys [905728 2013-08-13] (D-Link Corporation)
S3 ac97intc; C:\Windows\System32\drivers\ac97intc.sys [108032 2006-11-02] (Intel Corporation)
R3 ALCXWDM; C:\Windows\System32\drivers\RTKVAC.SYS [4172832 2009-06-18] (Realtek Semiconductor Corp.)
R1 anodlwf; C:\Windows\System32\DRIVERS\anodlwf.sys [12800 2010-05-29] ()
R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [37664 2013-08-22] (AVG Technologies)
R1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130715.001\BHDrvx86.sys [1002072 2013-07-15] (Symantec Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360\1404000.028\ccSetx86.sys [134744 2013-04-15] (Symantec Corporation)
R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-11] (Microsoft Corporation)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376920 2013-08-28] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [108120 2013-08-29] (Symantec Corporation)
R1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130830.001\IDSvix86.sys [392792 2013-08-28] (Symantec Corporation)
S3 KMWDFILTER; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [17408 2008-10-09] (Windows ® Codename Longhorn DDK provider)
R3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [25752 2009-10-07] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130831.007\NAVENG.SYS [93272 2013-08-29] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130831.007\NAVEX15.SYS [1612376 2013-08-29] (Symantec Corporation)
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2012-10-07] (Duplex Secure Ltd.)
R3 SRTSP; C:\Windows\System32\Drivers\N360\1404000.028\SRTSP.SYS [603224 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360\1404000.028\SRTSPX.SYS [32344 2013-03-04] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360\1404000.028\SYMDS.SYS [367704 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360\1404000.028\SYMEFA.SYS [934488 2013-05-23] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142496 2013-08-29] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360\1404000.028\Ironx86.SYS [175264 2012-07-27] (Symantec Corporation)
R1 SYMTDIv; C:\Windows\System32\Drivers\N360\1404000.028\SYMTDIV.SYS [352344 2013-04-24] (Symantec Corporation)
S3 USB_RNDIS_XP; C:\Windows\System32\DRIVERS\usb8023.sys [15872 2013-02-11] (Microsoft Corporation)
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B}; C:\Program Files\CyberLink\PowerDVD\000.fcl [13560 2006-11-02] (Cyberlink Corp.)
S3 catchme; \??\C:\Users\Admin\AppData\Local\Temp\catchme.sys [x]
S0 cpomy; System32\drivers\dydiatj.sys [x]
S3 EraserUtilDrv11310; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11310.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
U3 TrueSight; \??\C:\Windows\system32\TrueSight.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-09-01 15:57 - 2013-09-01 15:57 - 00002166 _____ C:\Users\Admin\Desktop\attach.zip
2013-08-29 04:49 - 2013-08-29 04:49 - 00975858 _____ C:\Users\Admin\Downloads\adwcleaner.exe.part
2013-08-29 04:49 - 2013-08-29 04:49 - 00975858 _____ C:\Users\Admin\Downloads\adwcleaner(1).exe
2013-08-29 04:49 - 2013-08-29 04:49 - 00760937 _____ (Farbar) C:\Users\Admin\Downloads\minitoolbox.exe
2013-08-29 01:08 - 2013-08-29 04:52 - 00142496 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT.SYS
2013-08-29 01:08 - 2013-08-29 04:52 - 00007611 _____ C:\Windows\system32\Drivers\SYMEVENT.CAT
2013-08-29 01:08 - 2013-08-29 01:08 - 00000000 ____D C:\Program Files\Symantec
2013-08-29 01:06 - 2013-08-29 15:52 - 00000000 ____D C:\Windows\system32\Drivers\N360
2013-08-29 01:06 - 2013-08-29 01:06 - 00000000 ____D C:\Program Files\Norton Security Suite
2013-08-29 01:05 - 2013-08-29 01:05 - 00000000 ____D C:\Users\Admin\Documents\Symantec
2013-08-29 00:56 - 2013-08-29 00:56 - 12334080 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 03695416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-08-29 00:56 - 2013-08-29 00:56 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-29 00:56 - 2013-08-29 00:56 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-29 00:56 - 2013-08-29 00:56 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 01104384 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00434176 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-08-29 00:56 - 2013-08-29 00:56 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00353584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00227840 _____ (Microsoft Corporation) C:\Windows\system32\ieaksie.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00203776 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\ieakui.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00162304 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00161792 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-08-29 00:56 - 2013-08-29 00:56 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-08-29 00:56 - 2013-08-29 00:56 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-29 00:56 - 2013-08-29 00:56 - 00130560 _____ (Microsoft Corporation) C:\Windows\system32\ieakeng.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00118784 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00114176 _____ (Microsoft Corporation) C:\Windows\system32\advpack.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00110592 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00101888 _____ (Microsoft Corporation) C:\Windows\system32\admparse.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-08-29 00:56 - 2013-08-29 00:56 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-29 00:56 - 2013-08-29 00:56 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-29 00:56 - 2013-08-29 00:56 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-08-29 00:56 - 2013-08-29 00:56 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-08-29 00:56 - 2013-08-29 00:56 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-08-29 00:52 - 2013-08-29 01:05 - 00003249 _____ C:\Windows\IE9_main.log
2013-08-29 00:52 - 2013-08-29 01:05 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Norton
2013-08-29 00:52 - 2013-08-29 00:52 - 00000935 _____ C:\Users\Admin\Desktop\Norton Installation Files.lnk
2013-08-29 00:52 - 2013-08-29 00:52 - 00000000 ____D C:\Users\Public\Downloads\Norton
2013-08-29 00:43 - 2013-08-29 00:46 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Google
2013-08-28 23:46 - 2013-08-28 23:47 - 00014641 _____ C:\Windows\ie8Uninst.log
2013-08-28 19:24 - 2013-08-02 00:09 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-26 23:24 - 2013-08-26 23:24 - 12907592 _____ (Malwarebytes Corp.) C:\Users\Admin\Downloads\mbar-1.07.0.1005.exe
2013-08-26 22:30 - 2013-08-26 22:30 - 00004817 _____ C:\Users\Admin\Desktop\dds.zip
2013-08-26 22:22 - 2013-09-01 15:44 - 00014357 _____ C:\Users\Admin\Desktop\dds.txt
2013-08-26 22:22 - 2013-09-01 15:44 - 00008127 _____ C:\Users\Admin\Desktop\attach.txt
2013-08-26 22:17 - 2013-08-26 21:59 - 00688992 ____R (Swearware) C:\Users\Admin\Desktop\dds.com
2013-08-26 22:15 - 2013-08-26 22:18 - 00000000 ____D C:\Users\Admin\Desktop\all_in_one_fix
2013-08-26 03:30 - 2013-08-26 03:30 - 00000000 ____D C:\Users\Admin\AppData\Local\Adobe
2013-08-26 01:55 - 2013-08-26 03:21 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-08-26 01:39 - 2013-08-26 01:39 - 00000906 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-08-26 01:33 - 2013-08-26 01:33 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2013-08-26 01:30 - 2013-08-26 01:30 - 00013426 _____ C:\ComboFix.txt
2013-08-26 00:46 - 2011-06-26 02:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-26 00:46 - 2010-11-07 13:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-26 00:46 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-26 00:46 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-26 00:46 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-26 00:46 - 2000-08-30 20:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-26 00:46 - 2000-08-30 20:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-26 00:46 - 2000-08-30 20:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-25 23:45 - 2013-08-26 01:30 - 00000000 ____D C:\Qoobox
2013-08-25 23:44 - 2013-08-26 01:03 - 00000000 ____D C:\Windows\erdnt
2013-08-25 23:41 - 2013-08-29 04:49 - 00760937 _____ (Farbar) C:\Users\Admin\Desktop\MiniToolBox.exe
2013-08-25 23:39 - 2013-08-25 23:39 - 01021434 _____ (Thisisu) C:\Users\Admin\Downloads\JRT(1).exe
2013-08-25 23:38 - 2013-08-25 23:38 - 05113393 _____ (Swearware) C:\Users\Admin\Downloads\ComboFix(1).exe
2013-08-25 21:50 - 2013-08-25 21:50 - 00001138 _____ C:\Users\Admin\Desktop\AdwCleaner[S2].txt
2013-08-25 21:27 - 2013-08-25 21:44 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-08-25 21:25 - 2013-08-26 23:25 - 00000000 ____D C:\Users\Admin\Desktop\mbar
2013-08-25 21:19 - 2013-09-02 00:52 - 00382854 _____ C:\Windows\PFRO.log
2013-08-25 15:45 - 2013-08-25 15:45 - 00602112 _____ (OldTimer Tools) C:\Users\Admin\Desktop\OTL.exe
2013-08-25 15:42 - 2013-08-25 15:42 - 05373340 _____ C:\Users\Admin\Desktop\tweaking.com_windows_repair_aio_setup.exe
2013-08-25 15:41 - 2013-08-25 15:41 - 00923136 _____ C:\Users\Admin\Desktop\RogueKiller.exe
2013-08-25 15:36 - 2013-08-25 15:36 - 01021434 _____ (Thisisu) C:\Users\Admin\Downloads\JRT.exe
2013-08-25 15:30 - 2013-08-25 15:49 - 00003041 _____ C:\Users\Admin\Desktop\infection_cleaner_instructions.txt
2013-08-25 15:29 - 2013-08-25 15:29 - 12907592 _____ (Malwarebytes Corp.) C:\Users\Admin\Desktop\mbar-1.07.0.1005.exe
2013-08-25 15:26 - 2013-08-25 15:26 - 00000000 ____D C:\Users\Admin\AppData\Roaming\SystemRequirementsLab
2013-08-25 15:26 - 2013-08-25 15:26 - 00000000 ____D C:\Program Files\SystemRequirementsLab
2013-08-25 15:20 - 2013-08-25 15:20 - 00000000 ____D C:\Program Files\Common Files\Java
2013-08-25 15:20 - 2013-08-25 15:17 - 00263592 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-08-25 15:19 - 2013-08-25 15:17 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-08-25 15:19 - 2013-08-25 15:17 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-08-25 15:19 - 2013-08-25 15:17 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-08-25 15:16 - 2013-08-25 15:16 - 00000000 ____D C:\Program Files\Java
2013-08-25 15:11 - 2013-08-25 15:11 - 00903080 _____ (Oracle Corporation) C:\Users\Admin\Downloads\jxpiinstall(1).exe
2013-08-25 15:08 - 2013-08-25 15:09 - 00903080 _____ (Oracle Corporation) C:\Users\Admin\Downloads\jxpiinstall.exe
2013-08-25 14:58 - 2013-08-25 14:58 - 00792704 _____ (AMD) C:\Users\Admin\Downloads\amddriverdownloader.exe
2013-08-24 20:15 - 2013-09-01 15:30 - 00000034 _____ C:\Windows\setupact.log
2013-08-24 20:15 - 2013-08-24 20:15 - 00000000 _____ C:\Windows\setuperr.log
2013-08-24 20:04 - 2013-09-02 00:57 - 00295483 _____ C:\Windows\WindowsUpdate.log
2013-08-24 20:02 - 2013-08-24 20:04 - 00028301 _____ C:\Users\Admin\Desktop\Result.txt
2013-08-24 19:59 - 2013-08-24 19:59 - 00002135 _____ C:\Users\Admin\Desktop\AdwCleaner[S0].txt
2013-08-24 19:58 - 2013-09-02 00:51 - 00007534 _____ C:\Windows\SchedLgU.Txt
2013-08-24 19:55 - 2013-08-24 19:55 - 00000278 _____ C:\Users\Admin\Desktop\ESET2.txt
2013-08-24 18:28 - 2013-08-24 18:28 - 00994642 _____ C:\Users\Admin\Desktop\AdwCleaner(1).exe
2013-08-24 18:26 - 2013-08-24 18:26 - 00001941 _____ C:\Users\Admin\Desktop\deepInfection_instructions.txt
2013-08-24 03:54 - 2013-08-24 03:54 - 00028945 _____ C:\Users\Admin\Desktop\Result_miniToolBox.txt
2013-08-24 03:38 - 2013-08-24 03:40 - 00028945 _____ C:\Users\Admin\Downloads\Result.txt
2013-08-23 12:04 - 2013-08-23 12:04 - 00000413 _____ C:\Users\Admin\Desktop\ESET.txt
2013-08-23 00:59 - 2013-08-23 00:59 - 00000000 ____D C:\Program Files\ESET
2013-08-23 00:57 - 2013-08-23 00:57 - 02347384 _____ (ESET) C:\Users\Admin\Desktop\esetsmartinstaller_enu.exe
2013-08-23 00:46 - 2013-08-24 18:21 - 00000000 ____D C:\TDSSKiller_Quarantine
2013-08-22 23:21 - 2013-08-29 00:41 - 00000000 ____D C:\AdwCleaner
2013-08-22 23:20 - 2013-08-29 04:49 - 00975858 _____ C:\Users\Admin\Downloads\adwcleaner.exe
2013-08-22 23:20 - 2013-08-22 23:20 - 00000000 ____D C:\Users\Admin\AppData\Local\AVG SafeGuard toolbar
2013-08-22 23:19 - 2013-08-22 23:17 - 00037664 _____ (AVG Technologies) C:\Windows\system32\Drivers\avgtpx86.sys
2013-08-22 23:18 - 2013-08-22 23:19 - 00000000 ____D C:\ProgramData\AVG SafeGuard toolbar
2013-08-22 23:18 - 2013-08-22 23:18 - 00000000 ____D C:\Program Files\AVG SafeGuard toolbar
2013-08-22 22:49 - 2013-08-29 00:10 - 00002520 _____ C:\Users\Admin\Desktop\Rkill.txt
2013-08-22 22:48 - 2013-08-22 22:48 - 01898112 _____ (Bleeping Computer, LLC) C:\Users\Admin\Desktop\iExplore.exe
2013-08-22 00:11 - 2013-08-22 00:11 - 00000000 ____D C:\Users\Admin\Desktop\SpaceSniffer
2013-08-21 23:08 - 2013-08-25 23:44 - 05113393 ____R (Swearware) C:\Users\Admin\Desktop\ComboFix.exe
2013-08-21 20:10 - 2013-08-26 01:39 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-08-21 20:10 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-21 20:06 - 2013-08-21 20:06 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Admin\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-21 19:55 - 2013-08-21 19:55 - 01536858 _____ C:\Users\Admin\Downloads\spacesniffer_1_1_4_0.zip
2013-08-21 19:51 - 2013-08-21 19:53 - 02748256 _____ (Kaspersky Lab ZAO) C:\Users\Admin\Downloads\tdsskiller.exe
2013-08-21 13:12 - 2013-08-21 13:12 - 04188160 _____ C:\Program Files\GUT5C25.tmp
2013-08-21 13:12 - 2013-08-21 13:12 - 00000000 ____D C:\Program Files\GUM5C24.tmp
2013-08-21 13:09 - 2013-08-21 13:09 - 00000000 ____D C:\Program Files\CCleaner
2013-08-21 13:08 - 2013-08-21 13:09 - 00000000 ____D C:\ProgramData\Google
2013-08-21 13:07 - 2013-09-02 00:55 - 00000880 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-21 13:07 - 2013-09-01 19:17 - 00000884 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-21 13:05 - 2013-08-29 00:43 - 00000000 ____D C:\Users\Admin\AppData\Local\Google
2013-08-21 12:59 - 2013-08-21 13:00 - 04429440 _____ (Piriform Ltd) C:\Users\Admin\Downloads\ccsetup404.exe
2013-08-20 17:29 - 2013-08-20 17:29 - 00004608 _____ C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-08-19 14:59 - 2013-08-21 02:58 - 00000000 ____D C:\Users\Admin\AppData\Local\{89C9A16B-6E97-4521-A0A0-46FA876E5F70}
2013-08-19 14:56 - 2013-08-19 14:57 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2013-08-15 01:59 - 2013-08-15 01:59 - 00000000 ____D C:\Users\Admin\AppData\Local\{878AC5C5-1BD2-4A9C-8A31-07F454DEFD30}
2013-08-14 13:59 - 2013-08-14 13:59 - 00000000 ____D C:\Users\Admin\AppData\Local\{E6CA5EDF-16D7-478D-9341-CC30F887E622}
2013-08-14 04:27 - 2013-08-14 04:36 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 02:29 - 2013-07-17 15:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 02:29 - 2013-07-10 05:47 - 00783360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 02:29 - 2013-04-15 10:20 - 00638328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-08-14 02:29 - 2013-04-13 06:56 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2013-08-14 02:28 - 2013-07-09 08:10 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 02:28 - 2013-07-08 00:55 - 03603904 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-08-14 02:28 - 2013-07-08 00:55 - 03551680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 02:28 - 2013-06-01 00:06 - 00505344 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-08-14 02:28 - 2013-04-24 00:00 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-08-14 02:28 - 2013-04-23 21:46 - 00812544 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-08-14 02:27 - 2013-06-15 09:22 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2013-08-14 02:27 - 2013-06-15 07:23 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-14 02:26 - 2013-07-05 00:53 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 02:25 - 2013-06-03 21:50 - 02049024 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-08-14 02:20 - 2013-05-02 00:04 - 00443904 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2013-08-14 02:20 - 2013-05-02 00:03 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\printcom.dll
2013-08-14 02:18 - 2013-04-17 07:28 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-08-14 02:18 - 2013-04-17 07:28 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-08-14 02:18 - 2013-04-17 07:28 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-08-14 02:18 - 2013-04-17 07:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-08-14 02:18 - 2013-04-17 06:34 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-08-14 02:18 - 2013-04-17 06:33 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-08-14 02:18 - 2013-04-17 06:14 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-08-14 02:18 - 2013-04-17 06:10 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-08-14 02:18 - 2013-04-17 06:10 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-08-14 02:08 - 2013-07-08 00:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 02:08 - 2013-07-08 00:16 - 00992768 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 02:08 - 2013-07-08 00:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 02:08 - 2013-07-08 00:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 00:09 - 2013-04-17 08:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2013-08-14 00:03 - 2013-08-26 01:01 - 00000000 ____D C:\Users\Admin\AppData\Local\CrashDumps
2013-08-14 00:00 - 2013-08-14 00:31 - 00000006 _____ C:\Windows\system32\ANIWZCSUSERNAME{A7279DE4-302D-4105-8DAB-B2F54C891FD6}
2013-08-13 11:43 - 2013-08-13 11:43 - 00000000 ____D C:\Program Files\ANI
2013-08-13 11:43 - 2008-09-11 11:48 - 00262144 _____ () C:\Windows\system32\wlanapp.dll
2013-08-13 11:43 - 2008-08-06 17:05 - 00266240 _____ (Wireless Service) C:\Windows\system32\wnicapi.dll
2013-08-13 11:43 - 2008-07-10 09:54 - 00692224 _____ (Wireless Service) C:\Windows\system32\ANIWZCS2.dll
2013-08-13 11:43 - 2008-06-20 14:08 - 00204800 _____ (Alpha Networks Inc.) C:\Windows\system32\aIPH.dll
2013-08-13 11:43 - 2006-09-26 13:49 - 00045115 _____ (Alpha Networks Inc.) C:\Windows\system32\ANICtl.dll
2013-08-13 11:43 - 2005-10-27 08:55 - 00049152 _____ () C:\Windows\system32\JJAKEn.dll
2013-08-13 11:43 - 2005-10-19 18:19 - 01327189 _____ (Funk Software, Inc.) C:\Windows\system32\odSupp_M.dll
2013-08-13 11:43 - 2005-10-19 18:19 - 00049152 _____ (Alpha Networks Inc.) C:\Windows\system32\AQCKGen.dll
2013-08-13 11:36 - 2013-08-13 11:36 - 00001615 _____ C:\Users\Public\Desktop\Wireless Connection Manager.lnk
2013-08-13 11:36 - 2008-05-15 03:28 - 00020384 _____ (Atheros Communications, Inc.) C:\Windows\system32\Drivers\jswpslwf.sys
2013-08-13 11:35 - 2013-08-13 11:35 - 00000000 ____D C:\Program Files\D-Link
2013-08-13 11:35 - 2005-10-22 21:56 - 00036864 _____ (Alpha Networks Inc.) C:\Windows\system32\ANIOApi.dll
2013-08-13 11:33 - 2013-08-13 11:33 - 00000000 ____D C:\Users\Admin\AppData\Roaming\InstallShield
2013-08-13 11:32 - 2013-08-13 11:32 - 00000000 ____D C:\Users\Admin\Desktop\wua2340_drivers_150
2013-08-13 10:43 - 2013-08-13 10:43 - 00000000 ____D C:\ProgramData\InstallShield
2013-08-13 10:42 - 2013-08-13 11:37 - 00000000 ____D C:\Program Files\Common Files\InstallShield

==================== One Month Modified Files and Folders =======

2013-09-02 01:01 - 2006-11-02 06:33 - 00724946 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-02 00:59 - 2013-09-02 00:59 - 00000000 ____D C:\FRST
2013-09-02 00:58 - 2013-03-01 22:22 - 00001356 _____ C:\Users\Admin\AppData\Local\d3d9caps.dat
2013-09-02 00:57 - 2013-08-24 20:04 - 00295483 _____ C:\Windows\WindowsUpdate.log
2013-09-02 00:55 - 2013-08-21 13:07 - 00000880 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-02 00:53 - 2012-11-05 03:14 - 00003664 _____ C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-02 00:53 - 2012-11-05 03:14 - 00003664 _____ C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-02 00:52 - 2013-08-25 21:19 - 00382854 _____ C:\Windows\PFRO.log
2013-09-02 00:52 - 2006-11-02 09:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-02 00:51 - 2013-08-24 19:58 - 00007534 _____ C:\Windows\SchedLgU.Txt
2013-09-01 19:17 - 2013-08-21 13:07 - 00000884 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-01 18:42 - 2012-08-23 21:37 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-01 16:00 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\rescache
2013-09-01 15:57 - 2013-09-01 15:57 - 00002166 _____ C:\Users\Admin\Desktop\attach.zip
2013-09-01 15:51 - 2013-03-01 22:25 - 00109264 _____ C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-01 15:44 - 2013-08-26 22:22 - 00014357 _____ C:\Users\Admin\Desktop\dds.txt
2013-09-01 15:44 - 2013-08-26 22:22 - 00008127 _____ C:\Users\Admin\Desktop\attach.txt
2013-09-01 15:30 - 2013-08-24 20:15 - 00000034 _____ C:\Windows\setupact.log
2013-08-29 15:52 - 2013-08-29 01:06 - 00000000 ____D C:\Windows\system32\Drivers\N360
2013-08-29 15:47 - 2006-11-02 07:18 - 00000000 ___RD C:\Windows\Offline Web Pages
2013-08-29 04:52 - 2013-08-29 01:08 - 00142496 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT.SYS
2013-08-29 04:52 - 2013-08-29 01:08 - 00007611 _____ C:\Windows\system32\Drivers\SYMEVENT.CAT
2013-08-29 04:49 - 2013-08-29 04:49 - 00975858 _____ C:\Users\Admin\Downloads\adwcleaner.exe.part
2013-08-29 04:49 - 2013-08-29 04:49 - 00975858 _____ C:\Users\Admin\Downloads\adwcleaner(1).exe
2013-08-29 04:49 - 2013-08-29 04:49 - 00760937 _____ (Farbar) C:\Users\Admin\Downloads\minitoolbox.exe
2013-08-29 04:49 - 2013-08-25 23:41 - 00760937 _____ (Farbar) C:\Users\Admin\Desktop\MiniToolBox.exe
2013-08-29 04:49 - 2013-08-22 23:20 - 00975858 _____ C:\Users\Admin\Downloads\adwcleaner.exe
2013-08-29 01:48 - 2012-08-21 14:45 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared
2013-08-29 01:08 - 2013-08-29 01:08 - 00000000 ____D C:\Program Files\Symantec
2013-08-29 01:06 - 2013-08-29 01:06 - 00000000 ____D C:\Program Files\Norton Security Suite
2013-08-29 01:06 - 2012-08-21 14:18 - 00000000 ____D C:\ProgramData\Norton
2013-08-29 01:05 - 2013-08-29 01:05 - 00000000 ____D C:\Users\Admin\Documents\Symantec
2013-08-29 01:05 - 2013-08-29 00:52 - 00003249 _____ C:\Windows\IE9_main.log
2013-08-29 01:05 - 2013-08-29 00:52 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Norton
2013-08-29 00:57 - 2006-11-02 02:32 - 00008798 _____ C:\Windows\system32\icrav03.rat
2013-08-29 00:57 - 2006-11-02 02:32 - 00001988 _____ C:\Windows\system32\ticrf.rat
2013-08-29 00:56 - 2013-08-29 00:56 - 12334080 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 03695416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-08-29 00:56 - 2013-08-29 00:56 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-29 00:56 - 2013-08-29 00:56 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-29 00:56 - 2013-08-29 00:56 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 01104384 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00434176 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-08-29 00:56 - 2013-08-29 00:56 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00353584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00227840 _____ (Microsoft Corporation) C:\Windows\system32\ieaksie.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00203776 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\ieakui.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00162304 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00161792 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-08-29 00:56 - 2013-08-29 00:56 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-08-29 00:56 - 2013-08-29 00:56 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-29 00:56 - 2013-08-29 00:56 - 00130560 _____ (Microsoft Corporation) C:\Windows\system32\ieakeng.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00118784 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00114176 _____ (Microsoft Corporation) C:\Windows\system32\advpack.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00110592 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00101888 _____ (Microsoft Corporation) C:\Windows\system32\admparse.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-08-29 00:56 - 2013-08-29 00:56 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-29 00:56 - 2013-08-29 00:56 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-29 00:56 - 2013-08-29 00:56 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-08-29 00:56 - 2013-08-29 00:56 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-08-29 00:56 - 2013-08-29 00:56 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-08-29 00:52 - 2013-08-29 00:52 - 00000935 _____ C:\Users\Admin\Desktop\Norton Installation Files.lnk
2013-08-29 00:52 - 2013-08-29 00:52 - 00000000 ____D C:\Users\Public\Downloads\Norton
2013-08-29 00:46 - 2013-08-29 00:43 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Google
2013-08-29 00:43 - 2013-08-21 13:05 - 00000000 ____D C:\Users\Admin\AppData\Local\Google
2013-08-29 00:41 - 2013-08-22 23:21 - 00000000 ____D C:\AdwCleaner
2013-08-29 00:10 - 2013-08-22 22:49 - 00002520 _____ C:\Users\Admin\Desktop\Rkill.txt
2013-08-28 23:47 - 2013-08-28 23:46 - 00014641 _____ C:\Windows\ie8Uninst.log
2013-08-28 23:36 - 2012-11-05 06:08 - 00000000 ____D C:\Windows\Panther
2013-08-28 23:34 - 2013-04-12 07:43 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-26 23:25 - 2013-08-25 21:25 - 00000000 ____D C:\Users\Admin\Desktop\mbar
2013-08-26 23:24 - 2013-08-26 23:24 - 12907592 _____ (Malwarebytes Corp.) C:\Users\Admin\Downloads\mbar-1.07.0.1005.exe
2013-08-26 22:30 - 2013-08-26 22:30 - 00004817 _____ C:\Users\Admin\Desktop\dds.zip
2013-08-26 22:18 - 2013-08-26 22:15 - 00000000 ____D C:\Users\Admin\Desktop\all_in_one_fix
2013-08-26 21:59 - 2013-08-26 22:17 - 00688992 ____R (Swearware) C:\Users\Admin\Desktop\dds.com
2013-08-26 03:30 - 2013-08-26 03:30 - 00000000 ____D C:\Users\Admin\AppData\Local\Adobe
2013-08-26 03:23 - 2006-11-02 08:47 - 00407680 _____ C:\Windows\system32\FNTCACHE.DAT
2013-08-26 03:21 - 2013-08-26 01:55 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-08-26 01:39 - 2013-08-26 01:39 - 00000906 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-08-26 01:39 - 2013-08-21 20:10 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-08-26 01:33 - 2013-08-26 01:33 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tweaking.com
2013-08-26 01:30 - 2013-08-26 01:30 - 00013426 _____ C:\ComboFix.txt
2013-08-26 01:30 - 2013-08-25 23:45 - 00000000 ____D C:\Qoobox
2013-08-26 01:26 - 2001-08-23 10:00 - 00000227 _____ C:\Windows\system.ini
2013-08-26 01:05 - 2006-11-02 07:18 - 00000000 ___RD C:\Users\Public
2013-08-26 01:03 - 2013-08-25 23:44 - 00000000 ____D C:\Windows\erdnt
2013-08-26 01:01 - 2013-08-14 00:03 - 00000000 ____D C:\Users\Admin\AppData\Local\CrashDumps
2013-08-26 01:01 - 2001-08-23 10:00 - 00000027 _____ C:\Windows\system32\Drivers\etc\hosts_bak_45
2013-08-25 23:44 - 2013-08-21 23:08 - 05113393 ____R (Swearware) C:\Users\Admin\Desktop\ComboFix.exe
2013-08-25 23:39 - 2013-08-25 23:39 - 01021434 _____ (Thisisu) C:\Users\Admin\Downloads\JRT(1).exe
2013-08-25 23:38 - 2013-08-25 23:38 - 05113393 _____ (Swearware) C:\Users\Admin\Downloads\ComboFix(1).exe
2013-08-25 21:50 - 2013-08-25 21:50 - 00001138 _____ C:\Users\Admin\Desktop\AdwCleaner[S2].txt
2013-08-25 21:48 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\Registration
2013-08-25 21:44 - 2013-08-25 21:27 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-08-25 15:49 - 2013-08-25 15:30 - 00003041 _____ C:\Users\Admin\Desktop\infection_cleaner_instructions.txt
2013-08-25 15:45 - 2013-08-25 15:45 - 00602112 _____ (OldTimer Tools) C:\Users\Admin\Desktop\OTL.exe
2013-08-25 15:42 - 2013-08-25 15:42 - 05373340 _____ C:\Users\Admin\Desktop\tweaking.com_windows_repair_aio_setup.exe
2013-08-25 15:41 - 2013-08-25 15:41 - 00923136 _____ C:\Users\Admin\Desktop\RogueKiller.exe
2013-08-25 15:36 - 2013-08-25 15:36 - 01021434 _____ (Thisisu) C:\Users\Admin\Downloads\JRT.exe
2013-08-25 15:29 - 2013-08-25 15:29 - 12907592 _____ (Malwarebytes Corp.) C:\Users\Admin\Desktop\mbar-1.07.0.1005.exe
2013-08-25 15:26 - 2013-08-25 15:26 - 00000000 ____D C:\Users\Admin\AppData\Roaming\SystemRequirementsLab
2013-08-25 15:26 - 2013-08-25 15:26 - 00000000 ____D C:\Program Files\SystemRequirementsLab
2013-08-25 15:20 - 2013-08-25 15:20 - 00000000 ____D C:\Program Files\Common Files\Java
2013-08-25 15:17 - 2013-08-25 15:20 - 00263592 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-08-25 15:17 - 2013-08-25 15:19 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-08-25 15:17 - 2013-08-25 15:19 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-08-25 15:17 - 2013-08-25 15:19 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-08-25 15:17 - 2012-08-31 09:44 - 00867240 _____ (Oracle Corporation) C:\Windows\system32\npdeployJava1.dll
2013-08-25 15:17 - 2011-02-08 02:31 - 00789416 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-08-25 15:16 - 2013-08-25 15:16 - 00000000 ____D C:\Program Files\Java
2013-08-25 15:11 - 2013-08-25 15:11 - 00903080 _____ (Oracle Corporation) C:\Users\Admin\Downloads\jxpiinstall(1).exe
2013-08-25 15:09 - 2013-08-25 15:08 - 00903080 _____ (Oracle Corporation) C:\Users\Admin\Downloads\jxpiinstall.exe
2013-08-25 14:58 - 2013-08-25 14:58 - 00792704 _____ (AMD) C:\Users\Admin\Downloads\amddriverdownloader.exe
2013-08-25 00:24 - 2013-03-01 12:22 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-08-24 20:15 - 2013-08-24 20:15 - 00000000 _____ C:\Windows\setuperr.log
2013-08-24 20:04 - 2013-08-24 20:02 - 00028301 _____ C:\Users\Admin\Desktop\Result.txt
2013-08-24 19:59 - 2013-08-24 19:59 - 00002135 _____ C:\Users\Admin\Desktop\AdwCleaner[S0].txt
2013-08-24 19:55 - 2013-08-24 19:55 - 00000278 _____ C:\Users\Admin\Desktop\ESET2.txt
2013-08-24 18:28 - 2013-08-24 18:28 - 00994642 _____ C:\Users\Admin\Desktop\AdwCleaner(1).exe
2013-08-24 18:26 - 2013-08-24 18:26 - 00001941 _____ C:\Users\Admin\Desktop\deepInfection_instructions.txt
2013-08-24 18:21 - 2013-08-23 00:46 - 00000000 ____D C:\TDSSKiller_Quarantine
2013-08-24 03:54 - 2013-08-24 03:54 - 00028945 _____ C:\Users\Admin\Desktop\Result_miniToolBox.txt
2013-08-24 03:40 - 2013-08-24 03:38 - 00028945 _____ C:\Users\Admin\Downloads\Result.txt
2013-08-23 12:04 - 2013-08-23 12:04 - 00000413 _____ C:\Users\Admin\Desktop\ESET.txt
2013-08-23 00:59 - 2013-08-23 00:59 - 00000000 ____D C:\Program Files\ESET
2013-08-23 00:57 - 2013-08-23 00:57 - 02347384 _____ (ESET) C:\Users\Admin\Desktop\esetsmartinstaller_enu.exe
2013-08-22 23:20 - 2013-08-22 23:20 - 00000000 ____D C:\Users\Admin\AppData\Local\AVG SafeGuard toolbar
2013-08-22 23:19 - 2013-08-22 23:18 - 00000000 ____D C:\ProgramData\AVG SafeGuard toolbar
2013-08-22 23:18 - 2013-08-22 23:18 - 00000000 ____D C:\Program Files\AVG SafeGuard toolbar
2013-08-22 23:17 - 2013-08-22 23:19 - 00037664 _____ (AVG Technologies) C:\Windows\system32\Drivers\avgtpx86.sys
2013-08-22 23:13 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\Resources
2013-08-22 22:48 - 2013-08-22 22:48 - 01898112 _____ (Bleeping Computer, LLC) C:\Users\Admin\Desktop\iExplore.exe
2013-08-22 00:11 - 2013-08-22 00:11 - 00000000 ____D C:\Users\Admin\Desktop\SpaceSniffer
2013-08-21 20:06 - 2013-08-21 20:06 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Admin\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-21 19:55 - 2013-08-21 19:55 - 01536858 _____ C:\Users\Admin\Downloads\spacesniffer_1_1_4_0.zip
2013-08-21 19:53 - 2013-08-21 19:51 - 02748256 _____ (Kaspersky Lab ZAO) C:\Users\Admin\Downloads\tdsskiller.exe
2013-08-21 13:12 - 2013-08-21 13:12 - 04188160 _____ C:\Program Files\GUT5C25.tmp
2013-08-21 13:12 - 2013-08-21 13:12 - 00000000 ____D C:\Program Files\GUM5C24.tmp
2013-08-21 13:09 - 2013-08-21 13:09 - 00000000 ____D C:\Program Files\CCleaner
2013-08-21 13:09 - 2013-08-21 13:08 - 00000000 ____D C:\ProgramData\Google
2013-08-21 13:09 - 2011-02-04 15:04 - 00000000 ____D C:\Program Files\Google
2013-08-21 13:00 - 2013-08-21 12:59 - 04429440 _____ (Piriform Ltd) C:\Users\Admin\Downloads\ccsetup404.exe
2013-08-21 12:43 - 2012-08-23 21:37 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-08-21 12:43 - 2011-11-28 14:34 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-08-21 02:58 - 2013-08-19 14:59 - 00000000 ____D C:\Users\Admin\AppData\Local\{89C9A16B-6E97-4521-A0A0-46FA876E5F70}
2013-08-20 17:29 - 2013-08-20 17:29 - 00004608 _____ C:\Users\Admin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-08-20 17:27 - 2012-08-27 11:27 - 00000000 ____D C:\Users\Admin\Desktop\Halimahs Stuff
2013-08-19 14:57 - 2013-08-19 14:56 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
2013-08-15 01:59 - 2013-08-15 01:59 - 00000000 ____D C:\Users\Admin\AppData\Local\{878AC5C5-1BD2-4A9C-8A31-07F454DEFD30}
2013-08-14 15:36 - 2012-11-07 14:23 - 00000000 ____D C:\Program Files\Windows Live
2013-08-14 14:39 - 2002-01-01 14:34 - 00000000 ____D C:\ProgramData\Skype
2013-08-14 14:38 - 2002-01-02 23:28 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Skype
2013-08-14 14:31 - 2012-11-23 13:00 - 00000000 ____D C:\Program Files\Logitech
2013-08-14 13:59 - 2013-08-14 13:59 - 00000000 ____D C:\Users\Admin\AppData\Local\{E6CA5EDF-16D7-478D-9341-CC30F887E622}
2013-08-14 13:59 - 2013-03-01 22:23 - 00000000 ____D C:\Users\Admin\AppData\Local\VirtualStore
2013-08-14 06:14 - 2006-11-02 07:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-08-14 05:16 - 2012-08-23 18:28 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-08-14 05:13 - 2006-11-02 08:37 - 00000000 ____D C:\Windows\system32\XPSViewer
2013-08-14 05:13 - 2006-11-02 08:37 - 00000000 ____D C:\Program Files\Windows Journal
2013-08-14 04:36 - 2013-08-14 04:27 - 00000000 ____D C:\Windows\system32\MRT
2013-08-14 04:18 - 2011-02-08 02:49 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-14 00:31 - 2013-08-14 00:00 - 00000006 _____ C:\Windows\system32\ANIWZCSUSERNAME{A7279DE4-302D-4105-8DAB-B2F54C891FD6}
2013-08-13 23:56 - 2013-03-01 22:22 - 00000000 ____D C:\Users\Admin
2013-08-13 11:43 - 2013-08-13 11:43 - 00000000 ____D C:\Program Files\ANI
2013-08-13 11:43 - 2011-02-08 02:42 - 00000000 ____D C:\Program Files\InstallShield Installation Information
2013-08-13 11:37 - 2013-08-13 10:42 - 00000000 ____D C:\Program Files\Common Files\InstallShield
2013-08-13 11:36 - 2013-08-13 11:36 - 00001615 _____ C:\Users\Public\Desktop\Wireless Connection Manager.lnk
2013-08-13 11:35 - 2013-08-13 11:35 - 00000000 ____D C:\Program Files\D-Link
2013-08-13 11:33 - 2013-08-13 11:33 - 00000000 ____D C:\Users\Admin\AppData\Roaming\InstallShield
2013-08-13 11:32 - 2013-08-13 11:32 - 00000000 ____D C:\Users\Admin\Desktop\wua2340_drivers_150
2013-08-13 11:32 - 2008-08-07 02:09 - 00905728 _____ (D-Link Corporation) C:\Windows\system32\Drivers\AGUx86.sys
2013-08-13 10:59 - 2013-04-02 18:55 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy
2013-08-13 10:43 - 2013-08-13 10:43 - 00000000 ____D C:\ProgramData\InstallShield
2013-08-05 16:00 - 2006-11-02 06:24 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2013-09-02 00:59

==================== End Of Log ============================

 

The Addition Log:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 02-09-2013 02
Ran by Admin at 2013-09-02 01:03:05
Running from C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FUK4MQWT
Boot Mode: Normal
==========================================================

==================== Installed Programs =======================

Adobe Flash Player 11 ActiveX (Version: 11.8.800.94)
Adobe Flash Player 11 Plugin (Version: 11.8.800.94)
Adobe Shockwave Player 12.0 (Version: 12.0.0.112)
ANIWZCS2 Service
AVG SafeGuard toolbar (Version: 15.4.0.5)
Brother MFL-Pro Suite (Version: 1.00)
CCleaner (Version: 4.04)
D3DX10 (Version: 15.4.2368.0902)
ESET Online Scanner v3
Foxit Reader (Version: 5.4.5.124)
Google Talk Plugin (Version: 3.10.2.10212)
Google Toolbar for Internet Explorer (Version: 1.0.0)
Google Toolbar for Internet Explorer (Version: 7.5.4413.1752)
Google Update Helper (Version: 1.3.21.153)
Intel® Extreme Graphics Driver
Java 7 Update 25 (Version: 7.0.250)
Java Auto Updater (Version: 2.1.9.5)
Junk Mail filter update (Version: 15.4.3502.0922)
Logitech Webcam Software (Version: 12.10.1113)
Logitech Webcam Software Driver Package (Version: 12.10.1110)
Malwarebytes Anti-Malware version 1.75.0.1300 (Version: 1.75.0.1300)
Mesh Runtime (Version: 15.4.5722.2)
Messenger Companion (Version: 15.4.3502.0922)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Access Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000)
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Groove MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Groove Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Outlook Connector (Version: 14.0.5118.5000)
Microsoft Office Outlook MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft Software Update for Web Folders  (English) 12 (Version: 12.0.6612.1000)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
MSVCRT (Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MSXML 6 Service Pack 2 (KB973686) (Version: 6.20.2003.0)
Norton Security Suite (Version: 20.4.0.40)
PowerDVD (Version: 7.30.0000)
RangeBooster G WUA-2340
Realtek AC'97 Audio
Segoe UI (Version: 15.4.2271.0615)
Software Update for Web Folders (Version: 9.60.6715.0)
Spybot - Search & Destroy (Version: 1.6.2)
swMSM (Version: 12.0.0.1)
System Requirements Lab for Intel (Version: 4.5.15.0)
Tweaking.com - Windows Repair (All in One) (Version: 1.9.15)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB2836940) (Version: 1)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2768023) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817642) 32-Bit Edition
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Windows Internet Explorer 8 (Version: 20090308.140743)
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3555.0308)
Windows Live Family Safety (Version: 15.4.3555.0308)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Mail (Version: 15.4.3502.0922)
Windows Live Mesh (Version: 15.4.3502.0922)
Windows Live Messenger (Version: 15.4.3538.0513)
Windows Live Messenger Companion Core (Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (Version: 15.4.3502.0922)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live Photo Gallery (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)
Windows Live Writer (Version: 15.4.3502.0922)
Windows Live Writer Resources (Version: 15.4.3502.0922)
 

==================== Restore Points  =========================

29-08-2013 00:54:21 Windows Update
29-08-2013 03:50:31 Windows Modules Installer
29-08-2013 04:53:47 Windows Modules Installer
29-08-2013 19:23:43 Norton Security Suite Registry
01-09-2013 22:14:33 Scheduled Checkpoint

==================== Hosts content: ==========================

2001-08-23 10:00 - 2013-08-26 03:13 - 00000855 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {0553949D-B17C-4D59-8785-822252516BEB} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {12AE26E2-E573-4C6C-BCAF-93CE7E8AD730} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-08-21] (Google Inc.)
Task: {155723BA-60E2-4354-93AF-84EAC8D3C2D8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-20] ()
Task: {211CCA30-C7DE-495C-ADD9-3F2653143E3C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-08-21] (Google Inc.)
Task: {22E1772E-7DFE-4C5F-841F-1C93FD5D82A4} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {247A397C-A7DD-476D-A8BD-8E1966414310} - System32\Tasks\Microsoft\Windows\Defrag\ManualDefrag => C:\Windows\system32\defrag.exe [2008-01-20] (Microsoft Corp.)
Task: {2DE18FE4-6467-484F-8431-206702EC5546} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-20] (Microsoft Corporation)
Task: {2E5B7D97-F14C-4CFF-864E-620AABA892D1} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {31D0C8A4-B75D-4D62-A659-434925C2BAAA} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\OptinNotification => C:\Windows\System32\wsqmcons.exe [2008-01-20] (Microsoft Corporation)
Task: {4A109B6B-4C26-4825-8195-82DDE1F60B42} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-07-22] (Piriform Ltd)
Task: {4D72741E-769C-45DB-8604-CB8EBDADAA29} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {4D9ED535-C955-4F99-B189-12E0406D62B2} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\schtasks.exe [2008-01-20] (Microsoft Corporation)
Task: {4EC289BB-83E4-485B-A77F-3E9378730CDF} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton Security Suite\Engine\20.4.0.40\WSCStub.exe [2013-06-04] (Symantec Corporation)
Task: {61ED9651-BAED-45E8-9945-35ADC6F748F4} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-21] (Adobe Systems Incorporated)
Task: {9A839648-97BF-4D7A-951A-62DB012C381D} - System32\Tasks\Microsoft\Windows\PLA\System\{BDE01C4C-7AE0-44BD-91CE-E5098D3F940C}_System Diagnostics => C:\Windows\system32\schtasks.exe [2008-01-20] (Microsoft Corporation)
Task: {AAF422A4-BD91-405D-A5BA-3543A5C1D5F7} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-725345543-1637723038-1801674531-1003Core => C:\Documents and Settings\Khal\Local Settings\Application Data\Google\Update\GoogleUpdate.exe No File
Task: {B461143E-6CCD-4006-BFD4-C308DFFD3043} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-725345543-1637723038-1801674531-1003UA => C:\Documents and Settings\Khal\Local Settings\Application Data\Google\Update\GoogleUpdate.exe No File
Task: {C522602A-D0B4-4011-8D7B-875B401946CB} - System32\Tasks\Norton Security Suite\Norton Error Analyzer => C:\Program Files\Norton Security Suite\Engine\20.4.0.40\SymErr.exe [2013-06-03] (Symantec Corporation)
Task: {DE387025-BC3A-43C8-9C45-A1B54958FD87} - System32\Tasks\WPD\SqmUpload_S-1-5-21-725345543-1637723038-1801674531-1009 => C:\Windows\System32\portabledeviceapi.dll [2009-09-30] (Microsoft Corporation)
Task: {EFBAC2E5-DE73-4A89-8656-A8125965A9F5} - System32\Tasks\User_Feed_Synchronization-{BC892F18-3C08-474B-8CA9-CA6DB583692B} => C:\Windows\system32\msfeedssync.exe [2013-08-29] (Microsoft Corporation)
Task: {F73B22BF-793B-439E-9DD6-A2CBCF767D16} - System32\Tasks\Microsoft\Windows\PLA\System\{A4697F7E-B5D5-4325-A58E-1B35CFB8C6DC}_System Diagnostics => C:\Windows\system32\schtasks.exe [2008-01-20] (Microsoft Corporation)
Task: {FF84FFF3-2529-4138-BA36-CA3F881168C1} - System32\Tasks\Norton Security Suite\Norton Error Processor => C:\Program Files\Norton Security Suite\Engine\20.4.0.40\SymErr.exe [2013-06-03] (Symantec Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-07-15 22:58 - 2013-07-15 22:58 - 00290232 _____ (Symantec Corporation) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130715.001\UMEngx86.dll
2013-08-21 20:10 - 2013-04-04 14:50 - 00527944 _____ (Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbam.dll
2013-08-21 20:10 - 2013-04-04 14:50 - 02191944 _____ (Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamnet.dll
2009-04-11 09:19 - 2009-04-11 09:19 - 02012160 _____ (Microsoft Corporation) C:\Windows\system32\milcore.dll
2013-08-29 04:52 - 2013-05-28 22:41 - 02506576 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\buShell.dll
2013-08-29 04:52 - 2013-05-21 00:44 - 00705928 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\ccL120U.dll
2013-08-29 04:52 - 2013-05-23 01:25 - 00086408 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\EFACli.dll
2006-11-02 04:34 - 2006-11-02 05:46 - 00869376 _____ (Microsoft Corporation) C:\Windows\system32\WINBRAND.dll
2012-11-06 10:12 - 2010-05-04 15:13 - 00231424 _____ (Microsoft Corporation) C:\Windows\System32\msshsq.dll
2013-08-29 04:52 - 2013-05-21 00:44 - 00089480 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\ccVrTrst.dll
2013-08-29 04:52 - 2013-05-21 00:44 - 00345480 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\ccSet.dll
2008-01-20 22:25 - 2008-01-20 22:25 - 00397312 _____ (Microsoft Corporation) C:\Windows\system32\audioeng.dll
2009-04-11 09:19 - 2009-04-11 09:19 - 00223744 _____ (Microsoft Corporation) C:\Windows\system32\wscntfy.dll
2013-08-29 04:52 - 2013-06-04 00:42 - 00579408 ____R (Symantec Corporation) C:\PROGRAM FILES\NORTON SECURITY SUITE\ENGINE\20.4.0.40\ASOEHOOK.DLL
2013-08-29 04:52 - 2013-05-21 00:44 - 00289160 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\ccGEvt.dll
2013-08-29 04:52 - 2013-05-21 00:44 - 00157576 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\ccSvc.dll
2013-08-29 04:52 - 2013-05-21 00:40 - 00410576 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\srtsp32.dll
2013-08-29 04:52 - 2013-05-21 00:44 - 00159624 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\ccIPC.dll
2013-08-29 04:52 - 2013-06-04 00:43 - 00548688 ____R (Symantec Corporation) C:\PROGRAM FILES\NORTON SECURITY SUITE\ENGINE\20.4.0.40\NPCTRAY.DLL
2013-08-29 04:52 - 2013-06-04 00:43 - 00962384 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\uiMain.dll
2013-08-29 04:52 - 2013-05-28 03:42 - 02430800 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\SYMHTMDX.DLL
2013-08-29 04:52 - 2013-05-29 21:22 - 00320816 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\diStRptr.dll
2013-08-29 04:52 - 2013-05-29 22:13 - 01337136 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\MClnTask.dll
2013-08-29 04:52 - 2013-06-04 00:42 - 01846608 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\isDataPr.dll
2013-08-29 04:52 - 2013-05-30 21:48 - 01397584 ____R (Symantec Corporation) C:\PROGRAM FILES\NORTON SECURITY SUITE\ENGINE\20.4.0.40\COACTMGR.DLL
2013-08-29 04:52 - 2012-05-30 10:51 - 00699280 ____R () C:\PROGRAM FILES\NORTON SECURITY SUITE\ENGINE\20.4.0.40\wincfi39.dll
2013-08-29 04:52 - 2013-05-30 21:48 - 00551760 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\coShdObj.dll
2013-08-29 04:52 - 2013-05-29 22:13 - 01078576 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\DataStor.dll
2013-08-29 04:52 - 2013-05-29 22:13 - 00965936 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\Comm.dll
2013-08-29 04:52 - 2013-07-03 17:42 - 00821552 _____ (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\naHelper.dll
2013-08-29 04:52 - 2013-06-04 00:42 - 00548176 ____R (Symantec Corporation) C:\PROGRAM FILES\NORTON SECURITY SUITE\ENGINE\20.4.0.40\ASHELPER.DLL
2013-08-29 04:52 - 2013-06-04 00:42 - 00537424 ____R (Symantec Corporation) C:\PROGRAM FILES\NORTON SECURITY SUITE\ENGINE\20.4.0.40\AVPAPP32.DLL
2013-08-29 04:52 - 2013-05-28 22:41 - 00263504 ____R (Symantec Corporation) C:\PROGRAM FILES\NORTON SECURITY SUITE\ENGINE\20.4.0.40\BUUIPLG.DLL
2013-08-29 04:52 - 2013-05-23 22:09 - 00502664 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\AVIfc.dll
2013-08-29 04:52 - 2013-05-21 00:44 - 00401288 ____R (Symantec Corporation) C:\PROGRAM FILES\NORTON SECURITY SUITE\ENGINE\20.4.0.40\CCJOBMGR.DLL
2013-08-29 04:52 - 2013-05-20 18:50 - 02651472 ____R (Symantec Corporation) C:\PROGRAM FILES\NORTON SECURITY SUITE\ENGINE\20.4.0.40\CLTALDIS.DLL
2013-08-29 02:02 - 2013-05-20 18:50 - 00536912 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\MUI\20.4.0.40\09\01\cltRes.loc
2013-08-29 04:52 - 2013-05-20 18:50 - 00932176 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\cltPE.dll
2013-08-29 04:52 - 2013-05-20 18:50 - 01035088 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\cltLMS.dll
2013-08-29 04:52 - 2013-06-04 00:42 - 00528208 ____R (Symantec Corporation) C:\PROGRAM FILES\NORTON SECURITY SUITE\ENGINE\20.4.0.40\FWSESAL.DLL
2013-08-29 04:52 - 2013-05-30 21:46 - 00999760 ____R (Symantec Corporation) C:\PROGRAM FILES\NORTON SECURITY SUITE\ENGINE\20.4.0.40\CODATAPR.DLL
2013-08-29 04:52 - 2013-06-04 00:43 - 00502608 ____R (Symantec Corporation) C:\PROGRAM FILES\NORTON SECURITY SUITE\ENGINE\20.4.0.40\NUEX.DLL
2013-08-29 04:52 - 2013-06-04 00:43 - 00243024 ____R (Symantec Corporation) C:\PROGRAM FILES\NORTON SECURITY SUITE\ENGINE\20.4.0.40\QSPLUGIN.DLL
2013-08-29 04:52 - 2012-05-15 05:27 - 00588216 ____R (Symantec Corporation) C:\PROGRAM FILES\NORTON SECURITY SUITE\ENGINE\20.4.0.40\SDKCMN.DLL
2013-08-29 04:52 - 2013-06-04 00:43 - 00916304 ____R (Symantec Corporation) C:\PROGRAM FILES\NORTON SECURITY SUITE\ENGINE\20.4.0.40\UIALERT.DLL
2013-08-29 04:52 - 2013-05-29 22:13 - 00028464 ____R (Symantec Corporation) C:\PROGRAM FILES\NORTON SECURITY SUITE\ENGINE\20.4.0.40\USERCTXT.DLL
2013-08-29 04:52 - 2013-06-04 00:42 - 00145744 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\isPwd.dll
2013-08-29 04:52 - 2013-05-28 22:41 - 00272208 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\buDataCl.dll
2013-08-29 04:52 - 2013-05-28 22:41 - 00442192 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\buComm.dll
2013-08-29 04:52 - 2013-05-28 13:52 - 01439056 ____R (SwapDrive, Inc.) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\BuEng.dll
2013-08-29 04:52 - 2013-04-23 05:02 - 00115536 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\tuDataPr.dll
2013-08-29 04:52 - 2013-06-04 00:42 - 00408400 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\AvScnTsk.dll
2013-08-14 02:18 - 2013-04-17 07:28 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-08-14 02:18 - 2013-04-17 07:28 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-08-13 11:43 - 2008-08-06 17:05 - 00266240 _____ (Wireless Service) C:\Windows\system32\wnicapi.dll
2013-08-13 11:35 - 2005-10-22 21:56 - 00036864 _____ (Alpha Networks Inc.) C:\Windows\system32\ANIOApi.dll
2012-11-06 12:56 - 2011-03-10 13:03 - 01136640 _____ (Microsoft Corporation) C:\Windows\system32\MFC42.DLL
2013-08-13 11:43 - 2008-09-11 11:48 - 00262144 _____ () C:\Windows\system32\WlanApp.dll
2006-11-02 04:40 - 2006-11-02 05:46 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\tschannel.dll
2008-01-20 22:24 - 2008-01-20 22:24 - 01298432 _____ (Microsoft Corporation) C:\Windows\System32\TMM.dll
2006-11-02 04:45 - 2006-11-02 05:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\pautoenr.dll
2009-04-11 09:19 - 2009-04-11 09:20 - 01112064 _____ (Microsoft Corporation) C:\Windows\system32\certenroll.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\IEUI.dll
2009-02-26 16:45 - 2009-02-26 16:45 - 00043392 _____ (Microsoft Corporation) C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
2013-08-29 00:56 - 2013-08-29 00:56 - 00434176 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-08-29 04:52 - 2013-05-30 21:48 - 00509776 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\coIEPlg.dll
2013-08-29 04:52 - 2013-05-30 21:48 - 01164112 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\coUICtlr.dll
2013-08-29 04:52 - 2013-05-30 21:49 - 00842064 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\coWPPlg.dll
2013-08-29 04:52 - 2013-05-30 21:48 - 00227664 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\coSfShre.dll
2013-08-29 04:52 - 2013-05-30 21:48 - 02573136 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\coIDSafe.dll
2013-08-29 04:52 - 2012-05-30 10:51 - 00699280 ____R () C:\Program Files\Norton Security Suite\Engine\20.4.0.40\wincfi39.dll
2013-08-29 04:52 - 2013-04-23 05:02 - 00059728 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\FFPrefs.dll
2013-08-29 04:52 - 2013-05-29 21:22 - 00556336 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\diMaster.dll
2013-08-29 04:52 - 2012-08-10 21:33 - 00387040 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\IPS\IPSBHO.DLL
2013-09-01 15:56 - 2013-08-28 15:50 - 01259424 _____ (Symantec Corporation) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130830.001\Scxpx86.dll
2013-08-25 15:17 - 2013-08-25 15:17 - 00463272 _____ (Oracle Corporation) C:\Program Files\Java\jre7\bin\ssv.dll
2011-03-28 21:35 - 2011-03-28 21:35 - 00441216 _____ (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
2011-03-28 21:33 - 2011-03-28 21:33 - 00856984 _____ (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\wlidcli.dll
2012-03-08 19:14 - 2012-03-08 19:14 - 00393600 _____ (Microsoft Corporation) C:\Program Files\Windows Live\Companion\companioncore.dll
2012-03-08 18:50 - 2012-03-08 18:50 - 02457960 _____ (Microsoft Corporation) C:\Program Files\Windows Live\Shared\UXCore.dll
2010-07-11 16:47 - 2010-07-11 16:47 - 00453456 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_41.dll
2012-03-08 18:50 - 2012-03-08 18:50 - 00071016 _____ (Microsoft Corporation) C:\Program Files\Windows Live\Shared\WLDCore.dll
2012-03-08 18:50 - 2012-03-08 18:50 - 00592744 _____ (Microsoft Corporation) C:\Program Files\Windows Live\Shared\uxcontacts.dll
2012-03-08 18:50 - 2012-03-08 18:50 - 00104296 _____ (Microsoft Corporation) C:\Program Files\Windows Live\Shared\UXCalendar.dll
2012-03-08 19:17 - 2012-03-08 19:17 - 00551784 _____ (Microsoft Corporation) C:\Program Files\Windows Live\Installer\wlshim.dll
2013-08-25 15:17 - 2013-08-25 15:17 - 00171944 _____ (Oracle Corporation) C:\Program Files\Java\jre7\bin\jp2ssv.dll
2013-08-29 04:52 - 2013-05-28 03:42 - 03008848 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\SYMHTML.DLL
2013-08-29 00:56 - 2013-08-29 00:56 - 00434176 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 01800704 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-08-14 02:18 - 2013-04-17 06:34 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\D3D10Warp.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\Dxtrans.dll
2006-11-02 05:03 - 2006-11-02 05:46 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\ddrawex.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\Dxtmsft.dll
2013-08-29 04:52 - 2013-05-29 21:22 - 00517424 ____R (Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\diArkive.dll
2013-08-21 11:42 - 2013-08-21 11:42 - 16230792 ____R (Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\Flash32_11_8_800_94.ocx
2013-08-29 00:56 - 2013-08-29 00:56 - 00768512 _____ (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VGX\vgx.dll
2013-08-29 00:56 - 2013-08-29 00:56 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2012-11-06 12:53 - 2011-08-25 09:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\oleaccrc.dll
2013-08-21 11:42 - 2013-08-21 11:42 - 00479112 _____ (Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashUtil32_11_8_800_94_ActiveX.dll

==================== Alternate Data Streams (whitelisted) ==========

AlternateDataStreams: C:\Windows\Thumbs.db:encryptable
AlternateDataStreams: C:\Users\Public\Thumbs.db:encryptable

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (09/01/2013 06:14:33 PM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine ConvertStringSidToSid.  hr = 0x80070539.

Operation:
   OnIdentify event
   Gathering Writer Data

Context:
   Execution Context: Shadow Copy Optimization Writer
   Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Writer Name: Shadow Copy Optimization Writer
   Writer Instance ID: {d7db39bd-969f-4516-bb2b-8dad8cc1d519}

Error: (09/01/2013 05:31:00 PM) (Source: Application Error) (User: )
Description: Faulting application ccSvcHst.exe, version 12.3.3.2, time stamp 0x519ab0d3, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception code 0xc0000005, fault offset 0x00000001,
process id 0x1584, application start time 0xccSvcHst.exe0.

Error: (09/01/2013 05:17:29 PM) (Source: Application Error) (User: )
Description: Faulting application ccSvcHst.exe, version 12.3.3.2, time stamp 0x519ab0d3, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception code 0xc0000005, fault offset 0x00000001,
process id 0x1614, application start time 0xccSvcHst.exe0.

Error: (09/01/2013 04:22:19 PM) (Source: Application Error) (User: )
Description: Faulting application ccSvcHst.exe, version 12.3.3.2, time stamp 0x519ab0d3, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception code 0xc0000005, fault offset 0x00000001,
process id 0x1dc, application start time 0xccSvcHst.exe0.

Error: (08/29/2013 03:23:57 PM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine ConvertStringSidToSid.  hr = 0x80070539.

Operation:
   OnIdentify event
   Gathering Writer Data

Context:
   Execution Context: Shadow Copy Optimization Writer
   Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Writer Name: Shadow Copy Optimization Writer
   Writer Instance ID: {9ca976db-0d81-4777-b28a-c9b5cdab3175}

Error: (08/29/2013 00:53:49 AM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine ConvertStringSidToSid.  hr = 0x80070539.

Operation:
   OnIdentify event
   Gathering Writer Data

Context:
   Execution Context: Shadow Copy Optimization Writer
   Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Writer Name: Shadow Copy Optimization Writer
   Writer Instance ID: {e9a7deae-c2f8-4955-91c3-1ae2e1fa4f93}

Error: (08/28/2013 11:50:33 PM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine ConvertStringSidToSid.  hr = 0x80070539.

Operation:
   OnIdentify event
   Gathering Writer Data

Context:
   Execution Context: Shadow Copy Optimization Writer
   Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Writer Name: Shadow Copy Optimization Writer
   Writer Instance ID: {1e34b05e-0a4e-4ae1-9c52-3b58a8f935d8}

Error: (08/28/2013 08:54:24 PM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine ConvertStringSidToSid.  hr = 0x80070539.

Operation:
   OnIdentify event
   Gathering Writer Data

Context:
   Execution Context: Shadow Copy Optimization Writer
   Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Writer Name: Shadow Copy Optimization Writer
   Writer Instance ID: {333d5dc6-eea0-47c2-8341-be983452b691}

Error: (08/26/2013 06:41:47 PM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine ConvertStringSidToSid.  hr = 0x80070539.

Operation:
   OnIdentify event
   Gathering Writer Data

Context:
   Execution Context: Shadow Copy Optimization Writer
   Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Writer Name: Shadow Copy Optimization Writer
   Writer Instance ID: {41ca8b9e-5cd6-4fb8-9993-209e737b5e4a}

Error: (08/26/2013 03:28:49 AM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine ConvertStringSidToSid.  hr = 0x80070539.

Operation:
   OnIdentify event
   Gathering Writer Data

Context:
   Execution Context: Shadow Copy Optimization Writer
   Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Writer Name: Shadow Copy Optimization Writer
   Writer Instance ID: {59d80fd8-f2c2-4aad-82c9-600be356604b}

System errors:
=============
Error: (09/02/2013 00:54:05 AM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Error: (09/02/2013 00:53:45 AM) (Source: Service Control Manager) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
cpomy
sptd

Error: (09/02/2013 00:53:27 AM) (Source: Service Control Manager) (User: )
Description: The vToolbarUpdater15.4.0 service failed to start due to the following error:
%%2

Error: (09/02/2013 00:52:12 AM) (Source: sptd) (User: )
Description: Driver detected an internal error in its data structures for .

Error: (09/02/2013 00:46:55 AM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Error: (09/02/2013 00:36:55 AM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Error: (09/02/2013 00:26:55 AM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Error: (09/02/2013 00:16:55 AM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Error: (09/02/2013 00:06:55 AM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Error: (09/01/2013 11:56:55 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Microsoft Office Sessions:
=========================
Error: (02/12/2013 10:36:41 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3293 seconds with 2520 seconds of active time.  This session ended with a crash.

CodeIntegrity Errors:
===================================
  Date: 2013-08-29 04:53:33.501
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\temp\TEMP.^^^\SYMEVENT.SYS because the set of per-page image hashes could not be found on the system.

  Date: 2013-08-29 04:53:32.681
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\temp\TEMP.^^^\SYMEVENT.SYS because the set of per-page image hashes could not be found on the system.

  Date: 2013-08-29 04:53:31.876
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\temp\TEMP.^^^\SYMEVENT.SYS because the set of per-page image hashes could not be found on the system.

  Date: 2013-08-29 04:53:31.071
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\temp\TEMP.^^^\SYMEVENT.SYS because the set of per-page image hashes could not be found on the system.

  Date: 2013-08-29 04:53:30.212
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\SYMEVENT.SYS because the set of per-page image hashes could not be found on the system.

  Date: 2013-08-29 04:53:29.407
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\SYMEVENT.SYS because the set of per-page image hashes could not be found on the system.

  Date: 2013-08-29 04:53:28.602
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\SYMEVENT.SYS because the set of per-page image hashes could not be found on the system.

  Date: 2013-08-29 04:53:27.743
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\SYMEVENT.SYS because the set of per-page image hashes could not be found on the system.

  Date: 2013-08-28 21:24:11.199
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22497_none_b34d67897fc6850f\tcpip.sys because the set of per-page image hashes could not be found on the system.

  Date: 2013-08-28 21:24:10.371
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.22497_none_b34d67897fc6850f\tcpip.sys because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Percentage of memory in use: 47%
Total physical RAM: 2038.32 MB
Available physical RAM: 1071.11 MB
Total Pagefile: 4321.69 MB
Available Pagefile: 3234.37 MB
Total Virtual: 2047.88 MB
Available Virtual: 1907.25 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:37.26 GB) (Free:10.37 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 37 GB) (Disk ID: 53DDB0DF)
Partition 1: (Active) - (Size=37 GB) - (Type=07 NTFS)

==================== End Of Log ============================



#7 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:20 AM

Posted 02 September 2013 - 01:39 AM



Hello ummhasan

These are the programs I would like you to run next, if you have any problems with one of these just skip it and move on to the next one.

-AdwCleaner-

Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Delete.
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
-Junkware-Removal-Tool-

Please download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
When they are complete let me have the two reports and let me know how things are running.

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#8 ummhasan

ummhasan
  • Topic Starter

  • Members
  • 155 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan
  • Local time:10:20 AM

Posted 02 September 2013 - 11:03 AM

Please download AdwCleaner by Xplode onto your desktop.

  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Delete.
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.

 

 

Thanks again for your reply. There is no Delete to click on AdwCleaner - do you mean to click uninstall or clean?



#9 ummhasan

ummhasan
  • Topic Starter

  • Members
  • 155 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan
  • Local time:10:20 AM

Posted 02 September 2013 - 12:03 PM

Okay, since I'm already familiar with the program, I assumed you meant clean so that's what I did. Here are the logs:

 

AdwCleaner:

# AdwCleaner v3.001 - Report created 02/09/2013 at 12:03:49
# Updated 24/08/2013 by Xplode
# Operating System : Windows Vista ™ Business Service Pack 2 (32 bits)
# Username : Admin - HASAN
# Running from : C:\Users\Admin\Desktop\AdwCleaner(1).exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16502

*************************

AdwCleaner[0].txt - [4775 octets] - [22/08/2013 23:21:38]
AdwCleaner[R0].txt - [2046 octets] - [24/08/2013 18:29:51]
AdwCleaner[R1].txt - [1046 octets] - [24/08/2013 20:17:00]
AdwCleaner[R2].txt - [1076 octets] - [25/08/2013 21:45:09]
AdwCleaner[R3].txt - [1287 octets] - [28/08/2013 19:14:56]
AdwCleaner[R4].txt - [1317 octets] - [28/08/2013 19:38:45]
AdwCleaner[R5].txt - [1437 octets] - [28/08/2013 19:47:12]
AdwCleaner[R6].txt - [1511 octets] - [29/08/2013 00:15:57]
AdwCleaner[R7].txt - [1540 octets] - [29/08/2013 00:40:32]
AdwCleaner[R8].txt - [1708 octets] - [02/09/2013 11:59:55]
AdwCleaner[S0].txt - [2135 octets] - [24/08/2013 18:34:26]
AdwCleaner[S1].txt - [1112 octets] - [24/08/2013 20:19:12]
AdwCleaner[S2].txt - [1138 octets] - [25/08/2013 21:46:25]
AdwCleaner[S3].txt - [1353 octets] - [28/08/2013 19:32:28]
AdwCleaner[S4].txt - [1379 octets] - [28/08/2013 19:41:33]
AdwCleaner[S5].txt - [1499 octets] - [28/08/2013 23:22:07]
AdwCleaner[S6].txt - [1576 octets] - [29/08/2013 00:17:35]
AdwCleaner[S7].txt - [1631 octets] - [02/09/2013 12:03:49]

########## EOF - C:\AdwCleaner\AdwCleaner[S7].txt - [1691 octets] ##########

 

 

Junkware:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.7 (09.01.2013:1)
OS: Windows Vista ™ Business x86
Ran by Admin on Mon 09/02/2013 at 12:30:06.72
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

~~~ Services

 

~~~ Registry Values

 

~~~ Registry Keys

 

~~~ Files

 

~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\Admin\appdata\local\{0CBF2A49-80F6-4847-8FB2-DED5526016E4}
Successfully deleted: [Empty Folder] C:\Users\Admin\appdata\local\{64638FF0-5499-4BA4-8C43-513D5A627DA5}
Successfully deleted: [Empty Folder] C:\Users\Admin\appdata\local\{878AC5C5-1BD2-4A9C-8A31-07F454DEFD30}
Successfully deleted: [Empty Folder] C:\Users\Admin\appdata\local\{89C9A16B-6E97-4521-A0A0-46FA876E5F70}
Successfully deleted: [Empty Folder] C:\Users\Admin\appdata\local\{BFE89529-1E81-4F18-A1B8-802BA3F7F760}
Successfully deleted: [Empty Folder] C:\Users\Admin\appdata\local\{C0E3A97E-C8EC-4D7D-BAF2-2316F945C53E}
Successfully deleted: [Empty Folder] C:\Users\Admin\appdata\local\{D85C00DC-D8F6-47E3-AFA1-FEA95C84022B}
Successfully deleted: [Empty Folder] C:\Users\Admin\appdata\local\{E6CA5EDF-16D7-478D-9341-CC30F887E622}

 

~~~ Event Viewer Logs were cleared

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 09/02/2013 at 12:57:03.08
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



#10 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:20 AM

Posted 02 September 2013 - 12:38 PM


Hello ummhasan

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"
  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#11 ummhasan

ummhasan
  • Topic Starter

  • Members
  • 155 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan
  • Local time:10:20 AM

Posted 02 September 2013 - 04:53 PM

Bellow is the comboFix log. I had no problems, the scan passed through 50 stages in 27 minutes and about 5 more to create the log. The system did not restart or show any errors.My hard drive is now showing only 9.79gb available out of 37.2gb size. The system is running fine and has been for some time (not slow), my only concern is the seemingly too much space being taken on the hard drive for what I have installed.

 

ComboFix Log:

ComboFix 13-09-02.02 - Admin 09/02/2013  17:13:57.1.1 - x86
Microsoft® Windows Vista™ Business   6.0.6002.2.1252.1.1033.18.2038.1256 [GMT -4:00]
Running from: c:\users\Admin\Desktop\ComboFix.exe
AV: Norton Security Suite *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Security Suite *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Security Suite *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
.
.
(((((((((((((((((((((((((   Files Created from 2013-08-02 to 2013-09-02  )))))))))))))))))))))))))))))))
.
.
2013-09-02 21:38 . 2013-09-02 21:38 -------- d-----w- c:\users\TEMP\AppData\Local\temp
2013-09-02 21:38 . 2013-09-02 21:38 -------- d-----w- c:\users\Mom\AppData\Local\temp
2013-09-02 21:38 . 2013-09-02 21:38 -------- d-----w- c:\users\Guest\AppData\Local\temp
2013-09-02 21:38 . 2013-09-02 21:38 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-09-02 16:29 . 2013-09-02 16:29 -------- d-----w- c:\windows\ERUNT
2013-09-02 04:59 . 2013-09-02 04:59 -------- d-----w- C:\FRST
2013-08-29 05:08 . 2013-08-29 08:52 142496 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2013-08-29 05:08 . 2013-08-29 05:08 -------- d-----w- c:\program files\Symantec
2013-08-29 05:06 . 2013-08-29 19:52 -------- d-----w- c:\windows\system32\drivers\N360
2013-08-29 05:06 . 2013-08-29 05:06 -------- d-----w- c:\program files\Norton Security Suite
2013-08-29 05:05 . 2013-08-29 05:05 -------- d-----w- c:\program files\NortonInstaller
2013-08-28 23:24 . 2013-08-02 04:09 1548288 ----a-w- c:\windows\system32\WMVDECOD.DLL
2013-08-26 07:30 . 2013-08-26 07:30 -------- d-----w- c:\users\Admin\AppData\Local\Adobe
2013-08-26 07:25 . 2013-08-29 04:55 -------- d-----w- c:\windows\system32\catroot2
2013-08-26 05:55 . 2013-08-26 07:21 181064 ----a-w- c:\windows\PSEXESVC.EXE
2013-08-26 01:27 . 2013-08-26 01:44 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2013-08-25 19:26 . 2013-08-25 19:26 -------- d-----w- c:\program files\SystemRequirementsLab
2013-08-25 19:26 . 2013-08-25 19:26 -------- d-----w- c:\users\Admin\AppData\Roaming\SystemRequirementsLab
2013-08-25 19:20 . 2013-08-25 19:20 -------- d-----w- c:\program files\Common Files\Java
2013-08-25 19:19 . 2013-08-25 19:17 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-08-25 19:16 . 2013-08-25 19:16 -------- d-----w- c:\program files\Java
2013-08-23 04:59 . 2013-08-23 04:59 -------- d-----w- c:\program files\ESET
2013-08-23 04:46 . 2013-08-24 22:21 -------- d-----w- C:\TDSSKiller_Quarantine
2013-08-23 03:21 . 2013-09-02 16:03 -------- d-----w- C:\AdwCleaner
2013-08-23 03:20 . 2013-08-23 03:20 -------- d-----w- c:\users\Admin\AppData\Local\AVG SafeGuard toolbar
2013-08-23 03:19 . 2013-08-23 03:17 37664 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
2013-08-23 03:18 . 2013-08-23 03:19 -------- d-----w- c:\programdata\AVG SafeGuard toolbar
2013-08-23 03:18 . 2013-08-23 03:18 -------- d-----w- c:\program files\AVG SafeGuard toolbar
2013-08-23 03:16 . 2013-08-23 03:16 -------- d-----w- c:\programdata\Common Files
2013-08-22 00:10 . 2013-08-26 05:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-08-22 00:10 . 2013-04-04 18:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-08-21 17:12 . 2013-08-21 17:12 -------- d-----w- c:\program files\GUM5C24.tmp
2013-08-21 17:12 . 2013-08-21 17:12 4188160 ----a-w- c:\program files\GUT5C25.tmp
2013-08-21 17:09 . 2013-08-21 17:09 -------- d-----w- c:\program files\CCleaner
2013-08-21 17:05 . 2013-08-29 04:43 -------- d-----w- c:\users\Admin\AppData\Local\Google
2013-08-14 08:27 . 2013-08-14 08:36 -------- d-----w- c:\windows\system32\MRT
2013-08-14 06:29 . 2013-07-17 19:41 2048 ----a-w- c:\windows\system32\tzres.dll
2013-08-14 06:29 . 2013-07-10 09:47 783360 ----a-w- c:\windows\system32\rpcrt4.dll
2013-08-14 06:29 . 2013-04-15 14:20 638328 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-08-14 06:29 . 2013-04-13 10:56 37376 ----a-w- c:\windows\system32\cdd.dll
2013-08-14 06:28 . 2013-04-24 01:46 812544 ----a-w- c:\windows\system32\certutil.exe
2013-08-14 06:28 . 2013-04-24 04:00 41984 ----a-w- c:\windows\system32\certenc.dll
2013-08-14 06:28 . 2013-07-08 04:55 3603904 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-08-14 06:28 . 2013-07-08 04:55 3551680 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-08-14 06:28 . 2013-07-09 12:10 1205168 ----a-w- c:\windows\system32\ntdll.dll
2013-08-14 06:28 . 2013-06-01 04:06 505344 ----a-w- c:\windows\system32\qedit.dll
2013-08-14 06:27 . 2013-06-15 13:22 15872 ----a-w- c:\windows\system32\icaapi.dll
2013-08-14 06:27 . 2013-06-15 11:23 24064 ----a-w- c:\windows\system32\drivers\tssecsrv.sys
2013-08-14 06:26 . 2013-07-05 04:53 905664 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-08-14 06:25 . 2013-06-04 01:50 2049024 ----a-w- c:\windows\system32\win32k.sys
2013-08-14 06:20 . 2013-05-02 04:04 443904 ----a-w- c:\windows\system32\win32spl.dll
2013-08-14 06:20 . 2013-05-02 04:03 37376 ----a-w- c:\windows\system32\printcom.dll
2013-08-14 06:18 . 2013-04-17 11:28 189952 ----a-w- c:\windows\system32\d3d10core.dll
2013-08-14 06:18 . 2013-04-17 10:33 486400 ----a-w- c:\windows\system32\d3d10level9.dll
2013-08-14 06:18 . 2013-04-17 10:10 1069056 ----a-w- c:\windows\system32\DWrite.dll
2013-08-14 06:18 . 2013-04-17 10:10 798208 ----a-w- c:\windows\system32\FntCache.dll
2013-08-14 06:18 . 2013-04-17 11:28 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
2013-08-14 06:18 . 2013-04-17 11:28 160768 ----a-w- c:\windows\system32\d3d10_1.dll
2013-08-14 06:18 . 2013-04-17 11:28 1029120 ----a-w- c:\windows\system32\d3d10.dll
2013-08-14 06:18 . 2013-04-17 10:34 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
2013-08-14 06:18 . 2013-04-17 10:14 683008 ----a-w- c:\windows\system32\d2d1.dll
2013-08-14 06:09 . 2013-04-09 03:52 1218048 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2013-08-14 06:09 . 2013-04-09 03:51 983552 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
2013-08-14 06:09 . 2013-04-09 03:51 936960 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2013-08-14 06:09 . 2013-04-09 03:51 964608 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
2013-08-14 06:08 . 2013-07-08 04:16 98304 ----a-w- c:\windows\system32\cryptnet.dll
2013-08-14 06:08 . 2013-07-08 04:16 133120 ----a-w- c:\windows\system32\cryptsvc.dll
2013-08-14 06:08 . 2013-07-08 04:16 992768 ----a-w- c:\windows\system32\crypt32.dll
2013-08-14 06:08 . 2013-07-08 04:20 172544 ----a-w- c:\windows\system32\wintrust.dll
2013-08-14 04:09 . 2013-04-17 12:30 24576 ----a-w- c:\windows\system32\cryptdlg.dll
2013-08-14 04:03 . 2013-08-26 05:01 -------- d-----w- c:\users\Admin\AppData\Local\CrashDumps
2013-08-13 15:43 . 2008-07-10 13:54 692224 ----a-w- c:\windows\system32\ANIWZCS2.dll
2013-08-13 15:43 . 2005-10-19 22:19 49152 ----a-w- c:\windows\system32\AQCKGen.dll
2013-08-13 15:43 . 2008-09-11 15:48 262144 ----a-w- c:\windows\system32\wlanapp.dll
2013-08-13 15:43 . 2008-08-06 21:05 266240 ----a-w- c:\windows\system32\wnicapi.dll
2013-08-13 15:43 . 2008-06-20 18:08 204800 ----a-w- c:\windows\system32\aIPH.dll
2013-08-13 15:43 . 2006-09-26 17:49 45115 ----a-w- c:\windows\system32\ANICtl.dll
2013-08-13 15:43 . 2013-08-13 15:43 -------- d-----w- c:\program files\ANI
2013-08-13 15:43 . 2005-10-27 12:55 49152 ----a-w- c:\windows\system32\JJAKEn.dll
2013-08-13 15:43 . 2005-10-19 22:19 1327189 ----a-w- c:\windows\system32\odSupp_M.dll
2013-08-13 15:36 . 2008-05-15 07:28 20384 ----a-w- c:\windows\system32\drivers\jswpslwf.sys
2013-08-13 15:35 . 2013-08-13 15:35 -------- d-----w- c:\program files\D-Link
2013-08-13 15:35 . 2005-10-23 01:56 36864 ----a-w- c:\windows\system32\ANIOApi.dll
2013-08-13 15:33 . 2013-08-13 15:33 -------- d-----w- c:\users\Admin\AppData\Roaming\InstallShield
2013-08-13 14:43 . 2013-08-13 14:43 -------- d-----w- c:\programdata\InstallShield
2013-08-13 14:42 . 2013-08-13 15:37 -------- d-----w- c:\program files\Common Files\InstallShield
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-25 19:17 . 2012-08-31 13:44 867240 ----a-w- c:\windows\system32\npdeployJava1.dll
2013-08-25 19:17 . 2011-02-08 06:31 789416 ----a-w- c:\windows\system32\deployJava1.dll
2013-08-21 16:43 . 2012-08-24 01:37 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-08-21 16:43 . 2011-11-28 18:34 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-08-13 15:32 . 2008-08-07 06:09 905728 ----a-w- c:\windows\system32\drivers\AGUx86.sys
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"D-Link RangeBooster G WUA-2340"="c:\program files\D-Link\RangeBooster G WUA-2340\AirPlusCFG.exe" [2008-09-24 1667072]
"SoundMan"="SOUNDMAN.EXE" [2009-04-14 604704]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
R3 A5AGU;D-Link Wireless LAN 802.11 USB device driver;c:\windows\system32\DRIVERS\AGUx86.sys [2013-08-13 905728]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ    PLA DPS BFE mpssvc
rsmsvcs REG_MULTI_SZ    ntmssvc
dot3svc REG_MULTI_SZ    dot3svc
eapsvcs REG_MULTI_SZ    eaphost
WudfServiceGroup REG_MULTI_SZ    WUDFSvc
LocalServiceAndNoImpersonation REG_MULTI_SZ    FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2013-09-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-24 16:43]
.
2013-09-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-08-21 17:05]
.
2013-09-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-08-21 17:05]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
TCP: DhcpNameServer = 75.75.76.76 75.75.75.75
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-Tweaking.com - Windows Repair (All in One) - c:\users\Admin\Desktop\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-09-02 17:39
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ...
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton Security Suite\Engine\20.4.0.40\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\20.4.0.40\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
Completion time: 2013-09-02  17:46:09
ComboFix-quarantined-files.txt  2013-09-02 21:46
ComboFix2.txt  2013-08-26 05:30
ComboFix3.txt  2013-08-26 05:04
.
Pre-Run: 10,583,437,312 bytes free
Post-Run: 10,468,356,096 bytes free
.
- - End Of File - - 34D2BB3A4A331D6C2FC8572753FE5412
5C616939100B85E558DA92B899A0FC36
 



#12 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:20 AM

Posted 04 September 2013 - 11:29 PM


Hello ummhasan

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Please start by opening Notepad and copy/paste the text in the box into the window:

ClearJavaCache::


 
Save it to your desktop as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe
CFScriptB-4.gif
This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"
  • In your next post I need the following
    • report from Combofix
    • let me know of any problems you may have had
    • How is the computer doing now after running the script?
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#13 ummhasan

ummhasan
  • Topic Starter

  • Members
  • 155 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan
  • Local time:10:20 AM

Posted 06 September 2013 - 07:21 AM

Hello again Gringo and thanks again for your time and reply!

 

Below is my report and during the scan, there was one problem this time. I have taken a screen shot of it and attached it here (I can't paste it).

 

After the scan, there is showing 10.8gb of free disc space, slightly more than what it was on the last scan. I have not noticed any other problems with the computer other than what appears to me to be very little disc space available. I have not attempted to run any on board tools like defrag, cleanup, registery cleaner (norton), or the like since my original post so I'm not sure if those would now help or not. I'm also not 100% sure if the PC is still infected or if the drive is just too small. I'm not an expert.

 

Thanks again for your time and efforts. Please let me know what you think based on the scan reports.

 

Report:

ComboFix 13-09-06.01 - Admin 09/06/2013   0:08.2.1 - x86
Microsoft® Windows Vista™ Business   6.0.6002.2.1252.1.1033.18.2038.1315 [GMT -4:00]
Running from: c:\users\Admin\Desktop\ComboFix.exe
Command switches used :: c:\users\Admin\Desktop\CFScript.txt
AV: Norton Security Suite *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Security Suite *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Security Suite *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
.
.
(((((((((((((((((((((((((   Files Created from 2013-08-06 to 2013-09-06  )))))))))))))))))))))))))))))))
.
.
2013-09-06 12:04 . 2013-09-06 12:04 -------- d-----w- c:\users\TEMP\AppData\Local\temp
2013-09-06 12:04 . 2013-09-06 12:04 -------- d-----w- c:\users\Mom\AppData\Local\temp
2013-09-06 12:04 . 2013-09-06 12:04 -------- d-----w- c:\users\Guest\AppData\Local\temp
2013-09-06 12:04 . 2013-09-06 12:04 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-09-02 16:29 . 2013-09-02 16:29 -------- d-----w- c:\windows\ERUNT
2013-09-02 04:59 . 2013-09-02 04:59 -------- d-----w- C:\FRST
2013-08-29 05:08 . 2013-08-29 08:52 142496 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2013-08-29 05:08 . 2013-08-29 05:08 -------- d-----w- c:\program files\Symantec
2013-08-29 05:06 . 2013-08-29 19:52 -------- d-----w- c:\windows\system32\drivers\N360
2013-08-29 05:06 . 2013-08-29 05:06 -------- d-----w- c:\program files\Norton Security Suite
2013-08-29 05:05 . 2013-08-29 05:05 -------- d-----w- c:\program files\NortonInstaller
2013-08-28 23:24 . 2013-08-02 04:09 1548288 ----a-w- c:\windows\system32\WMVDECOD.DLL
2013-08-26 07:30 . 2013-08-26 07:30 -------- d-----w- c:\users\Admin\AppData\Local\Adobe
2013-08-26 07:25 . 2013-09-06 04:02 -------- d-----w- c:\windows\system32\catroot2
2013-08-26 05:55 . 2013-08-26 07:21 181064 ----a-w- c:\windows\PSEXESVC.EXE
2013-08-26 01:27 . 2013-08-26 01:44 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2013-08-25 19:26 . 2013-08-25 19:26 -------- d-----w- c:\program files\SystemRequirementsLab
2013-08-25 19:26 . 2013-08-25 19:26 -------- d-----w- c:\users\Admin\AppData\Roaming\SystemRequirementsLab
2013-08-25 19:20 . 2013-08-25 19:20 -------- d-----w- c:\program files\Common Files\Java
2013-08-25 19:19 . 2013-08-25 19:17 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-08-25 19:16 . 2013-08-25 19:16 -------- d-----w- c:\program files\Java
2013-08-23 04:59 . 2013-08-23 04:59 -------- d-----w- c:\program files\ESET
2013-08-23 04:46 . 2013-08-24 22:21 -------- d-----w- C:\TDSSKiller_Quarantine
2013-08-23 03:21 . 2013-09-02 16:03 -------- d-----w- C:\AdwCleaner
2013-08-23 03:20 . 2013-08-23 03:20 -------- d-----w- c:\users\Admin\AppData\Local\AVG SafeGuard toolbar
2013-08-23 03:19 . 2013-08-23 03:17 37664 ----a-w- c:\windows\system32\drivers\avgtpx86.sys
2013-08-23 03:18 . 2013-08-23 03:19 -------- d-----w- c:\programdata\AVG SafeGuard toolbar
2013-08-23 03:18 . 2013-08-23 03:18 -------- d-----w- c:\program files\AVG SafeGuard toolbar
2013-08-23 03:16 . 2013-08-23 03:16 -------- d-----w- c:\programdata\Common Files
2013-08-22 00:10 . 2013-08-26 05:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-08-22 00:10 . 2013-04-04 18:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-08-21 17:12 . 2013-08-21 17:12 -------- d-----w- c:\program files\GUM5C24.tmp
2013-08-21 17:12 . 2013-08-21 17:12 4188160 ----a-w- c:\program files\GUT5C25.tmp
2013-08-21 17:09 . 2013-08-21 17:09 -------- d-----w- c:\program files\CCleaner
2013-08-21 17:05 . 2013-08-29 04:43 -------- d-----w- c:\users\Admin\AppData\Local\Google
2013-08-14 08:27 . 2013-08-14 08:36 -------- d-----w- c:\windows\system32\MRT
2013-08-14 06:29 . 2013-07-17 19:41 2048 ----a-w- c:\windows\system32\tzres.dll
2013-08-14 06:29 . 2013-07-10 09:47 783360 ----a-w- c:\windows\system32\rpcrt4.dll
2013-08-14 06:29 . 2013-04-15 14:20 638328 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-08-14 06:29 . 2013-04-13 10:56 37376 ----a-w- c:\windows\system32\cdd.dll
2013-08-14 06:28 . 2013-04-24 01:46 812544 ----a-w- c:\windows\system32\certutil.exe
2013-08-14 06:28 . 2013-04-24 04:00 41984 ----a-w- c:\windows\system32\certenc.dll
2013-08-14 06:28 . 2013-07-08 04:55 3603904 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-08-14 06:28 . 2013-07-08 04:55 3551680 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-08-14 06:28 . 2013-07-09 12:10 1205168 ----a-w- c:\windows\system32\ntdll.dll
2013-08-14 06:28 . 2013-06-01 04:06 505344 ----a-w- c:\windows\system32\qedit.dll
2013-08-14 06:27 . 2013-06-15 13:22 15872 ----a-w- c:\windows\system32\icaapi.dll
2013-08-14 06:27 . 2013-06-15 11:23 24064 ----a-w- c:\windows\system32\drivers\tssecsrv.sys
2013-08-14 06:26 . 2013-07-05 04:53 905664 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-08-14 06:25 . 2013-06-04 01:50 2049024 ----a-w- c:\windows\system32\win32k.sys
2013-08-14 06:20 . 2013-05-02 04:04 443904 ----a-w- c:\windows\system32\win32spl.dll
2013-08-14 06:20 . 2013-05-02 04:03 37376 ----a-w- c:\windows\system32\printcom.dll
2013-08-14 06:18 . 2013-04-17 11:28 189952 ----a-w- c:\windows\system32\d3d10core.dll
2013-08-14 06:18 . 2013-04-17 10:33 486400 ----a-w- c:\windows\system32\d3d10level9.dll
2013-08-14 06:18 . 2013-04-17 10:10 1069056 ----a-w- c:\windows\system32\DWrite.dll
2013-08-14 06:18 . 2013-04-17 10:10 798208 ----a-w- c:\windows\system32\FntCache.dll
2013-08-14 06:18 . 2013-04-17 11:28 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
2013-08-14 06:18 . 2013-04-17 11:28 160768 ----a-w- c:\windows\system32\d3d10_1.dll
2013-08-14 06:18 . 2013-04-17 11:28 1029120 ----a-w- c:\windows\system32\d3d10.dll
2013-08-14 06:18 . 2013-04-17 10:34 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
2013-08-14 06:18 . 2013-04-17 10:14 683008 ----a-w- c:\windows\system32\d2d1.dll
2013-08-14 06:09 . 2013-04-09 03:52 1218048 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2013-08-14 06:09 . 2013-04-09 03:51 983552 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
2013-08-14 06:09 . 2013-04-09 03:51 936960 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2013-08-14 06:09 . 2013-04-09 03:51 964608 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
2013-08-14 06:08 . 2013-07-08 04:16 98304 ----a-w- c:\windows\system32\cryptnet.dll
2013-08-14 06:08 . 2013-07-08 04:16 133120 ----a-w- c:\windows\system32\cryptsvc.dll
2013-08-14 06:08 . 2013-07-08 04:16 992768 ----a-w- c:\windows\system32\crypt32.dll
2013-08-14 06:08 . 2013-07-08 04:20 172544 ----a-w- c:\windows\system32\wintrust.dll
2013-08-14 04:09 . 2013-04-17 12:30 24576 ----a-w- c:\windows\system32\cryptdlg.dll
2013-08-14 04:03 . 2013-09-06 11:54 -------- d-----w- c:\users\Admin\AppData\Local\CrashDumps
2013-08-13 15:43 . 2008-07-10 13:54 692224 ----a-w- c:\windows\system32\ANIWZCS2.dll
2013-08-13 15:43 . 2005-10-19 22:19 49152 ----a-w- c:\windows\system32\AQCKGen.dll
2013-08-13 15:43 . 2008-09-11 15:48 262144 ----a-w- c:\windows\system32\wlanapp.dll
2013-08-13 15:43 . 2008-08-06 21:05 266240 ----a-w- c:\windows\system32\wnicapi.dll
2013-08-13 15:43 . 2008-06-20 18:08 204800 ----a-w- c:\windows\system32\aIPH.dll
2013-08-13 15:43 . 2006-09-26 17:49 45115 ----a-w- c:\windows\system32\ANICtl.dll
2013-08-13 15:43 . 2013-08-13 15:43 -------- d-----w- c:\program files\ANI
2013-08-13 15:43 . 2005-10-27 12:55 49152 ----a-w- c:\windows\system32\JJAKEn.dll
2013-08-13 15:43 . 2005-10-19 22:19 1327189 ----a-w- c:\windows\system32\odSupp_M.dll
2013-08-13 15:36 . 2008-05-15 07:28 20384 ----a-w- c:\windows\system32\drivers\jswpslwf.sys
2013-08-13 15:35 . 2013-08-13 15:35 -------- d-----w- c:\program files\D-Link
2013-08-13 15:35 . 2005-10-23 01:56 36864 ----a-w- c:\windows\system32\ANIOApi.dll
2013-08-13 15:33 . 2013-08-13 15:33 -------- d-----w- c:\users\Admin\AppData\Roaming\InstallShield
2013-08-13 14:43 . 2013-08-13 14:43 -------- d-----w- c:\programdata\InstallShield
2013-08-13 14:42 . 2013-08-13 15:37 -------- d-----w- c:\program files\Common Files\InstallShield
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-25 19:17 . 2012-08-31 13:44 867240 ----a-w- c:\windows\system32\npdeployJava1.dll
2013-08-25 19:17 . 2011-02-08 06:31 789416 ----a-w- c:\windows\system32\deployJava1.dll
2013-08-21 16:43 . 2012-08-24 01:37 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-08-21 16:43 . 2011-11-28 18:34 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-08-13 15:32 . 2008-08-07 06:09 905728 ----a-w- c:\windows\system32\drivers\AGUx86.sys
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"D-Link RangeBooster G WUA-2340"="c:\program files\D-Link\RangeBooster G WUA-2340\AirPlusCFG.exe" [2008-09-24 1667072]
"SoundMan"="SOUNDMAN.EXE" [2009-04-14 604704]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
R3 A5AGU;D-Link Wireless LAN 802.11 USB device driver;c:\windows\system32\DRIVERS\AGUx86.sys [2013-08-13 905728]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ    PLA DPS BFE mpssvc
rsmsvcs REG_MULTI_SZ    ntmssvc
dot3svc REG_MULTI_SZ    dot3svc
eapsvcs REG_MULTI_SZ    eaphost
WudfServiceGroup REG_MULTI_SZ    WUDFSvc
LocalServiceAndNoImpersonation REG_MULTI_SZ    FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2013-09-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-24 16:43]
.
2013-09-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-08-21 17:05]
.
2013-09-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-08-21 17:05]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
TCP: DhcpNameServer = 75.75.76.76 75.75.75.75
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-09-06 08:05
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ...
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton Security Suite\Engine\20.4.0.40\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\20.4.0.40\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
Completion time: 2013-09-06  08:10:03
ComboFix-quarantined-files.txt  2013-09-06 12:09
ComboFix2.txt  2013-09-02 21:46
ComboFix3.txt  2013-08-26 05:30
ComboFix4.txt  2013-08-26 05:04
.
Pre-Run: 10,800,250,880 bytes free
Post-Run: 11,583,909,888 bytes free
.
- - End Of File - - 45CDAAC2CE9F25EB40BDACAD4E3D8FB9
5C616939100B85E558DA92B899A0FC36
 

 



#14 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:10:20 AM

Posted 06 September 2013 - 09:20 AM


Hello

These logs are looking allot better. But we still have some work to do.

Please print out these instructions, or copy them to a Notepad file. It will make it easier for you to follow the instructions and complete all of the necessary steps..

Clean Out Temp Files
  • This small application you may want to keep and use once a week to keep the computer clean.

    Download CCleaner from here CCleaner
    • Run the installer to install the application.
    • When it gives you the option to install Yahoo toolbar uncheck the box next to it.
    • Run CCleaner. default settings are fine
    • Click Run Cleaner.
    • Close CCleaner.
: Malwarebytes' Anti-Malware :

I see that you have MBAM installed - That is great!! and at this time I would like you to update it and run me a quick scan
  • Double-click mbam icon
  • go to the update tab at the top
  • click on check for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.
  • When completed, a log will open in Notepad. please copy and paste the log into your next reply
    • If you accidentally close it, the log file is saved here and will be named like this:
    • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.



Download HijackThis
  • Go Here to download HijackThis program
  • Save HijackThis to your desktop.
  • Right Click on Hijackthis and select "Run as Admin" (XP users just need to double click to run)
  • Click on "Do A system scan and save a logfile" (if you do not see "Do A system scan and save a logfile" then click on main menu)
  • copy and paste hijackthis report into the topic
"information and logs"
  • In your next post I need the following
    • Log From MBAM
    • report from Hijackthis
    • let me know of any problems you may have had
    • How is the computer doing now?
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#15 ummhasan

ummhasan
  • Topic Starter

  • Members
  • 155 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan
  • Local time:10:20 AM

Posted 07 September 2013 - 01:38 AM

The computer shows now 10.1gb available out of 37.2, no problems with scans, and computer is now running a bit slow on opening folders and internet windows.

 

Below are the log/report:

 

MBAM Log:

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.09.07.01

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Admin :: HASAN [administrator]

9/7/2013 1:28:15 AM
mbam-log-2013-09-07 (01-28-15).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 281439
Time elapsed: 16 minute(s), 20 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

 

HijackThis report:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:59:52 AM, on 9/7/2013
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16502)
Boot mode: Normal

Running processes:
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\D-Link\RangeBooster G WUA-2340\AirPlusCFG.exe
C:\Windows\SOUNDMAN.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Macromed\Flash\FlashUtil32_11_8_800_94_ActiveX.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Security Suite\Engine\20.4.0.40\coIEPlg.dll
O2 - BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Security Suite\Engine\20.4.0.40\IPS\IPSBHO.DLL
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\20.4.0.40\coIEPlg.dll
O4 - HKLM\..\Run: [D-Link RangeBooster G WUA-2340] C:\Program Files\D-Link\RangeBooster G WUA-2340\AirPlusCFG.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\Windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\Windows\Network Diagnostic\xpnetdiag.exe
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\D-Link\RangeBooster G WUA-2340\JSWUtilVst\jswpsapi.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Norton Security Suite (N360) - Symantec Corporation - C:\Program Files\Norton Security Suite\Engine\20.4.0.40\ccSvcHst.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: vToolbarUpdater15.4.0 - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.4.0\ToolbarUpdater.exe (file missing)

--
End of file - 5709 bytes

 






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users