Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Google-Analytics Pop-Up / Redirection infection


  • Please log in to reply
17 replies to this topic

#1 cookie2112

cookie2112

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:51 PM

Posted 16 January 2014 - 08:01 AM

I have been experiencing these pop-ups and the odd redirections for over a month now and have tried numerous security programs (Malwarebytes, SpyHunter, AVG, Astrill....) scanned in safe mode, boot scans everything. I also took a cursory glance at my hosts file and had the 'Access Denied' issue, even though I am administrator. Finally I reset my router.

 

None of this has worked, I may take a another look at the hosts file but really as a novice I am not sure in what I am fixing, how I am fixing it or if I am fully removing this horrible thing from my faithful laptop or if I am just putting a plaster over the problem and going around in circles getting reinfected.

 

Both IE & Chrome are affected on my wireless laptop but my media pc (wired to router) shows no signs of the issue, I also note that previously an attempt was made to use my google account from Ukraine!, which caused me to change my password. It also appears that I am also signed out of my google account more frequently.

 

I'd really appreciate some direction from one of you good people.



BC AdBot (Login to Remove)

 


#2 InadequateInfirmity

InadequateInfirmity

    I Gots Me A Certified Edumication


  • Banned
  • 5,180 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:51 PM

Posted 16 January 2014 - 12:03 PM

Step 1:

Please download Junkware Removal Tool and save it on your desktop.

  • Shut down your anti-virus, anti-spyware, and firewall software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista or Windows 7, right-click it and select Run as administrator.
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log is saved to your desktop and will automatically open.
  • Please attach the JRT log.

Step-2:

Please download AdwCleanerby Xplode onto your desktop.


  • Close all open programs and internet browsers.
  • Double click on adwcleaner.exe to run the tool.
  • Click on Scan button.
  • When the scan has finished click on Clean button.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the contents of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.

Step 3:

Please download MINITOOLBOX and run it.

Checkmark following boxes:



Flush DNS
Reset FF proxy Settings
Reset Ie Proxy Settings
Report IE Proxy Settings
Report FF Proxy Settings
List content of Hosts
List IP configuration
List Winsock Entries
List last 10 Event Viewer log
List Installed Programs
List Users, Partitions and Memory size
List Devices (problems only)



Click Go and Attach the result.

 

Step 4:

 

 

 

 

Please Download Dr Webb Cure it from Here
Save the program to your desktop.
Boot the machine into Safe Mode
Click the button that reads I agree to participate in software quality improvemnet program.
cxVKZsX.png
Then hit the Continue button.
Now hit Select Objects for scanning.
WlY7bUh.png
Place a tick next to Scanning objects this will tick all items for scanning.
NyPaZ0k.png
Click the Tool icon on the top right.
Select Automatically Apply actions to threats.
Now go to settings and make sure that the screen looks like this.
CgyYnPy.png
Under actions make sure the settings are the same as below.
M8MQ7UQ.png
Then go to the log tab and drop the slider to minimal.
Hit ok
Next hit start scanning.
This scan can take a while to complete this is normal.
When the scan has completed hit the open report and post the log back here in your next reply.



#3 cookie2112

cookie2112
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:51 PM

Posted 16 January 2014 - 01:38 PM

Hi InadequateInfirmity , thanks so much for taking this up. I don't want to fall foul of the rules so just want to check - do I copy & paste the log here or in another forum. I can't see an attach option? Thanks again, I really appreciate it.

#4 InadequateInfirmity

InadequateInfirmity

    I Gots Me A Certified Edumication


  • Banned
  • 5,180 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:51 PM

Posted 16 January 2014 - 03:07 PM

Copy and paste



#5 cookie2112

cookie2112
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:51 PM

Posted 16 January 2014 - 05:59 PM

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Home Premium x64
Ran by Chris Cook on Thu 01/16/2014 at 17:31:30.06
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
~~~ Services
 
 
 
~~~ Registry Values
 
 
 
~~~ Registry Keys
 
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\caphyon
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\au__rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\au__rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskSLib_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskSLib_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\TaskScheduler_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\TaskScheduler_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\AskSLib_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\AskSLib_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\TaskScheduler_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\TaskScheduler_RASMANCS
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{7858E1B5-E097-4665-988F-83A5EDCAFD19}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{B7A8B51B-B540-4971-A178-65C86BB356FE}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{7858E1B5-E097-4665-988F-83A5EDCAFD19}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
 
 
 
~~~ Files
 
 
 
~~~ Folders
 
Successfully deleted: [Folder] "C:\Users\Chris Cook\AppData\Roaming\thinstall"
Successfully deleted: [Folder] "C:\Users\Chris Cook\appdata\local\thinstall"
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{0196A7F7-ED2E-44A7-BD55-ED740768079B}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{041EC688-EA6C-4CAF-AE27-74108B3257DA}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{0462F8C7-BB28-4E20-8F4D-71CDE364E6DC}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{055ED591-C80E-4502-91F9-2EE3BC72F872}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{067890DA-93E9-4687-A387-7D10A9615E15}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{06EA9F72-518C-4254-A4FB-D81901B183A9}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{07B53D44-2F9A-44A2-BE16-96E1C368B638}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{085D6867-5008-41DF-A81A-F0BF5CC63E5D}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{092D69FD-7208-4EBE-8E70-AACC612576E8}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{0A3434E9-D150-458F-9719-3EFE404FA0CB}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{0A86B28A-5DEB-4989-90B3-DB0AFB4DFFDE}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{0CE50698-0F7A-4ED9-89CB-BD349375F760}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{0D66BD09-D5B7-4CAB-8E91-77DE89478E2E}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{114AB219-69CD-481F-AA50-6EABAB1823F8}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{17F1DD53-D6C1-4B84-A889-A7AE55999CC1}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{195663AA-17F6-44F5-93C8-6E3C89E8BFB4}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{1AE8DACB-B134-4D94-B914-A20463196C4D}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{211E6B88-63E3-4014-8E58-F44D3725F9AA}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{2129A7DD-A564-4264-BA3A-9076BE67B57E}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{227D91E8-63F3-4484-996E-16446E25A1CC}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{245F368E-41FB-4130-BB8C-76E198910B6A}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{2532D1BC-C0FE-40DB-883C-25ABFEE32FF0}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{254CE18A-BF6D-4313-AEC5-447BC15A16B0}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{26CAB1C1-FE2E-48CC-AB73-B77B75651480}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{27FDDC64-F633-4EAD-94B2-B05BC8033579}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{291A4179-8091-4B52-82D5-BF258768D04C}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{2AE14AB5-745D-4F8E-B61F-9D6CA18DAC4D}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{2D033784-47C9-4636-B060-29CF2B303AEC}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{2D39767B-1A4B-4838-A906-B8625871EE2F}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{2D5D50D4-FED3-45D9-A412-C0027711B31D}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{2D683EB5-A2DE-4EAC-B7C4-96B81D3B643C}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{2FE483C7-62B7-416C-AE90-D8C8026EF581}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{345E50F9-3C00-40A7-A790-B5A246CA0402}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{34AC75F2-1B41-4D90-80CE-594ACE064923}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{36F69672-141A-4079-9931-062CE3E0CB72}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{387E67B9-7ABA-4CC1-9FC3-4AD734689FE3}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{388D9B7F-D7E7-41A8-9BA3-C00904AC8445}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{3AC388E7-8DC5-4B15-BC71-E786EEA86087}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{3C3589AA-FE55-4AAB-A081-3575E1449CCC}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{3CD338ED-5870-4427-BAD8-1EC7F4D8FB76}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{4093C9D4-4204-4C67-951D-B879626D9B31}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{4208C147-6A9F-4709-8514-95F33DBCBF5F}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{42369EB6-8A5C-44B3-B616-BAD4E9D28FAE}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{46A4C52F-2EDF-4421-ABC9-924F464EBB61}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{484490A5-9C47-4794-A738-8C2635F2552C}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{495352A4-86B0-42F4-85B6-164D7579A17C}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{49A14EA8-FA44-4D18-88A9-93EE24269515}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{4B2FA75D-8860-49B3-9649-6671F6F5D428}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{4C660610-2A24-4863-8F44-E2B9B7422DFD}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{5210E294-ED65-4ADC-AE28-E4218D17AD6C}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{5438F5CC-41DD-4E75-A86B-0D2C717DDFF2}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{54EE76E4-66AE-4310-A8F0-2E7E9F8BA509}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{55EA33DA-332D-421D-81F4-ECBAE65BB5A2}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{5E7CB0BC-BA34-40DD-B23C-923E36EE165C}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{5FCF7ABA-0C48-4CA3-A44B-50FB4E3AA05F}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{5FD42989-E0F3-4D2E-A38A-D5A3060F4BD5}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{60B01785-5E25-4F0D-933E-DBEFB955F5C6}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{61A36C51-2BB2-435D-95FB-77D3DD7EAA36}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{62F578BF-D7B7-4048-A782-A41C8237862F}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{64114AD4-952C-4EEB-8E56-2C7A4ACBAECE}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{649DC68E-2688-4E79-B7B4-DA210A4BF8A9}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{67345FA6-285D-4A12-9244-8242A3583B45}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{67D4E470-2706-4525-9E87-24DB430299D8}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{6AEF0447-45B8-4165-8632-626BF7AD2893}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{7125BE3F-66ED-4E1E-82B5-EC655872D46B}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{71392BBA-0228-4D18-8997-5B2198C8FB63}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{71969E9D-51FD-46C7-826E-480E2DED9D86}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{71EE41E3-8213-4127-8717-4D7B82577CDB}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{72A74A98-F033-4D7A-A0BA-432462B5CE3B}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{737C25C8-3DB8-4AEE-A64C-3B62CA99F7B4}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{761DB121-6FAA-4BB1-A656-E74D1994729B}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{794C7C34-6E79-40A0-874D-B4F43FFFD2E3}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{7A3C7578-BD8C-4AD0-9708-3902CEE5A42A}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{7AFCEF81-95B9-4E02-ACDF-8B7691F37916}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{7CEDB938-D42D-4D34-B222-48E340236CC8}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{7CFC0573-F1E6-4F25-B30D-FE1DD56C135D}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{7DD476D9-5DB9-4B95-9985-0199DCCB5290}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{7E481F26-D512-4C28-9F94-3FAFDBDBA7BB}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{856CBDBC-93A1-46F6-AFE6-6C49332E236A}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{895CB2D3-B9C5-4DD4-8E21-CCFA0DBFB61A}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{8A5C19B9-B883-4198-95B4-8EBBB94F4D1E}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{8B5FC390-E4D5-4C5F-825B-D4C347CE267F}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{8BA03B10-1871-41C5-BF28-131780D2B30C}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{904BEB35-D13B-479F-9C7E-AB2CFBDCE8FA}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{9259E7E5-3FDC-4372-B690-E192F0749097}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{926FFBE5-9965-41A5-94B0-F3DC17E15DFA}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{959C50BB-DBD1-47CB-AED9-77C828F1B212}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{9CB99FB9-D26A-447D-82DE-7A12C8E57848}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{9CCC0A2B-C6FE-4A78-98D6-F2540D8F57B3}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{9D4C6472-6973-4991-AE65-352645E47AAA}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{9E821996-5DC0-43A5-8EFD-5FFB6E618D31}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{A0EB6D69-F2CB-432F-A43E-A22E055F6210}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{A8E5261B-6969-41F1-B340-231F75D00957}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{A9BF60A2-2EA7-4473-87EF-39D59B78F1D7}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{ABF66E84-38EE-47C0-B4F8-87E7EFBCB4A6}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{AC6024D6-3DFD-420D-A876-9B6264114D7E}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{AD9F639A-7ACD-4C92-8ABF-88D85E1FB628}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{AF34CE66-ACEC-4523-942C-FBB7CEFAC887}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{AF5BC539-98ED-4780-A305-1D316A469CD1}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{B47C595C-3FD0-46A6-80A7-5AFFCAEBE8B0}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{B4A3F883-3E3A-4AE5-9CE6-8A4E6E9F7357}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{B4FC9F40-1546-421D-A869-FC3F9F496A30}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{B5527DAB-E03A-468D-B8DE-DA6B69B70385}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{BB282B20-21E9-431C-8F5A-1DC0C4FAEC42}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{BBC60ADE-4979-4FDF-9A7D-4BC9737FF28A}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{BEFFDB1D-A4DE-402B-820D-F412CC6F278F}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{C072BCF5-75AF-4254-991C-FD5421F24DA3}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{C22CC7E5-A539-4A41-BB34-99712DD434F7}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{C29AD5CC-F793-4295-9647-E0C27D502762}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{C30454FF-CF59-45F1-BBC9-B96643F081A0}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{C3722D02-9D41-4572-A990-4AC83BD05493}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{C381D1E7-08F1-4406-A2A3-30D6908137C3}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{C69A72B2-939B-4AEE-8B3E-E3527210110A}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{CA4CE0CB-1D18-4705-A921-9269780CAAA8}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{CA9F9F41-36BA-477A-8025-59B09573F0D9}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{CF1F4E91-FA7C-4995-9ED4-2158F0D924CF}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{CF5F1777-1F3A-4124-A02C-EE18B767B0A9}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{CFF655AA-9774-4828-9D0A-5A0D797A304E}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{D2576C68-0B53-4A21-8900-AA17BAD4B693}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{D374E2FC-267A-4C74-9A9B-B6C74432AF27}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{D4B48E13-AB0F-4C3B-A8AB-5B0D4F74FE76}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{D9CCD9D8-EC6F-4C74-8597-B2EF100A3ED6}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{D9F61418-7F49-487C-B32B-9AF285D930B7}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{DAB65786-785A-4F41-9BB5-A8C14F55CDAB}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{DBC00628-29EC-4B9E-A552-C460B09C8990}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{DBD015CB-A2F0-4AE4-B405-3A390098F6CD}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{DC829CAD-B4FB-48AD-839A-8DF51CB1F500}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{DCC57B65-C7E6-498C-A5A0-85F081A9B15B}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{E07133D9-1017-4F36-8DC3-1958101B1E87}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{E0F6A850-EB56-4F65-86CF-29E15CB4EF57}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{E1F361DE-16EC-4429-8B14-96C5B51DC1C0}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{E370B626-DE3E-4D86-8F8C-D926B0A4D913}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{EA142181-3140-46E4-B91E-1E4A60F4BFE7}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{EBA88F8D-45DD-4829-BCF6-F75397B0AC2B}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{EFDFBF77-2EDF-4609-AD1A-19273081DEDE}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{F2057741-2044-4C9D-8C45-7348F3DBA631}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{F22DAF07-0757-4E34-B593-F8AB2AA0D321}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{F6AE2D49-105B-4F56-87C8-01F9554A52A5}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{F9A93AF8-7F3B-47C4-8206-AB6C37C044F4}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{F9EBD1FA-748F-4F35-8D53-9A8840478C23}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{FAEEF7FA-53B7-4B18-922A-38315806C593}
Successfully deleted: [Empty Folder] C:\Users\Chris Cook\appdata\local\{FDD6F936-90F7-4366-92DE-A6CBC44446BA}
 
 
 
~~~ Event Viewer Logs were cleared
 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Thu 01/16/2014 at 17:39:44.05
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# AdwCleaner v3.017 - Report created 16/01/2014 at 17:51:22
# Updated 12/01/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Chris Cook - CHRISCOOKLAPTOP
# Running from : C:\Users\Chris Cook\Desktop\adwcleaner.exe
# Option : Clean
 
***** [ Services ] *****
 
 
***** [ Files / Folders ] *****
 
Folder Deleted : C:\ProgramData\AVG Security Toolbar
Folder Deleted : C:\Users\CHRISC~1\AppData\Local\Temp\AskSearch
File Deleted : C:\Users\CHRISC~1\AppData\Local\Temp\Uninstall.exe
 
***** [ Shortcuts ] *****
 
 
***** [ Registry ] *****
 
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Deleted : HKCU\Software\AVG Secure Search
Key Deleted : HKLM\Software\AVG Secure Search
 
***** [ Browsers ] *****
 
-\\ Internet Explorer v11.0.9600.16428
 
 
-\\ Google Chrome v32.0.1700.76
 
[ File : C:\Users\Chris Cook\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 
 
[ File : C:\Users\Rachel\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 
 
*************************
 
AdwCleaner[R0].txt - [3067 octets] - [16/01/2014 17:47:38]
AdwCleaner[S0].txt - [2823 octets] - [16/01/2014 17:51:22]
 
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2883 octets] ##########


#6 cookie2112

cookie2112
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:51 PM

Posted 16 January 2014 - 06:03 PM

MiniToolBox by Farbar  Version: 18-12-2013
Ran by Chris Cook (administrator) on 16-01-2014 at 18:02:05
Running from "C:\Users\Chris Cook\Desktop"
Microsoft Windows 7 Home Premium  Service Pack 1 (X64)
Boot Mode: Normal
***************************************************************************
 
========================= Flush DNS: ===================================
 
Windows IP Configuration
 
Successfully flushed the DNS Resolver Cache.
 
========================= IE Proxy Settings: ============================== 
 
Proxy is not enabled.
No Proxy Server is set.
 
"Reset IE Proxy Settings": IE Proxy Settings were reset.
========================= Hosts content: =================================
 
::1             localhost


#7 cookie2112

cookie2112
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:51 PM

Posted 16 January 2014 - 06:42 PM

=============================================================================
Dr.Web Scanner SE for Windows v9.0.0.10180
© Doctor Web, Ltd., 1992-2013
Scan session started 2014/01/16 18:13:26 
Module location : c:\users\chris cook\appdata\local\temp\20392785-626030F5-1CACED42-F244F4D\
=============================================================================
OPTION [Automatic Apply Actions] NO
OPTION [Turn Off Computer After Scan] NO
OPTION [Use Sound Alerts] NO
OPTION [Block Network] NO
OPTION [Protect Process] NO
OPTION [Protect Raw Disk] NO
Using language: "English"
OPTION [Automatic Apply Actions] YES
Available instances: 6
Instances used: 6
Platform: Windows 7 Premium x64/WOW (Build 7601), Service Pack 1
API Version: 2.2
Scanning Engine version: 9.0.6.11080
Virus Finding Engine version: 7.0.7.12100
Total 157 virus bases are loaded from c:\users\chris cook\appdata\local\temp\20392785-626030F5-1CACED42-F244F4D
rva2o0fr 7.0 1593ff66e128ea546ad5d1e2fc04895c0c46451a 2014/01/16 15:10:44 914 records - OK
kx6p8fix 7.0 d07fc5cc240588c772457e7df580f3cec20d9222 2011/07/25 10:20:03 2 records - OK
c7laxsol 7.0 c00072dd465971a05243d05eaa0cbcb628c4a6eb 2014/01/16 14:04:44 12503 records - OK
d9l4ui6d 7.0 141e9b07b61877285ee8d35a4ca0a552be38d299 2014/01/12 22:07:28 15935 records - OK
a5hu8owa 7.0 e4963e7b03c06feda00ae36a7942659c0737c1bd 2014/01/05 22:07:22 12941 records - OK
4h7ohfo3 7.0 c3164a886736d726e2441cad3a4de6f0b0e3219b 2013/12/29 22:07:50 18147 records - OK
faxy2wzn 7.0 1b3a9eb9e843e310051345db539364f71dcdce26 2013/12/22 22:07:36 24291 records - OK
xvob3jo4 7.0 3c6be998bcbacb19a30e4fd27fe02bb8d9401191 2013/12/15 22:08:17 22670 records - OK
p9i6twln 7.0 17c7a62a967080ce25e28d47e4cf1035e145ddc1 2013/12/08 22:09:54 21015 records - OK
wuy7xqpy 7.0 6dbc5b701b6ffb1a8bc80c52f3454314e6d82273 2013/12/01 22:09:01 20471 records - OK
1ljciom1 7.0 95e77d6bd2c5f5feabdd074d49272f3988737aac 2013/11/24 22:06:55 18641 records - OK
nsgb6lxa 7.0 8e677cc8b19dc0ad82c4b71202c0acd9e2e25827 2013/11/17 22:08:42 32245 records - OK
4f0i2yad 7.0 bc2662842e39ed5dc010a39140fd82d7ad1b6006 2013/11/10 22:09:43 33084 records - OK
h1n5dtl0 7.0 8900859cec3affe1e5bbb086bdb2299d125acf7c 2013/11/03 22:09:28 30356 records - OK
i5tgd2e4 7.0 0e9ca4f15f289ae826d213e6a1d672470a127b51 2013/10/27 23:09:43 18457 records - OK
yptlnol8 7.0 eba0efa3e9d70063908fb5e41a704579c255ea33 2013/10/20 23:09:49 19594 records - OK
ktpmqhex 7.0 0f5e49d3e5b4c931d1f2de5e7b3551b3290cae26 2013/10/13 23:07:20 22924 records - OK
azzxqpyf 7.0 11c09a3ae7c80058711dd699aeb1ca4f5ba0f5a5 2013/10/06 23:07:56 24694 records - OK
1jjlsmu0 7.0 27f46d939a14e1a0605b9762db1de5a2aca20a58 2013/09/29 23:08:23 24253 records - OK
a09n9ffd 7.0 e679853ff1af1082b1982cf226785128a26e1099 2013/09/22 23:07:56 18453 records - OK
d704an2x 7.0 690d8b937e4edb8176c3d466585662a6014e3d0e 2013/09/15 23:08:41 19662 records - OK
8uk6s8q0 7.0 cf5d32d1091e0c33523e8c6f9697c32ef2bf4f29 2013/09/08 23:07:53 11289 records - OK
020pvb8j 7.0 8f8258337f82d1dd4434e9b71f2e481f06baf7c2 2013/09/01 23:08:50 16486 records - OK
c48cp3b5 7.0 f806ed4628669b46da54d1f2eb12aa9bcef603a6 2013/08/25 23:08:46 18051 records - OK
4asx2e3s 7.0 b453f2d6f8659d9dd5b9aa92f2a4cfa16cbfa1db 2013/08/18 23:07:38 30970 records - OK
ukvh97pi 7.0 99da1df207839fb44ae24c23590c827a78b79624 2013/08/11 23:07:21 36983 records - OK
gujjam3m 7.0 f00c8b50a0012e8c42c6739e1326d23df1894610 2013/08/04 23:06:47 34115 records - OK
pf2uyff9 7.0 896fcf8d5d0cd958da3891b65648d2dc1592338b 2013/07/28 23:07:44 19463 records - OK
t72614hx 7.0 d690513befab3ea86af2fe671a7f24cc05c9feaa 2013/07/21 23:08:15 35067 records - OK
4vt4avb6 7.0 5d7d11b0edc97be077b0771339ba3dc0c75de9e0 2013/07/14 23:08:05 29822 records - OK
tfi0t9ot 7.0 67683402b8212ef4da87f649878865c52e5dc113 2013/07/07 23:08:35 39172 records - OK
bfyqn9el 7.0 613a3e4bae38b4e00a7432c24a9cd916fb1c654f 2013/06/30 23:06:34 24654 records - OK
9wy2v6q7 7.0 b81132c4abffd4d2949531a1219b6bb1c3bad6f7 2013/06/23 23:06:30 14062 records - OK
trqz9312 7.0 9aab251475626c658b193cfa2b5f91da471bf8f2 2013/06/16 23:05:57 13350 records - OK
i0gnnpef 7.0 e1f8aca88745fcdd49dc7ae75e142c41e1faf178 2013/06/09 23:08:13 26371 records - OK
51rd6bli 7.0 4e8627555a073f6bad5218bad3e69ebc4b93069f 2013/06/02 23:07:47 25525 records - OK
zscjoljj 7.0 f562371c5115143824efde38c9567c34ccbe5d1a 2013/05/26 23:16:19 33200 records - OK
kzx8xkg2 7.0 eccb30ec8ed44456f9b88fe96d9fe0de40e4fa51 2013/05/19 23:11:05 46384 records - OK
2bger5c0 7.0 9b481fbfbe1f564a84f21552da1d30d24e7b01db 2013/05/12 23:07:01 34270 records - OK
l3a9zpvh 7.0 1bf754dd720727b5d6803e081c16ff7f4ba7b40b 2013/05/05 23:08:46 41611 records - OK
xmdxaip3 7.0 4e883c92513c2d991968fb3e4f27910a63d9a2df 2013/04/28 23:06:36 36105 records - OK
t8citshe 7.0 b047d178295ecde53c3cf1c34e4361004569fa33 2013/04/21 23:07:26 31319 records - OK
co34ody8 7.0 9207e55a924e4aa989dfde4d8d219cf5cc200ce2 2013/04/14 23:07:56 28216 records - OK
s3rzjh03 7.0 78855cfb9fbc063889c5405a577fe73188f08789 2013/04/07 23:05:35 23589 records - OK
8setc5m1 7.0 cec6d34c79d50608520e81b90a23d91f39df0b27 2013/03/31 23:07:37 26946 records - OK
r30i8o3m 7.0 fd3c78d78ea4dae4e252a7f7d76db22e1a679be9 2013/03/24 23:05:37 34778 records - OK
zpntibrp 7.0 268e71b1123ab5e60fd2f38d269fe5f3d22b3697 2013/03/17 23:06:19 11271 records - OK
1rzzh0x7 7.0 d196879775b0dc0ee8286f2e4def9adedb5b88df 2013/03/10 23:05:36 12046 records - OK
3kfhiap6 7.0 0db61d4e3235481da8493523538ced712db362c2 2013/03/03 22:05:18 21747 records - OK
ptvfotx3 7.0 65f99faf227b51883c9f1c854a3f76806b60affb 2013/02/24 22:06:28 11540 records - OK
36x8bh9o 7.0 17bd7383b9c4b214c5c9029171db8ae1455984a0 2013/02/17 22:06:38 15568 records - OK
ghbxg4pw 7.0 cbe8774953ae403e49370d552b522a5839aa9fdb 2013/02/10 22:06:00 18805 records - OK
bx8r84ty 7.0 fb6865c02a3680338e4ee0603579107227313b2b 2013/02/03 22:06:01 32488 records - OK
ig7w4woj 7.0 95fcd2e24cd9b2ec2610656ffa70b8bf46e86a8b 2013/01/27 22:04:52 15470 records - OK
c19v9610 7.0 3d710b3dd4580a7eca8c74d2c886d48f5b8b5172 2013/01/20 22:06:27 30093 records - OK
9o6807xy 7.0 bddde0b5426b7e5bebd61e1239ca529c87ae6e36 2013/01/13 22:04:41 16158 records - OK
qpv7he5k 7.0 bc40bd9330301e8d7796f489d03357fb711b3121 2013/01/06 22:04:45 19597 records - OK
3gbokvr3 7.0 805b6089c867549c75f843eac96b759c3f8d101f 2012/12/30 22:05:41 18184 records - OK
ujuzhllj 7.0 c680da06ac6ec011d130e7ac765e33da89e2820a 2012/12/23 22:05:33 29945 records - OK
qeoe6x1u 7.0 33def496782eb5b7b1cc93fdb036a1b62fa6a2fd 2012/12/16 22:06:21 25519 records - OK
p5up76fw 7.0 422abae03c588822f412aa9aae50578a1d61737e 2012/12/09 22:05:04 20358 records - OK
67go4ptg 7.0 a4f0d0ecad4fb6e0afdb1925f4e0b7863b9d03fa 2012/12/02 22:06:19 20133 records - OK
myiqbe9n 7.0 86daa918ee3de1e4c1e5dea6f9b5f63544cf8814 2012/11/25 22:05:22 27311 records - OK
uo87n8dz 7.0 6556881c748e1f894eb9c7943ebae67017e1aec2 2012/11/18 22:06:09 29434 records - OK
q4vl38pe 7.0 559141ef34f9e6226bb58560e9b52e4cc5165150 2012/11/11 22:06:22 26900 records - OK
mg61wpmg 7.0 cc55013e63ff89319ec772e34d77056c7108cd3b 2012/11/04 22:05:22 25164 records - OK
py7586o3 7.0 f477dc247d9b562bb64fd4f46a7dcbdf7124eb60 2012/10/28 23:06:37 30226 records - OK
evyn1nko 7.0 abaf5f7fda7308fcf7573b193bbf2116723e9802 2012/10/21 23:04:37 16441 records - OK
xsrdr69k 7.0 5adc85528fb49e201d4bc61eca580d6839cc4a4c 2012/10/14 23:05:04 26289 records - OK
mg2725nw 7.0 da8cf3fbd81206bb3d8103347a439f920a74bbe2 2012/10/07 23:05:51 27278 records - OK
sahhkfd7 7.0 5988744d3cb357f1a013427d466e2d79ab5f8907 2012/09/30 23:05:11 17444 records - OK
k6bctrt0 7.0 d4a0dabf4a4df0f79805c6ccdc025f796765e786 2012/09/23 23:06:30 21205 records - OK
kucf8wdh 7.0 82ed005784d9e258213070a0cd8bfceff345018d 2012/09/16 23:05:43 11686 records - OK
smjxf9gl 7.0 a95ae63004b8d857c2db055f4e47c15bfc97f626 2012/09/09 23:04:34 12677 records - OK
n0t2z4mr 7.0 c39bf233d25242ae9ed8cf204b9b788c8f45ab79 2012/09/02 23:05:28 10118 records - OK
6crg1u0n 7.0 d37b5484b009947b7cdd3837dafe8148615401c2 2012/08/26 23:05:26 12602 records - OK
5bkfiqvq 7.0 41bf1347794ab7060dec7aaecc1d1d95cf6fecb5 2012/08/19 23:04:05 18298 records - OK
w9ax8vkg 7.0 1a997511e5892aaeb69b3db70e06676af36382e3 2012/08/12 23:05:19 17126 records - OK
y3sv4o12 7.0 f7226c59914e3683e538e668c3b664af3232654d 2012/08/05 23:03:53 20539 records - OK
cengsz5p 7.0 4035c8d3b617bf935a317a8c57efaa8e835a61f4 2012/07/29 23:05:26 19330 records - OK
kwrulsrw 7.0 09b55bc000f184ed426f1d8b9665669346fe5e71 2012/07/22 23:05:34 19692 records - OK
4wlpbtwb 7.0 f746c097f298e94faa9db94e6f64ef9fd4a7b010 2012/07/15 23:05:43 14727 records - OK
m3h30b9y 7.0 792a6a25a17e764390440cd4c2c6ca5a97ab162f 2012/07/08 23:04:33 19485 records - OK
5zvcfymn 7.0 ca9905c39e3d93428a4db65a192debe9fbd7acf7 2012/07/01 23:04:55 22898 records - OK
sxef9whn 7.0 dc29c610b866c66ba5327e7830452b2460149a35 2012/06/24 23:05:17 20551 records - OK
7wc4obi4 7.0 c28739bea153508d12942ac9a61abd475d0a0404 2012/06/17 23:03:35 9661 records - OK
ecrlbfwt 7.0 e5b5835a7c512120c5348e31483a4caa2a845d28 2012/06/10 23:04:32 23632 records - OK
7phiyi7a 7.0 61853ce89026ef0ebbd80174f1b7dd5d25bbc63a 2012/06/03 23:04:41 12423 records - OK
jybbec7l 7.0 4e6c9897e153b47ca97b7da48ceed23e555a7761 2012/05/27 23:04:26 15493 records - OK
4ad74j03 7.0 35f4c105cecd8ec1fd01714abebf30f8f3efb96e 2012/05/20 23:03:29 13065 records - OK
fb147el5 7.0 3522aa84677411aa7d67796bb05ea3ab62f02a71 2012/05/13 23:04:24 16238 records - OK
c0jhauph 7.0 7597333540eda537bd42c0a17d4a6526ad247a2e 2012/05/06 23:04:33 11570 records - OK
dddnp4ci 7.0 867814380363bc6ad605acf4b96e02c54dbd60f7 2012/04/29 23:03:28 15478 records - OK
w9w8as3i 7.0 3c04f402d91a19039cb9c223c435dc4ea1bb3da4 2012/04/22 23:05:05 11881 records - OK
of4gk7im 7.0 8d0220a2a50b367e61a51d3b29c2659cde41bb7f 2012/04/15 23:03:29 13578 records - OK
7428gka4 7.0 b79dc6f5832ad390108d1880694ec538e8b34bb0 2012/04/08 23:05:02 14292 records - OK
3tpy0hro 7.0 8ff7cc095c43c2154275b7a54a89bf365e8daf4a 2012/04/01 23:03:24 14084 records - OK
lnkbuhkj 7.0 9502a428b32be4ad08556134e271c9ba03195398 2012/03/25 23:04:43 19126 records - OK
21iqr6d2 7.0 28c2fabbc645aff41baac12b911a8499ea163536 2012/03/18 23:03:23 14920 records - OK
ahkwheya 7.0 86de597ff06e58206f94263f2eef33cb41b2530c 2012/03/11 23:03:25 19017 records - OK
yadfvuff 7.0 5bd1d666e7c9ca70c34e591dc6c55314ce4b11af 2012/03/04 22:04:32 19691 records - OK
td5taod8 7.0 15a9d10c451d2fcf124700f29f557d9bf338e671 2012/02/26 22:03:21 23605 records - OK
tiqkmkqr 7.0 5647d941e5358105ca6558dce78873f06c48d5dc 2012/02/19 22:03:45 19067 records - OK
qbeafjb6 7.0 c9b2600cb665ce34e0ccd0f19e0a88cd44437f51 2012/02/12 22:04:49 19019 records - OK
qc0ndqh8 7.0 9df2e129e78a9d9ab491186da1329c1dd1190e17 2012/02/05 22:05:25 28028 records - OK
w8swrzlv 7.0 b69b9504a51b8777b8e95a4680dc8ac1d8d8c25d 2012/01/29 22:08:41 29444 records - OK
wv26ye1v 7.0 3d7431bdee1a22d6329e017f348db7760f2645ac 2012/01/23 03:22:13 19353 records - OK
5m3blvqe 7.0 e04570f78fb00d758abdf77c534a460980e102c0 2012/01/15 22:12:31 20747 records - OK
s2sela8s 7.0 2de2479b112c4416e2375343f57ca789b042aecc 2012/01/08 22:04:30 28052 records - OK
39hg569u 7.0 c4bd9612ff1f71d8bd23b4f1bc114eed1ae2ee6b 2012/01/01 22:04:40 12183 records - OK
a5eadd06 7.0 28b1d218ade8f05fdc8550c7456ac3b74f705208 2011/12/25 22:03:33 19984 records - OK
6uaxfs86 7.0 539e41e8f3d97a6f347600c7cef903d9f34e0518 2011/12/18 22:08:45 22627 records - OK
sykhh0ax 7.0 f8e81968965f555bce0d02fc9933fee840b97aaf 2011/12/12 15:20:22 49580 records - OK
x5uy46x7 7.0 14751e0f442bba3efc08ee12d82a2815c61cfeb6 2011/12/04 03:00:00 45195 records - OK
9dpqk34z 7.0 1a1e6cb9b3096a2cbba2c31d05e11914c0357d52 2011/12/04 02:00:00 165532 records - OK
lm8srcht 7.0 0f948a7d416c556bfc8a8be2c2c39f998fee6d9e 2011/12/04 01:00:00 170820 records - OK
lnx6gnl0 7.0 9357c3cc73a4a374346a678f197daa22496c7ae5 2011/12/04 00:00:00 171279 records - OK
rlvaxrtb 7.0 ae56b06b3d6f1e13c5f10cce4ed68f2cccbf3298 2011/12/03 23:00:00 170253 records - OK
h9k35kkr 7.0 fdaab5c1079d02c94f20d07c39d638cad79d8771 2011/12/03 22:00:00 170291 records - OK
pulpzpe5 7.0 b59d8841e65d7670b2aae7f2b65734269f6c4fe3 2011/12/03 21:00:00 170501 records - OK
by7vnym9 7.0 3946b1d195434cf7a70d144da71c87559475c58f 2011/12/03 20:00:00 353582 records - OK
76k5f79v 7.0 8df4695f74ea5949551df6044720694e204b13d7 2011/12/03 19:00:00 852776 records - OK
570dvu17 7.0 6b796caaa74439981e2f469d23151cebeac1797d 2014/01/16 15:11:15 793 records - OK
gqb2g7sd 7.0 ce3100ec091fcc4cfffed117a4f62fb0bd553113 2013/11/24 22:15:53 1683 records - OK
h2oshsad 7.0 6ede5b37423910c2f3ffff6d90fef6a16e565e5e 2013/09/01 23:14:42 1327 records - OK
l4p4g12s 7.0 c1d53c2aef72dfab36a8045897938e7a31f279ac 2013/07/14 23:15:07 1590 records - OK
o5195kjv 7.0 0cb77ee7a3e6545553585eb6df267a86d4fecbe4 2013/04/21 23:14:29 1680 records - OK
4jre5793 7.0 6cb68b8fab821702ef054f864ff44917414e50fa 2013/02/03 22:13:43 2078 records - OK
3f1oqsom 7.0 cfbe9cf43615f7856e4c35f0fc02e2baf12e39e7 2012/12/16 22:14:14 1725 records - OK
z8nouagg 7.0 047694e79b1a8d295f27ea9c6565062404f84a57 2012/11/11 22:12:52 2050 records - OK
af8sr1kk 7.0 f3413603f4ee1c88018a78c1f6faf2abeb8fa8c1 2012/09/23 23:13:14 1456 records - OK
ujue7bfa 7.0 8871f579eeb7e5e7b70c6dd898afd27391d7daf4 2012/06/24 23:12:36 1421 records - OK
7h7hu2wq 7.0 3ee43130fe7fec4b367a791892a444d0a791b29b 2012/03/25 23:12:30 1385 records - OK
mxx31pqk 7.0 fddc5d687537580c7166dbf117d591593bc62261 2012/01/22 23:56:09 1653 records - OK
qc1tfbgo 7.0 f707471f02d3f401e356c8fabc9e001d14661aaa 2014/01/16 15:11:07 674 records - OK
owkz54n1 7.0 79ee97945d406605f5330158ea8367948c6377de 2013/12/22 22:25:01 2352 records - OK
agwr7uag 7.0 4ed4e052d8cc2df4eb5f1916da50e16da9e4e3da 2013/10/20 23:25:47 2062 records - OK
e1w4qaup 7.0 cc2fc58477a41d340f63e6d3d228133c927a9810 2013/09/15 23:25:22 3440 records - OK
kjgewrr4 7.0 63ff62f7b5aa956912f6c29e7ad7be26569416ff 2013/08/18 23:25:05 1485 records - OK
bqa2pd1s 7.0 d95d1ab4adf9a869001802f64960356e903dd478 2013/07/21 23:24:06 2214 records - OK
z0jrmpy8 7.0 45cdfad530697916adbfea43a8763a4ab0c95beb 2013/05/19 23:24:48 1426 records - OK
fztrxb1x 7.0 bd9fd948b79e07c8676018e17a43ee81f5335e36 2013/04/21 23:24:10 1641 records - OK
jrhkv49g 7.0 c7f70566b9bae9fd3f5a8d0b56d961f890a55508 2013/03/17 23:23:44 1742 records - OK
n4pu8cqc 7.0 8893c0d254eb40c78b5c78ea17fbc3be60ea6304 2013/01/20 22:24:33 2016 records - OK
v9w64515 7.0 cdf3a9d2dcab57f90c378d9eefacbfd358a42699 2012/12/09 22:23:23 1620 records - OK
vl3axwxc 7.0 c0726ba000e840272f0810b89051e6daa8799084 2012/11/04 22:23:16 1658 records - OK
tkg0pqyy 7.0 216611859de0125bf130d6324d43c9115cb05def 2012/10/07 23:23:20 1465 records - OK
spmq3o99 7.0 264c14ad60c4423ec292f5f8b182e4448504dfa9 2012/09/09 23:23:14 1588 records - OK
xeakk92d 7.0 33197bfe9efefa9db33725d240757103c625b601 2012/07/22 23:22:36 1702 records - OK
bk8r00eg 7.0 74d8e114edb84b95bc09d5a2a36191d15a61e2cb 2012/06/10 23:22:36 1659 records - OK
8ezcj21r 7.0 79ca8239f310688d2b9c314fa3d738a34985cce3 2012/04/29 23:22:34 1670 records - OK
2pewml18 7.0 aac27e986e3731e5260cb76f5b14558e36660dec 2012/03/11 23:22:28 1729 records - OK
kkv9eytz 7.0 fa5c96b8be693a20c2a295e3545419e6f117fdc4 2012/01/29 22:23:00 1523 records - OK
71eicihq 7.0 e9b21e0a3578ef2e2067f4876309671ddc78f65f 2011/12/18 22:22:29 1805 records - OK
6sgsjynx 7.0 8f7a8f6f55130f6becc5331ab38dc2108746b8aa 2011/12/03 18:00:00 26456 records - OK
xivwxdjm 7.0 e6d52b11d2f7d405ccd31347da3b6fde69825168 2011/12/03 17:00:00 74279 records - OK
8lclrdhv 7.0 e20ffde4bbc58e0585b0b3b2f324bc91272c2360 2011/12/03 16:00:00 1 record - OK
Total records count: 4870508
 
Anti-rootkit module version ( ver: 9.0.201311290, api: 6.09 )
 
Using c:\users\chris cook\appdata\local\temp\20392785-626030F5-1CACED42-F244F4D\ytljh1m7.key as Dr.Web ® Key file
This Dr.Web ® Key is for 1 computer (A User)
-----------------------------------------------------------------------------
Start scanning
-----------------------------------------------------------------------------
Command line used:-rpcep:\pipe\A8696E8 -rpcpr:np 
 
Object(s) to scan:
 - Scan processes in memory
 - Scan boot sectors
 - Scan system restore points
 - Scanning for rootkits 
 - C:\autoexec.bat
 - C:\bootmgr
 - C:\hiberfil.sys
 - C:\pagefile.sys
 - C:\vcredis1.cab
 - C:\vcredist.msi
 - C:\Windows\system32\
 - C:\Windows\SysWOW64\
 - C:\Users\Chris Cook\Documents\
 - C:\Windows\TEMP\
 - C:\Users\CHRISC~1\AppData\Local\Temp\
 
C:\Windows\system32\drivers\etc\hosts - probably infected with DFH:HOSTS.corrupted
C:\Windows\system32\drivers\etc\hosts - cured
c:\windows\system32\drivers\dump_iastor.sys - file not found
c:\windows\system32\drivers\dump_dumpfve.sys - file not found
c:\users\chris cook\appdata\local\temp\aa408ef.sys - file not found
c:\users\chris cook\appdata\local\temp\b511833.sys - file not found
System Idle Process - file not found
System Process - file not found
Process :0 - read error
Process System:4 - read error
C:\System Volume Information\{14f2a0a8-7e3e-11e3-8be1-78e3b5645c30}{3808876b-c176-4e48-b7ae-04046e6cc752} - read error
C:\System Volume Information\{14f2a0b7-7e3e-11e3-8be1-78e3b5645c30}{3808876b-c176-4e48-b7ae-04046e6cc752} - read error
C:\System Volume Information\{18339a21-7e3b-11e3-9b59-78e3b5645c30}{3808876b-c176-4e48-b7ae-04046e6cc752} - read error
C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752} - read error
C:\System Volume Information\{74ae5715-7ad5-11e3-8f08-78e3b5645c30}{3808876b-c176-4e48-b7ae-04046e6cc752} - read error
C:\System Volume Information\{74ae578a-7ad5-11e3-8f08-78e3b5645c30}{3808876b-c176-4e48-b7ae-04046e6cc752} - read error
C:\System Volume Information\{74ae5797-7ad5-11e3-8f08-78e3b5645c30}{3808876b-c176-4e48-b7ae-04046e6cc752} - read error
C:\System Volume Information\{eae56a9a-7b31-11e3-a768-78e3b5645c30}{3808876b-c176-4e48-b7ae-04046e6cc752} - read error
C:\System Volume Information\{eae56a9e-7b31-11e3-a768-78e3b5645c30}{3808876b-c176-4e48-b7ae-04046e6cc752} - read error
C:\System Volume Information\{eae56aa2-7b31-11e3-a768-78e3b5645c30}{3808876b-c176-4e48-b7ae-04046e6cc752} - read error
C:\System Volume Information\{eae56ef5-7b31-11e3-a768-78e3b5645c30}{3808876b-c176-4e48-b7ae-04046e6cc752} - read error
C:\pagefile.sys - read error
C:\hiberfil.sys - read error
C:\Windows\system32\catroot2\edb.log - read error
C:\Windows\system32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb - read error
C:\Windows\system32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb - read error
C:\Windows\system32\config\DEFAULT - read error
C:\Windows\system32\config\DEFAULT.LOG1 - read error
C:\Windows\system32\config\DEFAULT.LOG2 - read error
C:\Windows\system32\config\SAM - read error
C:\Windows\system32\config\SAM.LOG1 - read error
C:\Windows\system32\config\SAM.LOG2 - read error
C:\Windows\system32\config\SECURITY - read error
C:\Windows\system32\config\SECURITY.LOG1 - read error
C:\Windows\system32\config\SECURITY.LOG2 - read error
C:\Windows\system32\config\SOFTWARE - read error
C:\Windows\system32\config\SOFTWARE.LOG1 - read error
C:\Windows\system32\config\SOFTWARE.LOG2 - read error
C:\Windows\system32\config\SYSTEM - read error
C:\Windows\system32\config\SYSTEM.LOG1 - read error
C:\Windows\system32\config\SYSTEM.LOG2 - read error
C:\Windows\system32\config\RegBack\DEFAULT - read error
C:\Windows\system32\config\RegBack\SAM - read error
C:\Windows\system32\config\RegBack\SECURITY - read error
C:\Windows\system32\config\RegBack\SOFTWARE - read error
C:\Windows\system32\config\RegBack\SYSTEM - read error
C:\Users\Chris Cook\AppData\Local\Temp\SearchProtectionSetup.exe - is adware program Adware.BGuard.24
C:\Users\Chris Cook\AppData\Local\Temp\SearchProtectionSetup.exe - quarantined
C:\Users\Chris Cook\AppData\Local\Temp\ICReinstall\cnet2_AutoShutdownGeniusEn_exe.exe - is adware program Adware.Downware.130
C:\Users\Chris Cook\AppData\Local\Temp\ICReinstall\cnet2_AutoShutdownGeniusEn_exe.exe - quarantined
 
Total 14023273159 bytes in 32500 files scanned (44957 objects)
Total 32458 files (44910 objects) are clean
Total 2 files are infected
Total 0 files (1 object) is suspicious
Total 3 files are neutralized
Total 44 files are raised error condition
Scan time is 00:18:26.219


#8 InadequateInfirmity

InadequateInfirmity

    I Gots Me A Certified Edumication


  • Banned
  • 5,180 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:51 PM

Posted 16 January 2014 - 06:50 PM

Perform a full online scan with SUPERAntiSpyware.com - Online Scanner Remove all infections post back the result in your next repy.


Download Malwarebytes
http://www.malwareby.../mbam-setup.exe

 

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad.
  • Post the log back here.

Can I please see an entire minitoolbox log as well.



#9 cookie2112

cookie2112
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:51 PM

Posted 17 January 2014 - 05:46 AM

SUPERAntiSpyware Scan Log
 
Generated 01/16/2014 at 10:23 PM
 
Application Version : 5.7.1018
 
Core Rules Database Version : 10983
Trace Rules Database Version: 8795
 
Scan type       : Complete Scan
Total Scan Time : 01:32:06
 
Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Administrator
 
Memory items scanned      : 661
Memory threats detected   : 0
Registry items scanned    : 71917
Registry threats detected : 0
File items scanned        : 56780
File threats detected     : 89
 
Adware.Tracking Cookie
bridge.sf.admarketplace.net [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.admarketplace.net [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.clickbank.net [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.clickbank.net [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.clickbank.net [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.clickbank.net [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ssl.clickbank.net [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ssl.clickbank.net [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.clickbank.net [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
accounts.google.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.teensdigest.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.aff44.teensdigest.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.aff44.teensdigest.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.teensdigest.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.aff20.teensdigest.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.aff20.teensdigest.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.tradatracker.net [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.entrepreneurs.about.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.stats.paypal.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
accounts.google.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
accounts.google.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
accounts.google.com [ C:\USERS\CHRIS COOK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
art.aim4media.com [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
cdn.tremormedia.com [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
cdn1.static.youporn.phncdn.com [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
cdn2.baronsmedia.com [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
content.yieldmanager.edgesuite.net [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
core.insightexpressai.com [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
core.saymedia.com [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
ds.serving-sys.com [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
ia.media-imdb.com [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
media-cdn.tripadvisor.com [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
media.mtvnservices.com [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
mp.adverts.itv.com [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
objects.tremormedia.com [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
paidmedia.foxhome.com [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
s0.2mdn.net [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
secure-uk.imrworldwide.com [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
secure-us.imrworldwide.com [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
serving-sys.com [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
spe.atdmt.com [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
static.discoverymedia.com [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
static.mediaworks.co.nz [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
video.imedia.ro [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
www.femalefirst.co.uk [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
www.golfdiscount.com [ C:\USERS\CHRIS COOK\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\AXYF35VG ]
.atdmt.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.imrworldwide.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.imrworldwide.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.doubleclick.net [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
accounts.google.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
accounts.google.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
accounts.google.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
accounts.google.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
www.googleadservices.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.lucidmedia.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.at.atwola.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.atdmt.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.atdmt.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.tribalfusion.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.casalemedia.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.media6degrees.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.media6degrees.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.media6degrees.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.casalemedia.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
a.intentmedia.net [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
a.intentmedia.net [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
a.intentmedia.net [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.questionmarket.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.questionmarket.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.casalemedia.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.casalemedia.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.casalemedia.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.casalemedia.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.apmebf.com [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.fastclick.net [ C:\USERS\RACHEL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
 
Trojan.Agent/Gen-VBInject
C:\PROGRAMDATA\MICROSOFT\BINGDESKTOP\BINGCORE\TEMP\TMP6E5C.EXE
 
Trojan.Agent/Gen-Tracur
C:\WINDOWS\SYSWOW64\DISCHANDLER.EXE


#10 cookie2112

cookie2112
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:51 PM

Posted 17 January 2014 - 05:58 AM

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org
 
Database version: v2014.01.17.03
 
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Chris Cook :: CHRISCOOKLAPTOP [administrator]
 
1/17/2014 5:49:31 AM
mbam-log-2014-01-17 (05-49-31).txt
 
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 238713
Time elapsed: 7 minute(s), 20 second(s)
 
Memory Processes Detected: 0
(No malicious items detected)
 
Memory Modules Detected: 0
(No malicious items detected)
 
Registry Keys Detected: 0
(No malicious items detected)
 
Registry Values Detected: 0
(No malicious items detected)
 
Registry Data Items Detected: 0
(No malicious items detected)
 
Folders Detected: 0
(No malicious items detected)
 
Files Detected: 2
C:\Users\Chris Cook\AppData\Roaming\Adobe\acupx217.dll (Trojan.Agent.ED) -> Quarantined and deleted successfully.
C:\Users\Chris Cook\AppData\Local\Temp\fsgduqqt.exe (Trojan.Dorkbot.ED) -> Quarantined and deleted successfully.
 
(end)


#11 InadequateInfirmity

InadequateInfirmity

    I Gots Me A Certified Edumication


  • Banned
  • 5,180 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:51 PM

Posted 17 January 2014 - 12:12 PM

Please download TDSSKiller.exe to your desktop.. Vista/Windows 7 users right-click and select Run As Administrator.

  • Click on Change Parameters and click Detect TDLFS File System.
  • Click the Start Scan button.
  • Do not use the computer during the scan
  • If the scan completes with nothing found, click Close to exit.
  • If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  • Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
  • Note: If Cure is not an option, Skip instead, do not choose Delete unless instructed.
  • A TDSSKiller text file would be saved in Local Disk C.
  • Copy and paste the contents of that file in your next reply.

 

 

 

Please scan your machine with ESET OnlineScan
You will need to disable your antivirus prior to scanning.

  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the esetonlinebtn.png button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer.
      Save it to your Desktop.
    • Double click on the esetsmartinstaller_enu.png to download the ESET Smart Installer. icon on your Desktop.
  • Check "YES, I
  • accept the Terms of Use."
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Under Scan Settings, check "Scan Archives" and Remove Found Threats
  • Click Advanced settingsand select the following:
    • Scan potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, click List Threats
  • Click Export, and save the file to your desktop using a unique name, such as ESET Scan. Include the contents of this report in your next reply.
  • Click the Back button.
  • Click the Finish button.

Edited by InadequateInfirmity, 17 January 2014 - 12:13 PM.


#12 cookie2112

cookie2112
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:51 PM

Posted 17 January 2014 - 06:24 PM

Just saw that my hosts file had been changed, hence the short MiniToolBox log, it had put a number of empty lines before the following (I have reset the hosts file and pop-ups have gone but want to get rid of everything):

 

MiniToolBox by Farbar  Version: 18-12-2013
Ran by Chris Cook (administrator) on 16-01-2014 at 18:02:05
Running from "C:\Users\Chris Cook\Desktop"
Microsoft Windows 7 Home Premium  Service Pack 1 (X64)
Boot Mode: Normal
***************************************************************************
 
========================= Flush DNS: ===================================
 
Windows IP Configuration
 
Successfully flushed the DNS Resolver Cache.
 
========================= IE Proxy Settings: ============================== 
 
Proxy is not enabled.
No Proxy Server is set.
 
"Reset IE Proxy Settings": IE Proxy Settings were reset.
========================= Hosts content: =================================
 
::1             localhost
 
 
66.199.231.84 www.google-analytics.com.
66.199.231.84 google-analytics.com.
66.199.231.84 connect.facebook.net.
 
127.0.0.1       localhost
 
========================= IP Configuration: ================================
 
Realtek RTL8188CE 802.11b/g/n WiFi Adapter = Wireless Network Connection (Connected)
Realtek PCIe FE Family Controller = Local Area Connection (Media disconnected)
Astrill SSL VPN Adapter = Astrill SSL VPN (Media disconnected)
Microsoft Virtual WiFi Miniport Adapter = Wireless Network Connection 2 (Media disconnected)
 
 
# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4
 
reset
set global icmpredirects=enabled
 
 
popd
# End of IPv4 configuration
 
 
 
Windows IP Configuration
 
   Host Name . . . . . . . . . . . . : ChrisCookLaptop
   Primary Dns Suffix  . . . . . . . : 
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   System Quarantine State . . . . . : Not Restricted
 
 
Wireless LAN adapter Wireless Network Connection 2:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft Virtual WiFi Miniport Adapter
   Physical Address. . . . . . . . . : 20-10-7A-12-2C-59
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
 
Ethernet adapter Astrill SSL VPN:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Astrill SSL VPN Adapter
   Physical Address. . . . . . . . . : 00-FF-D2-81-31-E3
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
 
Ethernet adapter Local Area Connection:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Realtek PCIe FE Family Controller
   Physical Address. . . . . . . . . : 78-E3-B5-64-5C-30
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
 
Wireless LAN adapter Wireless Network Connection:
 
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Realtek RTL8188CE 802.11b/g/n WiFi Adapter
   Physical Address. . . . . . . . . : 20-10-7A-12-2C-59
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::f190:f868:4428:95db%11(Preferred) 
   IPv4 Address. . . . . . . . . . . : 192.168.1.119(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Thursday, January 16, 2014 5:53:17 PM
   Lease Expires . . . . . . . . . . : Friday, January 17, 2014 5:53:29 PM
   Default Gateway . . . . . . . . . : 192.168.1.1
   DHCP Server . . . . . . . . . . . : 192.168.1.1
   DHCPv6 IAID . . . . . . . . . . . : 236982394
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-16-A0-24-8A-20-10-7A-12-2C-59
   DNS Servers . . . . . . . . . . . : 192.168.1.1
   NetBIOS over Tcpip. . . . . . . . : Enabled
 
Tunnel adapter isatap.{4A2B3FC2-0D2D-4161-BD96-03B1A0E837BF}:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
 
Tunnel adapter Local Area Connection* 9:
 
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2001:0:5ef5:79fb:3830:3ab5:e799:7acb(Preferred) 
   Link-local IPv6 Address . . . . . : fe80::3830:3ab5:e799:7acb%22(Preferred) 
   Default Gateway . . . . . . . . . : ::
   NetBIOS over Tcpip. . . . . . . . : Disabled
Server:  Cisco85286
Address:  192.168.1.1
 
Name:    google.com
Addresses:  2a00:1450:4016:800::1005
 204.186.215.24
 204.186.215.25
 204.186.215.29
 204.186.215.30
 204.186.215.34
 204.186.215.35
 204.186.215.39
 204.186.215.40
 204.186.215.44
 204.186.215.45
 204.186.215.49
 204.186.215.50
 204.186.215.54
 204.186.215.55
 204.186.215.59
 204.186.215.20
 
 
Pinging google.com [204.186.215.20] with 32 bytes of data:
Reply from 204.186.215.20: bytes=32 time=19ms TTL=61
Reply from 204.186.215.20: bytes=32 time=129ms TTL=61
 
Ping statistics for 204.186.215.20:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 19ms, Maximum = 129ms, Average = 74ms
Server:  Cisco85286
Address:  192.168.1.1
 
Name:    yahoo.com
Addresses:  206.190.36.45
 98.138.253.109
 98.139.183.24
 
 
Pinging yahoo.com [98.139.183.24] with 32 bytes of data:
Reply from 98.139.183.24: bytes=32 time=256ms TTL=55
Reply from 98.139.183.24: bytes=32 time=134ms TTL=55
 
Ping statistics for 98.139.183.24:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 134ms, Maximum = 256ms, Average = 195ms
 
Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
 
Ping statistics for 127.0.0.1:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms
===========================================================================
Interface List
 18...20 10 7a 12 2c 59 ......Microsoft Virtual WiFi Miniport Adapter
 17...00 ff d2 81 31 e3 ......Astrill SSL VPN Adapter
 12...78 e3 b5 64 5c 30 ......Realtek PCIe FE Family Controller
 11...20 10 7a 12 2c 59 ......Realtek RTL8188CE 802.11b/g/n WiFi Adapter
  1...........................Software Loopback Interface 1
 21...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
 22...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
===========================================================================
 
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.119     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.1.0    255.255.255.0         On-link     192.168.1.119    281
    192.168.1.119  255.255.255.255         On-link     192.168.1.119    281
    192.168.1.255  255.255.255.255         On-link     192.168.1.119    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     192.168.1.119    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     192.168.1.119    281
===========================================================================
Persistent Routes:
  None
 
IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
 22     58 ::/0                     On-link
  1    306 ::1/128                  On-link
 22     58 2001::/32                On-link
 22    306 2001:0:5ef5:79fb:3830:3ab5:e799:7acb/128
                                    On-link
 11    281 fe80::/64                On-link
 22    306 fe80::/64                On-link
 22    306 fe80::3830:3ab5:e799:7acb/128
                                    On-link
 11    281 fe80::f190:f868:4428:95db/128
                                    On-link
  1    306 ff00::/8                 On-link
 22    306 ff00::/8                 On-link
 11    281 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None
========================= Winsock entries =====================================
 
Catalog5 01 C:\Windows\SysWOW64\NLAapi.dll [52224] (Microsoft Corporation)
Catalog5 02 C:\Windows\SysWOW64\napinsp.dll [52224] (Microsoft Corporation)
Catalog5 03 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)
Catalog5 04 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)
Catalog5 05 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog5 06 C:\Windows\SysWOW64\winrnr.dll [20992] (Microsoft Corporation)
Catalog5 07 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [145280] (Microsoft Corp.)
Catalog5 08 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [145280] (Microsoft Corp.)
Catalog5 09 C:\Windows\SysWOW64\wshbth.dll [36352] (Microsoft Corporation)
Catalog9 01 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 02 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 03 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 04 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 05 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 06 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 07 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 08 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 09 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 10 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 11 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
x64-Catalog5 01 C:\Windows\System32\NLAapi.dll [70656] (Microsoft Corporation)
x64-Catalog5 02 C:\Windows\System32\napinsp.dll [68096] (Microsoft Corporation)
x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)
x64-Catalog5 04 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)
x64-Catalog5 05 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog5 06 C:\Windows\System32\winrnr.dll [28672] (Microsoft Corporation)
x64-Catalog5 07 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [171392] (Microsoft Corp.)
x64-Catalog5 08 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [171392] (Microsoft Corp.)
x64-Catalog5 09 C:\Windows\System32\wshbth.dll [47104] (Microsoft Corporation)
x64-Catalog9 01 C:\Windows\System32\ASProxy64.dll [468392] (Astrill)
x64-Catalog9 02 C:\Windows\System32\ASProxy64.dll [468392] (Astrill)
x64-Catalog9 03 C:\Windows\System32\ASProxy64.dll [468392] (Astrill)
x64-Catalog9 04 C:\Windows\System32\ASProxy64.dll [468392] (Astrill)
x64-Catalog9 05 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 06 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 07 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 08 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 09 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 10 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 11 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 12 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 13 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 14 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 15 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 16 C:\Windows\System32\ASProxy64.dll [468392] (Astrill)
 
========================= Event log errors: ===============================
 
Application errors:
==================
Error: (01/16/2014 05:54:24 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 
System errors:
=============
Error: (01/16/2014 05:55:33 PM) (Source: WMPNetworkSvc) (User: )
Description: 0x80070057
 
Error: (01/16/2014 05:55:33 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0xc00d4268
 
Error: (01/16/2014 05:55:33 PM) (Source: WMPNetworkSvc) (User: )
Description: 0x80070057
 
Error: (01/16/2014 05:55:33 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0xc00d4268
 
Error: (01/16/2014 05:55:33 PM) (Source: WMPNetworkSvc) (User: )
Description: 0x80070057
 
Error: (01/16/2014 05:55:33 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0xc00d4268
 
Error: (01/16/2014 05:55:33 PM) (Source: WMPNetworkSvc) (User: )
Description: 0x80070057
 
Error: (01/16/2014 05:55:33 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0xc00d4268
 
Error: (01/16/2014 05:55:33 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0xc00d4268
 
Error: (01/16/2014 05:55:24 PM) (Source: Service Control Manager) (User: )
Description: The HP Support Assistant Service service failed to start due to the following error: 
%%2
 
 
Microsoft Office Sessions:
=========================
Error: (01/16/2014 05:54:24 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 
=========================== Installed Programs ============================
 
µTorrent (Version: 3.3.0.29625)
µTorrent (Version: 3.3.2.30303)
Adobe Flash Player 11 ActiveX (Version: 11.9.900.170)
Adobe Reader X (10.1.9) MUI (Version: 10.1.9)
Adobe Shockwave Player 11.6 (Version: 11.6.1.629)
Any Video Converter Ultimate 4.6.0
Astrill
avast! Free Antivirus (Version: 9.0.2011)
AVG 2014 (Version: 14.0.3658)
Bejeweled 3 (Version: 2.2.0.97)
Blackhawk Striker 2 (Version: 2.2.0.95)
Blio (Version: 2.2.8188)
Chuzzle Deluxe (Version: 2.2.0.95)
Cisco Connect (Version: 1.4.12068.0)
Cisco EAP-FAST Module (Version: 2.2.14)
Cisco LEAP Module (Version: 1.0.19)
Cisco PEAP Module (Version: 1.1.6)
Citrix Presentation Server Client (Version: 10.00.52110)
Cradle of Rome 2 (Version: 2.2.0.98)
CyberLink YouCam (Version: 3.5.0.4422)
D3DX10 (Version: 15.4.2368.0902)
Dora's World Adventure (Version: 2.2.0.95)
Dropbox (Version: 2.0.22)
eReg (Version: 1.20.138.34)
ESU for Microsoft Windows 7 SP1 (Version: 2.1.1)
Farm Frenzy (Version: 2.2.0.98)
Farmscapes (Version: 2.2.0.98)
FATE (Version: 2.2.0.97)
Final Drive Fury (Version: 2.2.0.95)
Free Easy Burner V 5.1 (Version: 5.1.0.0)
Google Chrome (Version: 32.0.1700.76)
Google Earth Plug-in (Version: 7.1.2.2041)
Google Update Helper (Version: 1.3.22.3)
Hewlett-Packard ACLM.NET v1.1.2.0 (Version: 1.00.0000)
Hoyle Card Games (Version: 2.2.0.95)
HP Application Assistant (Version: 1.0.409.3882)
HP Auto (Version: 1.0.12935.3667)
HP Client Services (Version: 1.1.12938.3539)
HP Customer Experience Enhancements (Version: 6.0.1.8)
HP Games (Version: 1.0.2.5)
HP On Screen Display (Version: 1.3.5)
HP Power Manager (Version: 1.4.4)
HP Quick Launch (Version: 2.6.3)
HP QuickWeb (Version: 3.1.1.10197)
HP Recovery Manager (Version: 2.0.0)
HP Security Assistant (Version: 1.0.12)
HP Setup (Version: 9.0.15076.3891)
HP Setup Manager (Version: 1.2.14901.3869)
HP Software Framework (Version: 4.5.1.1)
ImgBurn (Version: 2.5.7.0)
Intel® Control Center (Version: 1.2.1.1007)
Intel® Management Engine Components (Version: 7.0.0.1144)
Intel® Processor Graphics (Version: 8.15.10.2476)
Intel® Rapid Storage Technology (Version: 10.6.0.1002)
Java 7 Update 45 (Version: 7.0.450)
Java Auto Updater (Version: 2.1.9.8)
Jewel Match 3 (Version: 2.2.0.98)
Jewel Quest Mysteries: The Seventh Gate Collector's Edition (Version: 2.2.0.98)
John Deere Drive Green (Version: 2.2.0.95)
Juniper Networks Host Checker (Version: 7.4.0.28091)
Juniper Networks, Inc. Setup Client (Version: 7.4.7.41347)
Juniper Networks, Inc. Setup Client 64-bit Activex Control (Version: 2.1.1.1)
Juniper Terminal Services Client (Version: 7.4.0.28091)
Junk Mail filter update (Version: 15.4.3502.0922)
Letters from Nowhere 2 (Version: 2.2.0.97)
Logitech SetPoint 6.32 (Version: 6.32.20)
Luxor HD (Version: 2.2.0.98)
Mah Jong Medley (Version: 2.2.0.95)
Malwarebytes Anti-Malware version 1.75.0.1300 (Version: 1.75.0.1300)
Media Player Codec Pack 4.1.9 (Version: 4.1.9)
Mesh Runtime (Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Forefront UAG endpoint components v4.0.0
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft WSE 3.0 Runtime (Version: 3.0.5305.0)
MP3 Splitter Joiner Pro v4.2 build 2612
MSVCRT (Version: 15.4.2862.0708)
MSVCRT_amd64 (Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
opensource (Version: 1.0.14960.3876)
Penguins! (Version: 2.2.0.98)
Plants vs. Zombies - Game of the Year (Version: 2.2.0.98)
PlayReady PC Runtime x86 (Version: 1.3.0)
Poker Superstars III (Version: 2.2.0.95)
Polar Bowler (Version: 2.2.0.97)
Polar Golfer (Version: 2.2.0.98)
Realtek Ethernet Controller Driver (Version: 7.46.610.2011)
Realtek PCIE Card Reader (Version: 6.1.7601.84)
REALTEK Wireless LAN Driver (Version: 1.00.11.0706)
RollerCoaster Tycoon 3: Platinum (Version: 2.2.0.98)
Skype Click to Call (Version: 6.13.13771)
Skype™ 6.11 (Version: 6.11.102)
swMSM (Version: 12.0.0.1)
Synaptics TouchPad Driver (Version: 15.3.17.0)
TeamViewer 9 (Version: 9.0.24951)
The Treasures of Mystery Island: The Ghost Ship (Version: 2.2.0.98)
Torchlight (Version: 2.2.0.98)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3)
Update Installer for WildTangent Games App
Virtual Villagers 4 - The Tree of Life (Version: 2.2.0.98)
Visual Studio 2008 x64 Redistributables (Version: 10.0.0.2)
Visual Studio 2010 x64 Redistributables (Version: 13.0.0.1)
VLC media player 2.1.1 (Version: 2.1.1)
WildTangent Games App (HP Games) (Version: 4.0.10.5)
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3538.0513)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3538.0513)
Windows Live Mail (Version: 15.4.3502.0922)
Windows Live Mesh (Version: 15.4.3502.0922)
Windows Live Mesh ActiveX Control for Remote Connections (Version: 15.4.5722.2)
Windows Live Messenger (Version: 15.4.3538.0513)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (Version: 15.4.3502.0922)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live Photo Gallery (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)
Windows Live Writer (Version: 15.4.3502.0922)
Windows Live Writer Resources (Version: 15.4.3502.0922)
WinZip 16.5 (Version: 16.5.10095)
Xilisoft DVD Creator (Version: 7.0.4.20120507)
Zuma's Revenge (Version: 2.2.0.98)
 
========================= Devices: ================================
 
 
========================= Memory info: ===================================
 
Percentage of memory in use: 49%
Total physical RAM: 4043.86 MB
Available physical RAM: 2053.74 MB
Total Pagefile: 8085.9 MB
Available Pagefile: 5985.31 MB
Total Virtual: 4095.88 MB
Available Virtual: 3962.46 MB
 
========================= Partitions: =====================================
 
1 Drive c: () (Fixed) (Total:273.21 GB) (Free:36.34 GB) NTFS
2 Drive d: (Recovery) (Fixed) (Total:20.71 GB) (Free:2.24 GB) NTFS
3 Drive e: (HP_TOOLS) (Fixed) (Total:3.96 GB) (Free:1.07 GB) FAT32
4 Drive f: (CD_ROM) (CDROM) (Total:3.48 GB) (Free:0 GB) CDFS
 
========================= Users: ========================================
 
User accounts for \\CHRISCOOKLAPTOP
 
Administrator            Chris Cook               Guest                    
Rachel                   
 
 
**** End of log ****


#13 InadequateInfirmity

InadequateInfirmity

    I Gots Me A Certified Edumication


  • Banned
  • 5,180 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:51 PM

Posted 17 January 2014 - 07:21 PM

Open an elevated command prompt then copy and paste the following one at a time hitting enter after each.

http://www.sevenforums.com/tutorials/783-elevated-command-prompt.html

cd C:\windows\system32\drivers\etc

takeown /a /f hosts

cacls hosts /p everyone:f

Reply Y Then copy and paste the text below hitting enter after.

attrib -s -h -r hosts

Close the command prompt window.

Go here and run the fix it for the hosts file.
http://support.microsoft.com/kb/972034

After the fix it runs then reboot,the hosts file should be restored to original.

 

 

When you have done this and rebooted post a new minitoolbox log with only list host ticked.



#14 cookie2112

cookie2112
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:51 PM

Posted 17 January 2014 - 10:52 PM

C:\Users\Chris Cook\AppData\Roaming\Adobe\acupx217.dll Win32/Redyms.AF trojan cleaned by deleting (after the next restart) - quarantined
C:\Users\Chris Cook\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EPUHelp.exe Win32/Redyms.AF trojan cleaned by deleting - quarantined
C:\Users\Rachel\AppData\Local\Google\Chrome\User Data\Default\jjldhaolkjmnagjhjgopimigahmniecg\3.0.7\background.js Win32/Boaxxe.BE trojan cleaned by deleting - quarantined
Operating memory Win32/Redyms.AF trojan contained infected files


#15 cookie2112

cookie2112
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:07:51 PM

Posted 17 January 2014 - 11:07 PM

MiniToolBox by Farbar  Version: 18-12-2013
Ran by Chris Cook (administrator) on 17-01-2014 at 23:07:45
Running from "C:\Users\Chris Cook\Desktop\New folder"
Microsoft Windows 7 Home Premium  Service Pack 1 (X64)
Boot Mode: Normal
***************************************************************************
========================= Hosts content: =================================
::1             localhost
 
 
127.0.0.1       localhost
 
 
**** End of log ****





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users