Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Conduit search infection


  • This topic is locked This topic is locked
32 replies to this topic

#1 danar

danar

  • Members
  • 133 posts
  • OFFLINE
  •  
  • Local time:01:20 PM

Posted 28 January 2014 - 04:04 AM

My computer is infected with conduit search so when I open firefox or chrome or try to open a new tab, I get directed to conduit search home page rather than my default home page. And, when I try to open internet explorer or open a tab, it gets directed to search.ask homepage instead of my default homepage.

 

I've tried using malware bytes and avast to get rid of it, but I can't shake it.

 

I've downloaded DDS(this isn't my first rodeo here) and when I try to run it, I get the message "DDS Mode is not meant to run in Compatibility Mode. This program shall now exist." I click okay, but I'm not getting any logs.

 

Thank you for your help.

 

 



BC AdBot (Login to Remove)

 


#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:20 PM

Posted 28 January 2014 - 08:18 PM





Hello danar

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

  • Please do not run any tools unless instructed to do so.
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
  • Please do not attach logs or use code boxes, just copy and paste the text.
    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
  • Please read every post completely before doing anything.
    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
  • Please provide feedback about your experience as we go.
    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.
NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

I would like you to run this program for me.

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 danar

danar
  • Topic Starter

  • Members
  • 133 posts
  • OFFLINE
  •  
  • Local time:01:20 PM

Posted 28 January 2014 - 08:53 PM

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014
Ran by otto (administrator) on OTTO-PC on 28-01-2014 17:51:05
Running from C:\Users\otto\Downloads
Windows 8.1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Atheros) C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Google Pinyin 2\GooglePinyinDaemon.exe
(Microsoft Corporation) C:\Windows\System32\InputMethod\CHS\ChsIME.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Flux Software LLC) C:\Users\otto\AppData\Local\FluxSoftware\Flux\flux.exe
(The Weather Channel) C:\Program Files (x86)\The Weather Channel\The Weather Channel App\TWCApp.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Dropbox, Inc.) C:\Users\otto\AppData\Roaming\Dropbox\bin\Dropbox.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PrivacyIconClient.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-12] (Realtek Semiconductor)
HKLM-x32\...\Run: [IMSS] - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe [133440 2012-07-19] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [285240 2012-09-01] (Intel Corporation)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [102928 2012-10-23] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3764024 2014-01-15] (AVAST Software)
HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1778640 2014-01-09] (APN)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [f.lux] - C:\Users\otto\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)
HKCU\...\Run: [DW7] - C:\Program Files (x86)\The Weather Channel\The Weather Channel App\TWCApp.exe [13209088 2014-01-27] (The Weather Channel)
HKU\Administrator\...\RunOnce: [WAB Migrate] - C:\Program Files\Windows Mail\wab.exe [516608 2013-08-22] (Microsoft Corporation)
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => File Not Found
Startup: C:\Users\otto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\otto\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://dell13.msn.com/?pc=DCJB
SearchScopes: HKLM - DefaultScope {A30D84F2-5E24-482B-BF16-06CCC0364426} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=DCJB
SearchScopes: HKLM - {A30D84F2-5E24-482B-BF16-06CCC0364426} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=DCJB
SearchScopes: HKLM-x32 - DefaultScope {A30D84F2-5E24-482B-BF16-06CCC0364426} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=DCJB
SearchScopes: HKLM-x32 - {A30D84F2-5E24-482B-BF16-06CCC0364426} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=DCJB
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://search.conduit.com/Results.aspx?ctid=CT3322287&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPFC44D7C3-48EA-48E3-AA71-54C165781317&q={searchTerms}&SSPV=
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://search.conduit.com/Results.aspx?ctid=CT3322287&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPFC44D7C3-48EA-48E3-AA71-54C165781317&q={searchTerms}&SSPV=
SearchScopes: HKCU - {7B559351-0FCF-409C-8329-5ACA3B93B88D} URL = http://www.search.ask.com/web?tpid=KMPV7c&o=APN11363&pf=V7&p2=%5EBA2%5EYYYYYY%5EYY%5EUS&gct=&itbv=12.10.0.3727&apn_uid=EF53A3FB-1D80-45B9-ABE8-C4C5C8916742&apn_ptnrs=%5EBA2&apn_dtid=%5EYYYYYY%5EYY%5EUS&apn_dbr=iexplore.exe_6_11.0.9600.16384&doi=2014-01-28&trgb=IE&q={searchTerms}&psv=
SearchScopes: HKCU - {A30D84F2-5E24-482B-BF16-06CCC0364426} URL =
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: KMP Media Toolbar - {4B4D5056-3763-006A-76A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\KMPV7c\Passport_x64.dll (APN LLC.)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: KMP Media Toolbar - {4B4D5056-3763-006A-76A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\KMPV7c\Passport.dll (APN LLC.)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - KMP Media Toolbar - {4B4D5056-3763-006A-76A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\KMPV7c\Passport_x64.dll (APN LLC.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM-x32 - KMP Media Toolbar - {4B4D5056-3763-006A-76A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\KMPV7c\Passport.dll (APN LLC.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\otto\AppData\Roaming\Mozilla\Firefox\Profiles\61et5rua.default
FF NewTab: hxxp://search.conduit.com/?ctid=CT3322287&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=&Lay=1&UM=4&UP=SPFC44D7C3-48EA-48E3-AA71-54C165781317
FF Homepage: hxxp://search.conduit.com/?ctid=CT3322287&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SPFC44D7C3-48EA-48E3-AA71-54C165781317&SSPV=
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\otto\AppData\Roaming\Mozilla\Firefox\Profiles\61et5rua.default\searchplugins\conduit-search.xml
FF Extension: DoNotTrackMe: Online Privacy Protection - C:\Users\otto\AppData\Roaming\Mozilla\Firefox\Profiles\61et5rua.default\Extensions\donottrackplus@abine.com [2014-01-03]
FF Extension: WOT - C:\Users\otto\AppData\Roaming\Mozilla\Firefox\Profiles\61et5rua.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-26]
FF Extension: Ghostery - C:\Users\otto\AppData\Roaming\Mozilla\Firefox\Profiles\61et5rua.default\Extensions\firefox@ghostery.com.xpi [2013-10-19]
FF Extension: Copy As Plain Text - C:\Users\otto\AppData\Roaming\Mozilla\Firefox\Profiles\61et5rua.default\Extensions\{1a5dabbd-0e74-41da-b532-a364bb552cab}.xpi [2013-10-19]
FF Extension: NoScript - C:\Users\otto\AppData\Roaming\Mozilla\Firefox\Profiles\61et5rua.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-10-24]
FF Extension: Adblock Plus - C:\Users\otto\AppData\Roaming\Mozilla\Firefox\Profiles\61et5rua.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-10-19]
FF Extension: BetterPrivacy - C:\Users\otto\AppData\Roaming\Mozilla\Firefox\Profiles\61et5rua.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2013-10-19]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-10-24]

Chrome:
=======
CHR HomePage: hxxp://search.conduit.com/?ctid=CT3322287&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SPFC44D7C3-48EA-48E3-AA71-54C165781317&SSPV=
CHR DefaultSearchKeyword: conduit.search
CHR DefaultSearchProvider: Conduit Search
CHR DefaultSearchURL: http://search.conduit.com/Results.aspx?ctid=CT3322287&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPFC44D7C3-48EA-48E3-AA71-54C165781317&q={searchTerms}&SSPV=
CHR DefaultNewTabURL:
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (McAfee SecurityCenter) - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL No File
CHR Extension: (YouTube) - C:\Users\otto\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-10-03]
CHR Extension: (Google Search) - C:\Users\otto\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-10-03]
CHR Extension: (avast! Online Security) - C:\Users\otto\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-10-24]
CHR Extension: (Google Wallet) - C:\Users\otto\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-03]
CHR Extension: (Gmail) - C:\Users\otto\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-10-03]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2013-10-24]

==================== Services (Whitelisted) =================

R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-01-09] (APN LLC.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-01-15] (AVAST Software)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [166720 2012-07-19] (Intel Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [254512 2012-04-24] ()
S2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2099512 2013-10-12] (TuneUp Software)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe [77824 2012-06-19] (Atheros)

==================== Drivers (Whitelisted) ====================

S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
R2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [78648 2014-01-15] (AVAST Software)
R1 aswRdr; C:\WINDOWS\system32\drivers\aswRdr2.sys [92544 2013-10-24] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-10-24] ()
R1 aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [1034464 2014-01-15] (AVAST Software)
R1 aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [422216 2014-01-15] (AVAST Software)
R3 aswStm; C:\WINDOWS\system32\drivers\aswStm.sys [79672 2014-01-15] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2014-01-15] ()
S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-12] (Windows ® Win 7 DDK provider)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-09] (Intel Corporation)
R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-10] (Microsoft Corporation)
S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)
S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-25] (Microsoft Corporation)
S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-10-05] (Microsoft Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2013-09-18] (TuneUp Software)
S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-28 17:51 - 2014-01-28 17:51 - 00017994 _____ C:\Users\otto\Downloads\FRST.txt
2014-01-28 17:50 - 2014-01-28 17:51 - 00000000 ____D C:\FRST
2014-01-28 17:47 - 2014-01-28 17:48 - 02079744 _____ (Farbar) C:\Users\otto\Downloads\FRST64.exe
2014-01-28 17:47 - 2014-01-28 17:47 - 01137152 _____ (Farbar) C:\Users\otto\Downloads\FRST.exe
2014-01-28 01:09 - 2014-01-28 01:09 - 00688992 _____ (Swearware) C:\Users\otto\Downloads\dds(3).scr
2014-01-28 01:02 - 2014-01-28 01:02 - 00688992 _____ (Swearware) C:\Users\otto\Downloads\dds(2).scr
2014-01-28 01:01 - 2014-01-28 01:01 - 00106376 _____ (Swearware) C:\Users\otto\Downloads\dds(1).scr
2014-01-28 00:51 - 2014-01-28 00:51 - 00688992 _____ (Swearware) C:\Users\otto\Downloads\dds (2).scr
2014-01-28 00:17 - 2014-01-28 00:17 - 00688992 _____ (Swearware) C:\Users\otto\Downloads\dds (1).scr
2014-01-28 00:15 - 2014-01-28 00:15 - 00688992 _____ (Swearware) C:\Users\otto\Downloads\dds.com
2014-01-28 00:13 - 2014-01-28 00:13 - 00688992 _____ (Swearware) C:\Users\otto\Downloads\dds.scr
2014-01-27 23:04 - 2014-01-18 23:38 - 00270496 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2014-01-27 18:02 - 2014-01-27 18:02 - 00002223 _____ C:\Users\Public\Desktop\TuneUp 1-Click Maintenance.lnk
2014-01-27 18:02 - 2014-01-27 18:02 - 00002197 _____ C:\Users\Public\Desktop\TuneUp Utilities 2014.lnk
2014-01-27 18:02 - 2014-01-27 18:02 - 00001326 _____ C:\Users\Public\Desktop\The Weather Channel App.lnk
2014-01-27 18:02 - 2014-01-27 18:02 - 00000000 ____D C:\Users\otto\AppData\Roaming\TuneUp Software
2014-01-27 18:02 - 2014-01-27 18:02 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2014-01-27 18:02 - 2014-01-27 18:02 - 00000000 ____D C:\Program Files (x86)\The Weather Channel
2014-01-27 18:02 - 2014-01-27 18:02 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2014-01-27 18:02 - 2013-10-12 02:47 - 00040760 _____ (TuneUp Software) C:\WINDOWS\system32\TURegOpt.exe
2014-01-27 18:02 - 2013-10-12 02:47 - 00029496 _____ (TuneUp Software) C:\WINDOWS\system32\authuitu.dll
2014-01-27 18:02 - 2013-10-12 02:47 - 00025400 _____ (TuneUp Software) C:\WINDOWS\SysWOW64\authuitu.dll
2014-01-27 18:01 - 2014-01-27 18:02 - 00000000 ____D C:\ProgramData\TuneUp Software
2014-01-27 18:01 - 2014-01-27 18:02 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2014
2014-01-27 18:01 - 2014-01-27 18:01 - 00001049 _____ C:\Users\otto\Desktop\KMPlayer.lnk
2014-01-27 18:01 - 2014-01-27 18:01 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-01-27 18:01 - 2014-01-27 18:01 - 00000000 ____D C:\Users\otto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The KMPlayer
2014-01-27 18:01 - 2014-01-27 18:01 - 00000000 ____D C:\Users\otto\AppData\Local\The Weather Channel
2014-01-27 18:01 - 2014-01-27 18:01 - 00000000 ____D C:\ProgramData\APN
2014-01-27 18:00 - 2014-01-27 18:01 - 00000000 ____D C:\Program Files (x86)\The KMPlayer
2014-01-27 17:59 - 2014-01-27 17:59 - 00000000 ____D C:\Users\otto\AppData\Local\SearchProtect
2014-01-27 17:57 - 2014-01-27 17:58 - 00000000 ____D C:\Users\otto\AppData\Roaming\rmi
2014-01-15 20:28 - 2014-01-15 20:28 - 00079672 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswstm.sys
2014-01-15 06:27 - 2013-11-27 07:36 - 03395920 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSService.dll
2014-01-15 06:27 - 2013-11-27 03:41 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSCollect.exe
2014-01-15 06:27 - 2013-11-27 02:34 - 00138240 _____ C:\WINDOWS\system32\OEMLicense.dll
2014-01-15 06:27 - 2013-11-27 01:54 - 00103936 _____ C:\WINDOWS\SysWOW64\OEMLicense.dll
2014-01-15 06:27 - 2013-11-27 00:48 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-15 06:27 - 2013-11-27 00:45 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll
2014-01-15 06:27 - 2013-11-27 00:40 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-15 06:27 - 2013-11-27 00:38 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll
2014-01-15 06:27 - 2013-11-27 00:17 - 00695808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2014-01-15 06:27 - 2013-11-27 00:12 - 00848384 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2014-01-15 06:26 - 2013-12-08 16:15 - 00787968 _____ (Microsoft Corporation) C:\WINDOWS\system32\uDWM.dll
2014-01-14 11:53 - 2014-01-14 11:53 - 03127296 _____ C:\Users\otto\Downloads\-.pps

==================== One Month Modified Files and Folders =======

2014-01-28 17:51 - 2014-01-28 17:51 - 00017994 _____ C:\Users\otto\Downloads\FRST.txt
2014-01-28 17:51 - 2014-01-28 17:50 - 00000000 ____D C:\FRST
2014-01-28 17:48 - 2014-01-28 17:47 - 02079744 _____ (Farbar) C:\Users\otto\Downloads\FRST64.exe
2014-01-28 17:47 - 2014-01-28 17:47 - 01137152 _____ (Farbar) C:\Users\otto\Downloads\FRST.exe
2014-01-28 17:46 - 2013-09-22 20:25 - 00003594 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-414922455-1000596132-962163596-1001
2014-01-28 17:40 - 2013-11-30 10:47 - 01685413 _____ C:\WINDOWS\WindowsUpdate.log
2014-01-28 17:09 - 2013-10-03 18:47 - 00000910 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-28 17:02 - 2013-08-22 07:36 - 00000000 ____D C:\WINDOWS\system32\sru
2014-01-28 16:53 - 2013-11-07 17:54 - 00444476 _____ C:\WINDOWS\system32\prfh0804.dat
2014-01-28 16:53 - 2013-11-07 17:54 - 00135994 _____ C:\WINDOWS\system32\prfc0804.dat
2014-01-28 16:53 - 2013-09-29 20:04 - 01438230 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2014-01-28 15:45 - 2013-12-22 14:50 - 00000000 ___RD C:\Users\otto\Dropbox
2014-01-28 15:45 - 2013-11-14 23:38 - 00000000 ____D C:\Users\otto\AppData\Roaming\Dropbox
2014-01-28 15:45 - 2013-10-24 17:59 - 00003918 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{1CEF8596-76A9-4E2A-AAE1-9BC3BB431CB3}
2014-01-28 15:45 - 2013-10-24 17:42 - 00000000 __RDO C:\Users\otto\SkyDrive
2014-01-28 15:45 - 2013-10-03 18:47 - 00002205 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-28 15:45 - 2013-10-03 18:47 - 00000906 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-28 01:09 - 2014-01-28 01:09 - 00688992 _____ (Swearware) C:\Users\otto\Downloads\dds(3).scr
2014-01-28 01:02 - 2014-01-28 01:02 - 00688992 _____ (Swearware) C:\Users\otto\Downloads\dds(2).scr
2014-01-28 01:01 - 2014-01-28 01:01 - 00106376 _____ (Swearware) C:\Users\otto\Downloads\dds(1).scr
2014-01-28 00:51 - 2014-01-28 00:51 - 00688992 _____ (Swearware) C:\Users\otto\Downloads\dds (2).scr
2014-01-28 00:17 - 2014-01-28 00:17 - 00688992 _____ (Swearware) C:\Users\otto\Downloads\dds (1).scr
2014-01-28 00:15 - 2014-01-28 00:15 - 00688992 _____ (Swearware) C:\Users\otto\Downloads\dds.com
2014-01-28 00:13 - 2014-01-28 00:13 - 00688992 _____ (Swearware) C:\Users\otto\Downloads\dds.scr
2014-01-27 23:57 - 2013-08-22 06:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2014-01-27 23:56 - 2013-12-12 21:09 - 00066414 _____ C:\WINDOWS\PFRO.log
2014-01-27 23:56 - 2013-08-22 05:25 - 00786432 ___SH C:\WINDOWS\system32\config\BBI
2014-01-27 18:10 - 2013-09-22 20:15 - 00000000 ____D C:\Users\otto\AppData\Local\VirtualStore
2014-01-27 18:02 - 2014-01-27 18:02 - 00002223 _____ C:\Users\Public\Desktop\TuneUp 1-Click Maintenance.lnk
2014-01-27 18:02 - 2014-01-27 18:02 - 00002197 _____ C:\Users\Public\Desktop\TuneUp Utilities 2014.lnk
2014-01-27 18:02 - 2014-01-27 18:02 - 00001326 _____ C:\Users\Public\Desktop\The Weather Channel App.lnk
2014-01-27 18:02 - 2014-01-27 18:02 - 00000000 ____D C:\Users\otto\AppData\Roaming\TuneUp Software
2014-01-27 18:02 - 2014-01-27 18:02 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2014-01-27 18:02 - 2014-01-27 18:02 - 00000000 ____D C:\Program Files (x86)\The Weather Channel
2014-01-27 18:02 - 2014-01-27 18:02 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2014-01-27 18:02 - 2014-01-27 18:01 - 00000000 ____D C:\ProgramData\TuneUp Software
2014-01-27 18:02 - 2014-01-27 18:01 - 00000000 ____D C:\Program Files (x86)\TuneUp Utilities 2014
2014-01-27 18:01 - 2014-01-27 18:01 - 00001049 _____ C:\Users\otto\Desktop\KMPlayer.lnk
2014-01-27 18:01 - 2014-01-27 18:01 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-01-27 18:01 - 2014-01-27 18:01 - 00000000 ____D C:\Users\otto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\The KMPlayer
2014-01-27 18:01 - 2014-01-27 18:01 - 00000000 ____D C:\Users\otto\AppData\Local\The Weather Channel
2014-01-27 18:01 - 2014-01-27 18:01 - 00000000 ____D C:\ProgramData\APN
2014-01-27 18:01 - 2014-01-27 18:00 - 00000000 ____D C:\Program Files (x86)\The KMPlayer
2014-01-27 17:59 - 2014-01-27 17:59 - 00000000 ____D C:\Users\otto\AppData\Local\SearchProtect
2014-01-27 17:58 - 2014-01-27 17:57 - 00000000 ____D C:\Users\otto\AppData\Roaming\rmi
2014-01-23 08:09 - 2013-08-22 07:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2014-01-18 23:38 - 2014-01-27 23:04 - 00270496 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2014-01-15 20:28 - 2014-01-15 20:28 - 00079672 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswstm.sys
2014-01-15 20:28 - 2013-12-12 21:08 - 00001984 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-01-15 20:28 - 2013-11-12 12:41 - 00003924 _____ C:\WINDOWS\System32\Tasks\avast! Emergency Update
2014-01-15 20:28 - 2013-10-24 20:42 - 01034464 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2014-01-15 20:28 - 2013-10-24 20:42 - 00422216 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswsp.sys
2014-01-15 20:28 - 2013-10-24 20:42 - 00334136 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2014-01-15 20:28 - 2013-10-24 20:42 - 00207904 _____ C:\WINDOWS\system32\Drivers\aswVmm.sys
2014-01-15 20:28 - 2013-10-24 20:42 - 00078648 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2014-01-15 20:28 - 2013-10-24 20:42 - 00043152 _____ (AVAST Software) C:\WINDOWS\avastSS.scr
2014-01-15 20:28 - 2013-08-22 07:36 - 00000000 ____D C:\WINDOWS\WinStore
2014-01-15 07:19 - 2013-09-23 21:25 - 00000000 ____D C:\WINDOWS\system32\MRT
2014-01-15 07:18 - 2013-09-23 21:24 - 86054176 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-01-14 11:53 - 2014-01-14 11:53 - 03127296 _____ C:\Users\otto\Downloads\-.pps
2014-01-06 14:31 - 2013-08-22 07:38 - 00693240 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-01-06 14:31 - 2013-08-22 07:38 - 00105464 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-05 18:29 - 2013-10-24 17:27 - 00000000 ____D C:\Users\otto
2014-01-05 16:44 - 2013-10-19 20:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2014-01-05 16:37 - 2013-08-22 07:36 - 00000000 ____D C:\WINDOWS\system32\NDF
2014-01-03 06:41 - 2013-09-22 20:17 - 00000000 ___RD C:\Users\otto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-03 06:40 - 2013-12-22 14:50 - 00001067 _____ C:\Users\otto\Desktop\Dropbox.lnk
2014-01-03 06:40 - 2013-11-14 23:39 - 00000000 ____D C:\Users\otto\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

Some content of TEMP:
====================
C:\Users\otto\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpueslj8.dll
C:\Users\otto\AppData\Local\Temp\The_Weather_Channel_Application.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-28 00:38

==================== End Of Log ============================


Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-01-2014
Ran by otto at 2014-01-28 17:51:36
Running from C:\Users\otto\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

Adobe Reader XI (11.0.06) (x32 Version: 11.0.06 - Adobe Systems Incorporated)
Amazon 1Button App for Windows Taskbar (x32 Version: 1.0.0.2 - Amazon)
avast! Free Antivirus (x32 Version: 9.0.2011 - Avast Software)
CCleaner (Version: 4.04 - Piriform)
CyberLink LabelPrint 2.5 (x32 Version: 2.5.5415 - CyberLink Corp.) Hidden
CyberLink Media Suite 10 (x32 Version: 10.0.1.2417 - CyberLink Corp.) Hidden
CyberLink Media Suite Essentials (x32 Version: 10.0 - CyberLink Corp.)
CyberLink Power2Go 8 (x32 Version: 8.0.0.2126 - CyberLink Corp.) Hidden
CyberLink PowerDirector 10 (x32 Version: 10.0.1.2413 - CyberLink Corp.) Hidden
CyberLink PowerDVD 10 (x32 Version: 10.0.4828.52 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell Backup and Recovery - Support Software (x32 Version: 1.5.0.0 - Dell Inc.)
Dell Backup and Recovery (x32 Version: 1.5.0.0 - Dell Inc.)
Dell Digital Delivery (x32 Version: 2.7.1000.0 - Dell Products, LP)
Dell Product Registration (x32 Version: 1.16.1 - Dell Inc.)
Dell Wireless Driver Installation (x32 Version: 10.0 - Dell)
Dropbox (HKCU Version: 2.6.2 - Dropbox, Inc.)
DSC/AA Factory Installer (Version: 3.3.6261.27 - PC-Doctor, Inc.) Hidden
f.lux (HKCU Version:  - )
Google Chrome (x32 Version: 32.0.1700.76 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Toolbar for Internet Explorer (x32 Version: 7.5.4805.320 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Intel® Control Center (x32 Version: 1.2.1.1008 - Intel Corporation)
Intel® Management Engine Components (x32 Version: 8.1.0.1281 - Intel Corporation)
Intel® Processor Graphics (x32 Version: 10.18.10.3316 - Intel Corporation)
Intel® Rapid Storage Technology (x32 Version: 11.6.0.1030 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.738.1 - Intel Corporation) Hidden
KMP Media Toolbar (x32 Version: 12.10.0.3727 - APN, LLC)
Malwarebytes Anti-Malware version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office (x32 Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Mozilla Firefox 26.0 (x86 en-US) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
My Dell (Version: 3.4.6422.14 - PC-Doctor, Inc.)
Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)
Shared C Run-time for x64 (Version: 10.0.0 - McAfee)
The KMPlayer (remove only) (x32 Version: 3.8.0.117 - PandoraTV)
The Weather Channel App (x32 Version:  - )
TuneUp Utilities 2014 (en-US) (x32 Version: 14.0.1000.145 - TuneUp Software) Hidden
TuneUp Utilities 2014 (x32 Version: 14.0.1000.145 - TuneUp Software)
TuneUp Utilities 2014 (x32 Version: 14.0.1000.145 - TuneUp Software) Hidden
Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
谷歌拼音输入法 2.7 (Version:  - Google Inc.)

==================== Restore Points  =========================

10-01-2014 20:19:45 Scheduled Checkpoint
15-01-2014 15:18:16 Windows Update
22-01-2014 16:40:08 Scheduled Checkpoint
26-01-2014 19:13:36 Windows Update

==================== Hosts content: ==========================

2013-08-22 05:25 - 2013-08-22 05:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {1F78FF93-C028-4FAC-8866-9651DACE6586} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-07-22] (Piriform Ltd)
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-21] (Microsoft Corporation)
Task: {376FCC42-BE23-44D3-9555-063AD7DC58CE} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\My Dell\uaclauncher.exe [2013-09-05] (PC-Doctor, Inc.)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {3CBB1D9C-384A-4A9F-AEAF-179741D35FF5} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-10-03] (Google Inc.)
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {76C50318-8EEF-49F4-93C1-711816C35962} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-10-03] (Google Inc.)
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {879B8AE1-FFA4-401F-AD7C-9961CB4366E4} - System32\Tasks\CLVDLauncher => C:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2012-12-02] (CyberLink Corp.)
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {8E484091-2CAB-4A58-87AB-CDD9AAFB7FC7} - System32\Tasks\CLMLSvc_P2G8 => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2012-12-02] (CyberLink)
Task: {8F8C7AAD-F96B-4AC0-8B48-8435243B9573} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [2013-12-06] (PC-Doctor, Inc.)
Task: {9106F1FF-2C4B-483A-A2EC-BA891698D3BF} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {A111C8A8-A44E-40EE-9684-6B9AA4D283EF} - System32\Tasks\Dell\Dell System Registration => C:\Program Files (x86)\System Registration\prodreg.exe [2012-07-09] (Dell, Inc.)
Task: {A2FCB753-F1D2-4A00-9B17-99B4D612667F} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-01-15] (AVAST Software)
Task: {B7D01C2D-1758-4A53-A348-44459EB18F7E} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-01-15] (Microsoft Corporation)
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {E2A46136-F748-4E09-B8FB-D6078E66EF92} - System32\Tasks\Google Pinyin Daemon => C:\Program Files (x86)\Google\Google Pinyin 2\GooglePinyinDaemon.exe [2013-11-07] (Google Inc.)
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-08-21 13:45 - 2013-04-19 14:51 - 00020256 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBROverlayIcon.dll
2013-08-21 13:45 - 2013-04-19 14:52 - 00049440 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\STCommonShellIntegration.dll
2013-08-21 13:45 - 2013-04-19 14:51 - 00019232 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Shell\DBROverlayNotBackuped.dll
2013-10-03 22:42 - 2013-10-03 22:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-10-29 11:33 - 2013-10-29 11:33 - 01459712 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.UI\0ff25bd7c20be35c2e915bb82db13b72\Windows.UI.ni.dll
2013-10-29 11:33 - 2013-10-29 11:33 - 00521216 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.Data\4e1b0dc15d072d992e08612cd74a34db\Windows.Data.ni.dll
2013-10-28 12:49 - 2013-10-28 12:49 - 00363520 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.Foundation\432868bf54b081b16eaf68729020b30a\Windows.Foundation.ni.dll
2014-01-27 10:59 - 2014-01-27 08:58 - 02166272 _____ () C:\Program Files\AVAST Software\Avast\defs\14012701\algo.dll
2013-10-27 11:24 - 2013-10-27 11:24 - 00016384 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PSIClient\f97cf15f658c4ee5e0be06dbf62ac4b1\PSIClient.ni.dll
2013-08-21 13:36 - 2012-07-18 11:55 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll
2014-01-28 15:45 - 2014-01-28 15:45 - 00041984 _____ () c:\users\otto\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpueslj8.dll
2013-10-18 15:55 - 2013-10-18 15:55 - 25100288 _____ () C:\Users\otto\AppData\Roaming\Dropbox\bin\libcef.dll
2013-10-24 20:42 - 2013-10-24 20:42 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-08-21 13:41 - 2012-06-07 19:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2012-06-08 10:34 - 2012-06-08 10:34 - 00016400 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2013-12-19 19:30 - 2013-12-19 19:30 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Users\otto\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Could not start eventlog service, could not read events.

The requested service has already been started.

More help is available by typing NET HELPMSG 2182.


==================== Memory info ===========================

Percentage of memory in use: 56%
Total physical RAM: 3967.58 MB
Available physical RAM: 1735.6 MB
Total Pagefile: 4671.58 MB
Available Pagefile: 1916.64 MB
Total Virtual: 131072 MB
Available Virtual: 131071.78 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:452.6 GB) (Free:411.74 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 68A1FBC5)

Partition: GPT Partition Type
==================== End Of Log ============================



#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:20 PM

Posted 28 January 2014 - 08:59 PM



Hello danar

These are the programs I would like you to run next, if you have any problems with one of these just skip it and move on to the next one.

-AdwCleaner-

Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
-Junkware-Removal-Tool-

Please download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
When they are complete let me have the two reports and let me know how things are running.

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#5 danar

danar
  • Topic Starter

  • Members
  • 133 posts
  • OFFLINE
  •  
  • Local time:01:20 PM

Posted 29 January 2014 - 01:34 AM

I tried to run AdwCleaner, but I ran into a couple of problems.
 
When I clicked and downloaded your AdwCleaner, I got this message in a box:
 
"You are currently running a outdated version of AdwCleaner. Please click Okayin order to open AdwCleaner's download version where you can get the latest version"
 
I did that, and I got to sent to AdwCleaner's but it was in French. But, I downloaded and ran the program and it was running for around an hour and forty minutes, and it still says:
 
"Pending. Please uncheck elements you don't want to remove"
 
On the services tab for AdwCleaner, Ask Update se... is only thing that is checked.
 
Since it wasn't finished, I didn't press the clean option and stopped AdwCleaner. But, I printed the log printout of it so far:
 

# AdwCleaner v3.018 - Report created 28/01/2014 at 20:51:27
# Updated 28/01/2014 by Xplode
# Operating System : Windows 8.1 (64 bits)
# Username : otto - OTTO-PC
# Running from : C:\Users\otto\Downloads\adwcleaner.exe
# Option : Scan

***** [ Services ] *****

Service Found : APNMCP

***** [ Files / Folders ] *****

File Found : C:\Users\otto\AppData\Roaming\Mozilla\Firefox\Profiles\61et5rua.default\searchplugins\conduit-search.xml
Folder Found C:\Program Files (x86)\AskPartnerNetwork
Folder Found C:\ProgramData\apn
Folder Found C:\ProgramData\AskPartnerNetwork
Folder Found C:\Users\otto\AppData\Local\Searchprotect
Folder Found C:\Users\otto\AppData\Local\Temp\apn

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\AskPartnerNetwork
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Found : [x64] HKCU\Software\AskPartnerNetwork
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Found : HKLM\Software\AskPartnerNetwork
Key Found : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Key Found : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
Key Found : HKLM\Software\SearchProtect
Key Found : [x64] HKLM\SOFTWARE\AskPartnerNetwork
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnTbMon]

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16384


-\\ Mozilla Firefox v26.0 (en-US)

[ File : C:\Users\otto\AppData\Roaming\Mozilla\Firefox\Profiles\61et5rua.default\prefs.js ]

Line Found : user_pref("browser.newtab.url", "hxxp://search.conduit.com/?ctid=CT3322287&amp;octid=EB_ORIGINAL_CTID&amp;SearchSource=69&amp;CUI=&amp;SSPV=&amp;Lay=1&amp;UM=4&amp;UP=SPFC44D7C3-48EA-48E3-AA71-54C165781317");
Line Found : user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3322287&amp;octid=EB_ORIGINAL_CTID&amp;SearchSource=55&amp;CUI=&amp;UM=4&amp;UP=SPFC44D7C3-48EA-48E3-AA71-54C165781317&amp;SSPV=");

-\\ Google Chrome v32.0.1700.76

[ File : C:\Users\otto\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Found : homepage
Found : search_url
Found : suggest_url
Found : keyword
Found : homepage
Found : search_url
Found : homepage
Found : search_url
Found : suggest_url

*************************

AdwCleaner[R0].txt - [2321 octets] - [28/01/2014 20:51:27]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [2381 octets] ##########

Edited by danar, 29 January 2014 - 01:36 AM.


#6 danar

danar
  • Topic Starter

  • Members
  • 133 posts
  • OFFLINE
  •  
  • Local time:01:20 PM

Posted 29 January 2014 - 01:57 AM

&nbsp;

H
Please download Junkware Removal Tool to your desktop.[list]
[*]Shut down your protection software now to avoid potential conflicts.

&nbsp;

Would my protection software be avast, malware bytes, and windows firewall?

#7 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:20 PM

Posted 29 January 2014 - 02:16 AM

Avast would be the main one to turn off

gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#8 danar

danar
  • Topic Starter

  • Members
  • 133 posts
  • OFFLINE
  •  
  • Local time:01:20 PM

Posted 29 January 2014 - 02:25 AM

Should it take that long to run AdwCleaner? Or, was there something wrong with that program? Should I rerun it again?

Edited by danar, 29 January 2014 - 02:39 AM.


#9 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:20 PM

Posted 29 January 2014 - 02:33 AM

ten min maybe - how long has it been?


gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#10 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:20 PM

Posted 29 January 2014 - 02:34 AM

ten min maybe - how long has it been?


gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#11 danar

danar
  • Topic Starter

  • Members
  • 133 posts
  • OFFLINE
  •  
  • Local time:01:20 PM

Posted 29 January 2014 - 02:46 AM

&nbsp;

ten min maybe - how long has it been?


gringo

&nbsp;

AdwCleaner was running for hour and forty mintues before I stopped it and closed that program. Since it wasn't finished, I didn't clean the ask update it found.

#12 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:20 PM

Posted 29 January 2014 - 02:50 AM


Hello danar

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"
  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#13 danar

danar
  • Topic Starter

  • Members
  • 133 posts
  • OFFLINE
  •  
  • Local time:01:20 PM

Posted 29 January 2014 - 03:03 AM

Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 8.1 x64
Ran by otto on Tue 01/28/2014 at 23:48:14.69
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 


~~~ Services

Failed to stop: [Service] APNMCP

 

~~~ Registry Values

Failed to delete: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\apntbmon
Failed to delete: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\\apntbmon

 

~~~ Registry Keys

Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\protector_dll.protectorbho
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\protector_dll.protectorbho.1
Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\searchprotect
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{7B559351-0FCF-409C-8329-5ACA3B93B88D}
Successfully deleted: [Registry Key] "hkey_current_user\software\askpartnernetwork"
Failed to delete: [Registry Key] "hkey_local_machine\software\askpartnernetwork"
Failed to delete: [Registry Key] "hkey_local_machine\software\classes\clsid\{44cbc005-6243-4502-8a02-3a096a282664}"
Failed to delete: [Registry Key] "hkey_local_machine\software\classes\clsid\{80703783-e415-4ee3-ab60-d36981c5a6f1}"
Failed to delete: [Registry Key] "hkey_local_machine\software\classes\clsid\{d8278076-bc68-4484-9233-6e7f1628b56c}"
Failed to delete: [Registry Key] "hkey_local_machine\software\classes\clsid\{f297534d-7b06-459d-bc19-2dd8ef69297b}"
Failed to delete: [Registry Key] "hkey_local_machine\software\classes\typelib\{9945959c-aad8-4312-8b57-2de11927e770}"
Failed to delete: [Registry Key] "hkey_local_machine\software\microsoft\internet explorer\low rights\elevationpolicy\{6978f29a-3493-40b2-8cdc-9c13a02f85a4}"
Failed to delete: [Registry Key] "hkey_local_machine\software\microsoft\internet explorer\low rights\elevationpolicy\{d7949a66-d936-4028-9552-14f7dc50f38d}"



~~~ Files

 

~~~ Folders

Failed to delete: [Folder] "C:\ProgramData\apn"
Failed to delete: [Folder] "C:\ProgramData\AskPartnerNetwork"
Failed to delete: [Folder] "C:\Program Files (x86)\askpartnernetwork"

 

~~~ FireFox

Successfully deleted the following from C:\Users\otto\AppData\Roaming\mozilla\firefox\profiles\61et5rua.default\prefs.js

user_pref("browser.newtab.url", "hxxp://search.conduit.com/?ctid=CT3322287&amp;octid=EB_ORIGINAL_CTID&amp;SearchSource=69&amp;CUI=&amp;SSPV=&amp;Lay=1&amp;UM=4&amp;UP=SPFC44D7C3-48EA-48E3-AA71-54C1657813
user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3322287&amp;octid=EB_ORIGINAL_CTID&amp;SearchSource=55&amp;CUI=&amp;UM=4&amp;UP=SPFC44D7C3-48EA-48E3-AA71-54C165781317&amp;SSP

 

~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 01/28/2014 at 23:50:57.98
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Edited by danar, 29 January 2014 - 03:06 AM.


#14 danar

danar
  • Topic Starter

  • Members
  • 133 posts
  • OFFLINE
  •  
  • Local time:01:20 PM

Posted 29 January 2014 - 03:30 AM

I downloaded combofix, and shut off my security software so avast and firewall wouldn't interfere(although not Malware bytes since it was the free version.)

But, I got the message: "warning!! do not run combofix in comptability mode. doing so may damage your computer". I think I have Windows 8 because I don't have a start button anymore.

Edited by danar, 29 January 2014 - 03:46 AM.


#15 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:04:20 PM

Posted 29 January 2014 - 03:56 AM





Hello danar

Malwarebytes Anti-Rootkit

1.Download Malwarebytes Anti-Rootkit
2.Unzip the contents to a folder in a convenient location.
3.Open the folder where the contents were unzipped and run mbar.exe
4.Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
5.Click on the Cleanup button to remove any threats and reboot if prompted to do so.
6.Wait while the system shuts down and the cleanup process is performed.
7.Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
8.If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:
  • •Internet access
    •Windows Update
    •Windows Firewall
9.If there are additional problems with your system, such as any of those listed above or other system issues, then run the 'fixdamage' tool included with Malwarebytes Anti-Rootkit and reboot.
10.Verify that your system is now functioning normally.


--RogueKiller--

Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit
  • Quit all programs that you may have started.
  • Please disconnect any external drives from the computer before you run this scan!
  • For Vista or Windows 7, right-click and select "Run as Administrator to start"
  • For Windows XP, double-click to start.
  • Wait until Prescan has finished ...
  • Then Click on "Scan" button
  • Wait until the Status box shows "Scan Finished"
  • click on "delete"
  • Wait until the Status box shows "Deleting Finished"
  • Click on "Report" and copy/paste the content of the Notepad into your next reply.
  • the scan will make two reports the one I would like to see is called RKreport[2].txt on your Desktop
  • Exit/Close RogueKiller+
send me the reports made from MBAR and Roguekiller and also let me know how the computer is doing at this time.

Gringo






When you are complete please send me both reports

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users