Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Start qone8 redirect issue


  • This topic is locked This topic is locked
16 replies to this topic

#1 rgbj23

rgbj23

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:05:45 PM

Posted 01 February 2014 - 10:07 AM

Every time i start up my internet explorer web browser it redirects me to startqone8.com homepage. It doesn't do this when i open up my google chrome browser. How do I remove this virus?



BC AdBot (Login to Remove)

 


m

#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:45 PM

Posted 01 February 2014 - 10:20 AM





Hello rgbj23

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

  • Please do not run any tools unless instructed to do so.
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
  • Please do not attach logs or use code boxes, just copy and paste the text.
    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
  • Please read every post completely before doing anything.
    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
  • Please provide feedback about your experience as we go.
    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.
NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

I would like you to run this program for me.

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 rgbj23

rgbj23
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:05:45 PM

Posted 01 February 2014 - 10:33 AM

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2014 03
Ran by Owner (administrator) on OWNER-PC on 01-02-2014 10:27:23
Running from C:\Users\Owner\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal
 
The only official download link for FRST:
Download link from any site other than Bleeping Computer is unpermitted or outdated.
 
==================== Processes (Whitelisted) =================
 
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Akamai Technologies, Inc.) C:\Users\Owner\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\Owner\AppData\Local\Akamai\netsession_win.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
 
 
==================== Registry (Whitelisted) ==================
 
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe [761024 2013-12-22] ()
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [301568 2013-09-05] (Microsoft Corporation)
HKU\S-1-5-21-4083104177-283842345-1401581011-1000\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-4083104177-283842345-1401581011-1000\...\Run: [ApplePhotoStreams] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-4083104177-283842345-1401581011-1000\...\Run: [Akamai NetSession Interface] - C:\Users\Owner\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKU\S-1-5-21-4083104177-283842345-1401581011-1000\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2013-10-21] (Google Inc.)
HKU\S-1-5-21-4083104177-283842345-1401581011-1000\...\MountPoints2: E - E:\LaunchU3.exe -a
Startup: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Blitz Media Player.lnk
ShortcutTarget: Blitz Media Player.lnk -> C:\Program Files (x86)\BlitzMediaPlayer\BlitzMediaPlayerApp.exe ()
 
==================== Internet (Whitelisted) ====================
 
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKCU - DefaultScope {B512D7BF-4DCA-421E-A8BF-2DF0A58760F8} URL = http://search.yahoo.com/search?p={searchTerms}&ei=UTF-8&fr=w3i&type=W3i_DS,136,0_0,Search,20131249,19890,0,25,0
BHO: Ask Toolbar - {4F524A2D-5637-4300-76A7-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ-V7C\Passport_x64.dll" No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: Ask Toolbar - {4F524A2D-5637-4300-76A7-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ-V7C\Passport.dll" No File
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM - Ask Toolbar - {4F524A2D-5637-4300-76A7-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ-V7C\Passport_x64.dll" No File
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - Ask Toolbar - {4F524A2D-5637-4300-76A7-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ-V7C\Passport.dll" No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
 
Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (AVG SiteSafety plugin) - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\17.1.2\\npsitesafety.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.169\npGoogleUpdate3.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.450.18) - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Java™ Platform SE 7 U45) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Extension: (Google Docs) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-10-21]
CHR Extension: (Google Drive) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-10-21]
CHR Extension: (YouTube) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-10-21]
CHR Extension: (Google Search) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-10-21]
CHR Extension: (Print a Tree) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\dmibjfmphcpfoacbchialfobiohmhged [2013-10-21]
CHR Extension: (Norton Identity Protection) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-10-21]
CHR Extension: (Google Wallet) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-21]
CHR Extension: (Gmail) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-10-21]
CHR HKLM\...\Chrome\Extension: [dmibjfmphcpfoacbchialfobiohmhged] - C:\Users\Owner\AppData\Roaming\PRINTA~1\printatreeChrome.crx [2013-09-19]
CHR HKCU\...\Chrome\Extension: [dmibjfmphcpfoacbchialfobiohmhged] - C:\Users\Owner\AppData\Roaming\PRINTA~1\printatreeChrome.crx [2013-09-19]
CHR HKLM-x32\...\Chrome\Extension: [dmibjfmphcpfoacbchialfobiohmhged] - C:\Users\Owner\AppData\Roaming\PRINTA~1\printatreeChrome.crx [2013-09-19]
CHR HKLM-x32\...\Chrome\Extension: [hbcennhacfaagdopikcegfcobcadeocj] - C:\Program Files (x86)\Common Files\Spigot\GC\saebay_1.0.crx [2013-09-19]
CHR HKLM-x32\...\Chrome\Extension: [icdlfehblmklkikfigmjhbmmpmkmpooj] - C:\Program Files (x86)\Common Files\Spigot\GC\errorassistant_1.1.crx [2013-09-19]
CHR HKLM-x32\...\Chrome\Extension: [mhkaekfpcppmmioggniknbnbdbcigpkk] - C:\Users\Owner\AppData\Local\Slick Savings\coupons.crx [2013-09-19]
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\Exts\Chrome.crx [2013-09-19]
CHR HKLM-x32\...\Chrome\Extension: [pfndaklgolladniicklehhancnlgocpp] - C:\Program Files (x86)\Common Files\Spigot\GC\saamazon_1.0.crx [2013-09-19]
 
==================== Services (Whitelisted) =================
 
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-20] (Symantec Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation)
S2 vToolbarUpdater17.3.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.3.0\ToolbarUpdater.exe [x]
 
==================== Drivers (Whitelisted) ====================
 
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [46368 2013-11-12] (AVG Technologies)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.4.0.40\Definitions\BASHDefs\20130924.001\BHDrvx64.sys [1525848 2013-09-23] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-15] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-09-05] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-09-05] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.4.0.40\Definitions\IPSDefs\20131004.001\IDSvia64.sys [520280 2013-09-04] (Symantec Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.4.0.40\Definitions\VirusDefs\20131004.002\ENG64.SYS [126040 2013-09-05] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.4.0.40\Definitions\VirusDefs\20131004.002\EX64.SYS [2099288 2013-09-05] (Symantec Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation)
R3 RTL8187B; C:\Windows\System32\DRIVERS\RTL8187B.sys [416768 2009-06-10] (Realtek Semiconductor Corporation                           )
S3 SRTSP; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-04] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-09-05] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-04] (Symantec Corporation)
R1 SymNetS; C:\Windows\system32\drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-24] (Symantec Corporation)
S3 LVPr2M64; system32\DRIVERS\LVPr2M64.sys [x]
 
==================== NetSvcs (Whitelisted) ===================
 
 
==================== One Month Created Files and Folders ========
 
2014-02-01 10:27 - 2014-02-01 10:27 - 00014972 _____ () C:\Users\Owner\Downloads\FRST.txt
2014-02-01 10:26 - 2014-02-01 10:27 - 00000000 ____D () C:\FRST
2014-02-01 10:26 - 2014-02-01 10:26 - 02080256 _____ (Farbar) C:\Users\Owner\Downloads\FRST64.exe
2014-02-01 10:09 - 2014-02-01 10:16 - 00000000 ____D () C:\AdwCleaner
2014-02-01 10:05 - 2014-02-01 10:06 - 01166132 _____ () C:\Users\Owner\Downloads\AdwCleaner.exe
2014-02-01 09:56 - 2014-02-01 09:57 - 00005607 _____ () C:\Users\Owner\Desktop\attach.txt
2014-02-01 09:56 - 2014-02-01 09:56 - 00018580 _____ () C:\Users\Owner\Desktop\dds.txt
2014-02-01 09:55 - 2014-02-01 09:55 - 00688992 ____R (Swearware) C:\Users\Owner\Downloads\dds.scr
2014-02-01 09:26 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-02-01 09:26 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-02-01 09:26 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-02-01 09:26 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-02-01 09:25 - 2014-02-01 09:26 - 00005175 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-29 11:07 - 2014-01-29 11:07 - 00000000 ____D () C:\Users\Owner\Downloads\lolsomjqcc-Aforcol
2014-01-29 11:04 - 2014-01-29 11:04 - 00406879 _____ () C:\Users\Owner\Downloads\lolsomjqcc-Aforcol.zip
2014-01-24 17:17 - 2013-11-26 20:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-24 17:17 - 2013-11-26 20:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-24 17:17 - 2013-11-26 20:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-24 17:17 - 2013-11-26 20:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-24 17:17 - 2013-11-26 20:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-24 17:17 - 2013-11-26 20:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-24 17:17 - 2013-11-26 20:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-24 17:17 - 2013-11-26 06:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-24 17:17 - 2013-11-26 05:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-22 12:36 - 2014-01-22 12:37 - 00209742 _____ () C:\Users\momma\Downloads\project_files.zip
2014-01-22 12:34 - 2014-01-22 13:57 - 00000000 ____D () C:\Users\momma\AppData\Local\Google
2014-01-19 21:44 - 2014-01-24 20:06 - 00000000 ____D () C:\8fe6c82467612d297a02c7081a6f29d1
2014-01-18 19:42 - 2014-01-18 19:42 - 00000000 ____D () C:\Users\momma\AppData\Roaming\Malwarebytes
2014-01-18 19:41 - 2014-01-22 12:38 - 00000000 ____D () C:\Users\momma\Documents\maya
2014-01-18 19:41 - 2014-01-22 12:38 - 00000000 ____D () C:\Users\momma\AppData\Roaming\Autodesk
2014-01-18 19:41 - 2014-01-18 19:41 - 00000000 ____D () C:\Users\momma\AppData\Local\Autodesk
2014-01-18 19:40 - 2014-01-18 19:41 - 00000486 _____ () C:\Users\momma\AppData\Roaming\Microsoft\Windows\Start Menu\Google.website
2014-01-18 19:37 - 2014-01-18 19:37 - 00000000 ____D () C:\Users\momma\AppData\Roaming\Macromedia
2014-01-18 19:27 - 2014-01-18 19:27 - 00000000 ____D () C:\Users\momma\AppData\Local\AVG SafeGuard toolbar
2014-01-18 19:26 - 2014-01-24 20:06 - 00000000 ___RD () C:\Users\momma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-18 19:26 - 2014-01-24 20:06 - 00000000 ___RD () C:\Users\momma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-01-18 19:26 - 2014-01-24 13:22 - 00000694 _____ () C:\Users\momma\daemonprocess.txt
2014-01-18 19:26 - 2014-01-18 19:26 - 00058016 _____ () C:\Users\momma\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-18 19:26 - 2014-01-18 19:26 - 00000000 ____D () C:\Users\momma\AppData\Roaming\Apple Computer
2014-01-18 19:26 - 2014-01-18 19:26 - 00000000 ____D () C:\Users\momma\AppData\Roaming\Adobe
2014-01-18 19:26 - 2014-01-18 19:26 - 00000000 ____D () C:\Users\momma\AppData\Local\VirtualStore
2014-01-18 19:25 - 2014-01-24 20:06 - 00000000 ___RD () C:\Users\momma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-01-18 19:25 - 2014-01-24 20:06 - 00000000 ___RD () C:\Users\momma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-01-18 19:25 - 2014-01-24 20:06 - 00000000 ____D () C:\Users\momma
2014-01-18 19:20 - 2014-01-18 19:20 - 00000000 ____D () C:\Users\Owner\AppData\Roaming\Google
2014-01-05 17:33 - 2014-01-05 17:34 - 05955760 _____ (SparkTrust) C:\Users\Owner\Downloads\SparkTrust PC Cleaner Plus Setup (1).exe
2014-01-05 17:22 - 2014-02-01 10:19 - 00000474 _____ () C:\Windows\Tasks\SparkTrust Update Version3 Startup Task.job
2014-01-05 17:22 - 2014-01-05 18:05 - 00000522 _____ () C:\Windows\Tasks\SparkTrust PC Cleaner Plus.job
2014-01-05 17:22 - 2014-01-05 18:05 - 00000464 _____ () C:\Windows\Tasks\SparkTrust Registration3.job
2014-01-05 17:22 - 2014-01-05 18:05 - 00000422 _____ () C:\Windows\Tasks\SparkTrust Update Version3.job
2014-01-05 17:22 - 2014-01-05 17:22 - 00003446 _____ () C:\Windows\System32\Tasks\SparkTrust PC Cleaner Plus
2014-01-05 17:22 - 2014-01-05 17:22 - 00003232 _____ () C:\Windows\System32\Tasks\SparkTrust Update Version3
2014-01-05 17:22 - 2014-01-05 17:22 - 00003128 _____ () C:\Windows\System32\Tasks\SparkTrust Registration3
2014-01-05 17:22 - 2014-01-05 17:22 - 00002900 _____ () C:\Windows\System32\Tasks\SparkTrust Update Version3 Startup Task
2014-01-05 17:22 - 2014-01-05 17:22 - 00001353 _____ () C:\Users\Owner\Desktop\SparkTrust PC Cleaner Plus.lnk
2014-01-05 17:22 - 2014-01-05 17:22 - 00000000 ____D () C:\Users\Owner\AppData\Roaming\SparkTrust
2014-01-05 17:22 - 2014-01-05 17:22 - 00000000 ____D () C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SparkTrust
2014-01-05 17:22 - 2014-01-05 17:22 - 00000000 ____D () C:\ProgramData\SparkTrust
2014-01-05 17:22 - 2014-01-05 17:22 - 00000000 ____D () C:\Program Files (x86)\SparkTrust
2014-01-05 17:20 - 2014-01-05 17:20 - 05955760 _____ (SparkTrust) C:\Users\Owner\Downloads\SparkTrust PC Cleaner Plus Setup.exe
2014-01-05 17:18 - 2014-01-05 17:18 - 00406264 _____ (Bleeping Computer, LLC) C:\Users\Owner\Downloads\sc-cleaner.exe
2014-01-03 21:24 - 2014-01-03 21:24 - 00001783 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-01-03 21:23 - 2014-01-03 21:24 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-03 21:23 - 2014-01-03 21:24 - 00000000 ____D () C:\Program Files\iTunes
2014-01-03 21:23 - 2014-01-03 21:24 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-01-03 21:23 - 2014-01-03 21:23 - 00000000 ____D () C:\Program Files\iPod
 
==================== One Month Modified Files and Folders =======
 
2014-02-01 10:27 - 2014-02-01 10:27 - 00014972 _____ () C:\Users\Owner\Downloads\FRST.txt
2014-02-01 10:27 - 2014-02-01 10:26 - 00000000 ____D () C:\FRST
2014-02-01 10:26 - 2014-02-01 10:26 - 02080256 _____ (Farbar) C:\Users\Owner\Downloads\FRST64.exe
2014-02-01 10:26 - 2013-11-25 21:38 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-01 10:26 - 2009-07-14 00:13 - 00778866 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-01 10:26 - 2009-07-13 23:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-01 10:26 - 2009-07-13 23:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-01 10:24 - 2013-06-05 18:37 - 01339417 _____ () C:\Windows\WindowsUpdate.log
2014-02-01 10:23 - 2013-11-25 21:38 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-01 10:23 - 2013-09-05 17:40 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-01 10:23 - 2013-09-05 17:40 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-01 10:23 - 2013-09-05 17:39 - 00000000 ____D () C:\Users\Owner\AppData\Local\Adobe
2014-02-01 10:20 - 2013-10-21 15:28 - 00000892 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-01 10:19 - 2014-01-05 17:22 - 00000474 _____ () C:\Windows\Tasks\SparkTrust Update Version3 Startup Task.job
2014-02-01 10:19 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-01 10:19 - 2009-07-13 23:51 - 00049796 _____ () C:\Windows\setupact.log
2014-02-01 10:16 - 2014-02-01 10:09 - 00000000 ____D () C:\AdwCleaner
2014-02-01 10:16 - 2013-09-05 15:44 - 00000989 _____ () C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-02-01 10:15 - 2013-12-18 22:15 - 00000112 _____ () C:\Users\Owner\AppData\Roaming\WB.CFG
2014-02-01 10:06 - 2014-02-01 10:05 - 01166132 _____ () C:\Users\Owner\Downloads\AdwCleaner.exe
2014-02-01 09:57 - 2014-02-01 09:56 - 00005607 _____ () C:\Users\Owner\Desktop\attach.txt
2014-02-01 09:56 - 2014-02-01 09:56 - 00018580 _____ () C:\Users\Owner\Desktop\dds.txt
2014-02-01 09:55 - 2014-02-01 09:55 - 00688992 ____R (Swearware) C:\Users\Owner\Downloads\dds.scr
2014-02-01 09:43 - 2013-10-21 15:28 - 00000896 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-01 09:27 - 2013-11-04 22:07 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-01 09:26 - 2014-02-01 09:25 - 00005175 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-02-01 09:26 - 2013-09-05 17:43 - 00000000 ____D () C:\Program Files (x86)\Java
2014-01-29 11:27 - 2013-12-08 06:45 - 00003003 _____ () C:\Users\Owner\daemonprocess.txt
2014-01-29 11:07 - 2014-01-29 11:07 - 00000000 ____D () C:\Users\Owner\Downloads\lolsomjqcc-Aforcol
2014-01-29 11:04 - 2014-01-29 11:04 - 00406879 _____ () C:\Users\Owner\Downloads\lolsomjqcc-Aforcol.zip
2014-01-29 10:40 - 2013-12-04 09:23 - 00000000 ____D () C:\Users\Owner\AppData\Roaming\NCH Software
2014-01-29 10:39 - 2013-11-25 21:41 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-29 10:39 - 2013-11-06 20:52 - 00000063 _____ () C:\Users\Owner\AppData\Roaming\mbam.context.scan
2014-01-24 20:06 - 2014-01-19 21:44 - 00000000 ____D () C:\8fe6c82467612d297a02c7081a6f29d1
2014-01-24 20:06 - 2014-01-18 19:26 - 00000000 ___RD () C:\Users\momma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-24 20:06 - 2014-01-18 19:26 - 00000000 ___RD () C:\Users\momma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-01-24 20:06 - 2014-01-18 19:25 - 00000000 ___RD () C:\Users\momma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-01-24 20:06 - 2014-01-18 19:25 - 00000000 ___RD () C:\Users\momma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-01-24 20:06 - 2014-01-18 19:25 - 00000000 ____D () C:\Users\momma
2014-01-24 20:06 - 2013-12-04 09:24 - 00000000 ____D () C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NCH Software Suite
2014-01-24 20:06 - 2013-12-04 09:23 - 00000000 ____D () C:\Program Files (x86)\NCH Software
2014-01-24 20:06 - 2013-10-18 09:00 - 00000000 ____D () C:\ProgramData\FLEXnet
2014-01-24 20:06 - 2013-10-10 18:45 - 00000000 ____D () C:\Users\Owner\AppData\Local\Akamai
2014-01-24 20:06 - 2013-09-05 17:53 - 00000000 ____D () C:\ProgramData\Norton
2014-01-24 20:06 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\registration
2014-01-24 17:23 - 2013-09-05 16:33 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-24 17:21 - 2013-09-05 16:33 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-24 17:08 - 2013-09-05 15:43 - 00000000 ____D () C:\Users\Owner
2014-01-24 13:22 - 2014-01-18 19:26 - 00000694 _____ () C:\Users\momma\daemonprocess.txt
2014-01-22 13:57 - 2014-01-22 12:34 - 00000000 ____D () C:\Users\momma\AppData\Local\Google
2014-01-22 12:38 - 2014-01-18 19:41 - 00000000 ____D () C:\Users\momma\Documents\maya
2014-01-22 12:38 - 2014-01-18 19:41 - 00000000 ____D () C:\Users\momma\AppData\Roaming\Autodesk
2014-01-22 12:37 - 2014-01-22 12:36 - 00209742 _____ () C:\Users\momma\Downloads\project_files.zip
2014-01-19 02:33 - 2013-09-05 16:06 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-01-18 19:44 - 2013-09-22 15:37 - 00000000 ____D () C:\Users\Owner\AppData\Local\CrashDumps
2014-01-18 19:42 - 2014-01-18 19:42 - 00000000 ____D () C:\Users\momma\AppData\Roaming\Malwarebytes
2014-01-18 19:41 - 2014-01-18 19:41 - 00000000 ____D () C:\Users\momma\AppData\Local\Autodesk
2014-01-18 19:41 - 2014-01-18 19:40 - 00000486 _____ () C:\Users\momma\AppData\Roaming\Microsoft\Windows\Start Menu\Google.website
2014-01-18 19:37 - 2014-01-18 19:37 - 00000000 ____D () C:\Users\momma\AppData\Roaming\Macromedia
2014-01-18 19:27 - 2014-01-18 19:27 - 00000000 ____D () C:\Users\momma\AppData\Local\AVG SafeGuard toolbar
2014-01-18 19:26 - 2014-01-18 19:26 - 00058016 _____ () C:\Users\momma\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-18 19:26 - 2014-01-18 19:26 - 00000000 ____D () C:\Users\momma\AppData\Roaming\Apple Computer
2014-01-18 19:26 - 2014-01-18 19:26 - 00000000 ____D () C:\Users\momma\AppData\Roaming\Adobe
2014-01-18 19:26 - 2014-01-18 19:26 - 00000000 ____D () C:\Users\momma\AppData\Local\VirtualStore
2014-01-18 19:20 - 2014-01-18 19:20 - 00000000 ____D () C:\Users\Owner\AppData\Roaming\Google
2014-01-13 21:37 - 2013-12-04 09:23 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software
2014-01-07 09:30 - 2013-09-19 21:14 - 00000000 ____D () C:\Program Files (x86)\AVG SafeGuard toolbar
2014-01-05 18:05 - 2014-01-05 17:22 - 00000522 _____ () C:\Windows\Tasks\SparkTrust PC Cleaner Plus.job
2014-01-05 18:05 - 2014-01-05 17:22 - 00000464 _____ () C:\Windows\Tasks\SparkTrust Registration3.job
2014-01-05 18:05 - 2014-01-05 17:22 - 00000422 _____ () C:\Windows\Tasks\SparkTrust Update Version3.job
2014-01-05 17:34 - 2014-01-05 17:33 - 05955760 _____ (SparkTrust) C:\Users\Owner\Downloads\SparkTrust PC Cleaner Plus Setup (1).exe
2014-01-05 17:22 - 2014-01-05 17:22 - 00003446 _____ () C:\Windows\System32\Tasks\SparkTrust PC Cleaner Plus
2014-01-05 17:22 - 2014-01-05 17:22 - 00003232 _____ () C:\Windows\System32\Tasks\SparkTrust Update Version3
2014-01-05 17:22 - 2014-01-05 17:22 - 00003128 _____ () C:\Windows\System32\Tasks\SparkTrust Registration3
2014-01-05 17:22 - 2014-01-05 17:22 - 00002900 _____ () C:\Windows\System32\Tasks\SparkTrust Update Version3 Startup Task
2014-01-05 17:22 - 2014-01-05 17:22 - 00001353 _____ () C:\Users\Owner\Desktop\SparkTrust PC Cleaner Plus.lnk
2014-01-05 17:22 - 2014-01-05 17:22 - 00000000 ____D () C:\Users\Owner\AppData\Roaming\SparkTrust
2014-01-05 17:22 - 2014-01-05 17:22 - 00000000 ____D () C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SparkTrust
2014-01-05 17:22 - 2014-01-05 17:22 - 00000000 ____D () C:\ProgramData\SparkTrust
2014-01-05 17:22 - 2014-01-05 17:22 - 00000000 ____D () C:\Program Files (x86)\SparkTrust
2014-01-05 17:20 - 2014-01-05 17:20 - 05955760 _____ (SparkTrust) C:\Users\Owner\Downloads\SparkTrust PC Cleaner Plus Setup.exe
2014-01-05 17:18 - 2014-01-05 17:18 - 00406264 _____ (Bleeping Computer, LLC) C:\Users\Owner\Downloads\sc-cleaner.exe
2014-01-05 13:13 - 2013-09-05 18:14 - 00328822 _____ () C:\Windows\PFRO.log
2014-01-03 21:24 - 2014-01-03 21:24 - 00001783 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-01-03 21:24 - 2014-01-03 21:23 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-03 21:24 - 2014-01-03 21:23 - 00000000 ____D () C:\Program Files\iTunes
2014-01-03 21:24 - 2014-01-03 21:23 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-01-03 21:23 - 2014-01-03 21:23 - 00000000 ____D () C:\Program Files\iPod
2014-01-02 17:32 - 2013-12-01 14:40 - 00000000 ____D () C:\Users\Owner\AppData\Local\BlitzMediaPlayer
 
Some content of TEMP:
====================
C:\Users\Owner\AppData\Local\Temp\AcDeltree.exe
C:\Users\Owner\AppData\Local\Temp\air3F24.exe
C:\Users\Owner\AppData\Local\Temp\airD875.exe
C:\Users\Owner\AppData\Local\Temp\APNSetup.exe
C:\Users\Owner\AppData\Local\Temp\i4jdel0.exe
C:\Users\Owner\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Owner\AppData\Local\Temp\Mobogenie-2.1.26.exe
C:\Users\Owner\AppData\Local\Temp\MouseKeyboardCenterx64_1033.exe
C:\Users\Owner\AppData\Local\Temp\oi_{777E88E1-5AD2-4AB4-AC3B-CA1096EC9EE6}.exe
C:\Users\Owner\AppData\Local\Temp\prismsetup.exe
C:\Users\Owner\AppData\Local\Temp\qc_a402013b_7656_4f6f_b57f_5a8ef69f5fc4_64.exe
C:\Users\Owner\AppData\Local\Temp\Quarantine.exe
 
 
==================== Bamital & volsnap Check =================
 
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 
LastRegBack: 2013-11-24 12:38
 
==================== End Of Log ============================

Attached Files



#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:45 PM

Posted 01 February 2014 - 11:01 AM

Hello


I would like you to run this for me now please - http://www.bleepingcomputer.com/download/shortcut-cleaner/


gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#5 rgbj23

rgbj23
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:05:45 PM

Posted 01 February 2014 - 11:06 AM

I ran it and it is now finished



#6 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:45 PM

Posted 01 February 2014 - 11:38 AM

do you still get the redirects?

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#7 rgbj23

rgbj23
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:05:45 PM

Posted 01 February 2014 - 11:40 AM

No it is no longer redirecting



#8 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:45 PM

Posted 02 February 2014 - 09:18 AM



Hello rgbj23

These are the programs I would like you to run next, if you have any problems with one of these just skip it and move on to the next one.

-AdwCleaner-

Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
-Junkware-Removal-Tool-

Please download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
When they are complete let me have the two reports and let me know how things are running.

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#9 rgbj23

rgbj23
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:05:45 PM

Posted 03 February 2014 - 06:50 AM

Here are the logs from those programs. The computer seems to be running fine and isn't redirecting me to that page anymore.
 
# AdwCleaner v3.018 - Report created 02/02/2014 at 23:13:22
# Updated 28/01/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Owner - OWNER-PC
# Running from : C:\Users\Owner\Downloads\AdwCleaner (1).exe
# Option : Clean
 
***** [ Services ] *****
 
 
***** [ Files / Folders ] *****
 
 
***** [ Shortcuts ] *****
 
 
***** [ Registry ] *****
 
 
***** [ Browsers ] *****
 
-\\ Internet Explorer v11.0.9600.16428
 
 
-\\ Google Chrome v32.0.1700.102
 
[ File : C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 
 
*************************
 
AdwCleaner[R0].txt - [11072 octets] - [01/02/2014 10:09:35]
AdwCleaner[R1].txt - [889 octets] - [02/02/2014 23:12:16]
AdwCleaner[S0].txt - [10542 octets] - [01/02/2014 10:16:31]
AdwCleaner[S1].txt - [811 octets] - [02/02/2014 23:13:22]
 
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [870 octets] ##########
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Home Premium x64
Ran by Owner on Sun 02/02/2014 at 23:55:19.17
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
~~~ Services
 
 
 
~~~ Registry Values
 
 
 
~~~ Registry Keys
 
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\yt.ytnavassistplugin
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\yt.ytnavassistplugin.1
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\sparktrust
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\caphyon
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\sparktrust
Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\clsid\{44cbc005-6243-4502-8a02-3a096a282664}"
Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\clsid\{80703783-e415-4ee3-ab60-d36981c5a6f1}"
Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\clsid\{d8278076-bc68-4484-9233-6e7f1628b56c}"
Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\clsid\{f297534d-7b06-459d-bc19-2dd8ef69297b}"
Successfully deleted: [Registry Key] "hkey_local_machine\software\classes\typelib\{9945959c-aad8-4312-8b57-2de11927e770}"
Successfully deleted: [Registry Key] "hkey_local_machine\software\microsoft\internet explorer\low rights\elevationpolicy\{6978f29a-3493-40b2-8cdc-9c13a02f85a4}"
Successfully deleted: [Registry Key] "hkey_local_machine\software\microsoft\internet explorer\low rights\elevationpolicy\{d7949a66-d936-4028-9552-14f7dc50f38d}"
 
 
 
~~~ Files
 
 
 
~~~ Folders
 
Successfully deleted: [Folder] "C:\ProgramData\sparktrust"
Successfully deleted: [Folder] "C:\ProgramData\w3i"
Successfully deleted: [Folder] "C:\Users\Owner\AppData\Roaming\drivercure"
Successfully deleted: [Folder] "C:\Users\Owner\AppData\Roaming\printatree"
Successfully deleted: [Folder] "C:\Users\Owner\AppData\Roaming\sparktrust"
Successfully deleted: [Folder] "C:\Program Files (x86)\w3i"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
 
 
 
~~~ Event Viewer Logs were cleared
 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 02/03/2014 at  0:03:03.65
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


#10 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:45 PM

Posted 03 February 2014 - 12:55 PM


Hello rgbj23

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"
  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#11 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:45 PM

Posted 10 February 2014 - 01:20 AM



Hello

48 Hour bump

It has been more than 48 hours since my last post.
  • do you still need help with this?
  • do you need more time?
  • are you having problems following my instructions?
  • if after 48hrs you have not replied to this thread then it will have to be closed!
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#12 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:45 PM

Posted 16 February 2014 - 11:02 PM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#13 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:45 PM

Posted 19 February 2014 - 12:48 PM

This topic has been re-opened at the request of the person who originally posted.
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#14 rgbj23

rgbj23
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:05:45 PM

Posted 19 February 2014 - 01:14 PM

Below is a copy of the combofix log and the computer has been operating fine.
 
ComboFix 14-02-16.01 - Owner 02/17/2014  14:39:50.1.2 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.3933.2649 [GMT -5:00]
Running from: c:\users\Owner\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Created a new restore point
.
.
(((((((((((((((((((((((((   Files Created from 2014-01-17 to 2014-02-17  )))))))))))))))))))))))))))))))
.
.
2014-02-17 19:47 . 2014-02-17 19:47 -------- d-----w- c:\users\Guest\AppData\Local\temp
2014-02-17 19:47 . 2014-02-17 19:47 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-02-13 17:45 . 2013-12-21 09:53 548864 ----a-w- c:\windows\system32\vbscript.dll
2014-02-13 17:45 . 2013-12-21 08:56 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
2014-02-13 16:35 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0C7B98EC-D1FA-4D8F-BFF7-F13B121D0A3B}\mpengine.dll
2014-02-13 16:32 . 2013-12-06 02:30 2048 ----a-w- c:\windows\system32\msxml3r.dll
2014-02-13 16:32 . 2013-12-06 02:30 1882112 ----a-w- c:\windows\system32\msxml3.dll
2014-02-13 16:32 . 2013-12-06 02:02 2048 ----a-w- c:\windows\SysWow64\msxml3r.dll
2014-02-13 16:32 . 2013-12-06 02:02 1237504 ----a-w- c:\windows\SysWow64\msxml3.dll
2014-02-09 19:45 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-02-08 16:22 . 2014-02-08 16:22 -------- d-----w- c:\users\Owner\.thumbnails
2014-02-08 16:09 . 2014-02-08 16:10 -------- d-----w- c:\programdata\WinZip
2014-02-08 16:09 . 2014-02-08 16:09 -------- d-----w- c:\program files\WinZip
2014-02-08 15:57 . 2014-02-08 15:57 -------- d-----w- c:\program files\Blender Foundation
2014-02-06 21:58 . 2014-02-08 15:25 -------- d-----w- c:\users\Guest\AppData\Local\Google
2014-02-06 21:54 . 2014-02-06 21:55 -------- d-----w- c:\users\Guest\AppData\Roaming\Autodesk
2014-02-06 21:54 . 2014-02-06 21:54 -------- d-----w- c:\users\Guest\AppData\Local\Autodesk
2014-02-03 17:17 . 2014-02-03 17:17 -------- d-----w- c:\program files\iPod
2014-02-03 17:17 . 2014-02-03 17:18 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-02-03 17:17 . 2014-02-03 17:18 -------- d-----w- c:\program files\iTunes
2014-02-03 17:17 . 2014-02-03 17:18 -------- d-----w- c:\program files (x86)\iTunes
2014-02-03 17:12 . 2014-02-03 17:12 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2014-02-03 17:12 . 2014-02-03 17:12 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2014-02-03 17:12 . 2014-02-03 17:12 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2014-02-03 17:12 . 2014-02-03 17:12 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2014-02-03 17:12 . 2014-02-03 17:12 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2014-02-03 17:11 . 2014-02-03 17:12 -------- d-----w- c:\program files (x86)\QuickTime
2014-02-03 13:27 . 2014-02-17 19:28 -------- d-----w- c:\program files (x86)\Emsisoft Anti-Malware
2014-02-03 12:28 . 2014-02-03 13:19 -------- d-----w- c:\program files\Malwarebytes Anti-Exploit
2014-02-03 12:28 . 2013-07-16 08:41 743248 ----a-w- c:\windows\SysWow64\msvcp100d.dll
2014-02-03 12:28 . 2013-07-16 08:41 1858896 ----a-w- c:\windows\system32\msvcr100d.dll
2014-02-03 12:28 . 2013-07-16 08:41 1498960 ----a-w- c:\windows\SysWow64\msvcr100d.dll
2014-02-03 12:28 . 2013-07-16 08:41 1014096 ----a-w- c:\windows\system32\msvcp100d.dll
2014-02-03 11:53 . 2014-02-03 11:54 -------- d-----w- c:\program files (x86)\Vuze
2014-02-03 04:55 . 2014-02-03 04:55 -------- d-----w- c:\windows\ERUNT
2014-02-01 15:26 . 2014-02-01 15:29 -------- d-----w- C:\FRST
2014-02-01 15:09 . 2014-02-03 04:13 -------- d-----w- C:\AdwCleaner
2014-02-01 14:26 . 2013-12-19 02:09 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-01-24 22:20 . 2013-10-29 01:04 965000 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9D3CB2E1-0985-4F29-BC27-6B7B35D52A61}\gapaengine.dll
2014-01-24 22:17 . 2013-11-27 01:41 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2014-01-24 22:17 . 2013-11-27 01:41 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2014-01-24 22:17 . 2013-11-27 01:41 53248 ----a-w- c:\windows\system32\drivers\usbehci.sys
2014-01-24 22:17 . 2013-11-27 01:41 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2014-01-24 22:17 . 2013-11-27 01:41 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2014-01-24 22:17 . 2013-11-27 01:41 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2014-01-24 22:17 . 2013-11-27 01:41 7808 ----a-w- c:\windows\system32\drivers\usbd.sys
2014-01-24 22:17 . 2013-11-26 10:32 3156480 ----a-w- c:\windows\system32\win32k.sys
2014-01-24 22:17 . 2013-11-26 11:40 376768 ----a-w- c:\windows\system32\drivers\netio.sys
2014-01-20 02:44 . 2014-01-25 01:06 -------- d-----w- C:\8fe6c82467612d297a02c7081a6f29d1
2014-01-19 00:25 . 2014-01-25 01:06 -------- d-----w- c:\users\momma
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-06 22:26 . 2013-09-05 22:40 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-06 22:26 . 2013-09-05 22:40 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-01-24 22:21 . 2013-09-05 21:33 86054176 ----a-w- c:\windows\system32\MRT.exe
2014-01-19 07:33 . 2013-09-05 21:06 270496 ------w- c:\windows\system32\MpSigStub.exe
2013-12-03 17:58 . 2013-12-03 17:58 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-12-03 17:58 . 2013-12-03 17:58 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-12-03 17:58 . 2013-12-03 17:58 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-12-03 17:58 . 2013-12-03 17:58 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-12-03 17:58 . 2013-12-03 17:58 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-12-03 17:58 . 2013-12-03 17:58 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-12-03 17:58 . 2013-12-03 17:58 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-12-03 17:58 . 2013-12-03 17:58 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-12-03 17:58 . 2013-12-03 17:58 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-12-03 17:58 . 2013-12-03 17:58 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-12-03 17:58 . 2013-12-03 17:58 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-12-03 17:58 . 2013-12-03 17:58 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-12-03 17:58 . 2013-12-03 17:58 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-12-03 17:58 . 2013-12-03 17:58 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-12-03 17:58 . 2013-12-03 17:58 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-12-03 17:58 . 2013-12-03 17:58 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-12-03 17:58 . 2013-12-03 17:58 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-12-03 17:58 . 2013-12-03 17:58 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-12-03 17:58 . 2013-12-03 17:58 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-12-03 17:58 . 2013-12-03 17:58 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-12-03 17:58 . 2013-12-03 17:58 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-12-03 17:58 . 2013-12-03 17:58 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-12-03 17:58 . 2013-12-03 17:58 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-12-03 17:58 . 2013-12-03 17:58 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-12-03 17:58 . 2013-12-03 17:58 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-12-03 17:58 . 2013-12-03 17:58 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-12-03 17:58 . 2013-12-03 17:58 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-12-03 17:58 . 2013-12-03 17:58 247808 ----a-w- c:\windows\system32\msls31.dll
2013-12-03 17:58 . 2013-12-03 17:58 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2013-12-03 17:58 . 2013-12-03 17:58 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-12-03 17:58 . 2013-12-03 17:58 105984 ----a-w- c:\windows\system32\iesysprep.dll
2013-12-03 17:58 . 2013-12-03 17:58 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-12-03 17:58 . 2013-12-03 17:58 81408 ----a-w- c:\windows\system32\icardie.dll
2013-12-03 17:58 . 2013-12-03 17:58 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2013-12-03 17:58 . 2013-12-03 17:58 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2013-12-03 17:58 . 2013-12-03 17:58 413696 ----a-w- c:\windows\system32\html.iec
2013-12-03 17:58 . 2013-12-03 17:58 30208 ----a-w- c:\windows\system32\licmgr10.dll
2013-12-03 17:58 . 2013-12-03 17:58 296960 ----a-w- c:\windows\system32\dxtrans.dll
2013-12-03 17:58 . 2013-12-03 17:58 263376 ----a-w- c:\windows\system32\iedkcs32.dll
2013-12-03 17:58 . 2013-12-03 17:58 243200 ----a-w- c:\windows\system32\webcheck.dll
2013-12-03 17:58 . 2013-12-03 17:58 235520 ----a-w- c:\windows\system32\url.dll
2013-12-03 17:58 . 2013-12-03 17:58 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-12-03 17:58 . 2013-12-03 17:58 143872 ----a-w- c:\windows\system32\wextract.exe
2013-12-03 17:58 . 2013-12-03 17:58 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-12-03 17:58 . 2013-12-03 17:58 101376 ----a-w- c:\windows\system32\inseng.dll
2013-12-03 17:58 . 2013-12-03 17:58 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-12-03 17:58 . 2013-12-03 17:58 774144 ----a-w- c:\windows\system32\jscript.dll
2013-12-03 17:58 . 2013-12-03 17:58 62464 ----a-w- c:\windows\system32\pngfilt.dll
2013-12-03 17:58 . 2013-12-03 17:58 48128 ----a-w- c:\windows\system32\imgutil.dll
2013-12-03 17:58 . 2013-12-03 17:58 147968 ----a-w- c:\windows\system32\occache.dll
2013-12-03 17:58 . 2013-12-03 17:58 13824 ----a-w- c:\windows\system32\mshta.exe
2013-12-03 17:58 . 2013-12-03 17:58 135680 ----a-w- c:\windows\system32\iepeers.dll
2013-11-30 05:37 . 2012-07-17 19:37 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-11-23 18:26 . 2013-12-11 02:52 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2013-11-23 17:47 . 2013-12-11 02:52 465920 ----a-w- c:\windows\system32\WMPhoto.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-11-30 05:33 220632 ----a-w- c:\users\Owner\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-11-30 05:33 220632 ----a-w- c:\users\Owner\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-11-30 05:33 220632 ----a-w- c:\users\Owner\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2013-11-20 59720]
"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2013-11-20 59720]
"Akamai NetSession Interface"="c:\users\Owner\AppData\Local\Akamai\netsession_win.exe" [2013-06-05 4489472]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2013-10-21 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-01-20 43848]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"mobilegeni daemon"="c:\program files (x86)\Mobogenie\DaemonProcess.exe" [2013-12-22 761024]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-01-20 152392]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux3"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R1 ESProtectionDriver;Malwarebytes Anti-Exploit;c:\program files\Malwarebytes Anti-Exploit\MBAE.sys;c:\program files\Malwarebytes Anti-Exploit\MBAE.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 vToolbarUpdater17.3.0;vToolbarUpdater17.3.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.3.0\ToolbarUpdater.exe;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.3.0\ToolbarUpdater.exe [x]
R3 cleanhlp;cleanhlp;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [x]
R3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x]
R3 FlexNet Licensing Service 64;FlexNet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 lvpopf64;Logitech POP Suppression Filter;c:\windows\system32\DRIVERS\lvpopf64.sys;c:\windows\SYSNATIVE\DRIVERS\lvpopf64.sys [x]
R3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys;c:\windows\SYSNATIVE\DRIVERS\LVPr2M64.sys [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
R3 LVUVC64;QuickCam for Notebooks Deluxe(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys;c:\windows\SYSNATIVE\drivers\avgtpx64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8187B.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-02-08 14:43 1211720 ----a-w- c:\program files (x86)\Google\Chrome\Application\32.0.1700.107\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2014-02-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-05 22:26]
.
2014-02-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-10-21 20:27]
.
2014-02-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-10-21 20:27]
.
2014-02-17 c:\windows\Tasks\Malwarebytes Anti-Exploit.job
- c:\program files\Malwarebytes Anti-Exploit\mbae-loader.exe [2014-02-03 15:14]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-11-30 05:34 244696 ----a-w- c:\users\Owner\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-11-30 05:34 244696 ----a-w- c:\users\Owner\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-11-30 05:34 244696 ----a-w- c:\users\Owner\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 1266912]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://google.com/
mDefault_Page_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local;<local>
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76 208.67.220.220
TCP: Interfaces\{A18C4CC6-C6D4-4D28-B5B6-1082B290135E}: DhcpNameServer = 75.75.75.75 75.75.76.76 208.67.220.220
TCP: Interfaces\{A18C4CC6-C6D4-4D28-B5B6-1082B290135E}\2375942554134383: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{A18C4CC6-C6D4-4D28-B5B6-1082B290135E}\84F4D454D234432423: DhcpNameServer = 75.75.75.75 75.75.76.76
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{4F524A2D-5637-4300-76A7-7A786E7484D7} - c:\program files (x86)\AskPartnerNetwork\Toolbar\ORJ-V7C\Passport.dll
Toolbar-{4F524A2D-5637-4300-76A7-7A786E7484D7} - c:\program files (x86)\AskPartnerNetwork\Toolbar\ORJ-V7C\Passport.dll
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe
c:\users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Blitz Media Player.lnk - c:\program files (x86)\BlitzMediaPlayer\BlitzMediaPlayerApp.exe
SafeBoot-CleanHlp
SafeBoot-CleanHlp.sys
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
BHO-{4F524A2D-5637-4300-76A7-7A786E7484D7} - c:\program files (x86)\AskPartnerNetwork\Toolbar\ORJ-V7C\Passport_x64.dll
Toolbar-{4F524A2D-5637-4300-76A7-7A786E7484D7} - c:\program files (x86)\AskPartnerNetwork\Toolbar\ORJ-V7C\Passport_x64.dll
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
AddRemove-Printatree - c:\users\Owner\AppData\Roaming\PRINTA~1\PrintATreeManager.exe
AddRemove-UpdaterEX - c:\users\Owner\AppData\Roaming\UpdaterEX\UpdateProc\UpdateTask.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-4083104177-283842345-1401581011-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-4083104177-283842345-1401581011-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Nico Mak Computing\WinZip]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2014-02-17  14:50:20
ComboFix-quarantined-files.txt  2014-02-17 19:50
.
Pre-Run: 221,001,846,784 bytes free
Post-Run: 230,309,015,552 bytes free
.
- - End Of File - - DDAC6E8CB3FB19D35B394BD14E8CA43A
A36C5E4F47E84449FF07ED3517B43A31


#15 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:45 PM

Posted 19 February 2014 - 09:15 PM


Hello rgbj23

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Please start by opening Notepad and copy/paste the text in the box into the window:

ClearJavaCache::


 
Save it to your desktop as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe
CFScriptB-4.gif
This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"
  • In your next post I need the following
    • report from Combofix
    • let me know of any problems you may have had
    • How is the computer doing now after running the script?
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users