Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

"Bad Image" errors after running Malwarebytes to clean up infections


  • This topic is locked This topic is locked
2 replies to this topic

#1 snoopy24

snoopy24

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:08:26 PM

Posted 11 April 2014 - 06:40 PM

Hi

My computer got infected somehow I used Malwarebytes scans to clean it up, which usually work fine. Many infections were found and removed. However, now every time the computer is rebooted or a program is run, Windows is throwing a "Bad Image" error on ever program. Clicking OK closes the error, and the programs work, but the errors are very annoying. Is there some way to correct this problem?

 

Error example:

 

iexplore.exe - Bad Image

 

C:\PROGRA~2\Wincert\WIN32C~1.DLL is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support.

 

I already ran Frst but I need some help, can you please make me a fixlist and let me know how to use it

 

Thank you in advance

G.S

 

p.s. here is the Frst list

 

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-04-2014
Ran by Chuck (administrator) on CHUCK-PC on 11-04-2014 15:34:58
Running from C:\Users\Chuck\Desktop
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe
() c:\programdata\house of soft\gs-enabler\GS-Enabler.exe
(CyberLink) C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
() C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
(Affinegy, Inc.) C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(HiTRSUT) C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corporation) C:\Program Files\Microsoft\BingBar\SeaPort.EXE
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Acer Inc.) C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
() C:\Users\Chuck\Downloads\AdwCleaner.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Microsoft Corporation) C:\Windows\system32\wuauclt.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [4423680 2007-03-23] (Realtek Semiconductor)
HKLM\...\Run: [Acer Empowering Technology Monitor] - C:\Acer\Empowering Technology\SysMonitor.exe [319488 2007-01-24] ()
HKLM\...\Run: [eDataSecurity Loader] - C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe [464168 2007-02-07] (HiTRUST)
HKLM\...\Run: [Acer Product Registration] - C:\Program Files\Acer Registration\ACE1.exe [3383296 2007-02-02] (Leader Technologies)
HKLM\...\Run: [Acer Assist Launcher] - C:\Program Files\Acer Assist\launcher.exe [1261568 2007-02-02] ()
HKLM\...\Run: [eRecoveryService] - [X]
HKLM\...\Run: [Acer Tour Reminder] - C:\Acer\AcerTour\Reminder.exe
HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2007-10-14] (Hewlett-Packard)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2010-11-29] (Apple Inc.)
HKLM\...\Run: [InstaLAN] - C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe [1485208 2010-07-28] (Affinegy, Inc.)
HKLM\...\Run: [RegWork] - C:\Program Files\RegWork\RegWork.exe
HKLM\...\Run: [DivXUpdate] - C:\Program Files\DivX\DivX Update\DivXUpdate.exe [1230704 2011-03-21] ()
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-01-28] (Apple Inc.)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-02-20] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-03] (Adobe Systems Incorporated)
HKLM\...\Run: [BrowserSafeguard] - "C:\Program Files\Browsersafeguard\BrowserSafeguard.exe"
HKLM\...\runonceex: [] - [X]
HKU\.DEFAULT\...\Run: [] - [X]
HKU\.DEFAULT\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [90112 2006-11-10] ()
HKU\.DEFAULT\...\Run: [Acer Tour Reminder] - C:\Acer\AcerTour\Reminder.exe
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-3671800355-2533653517-425178959-1000\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-3671800355-2533653517-425178959-1000\...\Run: [TomTomHOME.exe] - C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [247768 2012-08-28] (TomTom)
HKU\S-1-5-21-3671800355-2533653517-425178959-1000\...\Run: [msnmsgr] - C:\Program Files\Windows Live\Messenger\msnmsgr.exe [4280184 2012-03-08] (Microsoft Corporation)
HKU\S-1-5-21-3671800355-2533653517-425178959-1000\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-3671800355-2533653517-425178959-1000\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-3671800355-2533653517-425178959-1000\...\Policies\Explorer: [NoDesktopCleanupWizard] 1
AppInit_DLLs: c:\progra~2\assist~1\assist~1.dll => C:\ProgramData\Assistant\Assistant.dll [4223488 2014-04-02] ()
Startup: C:\Users\Bonnie's\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:49179;https=127.0.0.1:49179
HKCU\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=MSSE
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.ca.acer.yahoo.com
URLSearchHook: HKLM - (No Name) - {f897eb0e-a3a4-46c3-80eb-2729699d8892} -  No File
SearchScopes: HKLM - DefaultScope value is missing.
BHO: ALOT Toolbar Helper - {14CEEAFF-96DD-4101-AE37-D5ECDC23C3F6} - C:\Program Files\alot\bin\BHO\alotBHO.dll (Vertro)
BHO: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: graeatsuAAvear - {47174B66-6816-7134-0A0C-5A22104DA150} - C:\Program Files\graeatsuAAvear\JuD7.dll No File
BHO: DivX HiQ - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: Facetheme - {70C6E9DE-F30E-4A40-8A6F-9572C2328320} - C:\Program Files\Object\bho_project.dll No File
BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll (HiTRUST)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: YoutubeAdblocker - {9CD8B219-994D-3ADB-B7CF-8D01C7078C71} - C:\Program Files\YoutubeAdblocker\0RQ.dll No File
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: SeaoRcch-NewTaub - {B9C4FE85-7FD0-B9B6-4613-CC277F5030B5} - C:\Program Files\SeaoRcch-NewTaub\hZaR9RVU4.dll No File
BHO: FunDeals - {BB33C4C1-6AD0-6D38-D9D8-AD9C6FA1785A} - C:\ProgramData\FunDeals\VbgsrW.dll No File
BHO: TakeTheoCCoupon - {CCEDECF1-E1EC-01BD-6AA0-636D12976758} - C:\ProgramData\TakeTheoCCoupon\rj9mj.dll No File
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO: No Name - {f897eb0e-a3a4-46c3-80eb-2729699d8892} -  No File
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll (HiTRUST)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {F897EB0E-A3A4-46C3-80EB-2729699D8892} -  No File
DPF: {63F5866B-A7C5-40B4-9A89-0CCA99726C8D} https://secure.logmeinrescue.com/Customer/x86/RescueDownloader.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

FireFox:
========
FF ProfilePath: C:\Users\Chuck\AppData\Roaming\Mozilla\Firefox\Profiles\q0lj3d5h.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @ei.DailyFitnessCenter_53.com/Plugin - C:\Program Files\DailyFitnessCenter_53EI\Installr\1.bin\NP53EISB.dll (Daily Fitness Center)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.4 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011-04-28]
FF HKLM\...\Firefox\Extensions: [{6904342A-8307-11DF-A508-4AE2DFD72085}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa
FF Extension: DivX HiQ - C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011-04-28]
FF HKLM\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2011\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM\...\Firefox\Extensions: [linkfilter@kaspersky.ru] - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2011\FFExt\linkfilter@kaspersky.ru
FF HKCU\...\Firefox\Extensions: [{10ea107a-1e21-48af-be43-9e461589fa89}] - C:\Program Files\Re-markit-soft\157.xpi
FF Extension: Re-markit - C:\Program Files\Re-markit-soft\157.xpi [2014-03-26]

Chrome:
=======
CHR HomePage: https://www.google.ca/
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\32.0.1700.102\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.260.3) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java™ Platform SE 6 U26) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (DivX Web Player) - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\32.0.1700.102\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\32.0.1700.102\pdf.dll ()
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll No File
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (YouTube) - C:\Users\Chuck\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-20]
CHR Extension: (Google Search) - C:\Users\Chuck\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-20]
CHR Extension: (UtubeAddReeMMoval) - C:\Users\Chuck\AppData\Local\Google\Chrome\User Data\Default\Extensions\eleajjoegibhaplailphimdbgoalmafl [2014-02-18]
CHR Extension: (MediaPlayerplus) - C:\Users\Chuck\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd [2014-03-26]
CHR Extension: (Google Wallet) - C:\Users\Chuck\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-30]
CHR Extension: (YYTBookkMuark) - C:\Users\Chuck\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfdbkbdbcbfnabllhieempfijkaoidlh [2014-01-21]
CHR Extension: (Gmail) - C:\Users\Chuck\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-20]
CHR Extension: (Push to Kindle) - C:\Users\Chuck\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnaiinchjaonopoejhknmgjingcnaloc [2014-01-21]
CHR HKLM\...\Chrome\Extension: [fnjbmmemklcjgepojigaapkoodmkgbae] - C:\Program Files\DivX\DivX Plus Web Player\google_chrome\wpa\wpa.crx [2011-02-07]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2011-09-21]
CHR HKLM\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files\DivX\DivX Plus Web Player\google_chrome\html5video\html5video.crx [2011-02-07]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

========================== Services (Whitelisted) =================

S2 699fd52f; C:\ProgramData\Assistant\AssistantSvc.dll [177488 2014-04-02] ()
R2 Acer HomeMedia Connect Service; C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [266343 2007-04-04] (CyberLink)
R2 AcerMemUsageCheckService; C:\Acer\Empowering Technology\ePerformance\MemCheck.exe [28672 2006-12-29] ()
R2 AffinegyService; C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe [569752 2010-07-28] (Affinegy, Inc.)
R2 eDataSecurity Service; C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe [457512 2007-02-07] (HiTRSUT)
R2 eRecoveryService; C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe [53248 2007-01-31] (Acer Inc.)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [280288 2013-10-23] (Microsoft Corporation)
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [143360 2007-04-09] ()
S2 CLTNetCnService; "c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [X]

==================== Drivers (Whitelisted) ====================

R2 int15; C:\Acer\Empowering Technology\eRecovery\int15.sys [76584 2006-12-07] ()
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation)
R0 PSDFilter; C:\Windows\System32\DRIVERS\psdfilter.sys [20264 2007-02-07] (HiTRUST)
R0 PSDNServ; C:\Windows\System32\drivers\PSDNServ.sys [16680 2007-02-07] (HiTRUST)
R0 psdvdisk; C:\Windows\System32\drivers\psdvdisk.sys [60712 2007-02-07] (HiTRUST)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-11 15:34 - 2014-04-11 15:35 - 00019402 _____ () C:\Users\Chuck\Desktop\FRST.txt
2014-04-11 15:31 - 2014-04-11 15:32 - 00001391 _____ () C:\Users\Chuck\Downloads\Addition.txt
2014-04-11 15:29 - 2014-04-11 15:31 - 00050943 _____ () C:\Users\Chuck\Downloads\FRST.txt
2014-04-11 15:29 - 2014-04-11 15:29 - 00000000 ____D () C:\FRST
2014-04-11 15:28 - 2014-04-11 15:28 - 01145856 _____ (Farbar) C:\Users\Chuck\Desktop\FRST.exe
2014-04-11 15:17 - 2014-04-11 15:17 - 00987448 _____ () C:\Users\Chuck\Desktop\SecurityCheck.exe
2014-04-11 15:10 - 2014-04-11 15:33 - 00000000 ____D () C:\AdwCleaner
2014-04-11 15:08 - 2014-04-11 15:08 - 01426178 _____ () C:\Users\Chuck\Downloads\AdwCleaner.exe
2014-04-11 14:52 - 2014-04-08 08:17 - 00000426 _____ () C:\AVScanner.ini
2014-04-11 14:49 - 2014-04-11 14:49 - 00000850 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-04-11 14:49 - 2014-04-11 14:49 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-04-11 14:46 - 2014-04-11 14:46 - 00282880 _____ (Mozilla) C:\Users\Chuck\Downloads\Firefox Setup Stub 28.0.exe
2014-04-11 14:42 - 2014-04-11 14:43 - 00000000 ____D () C:\Users\Chuck\AppData\Local\{50273670-A5C2-4878-A10F-FE9FB3D26495}
2014-04-11 12:36 - 2014-04-11 14:49 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-04-11 12:36 - 2014-04-11 12:36 - 00000000 ____D () C:\Users\Chuck\AppData\Local\Mozilla
2014-04-11 12:36 - 2014-04-11 12:36 - 00000000 ____D () C:\ProgramData\Mozilla
2014-04-11 11:49 - 2014-04-11 11:50 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-04-11 11:49 - 2014-04-11 11:49 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-11 11:28 - 2014-04-11 11:28 - 00000000 ____D () C:\Users\Chuck\AppData\Local\{FD560438-989E-4A86-BE7B-3A3936631B78}
2014-04-10 12:33 - 2014-04-10 12:33 - 00000000 ____D () C:\Users\Chuck\AppData\Local\{428D5195-7FA3-4F8A-B306-C8D03B1D3E57}
2014-04-09 13:39 - 2014-04-11 15:32 - 00000000 ____D () C:\ProgramData\TakeTheoCCoupon
2014-04-03 20:41 - 2014-04-03 20:41 - 00000000 ____D () C:\Users\Chuck\AppData\Local\{0EBF782D-AFC7-4AD6-B68C-7CF6B3FD3D0B}
2014-04-02 12:53 - 2014-04-02 12:53 - 00000000 ____D () C:\Users\Chuck\AppData\Local\_
2014-03-26 18:02 - 2014-04-02 09:55 - 00000000 ____D () C:\ProgramData\Assistant
2014-03-26 13:32 - 2014-03-26 13:32 - 00000000 ____D () C:\Users\Chuck\AppData\Local\{DAE00E5B-CCA9-4216-BC07-578ED9A67C9B}
2014-03-26 13:27 - 2014-03-26 13:28 - 00000324 _____ () C:\Users\Chuck\AppData\Roaming\aps.uninstall.scan.results
2014-03-26 13:26 - 2014-04-11 15:05 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-26 13:26 - 2014-03-26 13:26 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-03-26 13:26 - 2014-03-26 13:26 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-03-26 13:22 - 2014-03-26 13:22 - 01172720 _____ (AnyProtect.com) C:\Users\Chuck\AppData\Local\nsz312C.tmp
2014-03-26 13:19 - 2014-04-11 15:32 - 00000366 _____ () C:\Windows\Tasks\Re-markit_wd.job
2014-03-26 13:19 - 2014-04-11 14:15 - 00000000 ____D () C:\Program Files\Re-markit-soft
2014-03-26 13:17 - 2014-03-26 13:18 - 00407528 _____ () C:\Users\Chuck\Downloads\Setup.exe
2014-03-19 15:28 - 2014-03-19 15:28 - 00000000 ____D () C:\Users\Chuck\AppData\Local\{A72868C1-391E-47E9-B26A-6FF56D09DAFA}
2014-03-17 11:27 - 2014-03-17 11:27 - 00000000 ____D () C:\Users\Chuck\AppData\Local\{521B4301-CC2B-49D9-84C0-2C7B1DF8A474}
2014-03-13 11:49 - 2014-03-13 11:49 - 00000000 ____D () C:\Users\Chuck\AppData\Local\Skype
2014-03-13 11:49 - 2014-03-13 11:49 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-03-13 11:48 - 2014-03-14 11:48 - 00000000 ____D () C:\Users\Chuck\AppData\Local\{B6A1A547-FEDA-4306-98AD-9E217644819B}
2014-03-13 03:03 - 2014-02-22 22:50 - 12347904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-13 03:03 - 2014-02-22 22:47 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-13 03:03 - 2014-02-22 22:43 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-13 03:03 - 2014-02-22 22:41 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-13 03:03 - 2014-02-22 22:40 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-13 03:03 - 2014-02-22 22:39 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-13 03:03 - 2014-02-22 22:38 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-03-13 03:03 - 2014-02-22 22:38 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-13 03:03 - 2014-02-22 22:38 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-13 03:03 - 2014-02-22 22:37 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-13 03:03 - 2014-02-22 22:37 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-03-13 03:03 - 2014-02-22 22:37 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-13 03:03 - 2014-02-22 22:37 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-03-13 03:03 - 2014-02-22 22:36 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-13 03:03 - 2014-02-22 22:36 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-03-13 03:03 - 2014-02-22 22:35 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-12 20:39 - 2014-02-07 03:38 - 02050560 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-12 20:39 - 2014-02-03 03:37 - 00505344 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-12 20:39 - 2014-01-30 00:46 - 00876032 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-12 20:39 - 2013-11-12 17:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

==================== One Month Modified Files and Folders =======

2014-04-11 15:35 - 2014-04-11 15:34 - 00019402 _____ () C:\Users\Chuck\Desktop\FRST.txt
2014-04-11 15:34 - 2011-03-14 17:37 - 01312717 _____ () C:\Windows\WindowsUpdate.log
2014-04-11 15:33 - 2014-04-11 15:10 - 00000000 ____D () C:\AdwCleaner
2014-04-11 15:32 - 2014-04-11 15:31 - 00001391 _____ () C:\Users\Chuck\Downloads\Addition.txt
2014-04-11 15:32 - 2014-04-09 13:39 - 00000000 ____D () C:\ProgramData\TakeTheoCCoupon
2014-04-11 15:32 - 2014-03-26 13:19 - 00000366 _____ () C:\Windows\Tasks\Re-markit_wd.job
2014-04-11 15:32 - 2014-03-06 11:48 - 00000000 ____D () C:\ProgramData\FunDeals
2014-04-11 15:32 - 2014-01-21 19:10 - 00000000 ____D () C:\ProgramData\SeaoRcch-NewTaub
2014-04-11 15:32 - 2014-01-21 19:08 - 00000000 ____D () C:\ProgramData\YoutubeAdblocker
2014-04-11 15:32 - 2014-01-21 19:08 - 00000000 ____D () C:\ProgramData\graeatsuAAvear
2014-04-11 15:31 - 2014-04-11 15:29 - 00050943 _____ () C:\Users\Chuck\Downloads\FRST.txt
2014-04-11 15:29 - 2014-04-11 15:29 - 00000000 ____D () C:\FRST
2014-04-11 15:28 - 2014-04-11 15:28 - 01145856 _____ (Farbar) C:\Users\Chuck\Desktop\FRST.exe
2014-04-11 15:17 - 2014-04-11 15:17 - 00987448 _____ () C:\Users\Chuck\Desktop\SecurityCheck.exe
2014-04-11 15:16 - 2006-11-02 03:33 - 00759582 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-11 15:08 - 2014-04-11 15:08 - 01426178 _____ () C:\Users\Chuck\Downloads\AdwCleaner.exe
2014-04-11 15:05 - 2014-03-26 13:26 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-11 14:49 - 2014-04-11 14:49 - 00000850 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-04-11 14:49 - 2014-04-11 14:49 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-04-11 14:49 - 2014-04-11 12:36 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-04-11 14:46 - 2014-04-11 14:46 - 00282880 _____ (Mozilla) C:\Users\Chuck\Downloads\Firefox Setup Stub 28.0.exe
2014-04-11 14:43 - 2014-04-11 14:42 - 00000000 ____D () C:\Users\Chuck\AppData\Local\{50273670-A5C2-4878-A10F-FE9FB3D26495}
2014-04-11 14:42 - 2011-06-17 11:50 - 00000884 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-11 14:41 - 2011-10-08 17:35 - 00000000 ____D () C:\Users\Chuck\Tracing
2014-04-11 14:41 - 2006-11-02 04:18 - 00000000 ____D () C:\Windows\system32\LogFiles
2014-04-11 14:40 - 2014-01-21 19:09 - 00000460 ____H () C:\Windows\Tasks\GS-Enabler-S-993492499.job
2014-04-11 14:40 - 2013-04-13 03:29 - 00000470 _____ () C:\Windows\Tasks\ParetoLogic Update Version3 Startup Task.job
2014-04-11 14:40 - 2011-06-17 11:50 - 00000880 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-11 14:40 - 2006-11-02 06:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-11 14:40 - 2006-11-02 05:47 - 00003168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-11 14:40 - 2006-11-02 05:47 - 00003168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-11 14:23 - 2006-11-02 06:01 - 00032548 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-11 14:17 - 2011-03-14 17:51 - 00000000 ____D () C:\Users\Chuck
2014-04-11 14:16 - 2011-03-15 12:35 - 00000000 ____D () C:\Users\Bonnie's
2014-04-11 14:16 - 2006-11-02 04:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-04-11 14:16 - 2006-11-02 03:22 - 81788928 _____ () C:\Windows\system32\config\system_previous
2014-04-11 14:16 - 2006-11-02 03:22 - 53477376 _____ () C:\Windows\system32\config\software_previous
2014-04-11 14:16 - 2006-11-02 03:22 - 41418752 _____ () C:\Windows\system32\config\components_previous
2014-04-11 14:16 - 2006-11-02 03:22 - 00524288 _____ () C:\Windows\system32\config\default_previous
2014-04-11 14:16 - 2006-11-02 03:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-04-11 14:16 - 2006-11-02 03:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-04-11 14:15 - 2014-03-26 13:19 - 00000000 ____D () C:\Program Files\Re-markit-soft
2014-04-11 14:15 - 2011-05-18 07:56 - 00000000 ____D () C:\Program Files\Citrix
2014-04-11 14:15 - 2011-03-16 17:18 - 00000000 ____D () C:\ProgramData\HP Product Assistant
2014-04-11 14:15 - 2006-11-02 04:18 - 00000000 ____D () C:\Windows\system32\spool
2014-04-11 14:15 - 2006-11-02 04:18 - 00000000 ____D () C:\Windows\registration
2014-04-11 13:51 - 2011-03-15 12:46 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-04-11 12:36 - 2014-04-11 12:36 - 00000000 ____D () C:\Users\Chuck\AppData\Local\Mozilla
2014-04-11 12:36 - 2014-04-11 12:36 - 00000000 ____D () C:\ProgramData\Mozilla
2014-04-11 12:10 - 2006-11-02 05:52 - 00035848 _____ () C:\Windows\setupact.log
2014-04-11 11:50 - 2014-04-11 11:49 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-04-11 11:49 - 2014-04-11 11:49 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-11 11:28 - 2014-04-11 11:28 - 00000000 ____D () C:\Users\Chuck\AppData\Local\{FD560438-989E-4A86-BE7B-3A3936631B78}
2014-04-11 11:24 - 2007-04-16 17:56 - 00127816 _____ () C:\Windows\PFRO.log
2014-04-10 12:33 - 2014-04-10 12:33 - 00000000 ____D () C:\Users\Chuck\AppData\Local\{428D5195-7FA3-4F8A-B306-C8D03B1D3E57}
2014-04-10 03:05 - 2007-04-16 18:00 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-10 03:04 - 2013-08-14 03:10 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-09 13:39 - 2014-01-21 19:08 - 00000000 ____D () C:\ProgramData\c81e7302c2290066
2014-04-08 08:17 - 2014-04-11 14:52 - 00000426 _____ () C:\AVScanner.ini
2014-04-06 02:16 - 2011-04-24 18:12 - 00000364 _____ () C:\Windows\Tasks\FileCure Default.job
2014-04-03 22:59 - 2011-04-24 18:03 - 00000314 _____ () C:\Windows\Tasks\Regwork.job
2014-04-03 20:41 - 2014-04-03 20:41 - 00000000 ____D () C:\Users\Chuck\AppData\Local\{0EBF782D-AFC7-4AD6-B68C-7CF6B3FD3D0B}
2014-04-03 20:38 - 2006-11-02 05:47 - 00297288 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-02 12:53 - 2014-04-02 12:53 - 00000000 ____D () C:\Users\Chuck\AppData\Local\_
2014-04-02 09:55 - 2014-03-26 18:02 - 00000000 ____D () C:\ProgramData\Assistant
2014-03-26 15:35 - 2011-03-15 12:36 - 00071528 _____ () C:\Users\Bonnie's\AppData\Local\GDIPFONTCACHEV1.DAT
2014-03-26 13:52 - 2012-02-04 15:01 - 00000000 ____D () C:\Program Files\uTorrent
2014-03-26 13:32 - 2014-03-26 13:32 - 00000000 ____D () C:\Users\Chuck\AppData\Local\{DAE00E5B-CCA9-4216-BC07-578ED9A67C9B}
2014-03-26 13:32 - 2011-11-14 14:56 - 00000000 ___RD () C:\Users\Chuck\Dropbox
2014-03-26 13:32 - 2011-11-14 14:52 - 00000000 ____D () C:\Users\Chuck\AppData\Roaming\Dropbox
2014-03-26 13:28 - 2014-03-26 13:27 - 00000324 _____ () C:\Users\Chuck\AppData\Roaming\aps.uninstall.scan.results
2014-03-26 13:26 - 2014-03-26 13:26 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-03-26 13:26 - 2014-03-26 13:26 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-03-26 13:25 - 2011-03-14 17:54 - 00071528 _____ () C:\Users\Chuck\AppData\Local\GDIPFONTCACHEV1.DAT
2014-03-26 13:22 - 2014-03-26 13:22 - 01172720 _____ (AnyProtect.com) C:\Users\Chuck\AppData\Local\nsz312C.tmp
2014-03-26 13:19 - 2014-01-30 14:38 - 00000258 __RSH () C:\ProgramData\ntuser.pol
2014-03-26 13:18 - 2014-03-26 13:17 - 00407528 _____ () C:\Users\Chuck\Downloads\Setup.exe
2014-03-19 15:28 - 2014-03-19 15:28 - 00000000 ____D () C:\Users\Chuck\AppData\Local\{A72868C1-391E-47E9-B26A-6FF56D09DAFA}
2014-03-18 18:44 - 2006-11-02 03:24 - 87350280 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-03-17 11:27 - 2014-03-17 11:27 - 00000000 ____D () C:\Users\Chuck\AppData\Local\{521B4301-CC2B-49D9-84C0-2C7B1DF8A474}
2014-03-17 10:31 - 2011-10-08 17:48 - 00000000 ____D () C:\Users\Chuck\AppData\Roaming\Skype
2014-03-14 11:48 - 2014-03-13 11:48 - 00000000 ____D () C:\Users\Chuck\AppData\Local\{B6A1A547-FEDA-4306-98AD-9E217644819B}
2014-03-13 11:49 - 2014-03-13 11:49 - 00000000 ____D () C:\Users\Chuck\AppData\Local\Skype
2014-03-13 11:49 - 2014-03-13 11:49 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-03-13 11:49 - 2011-10-08 17:48 - 00000000 ___RD () C:\Program Files\Skype
2014-03-13 11:49 - 2011-10-08 17:48 - 00000000 ____D () C:\ProgramData\Skype
2014-03-13 03:40 - 2006-11-02 04:18 - 00000000 ____D () C:\Windows\rescache
2014-03-13 03:22 - 2011-10-08 10:56 - 00000000 ____D () C:\Program Files\Microsoft Silverlight

Files to move or delete:
====================
C:\ProgramData\dsgsdgdsgdsgw.js
C:\ProgramData\dsgsdgdsgdsgw.pad


Some content of TEMP:
====================
C:\Users\Chuck\AppData\Local\Temp\7.2.20.2-EasyShrx.Dll
C:\Users\Chuck\AppData\Local\Temp\BackupSetup.exe
C:\Users\Chuck\AppData\Local\Temp\GetCC.dll
C:\Users\Chuck\AppData\Local\Temp\installer.exe
C:\Users\Chuck\AppData\Local\Temp\LMIRescue001.exe
C:\Users\Chuck\AppData\Local\Temp\nsi21C0.exe
C:\Users\Chuck\AppData\Local\Temp\nsi2653.exe
C:\Users\Chuck\AppData\Local\Temp\nsiAFC0.exe
C:\Users\Chuck\AppData\Local\Temp\nsiB53D.exe
C:\Users\Chuck\AppData\Local\Temp\nsnA6BA.exe
C:\Users\Chuck\AppData\Local\Temp\nsx2A59.exe
C:\Users\Chuck\AppData\Local\Temp\Quarantine.exe
C:\Users\Chuck\AppData\Local\Temp\SendMsg.dll
C:\Users\Chuck\AppData\Local\Temp\shelper.exe
C:\Users\Chuck\AppData\Local\Temp\sp-downloader.exe
C:\Users\Chuck\AppData\Local\Temp\SPSetup.exe
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite12957.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite14341.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite18880.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite19585.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite19889.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite21361.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite21918.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite26028.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite27570.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite28369.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite31150.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite32526.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite34701.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite34938.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite37316.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite37803.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite40645.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite41206.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite41472.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite41489.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite44128.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite47126.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite50735.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite55717.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite56394.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite58691.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite60038.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite61040.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite62299.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite64703.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite70684.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite70860.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite73565.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite73846.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite74975.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite75909.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite78027.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite79074.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite82407.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite82477.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite87181.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite88571.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite89107.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite89240.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite89859.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite90972.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite91635.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite95908.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite98144.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite98917.dll
C:\Users\Chuck\AppData\Local\Temp\System.Data.SQLite99494.dll
C:\Users\Chuck\AppData\Local\Temp\Update.exe
C:\Users\Chuck\AppData\Local\Temp\utt306.tmp.exe
C:\Users\Chuck\AppData\Local\Temp\utt4DEE.tmp.exe
C:\Users\Chuck\AppData\Local\Temp\vbmz6.exe
C:\Users\Chuck\AppData\Local\Temp\vcredist_x86.exe
C:\Users\Chuck\AppData\Local\Temp\winzipdusetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-11 15:17

==================== End Of Log ============================



BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 38,770 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:11:26 PM

Posted 16 April 2014 - 01:38 PM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below.
 
start

HKLM\...\Run: [BrowserSafeguard] - "C:\Program Files\Browsersafeguard\BrowserSafeguard.exe"
HKLM\...\runonceex: [] - [X]
HKU\.DEFAULT\...\Run: [] - [X]
AppInit_DLLs: c:\progra~2\assist~1\assist~1.dll => C:\ProgramData\Assistant\Assistant.dll [4223488 2014-04-02] ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
URLSearchHook: HKLM - (No Name) - {f897eb0e-a3a4-46c3-80eb-2729699d8892} -  No File
SearchScopes: HKLM - DefaultScope value is missing.
BHO: ALOT Toolbar Helper - {14CEEAFF-96DD-4101-AE37-D5ECDC23C3F6} - C:\Program Files\alot\bin\BHO\alotBHO.dll (Vertro)
BHO: graeatsuAAvear - {47174B66-6816-7134-0A0C-5A22104DA150} - C:\Program Files\graeatsuAAvear\JuD7.dll No File
BHO: Facetheme - {70C6E9DE-F30E-4A40-8A6F-9572C2328320} - C:\Program Files\Object\bho_project.dll No File
BHO: YoutubeAdblocker - {9CD8B219-994D-3ADB-B7CF-8D01C7078C71} - C:\Program Files\YoutubeAdblocker\0RQ.dll No File
BHO: SeaoRcch-NewTaub - {B9C4FE85-7FD0-B9B6-4613-CC277F5030B5} - C:\Program Files\SeaoRcch-NewTaub\hZaR9RVU4.dll No File
BHO: FunDeals - {BB33C4C1-6AD0-6D38-D9D8-AD9C6FA1785A} - C:\ProgramData\FunDeals\VbgsrW.dll No File
BHO: TakeTheoCCoupon - {CCEDECF1-E1EC-01BD-6AA0-636D12976758} - C:\ProgramData\TakeTheoCCoupon\rj9mj.dll No File
BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO: No Name - {f897eb0e-a3a4-46c3-80eb-2729699d8892} -  No File
Toolbar: HKCU - No Name - {F897EB0E-A3A4-46C3-80EB-2729699D8892} -  No File
FF HKCU\...\Firefox\Extensions: [{10ea107a-1e21-48af-be43-9e461589fa89}] - C:\Program Files\Re-markit-soft\157.xpi
FF Extension: Re-markit - C:\Program Files\Re-markit-soft\157.xpi [2014-03-26]
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\32.0.1700.102\gcswf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.260.3) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java Platform SE 6 U26) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (UtubeAddReeMMoval) - C:\Users\Chuck\AppData\Local\Google\Chrome\User Data\Default\Extensions\eleajjoegibhaplailphimdbgoalmafl [2014-02-18]
CHR Extension: (MediaPlayerplus) - C:\Users\Chuck\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd [2014-03-26]
CHR Extension: (YYTBookkMuark) - C:\Users\Chuck\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfdbkbdbcbfnabllhieempfijkaoidlh [2014-01-21]
S2 699fd52f; C:\ProgramData\Assistant\AssistantSvc.dll [177488 2014-04-02] ()
C:\Users\Chuck\AppData\Local\Temp\7.2.20.2-EasyShrx.Dll
C:\Users\Chuck\AppData\Local\Temp\BackupSetup.exe
C:\Users\Chuck\AppData\Local\Temp\GetCC.dll
C:\Users\Chuck\AppData\Local\Temp\installer.exe
C:\Users\Chuck\AppData\Local\Temp\LMIRescue001.exe
C:\Users\Chuck\AppData\Local\Temp\nsi21C0.exe
C:\Users\Chuck\AppData\Local\Temp\nsi2653.exe
C:\Users\Chuck\AppData\Local\Temp\nsiAFC0.exe
C:\Users\Chuck\AppData\Local\Temp\nsiB53D.exe
C:\Users\Chuck\AppData\Local\Temp\nsnA6BA.exe
C:\Users\Chuck\AppData\Local\Temp\nsx2A59.exe
C:\Users\Chuck\AppData\Local\Temp\SendMsg.dll
C:\Users\Chuck\AppData\Local\Temp\shelper.exe
C:\Users\Chuck\AppData\Local\Temp\sp-downloader.exe
C:\Users\Chuck\AppData\Local\Temp\SPSetup.exe
C:\Users\Chuck\AppData\Local\Temp\Update.exe
C:\Users\Chuck\AppData\Local\Temp\utt306.tmp.exe
C:\Users\Chuck\AppData\Local\Temp\utt4DEE.tmp.exe
C:\Users\Chuck\AppData\Local\Temp\vbmz6.exe
C:\Users\Chuck\AppData\Local\Temp\vcredist_x86.exe
C:\Users\Chuck\AppData\Local\Temp\winzipdusetup.exe

end

Save the files as fixlist.txt in to the same folder as FRST
Run FRST and click Fix only once and wait
The tool will create a log (Fixlog.txt) please post it to your reply.

====

Download Malwarebytes' Anti-Malware from Here

Double-click mbam-setup-2.X.X.XXXX.exe to install the application (X's are the current version number).
  • Make sure a checkmark is placed next to Launch Malwarebytes' Anti-Malware, then click Finish.
  • Once MBAM opens, when it says Your databases are out of date, click the Fix Now button.
  • Click the Settings tab at the top, and then in the left column, select Detections and Protections, and if not already checked place a checkmark in the selection box for Scan for rootkits.
  • Click the Scan tab at the top of the program window, select Threat Scan and click the Scan Now button.
  • If you receive a message that updates are available, click the Update Now button (the update will be downloaded, installed, and the scan will start).
  • The scan may take some time to finish,so please be patient.
  • If potential threats are detected, ensure that Quarantine is selected as the Action for all the listed items, and click the Apply Actions button.
  • While still on the Scan tab, click the link for View detailed log, and in the window that opens click the Export button, select Text file (*.txt), and save the log to your Desktop.
  • The log is automatically saved by MBAM and can also be viewed by clicking the History tab and then selecting Application Logs.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

===

Please download AdwCleaner by Xplode onto your Desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Click the Report button and the report will open in Notepad.
IMPORTANT
  • If you click the Clean button all items listed in the report will be removed.
If you find some false positive items or programs that you wish to keep, Close the AdwCleaner windows.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Check off the element(s) you wish to keep.
  • Click on the Clean button follow the prompts.
  • A log file will automatically open after the scan has finished.
  • Please post the content of that log file with your next answer.
  • You can find the log file at C:\AdwCleaner[Sn].txt (n is a number).
===

Please paste the logs in your next reply DO NOT ATTACH THEM unless specified.

Let me know what problem persists.

#3 nasdaq

nasdaq

  • Malware Response Team
  • 38,770 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:11:26 PM

Posted 23 April 2014 - 08:06 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users