Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Computer wiped of all user info, Scans not running fully.


  • This topic is locked This topic is locked
6 replies to this topic

#1 Ayomi

Ayomi

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:16 AM

Posted 02 May 2014 - 10:00 AM

Yesterday my Mothers Window 7 computer was turned on and all her information had gone. My Documents/Pictures etc, show as empty folders.

The night before the she had gone to Thunderbird to send an email and the program had 'lost' her account and asked her to create an account as if she was a new user.

She had left that and went on the internet. When she next went back to the desktop most of the icons had disappeared. She turned the computer off and left it to the next day when all personal information seems to have been deleted.

 

A friend ran Malwarebytes Anti-Malware software that found some 'problems' - I don't know what they were. They then apparantly tried some other anti-malware that wouldn't run. I don't think either of these were done in safe mode.

 

I collected the computer and started following your instructions. In safe mode I tried running DDS. The 'settings' screen appeared, after pressing 'start' the information screen appeared then disappeared and no pop-up appears.

Please could someone help -  my mother is 88 has no back-ups and uses the computer for everything!

 

 



BC AdBot (Login to Remove)

 


#2 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,929 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:09:16 PM

Posted 02 May 2014 - 12:40 PM


Hi and :welcome:
 
Lets give it a try.
 
Please download Farbar Recovery Scan Tool and save it to your desktop.
 
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Make sure that under Optional Scans, there is a checkmark on Addition.txt and Shortcut.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another two logs (Addition.txt and Shortcut.txt). Please attach these to your reply.
 
 

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#3 Ayomi

Ayomi
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:16 AM

Posted 02 May 2014 - 01:02 PM

Thank you for responding, here's the requested:
 
 
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-05-2014
Ran by theodora (administrator) on THEODORA-PC on 02-05-2014 18:50:47
Running from E:\May 2014 Virus Fix
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal
 
The only official download link for FRST:
Download link from any site other than Bleeping Computer is unpermitted or outdated.
 
==================== Processes (Whitelisted) =================
 
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(Trusteer Ltd.) C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe
(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Apple Computer, Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler64.exe
(Trusteer Ltd.) C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\ToolbarUpdater.exe
(Check Point Software Technologies, Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe
() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\loggingserver.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
 
 
==================== Registry (Whitelisted) ==================
 
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11905128 2011-06-28] (Realtek Semiconductor)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2779024 2011-03-15] (CANON INC.)
HKLM-x32\...\Run: [PivotSoftware] => C:\Program Files (x86)\Portrait Displays\Pivot Software\wpctrl.exe [694008 2007-02-09] ()
HKLM-x32\...\Run: [DT ACR] => C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DT_startup.exe [121456 2011-05-26] (Portrait Displays, Inc.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [ZoneAlarm] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [73832 2013-10-26] (Check Point Software Technologies LTD)
HKLM-x32\...\Run: [OpwareSE2] => C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\OpwareSE2.exe [49152 2003-05-08] (ScanSoft, Inc.)
HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG Secure Search\vprot.exe [2557976 2014-04-27] ()
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5180432 2014-04-06] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [TkBellExe] => C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [295512 2013-09-06] (RealNetworks, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\599\G2AWinLogon_x64.dll (Citrix Online, a division of Citrix Systems, Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
 
==================== Internet (Whitelisted) ====================
 
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.co.uk/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x763069712165CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-GB
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -  No File
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Zonealarm Helper Object - {2A841F7A-A014-4DA5-B6D9-8B913DFB7A8C} - C:\Program Files (x86)\Check Point Software Technologies LTD\zonealarm\1.8.22.0\bh\zonealarm.dll (Check Point Software Technologies LTD)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -  No File
BHO-x32: ZoneAlarm Do Not Track Me - {6E45F3E8-2683-4824-A6BE-08108022FB36} - C:\Program Files (x86)\Check Point Software Technologies LTD\zonealarm\AbineSDK\IE\DNTPAddon.dll (Abine Inc)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\18.1.0.443\AVG Secure Search_toolbar.dll (AVG Secure Search)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\18.1.0.443\AVG Secure Search_toolbar.dll (AVG Secure Search)
Toolbar: HKLM-x32 - ZoneAlarm Security Toolbar - {438FAE3E-BDEF-44D3-AB8B-0C7C8350DF59} - C:\Program Files (x86)\Check Point Software Technologies LTD\zonealarm\1.8.22.0\zonealarmTlbr.dll (Check Point Software Technologies LTD)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
DPF: HKLM {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -  No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -  No File
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.0\ViProtocol.dll (AVG Secure Search)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
 
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.0\\npsitesafety.dll No File
FF Plugin-x32: @checkpoint.com/FFApi - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll No File
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-04-11]
FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF HKLM-x32\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG Secure Search\FireFoxExt\15.5.0.2
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-09-06]
FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ []
FF HKLM-x32\...\Thunderbird\Extensions: [avgthb@avg.com] - C:\Program Files (x86)\AVG\AVG2012\Thunderbird\
FF Extension: AVG E-mail Scanner - C:\Program Files (x86)\AVG\AVG2012\Thunderbird\ []
 
==================== Services (Whitelisted) =================
 
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3645456 2014-04-18] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [291912 2014-03-27] (AVG Technologies CZ, s.r.o.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1764992 2014-04-11] (Microsoft Corporation)
R2 DTSRVC; C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe [129648 2011-05-26] (Portrait Displays, Inc.)
S3 Macromedia Licensing Service; C:\Program Files (x86)\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe [68096 2012-01-25] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.)
R2 RapportMgmtService; C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [1444120 2014-02-10] (Trusteer Ltd.)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2445816 2013-10-26] (Check Point Software Technologies LTD)
R2 vToolbarUpdater18.1.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\ToolbarUpdater.exe [1801240 2014-04-27] (AVG Secure Search)
R2 ZAPrivacyService; C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe [50704 2013-10-15] (Check Point Software Technologies, Ltd.)
 
==================== Drivers (Whitelisted) ====================
 
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-03-27] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [237336 2014-04-18] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [192792 2014-03-27] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [236824 2014-03-27] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [324376 2014-03-27] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [130840 2014-03-31] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [32536 2014-03-27] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [274200 2014-03-31] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50464 2014-04-27] (AVG Technologies)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-02] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
R3 PdiPorts; C:\Windows\System32\DRIVERS\PdiPorts.sys [20592 2011-05-05] (Portrait Displays, Inc.)
R1 RapportCerberus_59849; C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_59849.sys [606672 2014-01-31] ()
R1 RapportEI64; C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [282712 2014-02-10] (Trusteer Ltd.)
R1 RapportPG64; C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [397848 2014-02-10] (Trusteer Ltd.)
R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [454168 2013-10-23] (Check Point Software Technologies LTD)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
 
==================== One Month Created Files and Folders ========
 
2014-05-02 18:49 - 2014-05-02 18:50 - 00000000 ____D () C:\FRST
2014-05-02 15:26 - 2014-05-02 15:21 - 00688992 _____ (Swearware) C:\Windows\system32\config\systemprofile\Desktop\dds.com
2014-05-02 13:55 - 2014-05-02 13:55 - 00000000 ____D () C:\Windows\SysWOW64\cache
2014-05-02 12:46 - 2014-05-02 15:00 - 00000702 _____ () C:\Windows\system32\config\systemprofile\Desktop\Rkill.txt
2014-05-02 12:40 - 2014-05-02 12:40 - 00023564 _____ () C:\ComboFix.txt
2014-05-02 12:11 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-02 12:11 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-02 12:11 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-05-02 12:11 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-02 12:11 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-02 12:11 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-05-02 12:11 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-05-02 12:11 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-05-02 12:09 - 2014-05-02 12:40 - 00000000 ____D () C:\Qoobox
2014-05-02 12:09 - 2014-05-02 12:38 - 00000000 ____D () C:\Windows\erdnt
2014-05-02 11:52 - 2014-05-02 11:52 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-05-02 10:23 - 2014-05-02 18:46 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-02 10:23 - 2014-05-02 14:21 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-02 10:23 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-02 10:23 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-02 10:23 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-01 10:19 - 2014-05-01 22:36 - 00000000 ____D () C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft Games
2014-05-01 10:19 - 2014-05-01 10:19 - 00109296 _____ () C:\Windows\system32\config\systemprofile\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-01 09:49 - 2014-05-01 21:21 - 00001425 _____ () C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-05-01 09:49 - 2014-05-01 21:21 - 00000000 ___RD () C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-01 09:49 - 2014-05-01 21:21 - 00000000 ___RD () C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-01 09:49 - 2014-05-01 09:49 - 00002069 _____ () C:\Windows\SysWOW64\debug.log
2014-05-01 09:49 - 2014-05-01 09:49 - 00000000 ____D () C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-05-01 09:49 - 2014-05-01 09:49 - 00000000 ____D () C:\Windows\system32\config\systemprofile\AppData\Roaming\Adobe
2014-04-30 17:48 - 2014-04-30 17:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-04-29 09:03 - 2014-05-02 11:01 - 00003224 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-247221110-2661444636-2198035892-1000
2014-04-28 09:56 - 2014-05-02 11:01 - 00003352 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-247221110-2661444636-2198035892-1000
2014-04-18 16:37 - 2014-04-18 16:37 - 00000000 ____D () C:\Windows\system32\config\systemprofile\AppData\Roaming\McAfee
2014-04-18 16:37 - 2014-04-18 16:37 - 00000000 ____D () C:\Program Files\McAfee Security Scan
2014-04-18 15:01 - 2014-04-18 15:01 - 00237336 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys
2014-04-13 19:47 - 2014-04-29 21:50 - 00003950 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{60D01FA5-8753-4595-BC3B-39AC92131D36}
2014-04-09 19:03 - 2014-03-31 02:16 - 23134208 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-09 19:03 - 2014-03-31 02:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-09 19:03 - 2014-03-31 01:13 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-09 19:03 - 2014-03-31 00:57 - 17073152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-09 19:03 - 2014-03-04 10:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 19:03 - 2014-03-04 10:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 19:03 - 2014-03-04 10:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 19:03 - 2014-03-04 10:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 19:03 - 2014-03-04 10:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 19:03 - 2014-03-04 10:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 19:03 - 2014-03-04 10:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 19:03 - 2014-03-04 10:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 19:03 - 2014-03-04 10:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 19:03 - 2014-03-04 09:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 19:03 - 2014-03-04 09:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 19:03 - 2014-02-04 03:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 19:03 - 2014-02-04 03:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 19:03 - 2014-02-04 03:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 19:03 - 2014-02-04 03:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 19:03 - 2014-02-04 03:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 19:03 - 2014-01-24 03:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
 
==================== One Month Modified Files and Folders =======
 
2014-05-02 18:50 - 2014-05-02 18:49 - 00000000 ____D () C:\FRST
2014-05-02 18:49 - 2009-07-14 06:13 - 00786598 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-02 18:47 - 2012-04-09 10:55 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-02 18:47 - 2012-01-06 22:23 - 01453335 _____ () C:\Windows\WindowsUpdate.log
2014-05-02 18:46 - 2014-05-02 10:23 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-02 18:45 - 2012-01-13 11:56 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-02 18:45 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-02 18:45 - 2009-07-14 05:51 - 00093902 _____ () C:\Windows\setupact.log
2014-05-02 18:12 - 2012-01-13 11:56 - 00000902 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-02 15:21 - 2014-05-02 15:26 - 00688992 _____ (Swearware) C:\Windows\system32\config\systemprofile\Desktop\dds.com
2014-05-02 15:00 - 2014-05-02 12:46 - 00000702 _____ () C:\Windows\system32\config\systemprofile\Desktop\Rkill.txt
2014-05-02 14:21 - 2014-05-02 10:23 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-02 14:02 - 2009-07-14 05:45 - 00022064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-02 14:02 - 2009-07-14 05:45 - 00022064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-02 13:55 - 2014-05-02 13:55 - 00000000 ____D () C:\Windows\SysWOW64\cache
2014-05-02 13:54 - 2010-11-21 04:47 - 00156980 _____ () C:\Windows\PFRO.log
2014-05-02 12:40 - 2014-05-02 12:40 - 00023564 _____ () C:\ComboFix.txt
2014-05-02 12:40 - 2014-05-02 12:09 - 00000000 ____D () C:\Qoobox
2014-05-02 12:38 - 2014-05-02 12:09 - 00000000 ____D () C:\Windows\erdnt
2014-05-02 12:36 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-05-02 12:08 - 2013-11-16 13:55 - 00003374 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-247221110-2661444636-2198035892-1000
2014-05-02 12:08 - 2013-11-16 13:55 - 00003246 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-247221110-2661444636-2198035892-1000
2014-05-02 11:52 - 2014-05-02 11:52 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-05-02 11:01 - 2014-04-29 09:03 - 00003224 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-247221110-2661444636-2198035892-1000
2014-05-02 11:01 - 2014-04-28 09:56 - 00003352 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-247221110-2661444636-2198035892-1000
2014-05-02 10:55 - 2009-07-14 04:20 - 00000000 __RSD () C:\Windows\Media
2014-05-01 22:36 - 2014-05-01 10:19 - 00000000 ____D () C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft Games
2014-05-01 21:21 - 2014-05-01 09:49 - 00001425 _____ () C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-05-01 21:21 - 2014-05-01 09:49 - 00000000 ___RD () C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-01 21:21 - 2014-05-01 09:49 - 00000000 ___RD () C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-01 10:36 - 2012-01-12 20:05 - 00000000 ____D () C:\Program Files (x86)\Microsoft Money 2005
2014-05-01 10:19 - 2014-05-01 10:19 - 00109296 _____ () C:\Windows\system32\config\systemprofile\AppData\Local\GDIPFONTCACHEV1.DAT
2014-05-01 09:50 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-05-01 09:49 - 2014-05-01 09:49 - 00002069 _____ () C:\Windows\SysWOW64\debug.log
2014-05-01 09:49 - 2014-05-01 09:49 - 00000000 ____D () C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-05-01 09:49 - 2014-05-01 09:49 - 00000000 ____D () C:\Windows\system32\config\systemprofile\AppData\Roaming\Adobe
2014-05-01 09:49 - 2012-10-24 21:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-30 17:48 - 2014-04-30 17:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-04-30 13:04 - 2012-01-12 23:01 - 00000000 ____D () C:\Windows\System32\Tasks\Games
2014-04-29 21:50 - 2014-04-13 19:47 - 00003950 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{60D01FA5-8753-4595-BC3B-39AC92131D36}
2014-04-29 09:20 - 2012-01-06 22:19 - 70434816 _____ () C:\Windows\system32\config\RegBack\SOFTWARE
2014-04-29 09:20 - 2012-01-06 22:19 - 18120704 _____ () C:\Windows\system32\config\RegBack\SYSTEM
2014-04-29 09:20 - 2012-01-06 22:19 - 00184320 _____ () C:\Windows\system32\config\RegBack\DEFAULT
2014-04-29 09:20 - 2012-01-06 22:19 - 00061440 _____ () C:\Windows\system32\config\RegBack\SAM
2014-04-29 09:20 - 2012-01-06 22:19 - 00024576 _____ () C:\Windows\system32\config\RegBack\SECURITY
2014-04-28 19:47 - 2012-04-09 10:55 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-04-28 19:47 - 2012-04-09 10:55 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-04-28 19:47 - 2012-01-13 11:56 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-04-27 20:07 - 2013-09-25 18:57 - 00000000 ____D () C:\Program Files (x86)\AVG Secure Search
2014-04-27 20:06 - 2012-08-30 19:40 - 00050464 _____ (AVG Technologies) C:\Windows\system32\Drivers\avgtpx64.sys
2014-04-18 16:37 - 2014-04-18 16:37 - 00000000 ____D () C:\Windows\system32\config\systemprofile\AppData\Roaming\McAfee
2014-04-18 16:37 - 2014-04-18 16:37 - 00000000 ____D () C:\Program Files\McAfee Security Scan
2014-04-18 15:01 - 2014-04-18 15:01 - 00237336 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys
2014-04-17 19:08 - 2013-02-22 10:28 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-04-10 09:29 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-04-09 22:44 - 2013-08-14 21:17 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-09 22:43 - 2012-01-20 11:49 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-03 09:51 - 2014-05-02 10:23 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-05-02 10:23 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-05-02 10:23 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
 
==================== Bamital & volsnap Check =================
 
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 
LastRegBack: 2014-04-29 09:20
 
==================== End Of Log ============================
 
 

Attached Files



#4 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,929 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:09:16 PM

Posted 02 May 2014 - 02:03 PM

First lets remove some tasks that appear malicious.

 

Download the enclosed file. 

 

Save it in the same location FRST is saved.

 

Launch FRST and click on the Fix button.

 

The tool will make a log in the same location FRST is saved (Fixlog.txt), Please post it to your reply.
 
=================================================
 

Seems that the main issue is a corrupted profile.
 

Error: (05/02/2014 06:45:33 PM) (Source: Microsoft-Windows-User Profiles Service) (User: theodora-PC)
Description: Windows cannot load the user's profile but has logged you on with the default profile for the system.

 

The safest way to fix a user profile is creating a new account and transfer all files from the old profile into the new one. Your user profile is a collection of settings that make the computer look and work the way you want it to. It contains your settings for desktop backgrounds, screen savers, pointer preferences, sound settings, and other features. User profiles ensure that your personal preferences are used whenever you log on to Windows. If you tried to log on to Windows and received an error message telling you that your user profile might be corrupted, you can try to repair it. You will need to create a new profile, and then copy the files from the existing profile to the new one.
 
To create a new user profile

To create a new user profile, you must first create a new user account. When the account is created, a profile is also created.

Activate the Administrator Account:
 
Cick on the Orb (Start), type CMD and press CTRL+SHIFT+ENTER simultaneously. At the prompt type the following and press Enter:
 
net user administrator /active:yes
 
Restart the computer and logon into the Administrator account.

  • Open User Accounts by clicking the Start button 4f6cbd09-148c-4dd8-b1f2-48f232a2fd33_818, clicking Control Panel, clicking User Accounts and Family Safety, and then clicking User Accounts.
  • Click Manage another account18abb370-ac1e-4b6b-b663-e028a75bf05b_48. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
  • Click Create a new account.
  • Type the name you want to give the user account, click an account type (Assign to this account Administrator rights), and then click Create Account.
  • Restart the PC.

To copy files to the new user profile

After you create the profile, you can copy the files from the existing profile. You must have at least three user accounts on the computer to complete these steps, including the new account you just created.

  1. Log on as a user other than the new user you just created or the user that you want to copy files from.

  2. Open the My Documents folder by clicking the Start button 4f6cbd09-148c-4dd8-b1f2-48f232a2fd33_818, and then clicking Computer. Double-click the hard disk drive that Windows is installed on (it's usually your C: drive), double-click Users, double-click the folder with the name of your account, and then double-click My Documents.

  3. Click the Tools menu, and then click Folder Options.

    If you don't see the Tools menu, press Alt.

  4. Click the View tab, and then click Show hidden files, folders, and drives.

  5. Clear the Hide protected operating system files check box, click Yes to confirm, and then click OK.

  6. Locate the C:\Users\Old_Username folder, where C is the drive that Windows is installed on, and Old_Username is the name of the profile you want to copy files from.

  7. Select all of the files and folders in this folder, except the following files:

    • Ntuser.dat

    • Ntuser.dat.log

    • Ntuser.ini

  8. Click the Edit menu, and then click Copy.

    If you don't see the Edit menu, press Alt.

  9. Locate the C:\Users\New_Username folder, where C is the drive that Windows is installed on, and New_Username is the name of the new user profile you created.

  10. Click the Edit menu, and then click Paste.

    If you don't see the Edit menu, press Alt.

  11. Log off, and then log back on as the new user.

    If you have e‑mail messages in an e‑mail program, you must import your e‑mail messages and addresses to the new user profile before you delete the old profile. If everything is working properly, you can delete the old profile.

  12. To de-activate the Administrator account, at an Administrator Command prompt type net user administrator /active:no and press Enter, then restart the computer.

 


Edited by JSntgRvr, 02 May 2014 - 02:04 PM.

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#5 Ayomi

Ayomi
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:16 AM

Posted 02 May 2014 - 05:55 PM

Fixlog.txt result is posted below.

 

Followed user profile steps right up to the final No 10 step. When I 'paste' a 'Folder Access Denied' window pops up saying '..permission from administrator to make changes...'

Logged in as user with admin rights and 'new user' has admin rights too. So can't see what the problem would be?

Only confusion was that there are 7 'ntuser' files:

NTUSER.DAT

ntuser.dat.LOG1

ntuser.dat.LOG2

NTUSER.DAT{016888bd-...........(BLF File)

NTUSER.DAT{016888bd-...........(REGTRANS-MS File)

NTUSER.DAT{016888bd-...........(REGTRANS-MS File)

ntuser     (Configuration settings)

 

I did not copy or paste any of these files - should I have included some?

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-05-2014
Ran by theodora at 2014-05-02 22:55:36 Run:1
Running from E:\May 2014 Virus Fix
Boot Mode: Normal
==============================================
 
Content of fixlist:
*****************
Start
Task: {1961D655-7527-44D2-BEC3-C93B24563544} - System32\Tasks\0 => Iexplore.exe  <==== ATTENTION
Task: {578C229F-C174-4209-8368-3DF2ACC84783} - System32\Tasks\5035 => Wscript.exe C:\Users\theodora\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {9714DEE4-74D1-4AE2-8F83-A7AA86AC522C} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-247221110-2661444636-2198035892-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2013-08-14] (RealNetworks, Inc.)
Task: {AA3914F9-FFD6-47DB-B6D0-D01A109A4B29} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-247221110-2661444636-2198035892-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {D4B873C4-9CEB-475C-A693-DC286FCCB0E3} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-247221110-2661444636-2198035892-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {D5FD8C82-3B5B-454E-9534-1D3FE7375175} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-247221110-2661444636-2198035892-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {E6D769D3-86D8-455F-AA22-435FC0A5C9B8} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-247221110-2661444636-2198035892-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
End
*****************
 
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1961D655-7527-44D2-BEC3-C93B24563544} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1961D655-7527-44D2-BEC3-C93B24563544} => Key deleted successfully.
C:\Windows\System32\Tasks\0 => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\0 => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{578C229F-C174-4209-8368-3DF2ACC84783} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{578C229F-C174-4209-8368-3DF2ACC84783} => Key deleted successfully.
C:\Windows\System32\Tasks\5035 => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\5035 => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9714DEE4-74D1-4AE2-8F83-A7AA86AC522C} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9714DEE4-74D1-4AE2-8F83-A7AA86AC522C} => Key deleted successfully.
C:\Windows\System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-247221110-2661444636-2198035892-1000 => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RealDownloaderDownloaderScheduledTaskS-1-5-21-247221110-2661444636-2198035892-1000 => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{AA3914F9-FFD6-47DB-B6D0-D01A109A4B29} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AA3914F9-FFD6-47DB-B6D0-D01A109A4B29} => Key deleted successfully.
C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-247221110-2661444636-2198035892-1000 => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RealDownloaderRealUpgradeLogonTaskS-1-5-21-247221110-2661444636-2198035892-1000 => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D4B873C4-9CEB-475C-A693-DC286FCCB0E3} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D4B873C4-9CEB-475C-A693-DC286FCCB0E3} => Key deleted successfully.
C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-247221110-2661444636-2198035892-1000 => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-247221110-2661444636-2198035892-1000 => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{D5FD8C82-3B5B-454E-9534-1D3FE7375175} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D5FD8C82-3B5B-454E-9534-1D3FE7375175} => Key deleted successfully.
C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-247221110-2661444636-2198035892-1000 => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RealPlayerRealUpgradeLogonTaskS-1-5-21-247221110-2661444636-2198035892-1000 => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E6D769D3-86D8-455F-AA22-435FC0A5C9B8} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E6D769D3-86D8-455F-AA22-435FC0A5C9B8} => Key deleted successfully.
C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-247221110-2661444636-2198035892-1000 => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\RealPlayerRealUpgradeScheduledTaskS-1-5-21-247221110-2661444636-2198035892-1000 => Key deleted successfully.
 
==== End of Fixlog ====


#6 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,929 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:09:16 PM

Posted 02 May 2014 - 07:38 PM

It may be due to permisions.
 
You should logon as the new profile, then take ownership of the folder on the old profile you need to copy the files from.
 

To take ownership of a file or folder

  • Open Windows Explorer, and then locate the file or folder you want to take ownership of.
  • Right-click the file or folder, click Properties, and then click the Security tab.
  • Click Advanced, and then click the Owner tab.
  • Click Edit, and then do one of the following:
    • To change the owner to a user or group that is not listed, click Other users and groups and, in Enter the object name to select (examples), type the name of the user or group, and then click OK
    • If the new profile is listed, click on it and take full permissions. 
    • To change the owner to a user or group that is listed, in the Change owner to box, click the new owner. 
       
  • (Optional) To change the owner of all subcontainers and objects within the tree, select the Replace owner on subcontainers and objects check box.

Do not copy those files:
 

NTUSER.DAT
ntuser.dat.LOG1
ntuser.dat.LOG2
NTUSER.DAT{016888bd-...........(BLF File)
NTUSER.DAT{016888bd-...........(REGTRANS-MS File)
NTUSER.DAT{016888bd-...........(REGTRANS-MS File)
ntuser (Configuration settings)

 

 


No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif


#7 JSntgRvr

JSntgRvr

    Master Surgeon General


  • Malware Response Team
  • 11,929 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto Rico
  • Local time:09:16 PM

Posted 03 June 2014 - 07:20 PM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.

No request for help throughout private messaging will be attended.

If I have helped you, consider making a donation to help me continue the fight against Malware!
btn_donate_SM.gif





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users