Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

infected users 32 dll and boo/cidox.b and acorIEHELper


  • This topic is locked This topic is locked
32 replies to this topic

#1 carmella04

carmella04

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:01:16 PM

Posted 18 May 2014 - 02:04 AM

Avira detects this virus everytime . What to do. Help :unsure:
 
 
14:22:33.0904 0x0d3c  TDSS rootkit removing tool 3.0.0.34 Apr 29 2014 18:20:10
14:22:40.0121 0x0d3c  ============================================================
14:22:40.0121 0x0d3c  Current date / time: 2014/05/18 14:22:40.0121
14:22:40.0121 0x0d3c  SystemInfo:
14:22:40.0121 0x0d3c  
14:22:40.0121 0x0d3c  OS Version: 6.1.7601 ServicePack: 1.0
14:22:40.0121 0x0d3c  Product type: Workstation
14:22:40.0121 0x0d3c  ComputerName: LAPTOP
14:22:40.0122 0x0d3c  UserName: almonte
14:22:40.0122 0x0d3c  Windows directory: C:\Windows
14:22:40.0122 0x0d3c  System windows directory: C:\Windows
14:22:40.0122 0x0d3c  Running under WOW64
14:22:40.0122 0x0d3c  Processor architecture: Intel x64
14:22:40.0122 0x0d3c  Number of processors: 2
14:22:40.0122 0x0d3c  Page size: 0x1000
14:22:40.0122 0x0d3c  Boot type: Normal boot
14:22:40.0122 0x0d3c  ============================================================
14:22:45.0822 0x0d3c  KLMD registered as C:\Windows\system32\drivers\46206099.sys
14:22:46.0101 0x0d3c  System UUID: {F4B2FACD-97CF-2388-699A-227F53EFA11F}
14:22:46.0993 0x0d3c  Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
14:22:46.0998 0x0d3c  ============================================================
14:22:46.0998 0x0d3c  \Device\Harddisk0\DR0:
14:22:46.0998 0x0d3c  MBR partitions:
14:22:46.0998 0x0d3c  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
14:22:46.0999 0x0d3c  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x135C4000
14:22:47.0014 0x0d3c  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x135F7000, BlocksNum 0x11E37000
14:22:47.0014 0x0d3c  ============================================================
14:22:47.0055 0x0d3c  C: <-> \Device\Harddisk0\DR0\Partition2
14:22:47.0260 0x0d3c  D: <-> \Device\Harddisk0\DR0\Partition3
14:22:47.0260 0x0d3c  ============================================================
14:22:47.0261 0x0d3c  Initialize success
14:22:47.0261 0x0d3c  ============================================================
14:26:42.0879 0x0f78  KLMD registered as C:\Windows\system32\drivers\84685366.sys
14:26:44.0110 0x0f78  Deinitialize success

Edited by carmella04, 18 May 2014 - 02:47 AM.


BC AdBot (Login to Remove)

 


#2 carmella04

carmella04
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:01:16 PM

Posted 18 May 2014 - 02:32 AM

browser always unresponsive cant update



#3 carmella04

carmella04
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:01:16 PM

Posted 18 May 2014 - 02:36 AM

log report #2

http://pastebin.com/pmRX2rXb


log#3

http://pastebin.com/WL6DNxNV



#4 carmella04

carmella04
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:01:16 PM

Posted 18 May 2014 - 02:45 AM

avira detects

AcorIEHelper.dll        detection  : TR/Crypt.Xpack.66455

users32.DLL             detection : HEUR/Modified.Systemfile



#5 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:01:16 AM

Posted 18 May 2014 - 05:59 AM





Hello carmella04

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

  • Please do not run any tools unless instructed to do so.
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
  • Please do not attach logs or use code boxes, just copy and paste the text.
    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
  • Please read every post completely before doing anything.
    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
  • Please provide feedback about your experience as we go.
    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.
NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

I would like you to run this program for me.

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#6 carmella04

carmella04
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:01:16 PM

Posted 18 May 2014 - 07:38 AM

ok

sir , i have 2 disk drives can i just move it to another drive?



#7 carmella04

carmella04
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:01:16 PM

Posted 18 May 2014 - 07:41 AM

now, the computer is running but programs always not responding specially in google chrome . Then my avira every now and then detects the virus when i click remove after it scan the message will pop out all over again . 

it detects this two frequently

avira detects

AcorIEHelper.dll        detection  : TR/Crypt.Xpack.66455

users32.DLL             detection : HEUR/Modified.Systemfile

 

ive downloaded the Farbar



#8 carmella04

carmella04
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:01:16 PM

Posted 18 May 2014 - 07:46 AM

*FRST.LOG

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014
Ran by almonte (administrator) on LAPTOP on 18-05-2014 20:43:01
Running from C:\Users\almonte\Downloads
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Normal
 
The only official download link for FRST:
Download link from any site other than Bleeping Computer is unpermitted or outdated.
 
==================== Processes (Whitelisted) =================
 
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(BitTorrent Inc.) C:\Users\almonte\AppData\Roaming\uTorrent\uTorrent.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft) C:\Users\almonte\AppData\Roaming\.minecraft\WmiPrv\WmiPrvSE.exe
(BitTorrent Inc.) C:\Users\almonte\AppData\Roaming\uTorrent\uTorrent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
() C:\ProgramData\Globe Tattoo Broadband\OnlineUpdate\ouc.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Twain Working Group) C:\Windows\twunk_32.exe
 
 
==================== Registry (Whitelisted) ==================
 
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-25] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [YouCam Mirage] => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [136488 2010-08-20] (CyberLink)
HKLM-x32\...\Run: [YouCam Tray] => C:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe [162912 2010-08-20] (CyberLink Corp.)
HKLM-x32\...\Run: [NSU_agent] => C:\Program Files (x86)\Nokia\Nokia Software Updater\nsu3ui_agent.exe [190768 2012-02-28] ()
HKU\S-1-5-21-3332921106-3208867521-1591249988-1000\...\Run: [Facebook Update] => C:\Users\almonte\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-10-29] (Facebook Inc.)
HKU\S-1-5-21-3332921106-3208867521-1591249988-1000\...\Run: [uTorrent] => C:\Users\almonte\AppData\Roaming\uTorrent\uTorrent.exe [1270352 2014-04-29] (BitTorrent Inc.)
HKU\S-1-5-21-3332921106-3208867521-1591249988-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20922016 2014-02-10] (Skype Technologies S.A.)
HKU\S-1-5-21-3332921106-3208867521-1591249988-1000\...\Run: [WmiPrv] => C:\Users\almonte\AppData\Roaming\.minecraft\WmiPrv\WmiPrvSE.exe [580608 2014-05-18] (Microsoft)
HKU\S-1-5-21-3332921106-3208867521-1591249988-1000\...\MountPoints2: F - F:\Autoplay.exe
HKU\S-1-5-21-3332921106-3208867521-1591249988-1000\...\MountPoints2: G - G:\Autoplay.exe
HKU\S-1-5-21-3332921106-3208867521-1591249988-1000\...\MountPoints2: H - H:\Autorun.exe
HKU\S-1-5-21-3332921106-3208867521-1591249988-1000\...\MountPoints2: I - I:\Autorun.exe
HKU\S-1-5-21-3332921106-3208867521-1591249988-1000\...\MountPoints2: J - J:\Autorun.exe
HKU\S-1-5-21-3332921106-3208867521-1591249988-1000\...\MountPoints2: K - K:\Autorun.exe
HKU\S-1-5-21-3332921106-3208867521-1591249988-1000\...\MountPoints2: M - M:\Autorun.exe
HKU\S-1-5-21-3332921106-3208867521-1591249988-1000\...\MountPoints2: N - N:\Autorun.exe
HKU\S-1-5-21-3332921106-3208867521-1591249988-1000\...\MountPoints2: O - O:\Autorun.exe
HKU\S-1-5-21-3332921106-3208867521-1591249988-1000\...\MountPoints2: P - P:\Autorun.exe
HKU\S-1-5-21-3332921106-3208867521-1591249988-1000\...\MountPoints2: R - R:\AutoRun.exe
HKU\S-1-5-21-3332921106-3208867521-1591249988-1000\...\MountPoints2: {a5ce1bad-bfb6-11e3-af2d-00235aac5c66} - R:\AutoRun.exe
HKU\S-1-5-21-3332921106-3208867521-1591249988-1000\...\MountPoints2: {a5ce1bba-bfb6-11e3-af2d-00235aac5c66} - R:\AutoRun.exe
HKU\S-1-5-21-3332921106-3208867521-1591249988-1000\...\MountPoints2: {c3683b52-3d1e-11e3-b1d9-00235aac5c66} - F:\NokiaPCIA_Autorun.exe
Startup: C:\Users\almonte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AodbeARMHelper.exe ()
 
==================== Internet (Whitelisted) ====================
 
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ideacts.com/cms/CMSConnect/C3MServeruninstall.aspx?GUID=f9fbdbe1-a984-41c8-8639-25ce55311e23&CafeCode=MAKATI-0749&UNINSTDT=09/17/2013 06:37:22 PM&IsOffLine=1&CountryId=180
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ph.msn.com/?rd=1&ucc=PH&dcc=PH&opt=0&ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xDEA3129D7E99CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = fil
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={sear
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Toolbar: HKCU - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{1115B9EF-2B7B-4517-B5B2-86E7D9150A8E}: [NameServer]10.188.62.1 10.188.191.1
 
FireFox:
========
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\almonte\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\almonte\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
 
Chrome: 
=======
CHR HomePage: file:///C:/Users/almonte/Downloads
CHR StartupUrls: "hxxp://google.com/"
CHR DefaultSearchKeyword: askws
CHR DefaultNewTabURL: 
CHR Extension: (Floorplanner) - C:\Users\almonte\AppData\Local\Google\Chrome\User Data\Default\Extensions\abopacaefhbognnmeigicfpgnmpideag [2014-03-04]
CHR Extension: (avira web protection) - C:\Users\almonte\AppData\Local\Google\Chrome\User Data\Default\Extensions\agomemppmpabchheglekdfpkkappkanl [2013-08-27]
CHR Extension: (FBLayouts & More) - C:\Users\almonte\AppData\Local\Google\Chrome\User Data\Default\Extensions\bahoaobbejcegkepmdohpmbjmadgmdoo [2014-03-04]
CHR Extension: (American Racing 2 3D) - C:\Users\almonte\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfpfdjclhabpjncikdngdoldjjjegnbe [2014-03-04]
CHR Extension: (uTorrentControl_v6) - C:\Users\almonte\AppData\Local\Google\Chrome\User Data\Default\Extensions\cflheckfmhopnialghigdlggahiomebp [2013-08-19]
CHR Extension: (Download FB Album mod) - C:\Users\almonte\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgjnhhjpfcdhbhlcmmjppicjmgfkppok [2014-03-04]
CHR Extension: (Warrior Girl) - C:\Users\almonte\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbngkgeakdhomabndkmfcjijooohmpff [2014-03-04]
CHR Extension: (blackboard) - C:\Users\almonte\AppData\Local\Google\Chrome\User Data\Default\Extensions\doakoidnlldglphcgpdbbgcnamlppemh [2014-03-04]
CHR Extension: (Facebook Layouts & Extras) - C:\Users\almonte\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdeghapgkmmickhpnbgfgkocambmjlgd [2014-03-04]
CHR Extension: (Picadilo) - C:\Users\almonte\AppData\Local\Google\Chrome\User Data\Default\Extensions\geljjpapbfokifgnlnpdbiplebdhlein [2014-03-04]
CHR Extension: (Cut the Rope) - C:\Users\almonte\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfbadlndcminbkfojhlimnkgaackjmdo [2014-03-08]
CHR Extension: (Typing Test - KeyHero) - C:\Users\almonte\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkcieoaeooeidmpaopkpjpjfakidlabm [2014-03-04]
CHR Extension: (Facebook Fast Delete Messages) - C:\Users\almonte\AppData\Local\Google\Chrome\User Data\Default\Extensions\klmpnhheahecaojonebajllddfhpilan [2014-03-04]
CHR Extension: (Graffiti Creator) - C:\Users\almonte\AppData\Local\Google\Chrome\User Data\Default\Extensions\lgmlohhjedlnljheklbjepdfikchfaoe [2014-03-04]
CHR Extension: (Google Wallet) - C:\Users\almonte\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Canvas Life) - C:\Users\almonte\AppData\Local\Google\Chrome\User Data\Default\Extensions\phocfhaegibfmggagffipgngifmjjdno [2014-03-08]
CHR HKCU\...\Chrome\Extension: [agomemppmpabchheglekdfpkkappkanl] - C:\Users\almonte\AppData\Local\CRE\agomemppmpabchheglekdfpkkappkanl.crx [2013-08-21]
CHR HKCU\...\Chrome\Extension: [cflheckfmhopnialghigdlggahiomebp] - C:\Users\almonte\AppData\Local\CRE\cflheckfmhopnialghigdlggahiomebp.crx [2013-07-27]
CHR HKLM-x32\...\Chrome\Extension: [agomemppmpabchheglekdfpkkappkanl] - C:\Users\almonte\AppData\Local\CRE\agomemppmpabchheglekdfpkkappkanl.crx [2013-08-21]
CHR HKLM-x32\...\Chrome\Extension: [cflheckfmhopnialghigdlggahiomebp] - C:\Users\almonte\AppData\Local\CRE\cflheckfmhopnialghigdlggahiomebp.crx [2013-07-27]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2013-08-06]
 
==================== Services (Whitelisted) =================
 
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-25] (Avira Operations GmbH & Co. KG)
S2 Globe Tattoo Broadband. RunOuc; C:\Program Files (x86)\Globe Tattoo Broadband\UpdateDog\ouc.exe [218624 2014-04-09] ()
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [339456 2010-11-16] ()
 
==================== Drivers (Whitelisted) ====================
 
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-12] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-27] (Avira Operations GmbH & Co. KG)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [256000 2014-04-09] (Huawei Technologies Co., Ltd.)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
 
==================== One Month Created Files and Folders ========
 
2014-05-18 20:43 - 2014-05-18 20:43 - 00014122 _____ () C:\Users\almonte\Downloads\FRST.txt
2014-05-18 20:42 - 2014-05-18 20:43 - 00000000 ____D () C:\FRST
2014-05-18 20:37 - 2014-05-18 20:37 - 02067456 _____ (Farbar) C:\Users\almonte\Downloads\FRST64.exe
2014-05-18 17:41 - 2014-05-18 17:41 - 00017889 _____ () C:\Users\almonte\Downloads\Olympus.Has.Fallen.2013.BRRip.480p.x264.AAC.VYTO.1056469.seventorrents.com.torrent
2014-05-18 17:14 - 2014-05-18 17:14 - 00013325 _____ () C:\Users\almonte\Downloads\Heaven.Is.For.Real.2014.HDCAM.x264.Pimp4003.1065921.seventorrents.com.torrent
2014-05-18 14:33 - 2014-05-18 14:33 - 00000000 ____D () C:\TDSSKiller_Quarantine
2014-05-18 14:22 - 2014-05-18 14:22 - 00000000 ____D () C:\Users\almonte\Downloads\Infected with BOO Cidox.B - Can I fix it  - Virus, Trojan, Spyware, and Malware Removal Logs_files
2014-05-18 14:18 - 2014-05-18 14:20 - 04164448 _____ (Kaspersky Lab ZAO) C:\Users\almonte\Downloads\tdsskiller.exe
2014-05-16 22:42 - 2014-05-16 22:43 - 02046003 _____ () C:\Users\almonte\Downloads\Clash_of_Clans_Hack_2014.zip
2014-05-16 18:22 - 2014-05-16 18:40 - 03313664 _____ (Avira GmbH) C:\Users\almonte\Downloads\bootwizard.exe
2014-05-16 18:15 - 2014-05-18 17:09 - 00000672 _____ () C:\Windows\setupact.log
2014-05-16 18:15 - 2014-05-16 18:15 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-15 21:21 - 2014-05-15 21:21 - 00033098 _____ () C:\Users\almonte\Downloads\X-Men Days of Future Past 2014.torrent
2014-05-15 18:49 - 2014-05-15 18:49 - 00000018 _____ () C:\Users\almonte\Desktop\son of god.txt
2014-05-15 17:47 - 2014-05-15 17:47 - 00016769 _____ () C:\Users\almonte\Downloads\X-Men_Days_of_Future_Past_(2014).torrent.torrent
2014-05-12 19:46 - 2014-05-12 19:47 - 00000000 ____D () C:\Users\almonte\Desktop\Son.Of.God.2014.WEBRip.480p.x264.AAC-VYTO
2014-05-08 19:22 - 2014-05-08 19:22 - 00042919 _____ () C:\Users\almonte\Downloads\I.Am.Soldier.2014.BDRip.x264.SONiDO.1064622.seventorrents.com.torrent
2014-05-08 19:22 - 2014-05-08 19:22 - 00007727 _____ () C:\Users\almonte\Downloads\I.Am.Soldier.2014.720p.BrRip.x264.YIFY.1064676.seventorrents.com.torrent
2014-05-08 19:10 - 2014-05-08 19:10 - 00000000 ____D () C:\Users\almonte\Desktop\I.Frankenstein.2014.BBRip.480p.x264.AAC-VYTO [P2PDL]
2014-05-07 20:21 - 2014-05-07 20:21 - 00124395 _____ () C:\Users\almonte\Downloads\[Limetorrents.com]_Da Possessed (2014) HDTVRip @ pinoy-pirates.torrent
2014-05-06 20:22 - 2014-05-06 20:22 - 00015577 _____ () C:\Users\almonte\Downloads\Vampire.Academy.2014.BRRip.480p.x264.AAC.VYTO.1066241.seventorrents.com (1).torrent
2014-05-05 22:57 - 2014-05-05 22:57 - 00015577 _____ () C:\Users\almonte\Downloads\Vampire.Academy.2014.BRRip.480p.x264.AAC.VYTO.1066241.seventorrents.com.torrent
2014-05-05 22:56 - 2014-05-05 22:56 - 00015544 _____ () C:\Users\almonte\Downloads\Pompeii.2014.BRRip.480p.x264.AAC.VYTO.1066626.seventorrents.com.torrent
2014-05-05 18:37 - 2014-05-05 18:37 - 00929416 _____ (CNET Download.com) C:\Users\almonte\Downloads\cbsidlm-cbsi188-RAR_Password_Unlocker-SEO-10965719.exe
2014-05-04 07:13 - 2014-05-04 07:13 - 00029735 _____ () C:\Users\almonte\Downloads\Transformers_4_[DvdRip_2012]_avi.torrent
2014-05-04 07:09 - 2014-05-04 07:09 - 00029413 _____ () C:\Users\almonte\Downloads\[kickass.to]water.world.1995.dvdrip.torrent
2014-05-03 19:32 - 2014-05-03 19:32 - 00072713 _____ () C:\Users\almonte\Downloads\[kickass.to]apocalypto.2006.bluray.720p.900mb.ganool.torrent
2014-05-03 19:32 - 2014-05-03 19:32 - 00055506 _____ () C:\Users\almonte\Downloads\[kickass.to]waterworld.dvdrip.divx.h.torrent
2014-05-03 14:29 - 2014-05-03 14:29 - 00003292 _____ () C:\Windows\System32\Tasks\{9C78437C-303B-492E-93DA-B27C91250523}
2014-05-03 14:13 - 2014-05-03 14:28 - 00000000 ____D () C:\Users\almonte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Battle Realms
2014-05-03 14:13 - 2014-05-03 14:13 - 00000000 _____ () C:\Windows\PowerReg.dat
2014-05-03 14:12 - 2014-05-03 14:12 - 00000000 ____D () C:\Program Files (x86)\Liquid Entertainment
2014-05-03 13:15 - 2014-05-03 13:15 - 00000354 _____ () C:\Users\almonte\Downloads\DONG.txt
2014-05-02 20:42 - 2014-05-02 20:42 - 01707330 _____ () C:\Users\almonte\Downloads\shambles.unity3d
2014-05-01 22:56 - 2014-05-01 22:56 - 00000028 _____ () C:\Users\almonte\Downloads\DIary.txt
2014-04-29 12:24 - 2014-04-29 12:24 - 00011330 _____ () C:\Users\almonte\Downloads\Diary_ng_Panget(the_movie)_2014_camrip_kanortorrent_topsiderpinoy.com.avi.torrent
2014-04-29 12:14 - 2014-04-29 12:14 - 00022324 _____ () C:\Users\almonte\Downloads\300-rise-of-an-empire_english-883203.zip
2014-04-29 00:44 - 2014-04-29 00:44 - 00000000 ____D () C:\Users\almonte\AppData\Roaming\Unity
2014-04-28 23:54 - 2014-04-28 23:54 - 01070496 _____ (Unity Technologies ApS) C:\Users\almonte\Downloads\UnityWebPlayer (1).exe
2014-04-23 16:39 - 2014-04-23 16:39 - 00000020 _____ () C:\Users\almonte\Desktop\New WinRAR archive.rar
 
==================== One Month Modified Files and Folders =======
 
2014-05-18 20:43 - 2014-05-18 20:43 - 00014122 _____ () C:\Users\almonte\Downloads\FRST.txt
2014-05-18 20:43 - 2014-05-18 20:42 - 00000000 ____D () C:\FRST
2014-05-18 20:43 - 2013-08-19 10:14 - 00000000 ____D () C:\Users\almonte\AppData\Roaming\uTorrent
2014-05-18 20:41 - 2009-07-14 12:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-18 20:41 - 2009-07-14 12:45 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-18 20:40 - 2014-04-07 19:30 - 00392397 _____ () C:\Windows\WindowsUpdate.log
2014-05-18 20:37 - 2014-05-18 20:37 - 02067456 _____ (Farbar) C:\Users\almonte\Downloads\FRST64.exe
2014-05-18 19:45 - 2013-09-11 19:11 - 00001074 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-18 18:05 - 2013-10-29 00:00 - 00000936 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3332921106-3208867521-1591249988-1000UA.job
2014-05-18 17:41 - 2014-05-18 17:41 - 00017889 _____ () C:\Users\almonte\Downloads\Olympus.Has.Fallen.2013.BRRip.480p.x264.AAC.VYTO.1056469.seventorrents.com.torrent
2014-05-18 17:14 - 2014-05-18 17:14 - 00013325 _____ () C:\Users\almonte\Downloads\Heaven.Is.For.Real.2014.HDCAM.x264.Pimp4003.1065921.seventorrents.com.torrent
2014-05-18 17:13 - 2013-08-16 17:43 - 00000000 ____D () C:\Users\almonte\AppData\Roaming\Skype
2014-05-18 17:09 - 2014-05-16 18:15 - 00000672 _____ () C:\Windows\setupact.log
2014-05-18 17:09 - 2014-02-09 02:59 - 00000000 ____D () C:\Users\almonte\AppData\Roaming\.minecraft
2014-05-18 17:09 - 2013-09-11 19:11 - 00001070 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-18 17:09 - 2009-07-14 13:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-18 14:33 - 2014-05-18 14:33 - 00000000 ____D () C:\TDSSKiller_Quarantine
2014-05-18 14:22 - 2014-05-18 14:22 - 00000000 ____D () C:\Users\almonte\Downloads\Infected with BOO Cidox.B - Can I fix it  - Virus, Trojan, Spyware, and Malware Removal Logs_files
2014-05-18 14:20 - 2014-05-18 14:18 - 04164448 _____ (Kaspersky Lab ZAO) C:\Users\almonte\Downloads\tdsskiller.exe
2014-05-18 13:01 - 2014-04-06 22:30 - 00003926 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{287212E2-C957-4547-8743-FA567174C525}
2014-05-18 00:05 - 2013-10-29 00:00 - 00000914 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3332921106-3208867521-1591249988-1000Core.job
2014-05-17 19:00 - 2013-09-07 17:38 - 00000000 ___HD () C:\Windows\syntaxerror00100
2014-05-16 22:43 - 2014-05-16 22:42 - 02046003 _____ () C:\Users\almonte\Downloads\Clash_of_Clans_Hack_2014.zip
2014-05-16 18:40 - 2014-05-16 18:22 - 03313664 _____ (Avira GmbH) C:\Users\almonte\Downloads\bootwizard.exe
2014-05-16 18:15 - 2014-05-16 18:15 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-16 15:06 - 2013-08-22 12:02 - 00000000 ____D () C:\Users\almonte\AppData\Roaming\Adobe
2014-05-16 15:06 - 2013-08-15 12:17 - 00000000 ___RD () C:\Users\almonte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-16 15:03 - 2013-08-31 22:10 - 00000000 ____D () C:\Users\almonte\AppData\Roaming\vlc
2014-05-16 11:03 - 2014-01-23 08:50 - 00002151 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-05-15 21:21 - 2014-05-15 21:21 - 00033098 _____ () C:\Users\almonte\Downloads\X-Men Days of Future Past 2014.torrent
2014-05-15 18:49 - 2014-05-15 18:49 - 00000018 _____ () C:\Users\almonte\Desktop\son of god.txt
2014-05-15 17:47 - 2014-05-15 17:47 - 00016769 _____ () C:\Users\almonte\Downloads\X-Men_Days_of_Future_Past_(2014).torrent.torrent
2014-05-12 19:47 - 2014-05-12 19:46 - 00000000 ____D () C:\Users\almonte\Desktop\Son.Of.God.2014.WEBRip.480p.x264.AAC-VYTO
2014-05-12 12:41 - 2014-01-17 13:07 - 00002006 _____ () C:\Users\Public\Desktop\Google Slides.lnk
2014-05-12 12:41 - 2014-01-17 13:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-05-12 10:39 - 2013-09-11 19:11 - 00004070 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-12 10:39 - 2013-09-11 19:11 - 00003818 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-08 19:22 - 2014-05-08 19:22 - 00042919 _____ () C:\Users\almonte\Downloads\I.Am.Soldier.2014.BDRip.x264.SONiDO.1064622.seventorrents.com.torrent
2014-05-08 19:22 - 2014-05-08 19:22 - 00007727 _____ () C:\Users\almonte\Downloads\I.Am.Soldier.2014.720p.BrRip.x264.YIFY.1064676.seventorrents.com.torrent
2014-05-08 19:15 - 2009-07-14 13:13 - 00713888 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-08 19:10 - 2014-05-08 19:10 - 00000000 ____D () C:\Users\almonte\Desktop\I.Frankenstein.2014.BBRip.480p.x264.AAC-VYTO [P2PDL]
2014-05-07 20:21 - 2014-05-07 20:21 - 00124395 _____ () C:\Users\almonte\Downloads\[Limetorrents.com]_Da Possessed (2014) HDTVRip @ pinoy-pirates.torrent
2014-05-06 20:22 - 2014-05-06 20:22 - 00015577 _____ () C:\Users\almonte\Downloads\Vampire.Academy.2014.BRRip.480p.x264.AAC.VYTO.1066241.seventorrents.com (1).torrent
2014-05-05 22:57 - 2014-05-05 22:57 - 00015577 _____ () C:\Users\almonte\Downloads\Vampire.Academy.2014.BRRip.480p.x264.AAC.VYTO.1066241.seventorrents.com.torrent
2014-05-05 22:56 - 2014-05-05 22:56 - 00015544 _____ () C:\Users\almonte\Downloads\Pompeii.2014.BRRip.480p.x264.AAC.VYTO.1066626.seventorrents.com.torrent
2014-05-05 18:37 - 2014-05-05 18:37 - 00929416 _____ (CNET Download.com) C:\Users\almonte\Downloads\cbsidlm-cbsi188-RAR_Password_Unlocker-SEO-10965719.exe
2014-05-04 07:13 - 2014-05-04 07:13 - 00029735 _____ () C:\Users\almonte\Downloads\Transformers_4_[DvdRip_2012]_avi.torrent
2014-05-04 07:09 - 2014-05-04 07:09 - 00029413 _____ () C:\Users\almonte\Downloads\[kickass.to]water.world.1995.dvdrip.torrent
2014-05-03 19:32 - 2014-05-03 19:32 - 00072713 _____ () C:\Users\almonte\Downloads\[kickass.to]apocalypto.2006.bluray.720p.900mb.ganool.torrent
2014-05-03 19:32 - 2014-05-03 19:32 - 00055506 _____ () C:\Users\almonte\Downloads\[kickass.to]waterworld.dvdrip.divx.h.torrent
2014-05-03 14:31 - 2013-09-13 23:56 - 00000000 ____D () C:\Users\almonte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-05-03 14:29 - 2014-05-03 14:29 - 00003292 _____ () C:\Windows\System32\Tasks\{9C78437C-303B-492E-93DA-B27C91250523}
2014-05-03 14:28 - 2014-05-03 14:13 - 00000000 ____D () C:\Users\almonte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Battle Realms
2014-05-03 14:13 - 2014-05-03 14:13 - 00000000 _____ () C:\Windows\PowerReg.dat
2014-05-03 14:12 - 2014-05-03 14:12 - 00000000 ____D () C:\Program Files (x86)\Liquid Entertainment
2014-05-03 13:15 - 2014-05-03 13:15 - 00000354 _____ () C:\Users\almonte\Downloads\DONG.txt
2014-05-02 20:42 - 2014-05-02 20:42 - 01707330 _____ () C:\Users\almonte\Downloads\shambles.unity3d
2014-05-01 22:56 - 2014-05-01 22:56 - 00000028 _____ () C:\Users\almonte\Downloads\DIary.txt
2014-04-29 12:24 - 2014-04-29 12:24 - 00011330 _____ () C:\Users\almonte\Downloads\Diary_ng_Panget(the_movie)_2014_camrip_kanortorrent_topsiderpinoy.com.avi.torrent
2014-04-29 12:14 - 2014-04-29 12:14 - 00022324 _____ () C:\Users\almonte\Downloads\300-rise-of-an-empire_english-883203.zip
2014-04-29 00:44 - 2014-04-29 00:44 - 00000000 ____D () C:\Users\almonte\AppData\Roaming\Unity
2014-04-28 23:54 - 2014-04-28 23:54 - 01070496 _____ (Unity Technologies ApS) C:\Users\almonte\Downloads\UnityWebPlayer (1).exe
2014-04-28 23:54 - 2013-11-17 12:14 - 00000000 ____D () C:\Users\almonte\AppData\Local\Unity
2014-04-23 16:39 - 2014-04-23 16:39 - 00000020 _____ () C:\Users\almonte\Desktop\New WinRAR archive.rar
2014-04-18 15:20 - 2009-07-14 11:20 - 00000000 ____D () C:\Windows\system32\NDF
 
Some content of TEMP:
====================
C:\Users\almonte\AppData\Local\Temp\1_Offer_1.exe
C:\Users\almonte\AppData\Local\Temp\6_Offer_3.exe
C:\Users\almonte\AppData\Local\Temp\avgnt.exe
C:\Users\almonte\AppData\Local\Temp\DownloadManager.exe
C:\Users\almonte\AppData\Local\Temp\htmlayout.dll
C:\Users\almonte\AppData\Local\Temp\UpdateFlashPlayer_f102cc03.exe
 
 
==================== Bamital & volsnap Check =================
 
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 
LastRegBack: 2014-05-12 11:49
 
==================== End Of Log ============================

*ADDITION.Log

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-05-2014
Ran by almonte at 2014-05-18 20:43:52
Running from C:\Users\almonte\Downloads
Boot Mode: Normal
==========================================================
 
 
==================== Security Center ========================
 
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 
==================== Installed Programs ======================
 
µTorrent (HKCU\...\uTorrent) (Version: 3.4.1.30888 - BitTorrent Inc.)
Adobe Flash Player ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 9.0.124.0 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.03) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.03 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.1.629 - Adobe Systems, Inc.)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
Battle Realms (HKLM-x32\...\{9AA761E6-CA51-4FF2-A552-D51638BF0595}) (Version: 0.10.000 - Liquid Entertainment)
Battle Realms WOTW Expansion (HKLM-x32\...\{88D489A4-D954-414F-9F49-117EFB372951}) (Version: 0.20.000 - Liquid Entertainment)
CCleaner (HKLM\...\CCleaner) (Version: 4.04 - Piriform)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 4.0.0820 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 4.0.0820 - CyberLink Corp.) Hidden
Diner Dash 5 - Boom Collectors Edition (HKLM-x32\...\Diner Dash 5 - Boom Collectors Edition1.0) (Version: 1.0 - Foxy Games)
Facebook Video Calling 2.0.0.447 (HKLM-x32\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)
Free Studio version 2013 (HKLM-x32\...\Free Studio_is1) (Version: 6.1.10.812 - DVDVideoSoft Ltd.)
Globe Tattoo Broadband (HKLM-x32\...\Globe Tattoo Broadband) (Version: 21.005.11.00.158 - Huawei Technologies Co.,Ltd)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.137 - Google Inc.)
Google Drive (HKLM-x32\...\{418BAAD1-754D-48B4-B078-46EF4F25AF42}) (Version: 1.15.6556.8063 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
Java™ 6 Update 27 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416027FF}) (Version: 6.0.270 - Oracle)
Microsoft Office Access MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Access Setup Metadata MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Groove Setup Metadata MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Report Viewer Redistributable 2008 (HKLM-x32\...\Microsoft Report Viewer Redistributable 2008) (Version:  - Microsoft Corporation)
Microsoft Report Viewer Redistributable 2008 (x32 Version: 9.0.21022 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.60831.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
MixPad (HKLM-x32\...\MixPad) (Version: 3.48 - NCH Software)
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
Nokia Connectivity Cable Driver (HKLM-x32\...\{A57025CC-5F2E-4D01-B387-06DB10500D43}) (Version: 7.1.78.0 - Nokia)
Nokia PC Suite (HKLM-x32\...\Nokia PC Suite) (Version: 7.1.180.94 - Nokia)
Nokia PC Suite (x32 Version: 7.1.180.94 - Nokia) Hidden
Nokia Software Updater (HKLM-x32\...\{7130468A-F53F-4698-8C09-A339EA3B05E6}) (Version: 3.0.655 - Nokia)
Origin (HKLM-x32\...\Origin) (Version: 9.0.14.2148 - Electronic Arts, Inc.)
PC Connectivity Solution (HKLM-x32\...\{644F4910-E812-49AD-93EC-86828CB81A0D}) (Version: 12.0.27.0 - Nokia)
PowerISO (HKLM-x32\...\PowerISO) (Version: 5.7 - Power Software Ltd)
Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.11.13307 - Skype Technologies S.A.)
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
The Sims™ 3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.62.153 - Electronic Arts)
The Sims™ 3 70s, 80s, & 90s Stuff (HKLM-x32\...\{E1868CAE-E3B9-4099-8C18-AA8944D336FD}) (Version: 17.0.77 - Electronic Arts)
The Sims™ 3 Ambitions (HKLM-x32\...\{910F4A29-1134-49E0-AD8B-56E4A3152BD1}) (Version: 4.0.87 - Electronic Arts)
The Sims™ 3 Diesel Stuff (HKLM-x32\...\{1C9B6173-6DC9-4EEE-9EFC-6BA115CFBE43}) (Version: 14.0.48 - Electronic Arts)
The Sims™ 3 Fast Lane Stuff (HKLM-x32\...\{ED436EA8-4145-4703-AE5D-4D09DD24AF5A}) (Version: 5.0.44 - Electronic Arts)
The Sims™ 3 Generations (HKLM-x32\...\{E6B88BD6-E4B2-4701-A648-B6DAC6E491CC}) (Version: 8.0.152 - Electronic Arts)
The Sims™ 3 High-End Loft Stuff (HKLM-x32\...\{71828142-5A24-4BD0-97E7-976DA08CE6CF}) (Version: 3.0.38 - Electronic Arts)
The Sims™ 3 Into the Future (HKLM-x32\...\{A0BBD6C7-B546-4048-B33A-F21F5C9F5B09}) (Version: 21.0.150 - Electronic Arts)
The Sims™ 3 Island Paradise (HKLM-x32\...\{DB21639E-FE55-432C-BCA2-0C5249E3F79E}) (Version: 19.0.101 - Electronic Arts)
The Sims™ 3 Katy Perry's Sweet Treats (HKLM-x32\...\{9B2506E3-9A3F-45B5-96BF-509CAD584650}) (Version: 13.0.62 - Electronic Arts)
The Sims™ 3 Late Night (HKLM-x32\...\{45057FCE-5784-48BE-8176-D9D00AF56C3C}) (Version: 6.0.81 - Electronic Arts)
The Sims™ 3 Master Suite Stuff (HKLM-x32\...\{08A25478-C5DD-4EA7-B168-3D687CA987FF}) (Version: 11.0.84 - Electronic Arts)
The Sims™ 3 Movie Stuff (HKLM-x32\...\{D0087539-3C57-44E0-BEE7-D779D546CBE1}) (Version: 20.0.53 - Electronic Arts)
The Sims™ 3 Outdoor Living Stuff (HKLM-x32\...\{117B6BF6-82C3-420C-B284-9247C8568E53}) (Version: 7.0.55 - Electronic Arts)
The Sims™ 3 Pets (HKLM-x32\...\{C12631C6-804D-4B32-B0DD-8A496462F106}) (Version: 10.0.96 - Electronic Arts)
The Sims™ 3 Seasons (HKLM-x32\...\{3DE92282-CB49-434F-81BF-94E5B380E889}) (Version: 16.0.136 - Electronic Arts)
The Sims™ 3 Showtime (HKLM-x32\...\{3BBFD444-5FAB-49F6-98B1-A1954E831399}) (Version: 12.0.273 - Electronic Arts)
The Sims™ 3 Supernatural (HKLM-x32\...\{B37DAFA5-717D-41F8-BDFB-3A4B68C0B3A1}) (Version: 15.0.135 - Electronic Arts)
The Sims™ 3 Town Life Stuff (HKLM-x32\...\{7B11296A-F894-449C-8DF6-6AAAA7D4D118}) (Version: 9.0.73 - Electronic Arts)
The Sims™ 3 University Life (HKLM-x32\...\{F26DE8EF-F2CF-40DC-8CDA-CC0D82D11B36}) (Version: 18.0.126 - Electronic Arts)
The Sims™ 3 World Adventures (HKLM-x32\...\{BA26FFA5-6D47-47DB-BE56-34C357B5F8CC}) (Version: 2.0.86 - Electronic Arts)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
VLC media player 2.0.8 (HKLM-x32\...\VLC media player) (Version: 2.0.8 - VideoLAN)
Windows Driver Package - Nokia Modem  (02/25/2011 4.7) (HKLM\...\E0AC723A3DE3A04256288CADBBB011B112AED454) (Version: 02/25/2011 4.7 - Nokia)
Windows Driver Package - Nokia Modem  (02/25/2011 7.01.0.9) (HKLM\...\72A50F48CC5601190B9C4E74D81161693133E7F7) (Version: 02/25/2011 7.01.0.9 - Nokia)
Windows Driver Package - Nokia pccsmcfd LegacyDriver  (05/31/2012 7.1.2.0) (HKLM\...\62BBD193ADFDBB228C7E1ADB56463F5732FF7F6F) (Version: 05/31/2012 7.1.2.0 - Nokia)
WinRAR 4.00 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.00.0 - win.rar GmbH)
 
==================== Restore Points  =========================
 
12-05-2014 03:56:11 Scheduled Checkpoint
 
==================== Hosts content: ==========================
 
2009-07-14 10:34 - 2009-06-11 05:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 
==================== Scheduled Tasks (whitelisted) =============
 
Task: {02C68433-5F0F-45AA-B4B3-5BC821D92049} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-07-23] (Piriform Ltd)
Task: {2C264E10-8A87-4569-B485-FB50DD350687} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-09-11] (Google Inc.)
Task: {8E59C005-83E4-4B24-B923-AE15EC54A5D4} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-09-11] (Google Inc.)
Task: {B3FE9C85-60BC-4C59-9478-F92BC99F7C28} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3332921106-3208867521-1591249988-1000Core => C:\Users\almonte\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-10-29] (Facebook Inc.)
Task: {E9AF2D43-29BE-4F79-B319-CCDF95CD37CA} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3332921106-3208867521-1591249988-1000UA => C:\Users\almonte\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-10-29] (Facebook Inc.)
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3332921106-3208867521-1591249988-1000Core.job => C:\Users\almonte\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3332921106-3208867521-1591249988-1000UA.job => C:\Users\almonte\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 
==================== Loaded Modules (whitelisted) =============
 
2014-05-16 15:06 - 2014-05-16 15:06 - 02967040 _____ () C:\ProgramData\Microsoft\Crypto\RSA64\CryptoProvider.dll
2014-05-16 15:06 - 2014-05-16 15:06 - 02278912 _____ () C:\ProgramData\Microsoft\Crypto\RSA64\rsa64.dll
2013-08-15 13:37 - 2011-03-02 12:40 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll
2014-04-09 16:40 - 2014-04-09 16:38 - 00218624 _____ () C:\ProgramData\Globe Tattoo Broadband\OnlineUpdate\ouc.exe
2010-11-16 21:38 - 2010-11-16 21:38 - 00339456 _____ () C:\ProgramData\DatacardService\HWDeviceService64.exe
2013-08-15 14:10 - 2013-08-15 14:01 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2014-04-09 16:40 - 2014-04-09 16:38 - 00011362 _____ () C:\ProgramData\Globe Tattoo Broadband\OnlineUpdate\mingwm10.dll
2014-04-09 16:40 - 2014-04-09 16:38 - 00043008 _____ () C:\ProgramData\Globe Tattoo Broadband\OnlineUpdate\libgcc_s_dw2-1.dll
2014-04-09 16:40 - 2014-04-09 16:38 - 02415104 _____ () C:\ProgramData\Globe Tattoo Broadband\OnlineUpdate\QtCore4.dll
2014-04-09 16:40 - 2014-04-09 16:38 - 01148416 _____ () C:\ProgramData\Globe Tattoo Broadband\OnlineUpdate\QtNetwork4.dll
2014-05-16 11:03 - 2014-05-08 07:29 - 00065352 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\chrome_elf.dll
2014-05-16 11:03 - 2014-05-08 07:29 - 00674632 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\libglesv2.dll
2014-05-16 11:03 - 2014-05-08 07:29 - 00093000 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\libegl.dll
2014-05-16 11:03 - 2014-05-08 07:29 - 04081480 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\pdf.dll
2014-05-16 11:03 - 2014-05-08 07:29 - 00390472 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll
2014-05-16 11:03 - 2014-05-08 07:29 - 01647432 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\ffmpegsumo.dll
 
==================== Alternate Data Streams (whitelisted) =========
 
 
==================== Safe Mode (whitelisted) ===================
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\25319500.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\72374819.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\25319500.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\72374819.sys => ""="Driver"
 
==================== EXE Association (whitelisted) =============
 
 
==================== Disabled items from MSCONFIG ==============
 
 
==================== Faulty Device Manager Devices =============
 
Name: Base System Device
Description: Base System Device
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: Base System Device
Description: Base System Device
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
Name: Base System Device
Description: Base System Device
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (05/18/2014 05:11:24 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/18/2014 03:13:56 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/18/2014 03:11:06 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program chrome.exe version 34.0.1847.137 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.
 
Process ID: fdc
 
Start Time: 01cf72643453d8f9
 
Termination Time: 13
 
Application Path: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
 
Report Id: 9261c5d3-de5b-11e3-a6fb-00235aac5c66
 
Error: (05/18/2014 02:41:56 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/18/2014 02:36:00 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/18/2014 02:29:11 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/18/2014 02:17:39 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/18/2014 01:00:05 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/18/2014 09:53:36 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/18/2014 00:05:06 AM) (Source: Google Update) (EventID: 20) (User: laptop)
Description: Network Request Error.
Error: 0x80072ee7. Http status code: 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=IE, wpad=1, script=.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying WinHTTP.
Send request returned 0x80072ee7. Http status code 0.
trying CUP:iexplore.
Send request returned 0x80004005. Http status code 0.
Trying config: source=, direct connection.
trying CUP:WinHTTP.
Send request returned 0x80072ee7. Http s
 
 
System errors:
=============
Error: (05/18/2014 05:09:58 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Globe Tattoo Broadband. OUC service failed to start due to the following error: 
%%1053
 
Error: (05/18/2014 05:09:58 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Globe Tattoo Broadband. OUC service to connect.
 
Error: (05/18/2014 03:12:27 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Globe Tattoo Broadband. OUC service failed to start due to the following error: 
%%1053
 
Error: (05/18/2014 03:12:27 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Globe Tattoo Broadband. OUC service to connect.
 
Error: (05/18/2014 02:40:27 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Globe Tattoo Broadband. OUC service failed to start due to the following error: 
%%1053
 
Error: (05/18/2014 02:40:27 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Globe Tattoo Broadband. OUC service to connect.
 
Error: (05/18/2014 02:34:38 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Globe Tattoo Broadband. OUC service failed to start due to the following error: 
%%1053
 
Error: (05/18/2014 02:34:38 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Globe Tattoo Broadband. OUC service to connect.
 
Error: (05/18/2014 02:27:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Globe Tattoo Broadband. OUC service failed to start due to the following error: 
%%1053
 
Error: (05/18/2014 02:27:49 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Globe Tattoo Broadband. OUC service to connect.
 
 
Microsoft Office Sessions:
=========================
Error: (03/15/2014 08:38:03 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 7639 seconds with 2880 seconds of active time.  This session ended with a crash.
 
 
==================== Memory info =========================== 
 
Percentage of memory in use: 40%
Total physical RAM: 3002.96 MB
Available physical RAM: 1795.8 MB
Total Pagefile: 6004.12 MB
Available Pagefile: 4466.8 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
 
==================== Drives ================================
 
Drive c: (win7) (Fixed) (Total:154.88 GB) (Free:53.65 GB) NTFS
Drive d: (documents) (Fixed) (Total:143.11 GB) (Free:14.43 GB) NTFS
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 546578AC)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=155 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=143 GB) - (Type=OF Extended)
 
==================== End Of Log ============================


#9 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:01:16 AM

Posted 18 May 2014 - 08:20 AM



Hello carmella04

These are the programs I would like you to run next, if you have any problems with one of these just skip it and move on to the next one.

-AdwCleaner-

Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
-Junkware-Removal-Tool-

Please download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
When they are complete let me have the two reports and let me know how things are running.

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#10 carmella04

carmella04
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:01:16 PM

Posted 18 May 2014 - 08:37 AM

*LOG FOR ADWARE

 

# AdwCleaner v3.208 - Report created 18/05/2014 at 21:32:33
# Updated 11/05/2014 by Xplode
# Operating System : Windows 7 Ultimate Service Pack 1 (64 bits)
# Username : almonte - LAPTOP
# Running from : C:\Users\almonte\Downloads\AdwCleaner.exe
# Option : Clean
 
***** [ Services ] *****
 
 
***** [ Files / Folders ] *****
 
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\MyPC Backup
Folder Deleted : C:\Users\almonte\AppData\Local\Bundled software uninstaller
Folder Deleted : C:\Users\almonte\AppData\Local\NativeMessaging
Folder Deleted : C:\Users\almonte\AppData\Local\TBHostSupport
Folder Deleted : C:\Users\almonte\AppData\Local\WhiteListing
Folder Deleted : C:\Users\almonte\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\almonte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SmartTweak Software
Folder Deleted : C:\Users\almonte\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdeghapgkmmickhpnbgfgkocambmjlgd
Folder Deleted : C:\Users\almonte\AppData\Local\Google\Chrome\User Data\Default\Extensions\agomemppmpabchheglekdfpkkappkanl
Folder Deleted : C:\Users\almonte\AppData\Local\Google\Chrome\User Data\Default\Extensions\cflheckfmhopnialghigdlggahiomebp
 
***** [ Shortcuts ] *****
 
 
***** [ Registry ] *****
 
Key Deleted : HKCU\Software\Google\Chrome\Extensions\agomemppmpabchheglekdfpkkappkanl
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\agomemppmpabchheglekdfpkkappkanl
Key Deleted : HKCU\Software\Google\Chrome\Extensions\cflheckfmhopnialghigdlggahiomebp
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\cflheckfmhopnialghigdlggahiomebp
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\outobox_Setup_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\outobox_Setup_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\outobox1120_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\outobox1120_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{DCABB943-792E-44C4-9029-ECBEE6265AF9}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Key Deleted : HKCU\Software\BI
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\smarttweak
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKLM\Software\Conduit
 
***** [ Browsers ] *****
 
-\\ Internet Explorer v8.0.7601.17514
 
 
-\\ Google Chrome v34.0.1847.137
 
[ File : C:\Users\almonte\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 
Deleted [Search Provider] : hxxp://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&CUI=UN12849745304851211&ctid=CT3250851&UM=1
Deleted [Search Provider] : hxxp://www.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=DD9E002100F70203&affID=122601&tt=250613_gr2&tsp=4928
Deleted [Search Provider] : hxxp://en.softonic.com/s/{searchTerms}
Deleted [Extension] : agomemppmpabchheglekdfpkkappkanl
Deleted [Extension] : cflheckfmhopnialghigdlggahiomebp
Deleted [Extension] : gdeghapgkmmickhpnbgfgkocambmjlgd
 
*************************
 
AdwCleaner[R0].txt - [4025 octets] - [18/05/2014 21:30:38]
AdwCleaner[S0].txt - [3903 octets] - [18/05/2014 21:32:33]
 
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3963 octets] ##########


#11 carmella04

carmella04
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:01:16 PM

Posted 18 May 2014 - 08:41 AM

It restarted normally but the pop outs of Detection in avira is still there

I didint find this  C:\AdwCleaner[S1].txt 

but i found Adwcleaner[S0] and Adwcleaner[R0]



#12 carmella04

carmella04
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:01:16 PM

Posted 18 May 2014 - 08:52 AM

*Log FOR JUNKWARE

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Ultimate x64
Ran by almonte on Sun 05/18/2014 at 21:43:21.58
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
~~~ Services
 
 
 
~~~ Registry Values
 
 
 
~~~ Registry Keys
 
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\KMPAskPIPCount_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\KMPAskPIPCount_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\KMPAskPIPCount_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\KMPAskPIPCount_RASMANCS
 
 
 
~~~ Files
 
 
 
~~~ Folders
 
Successfully deleted: [Folder] "C:\ProgramData\apn"
 
 
 
~~~ Event Viewer Logs were cleared
 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sun 05/18/2014 at 21:51:10.99
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


#13 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:01:16 AM

Posted 18 May 2014 - 11:16 AM


Hello carmella04

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"
  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#14 carmella04

carmella04
  • Topic Starter

  • Members
  • 21 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:01:16 PM

Posted 18 May 2014 - 08:39 PM

ComboFix 14-05-16.01 - almonte 05/19/2014   9:05.2.2 - x64
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.63.1033.18.3003.1879 [GMT 8:00]
Running from: c:\users\almonte\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Crypto\RSA64\rsa64.dll
.
.
(((((((((((((((((((((((((   Files Created from 2014-04-19 to 2014-05-19  )))))))))))))))))))))))))))))))
.
.
2014-05-19 01:12 . 2014-05-19 01:12 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-05-18 13:43 . 2014-05-18 13:43 -------- d-----w- c:\windows\ERUNT
2014-05-18 13:31 . 2010-08-30 00:34 536576 ----a-w- c:\windows\SysWow64\sqlite3.dll
2014-05-18 13:30 . 2014-05-18 13:33 -------- d-----w- C:\AdwCleaner
2014-05-18 12:42 . 2014-05-18 12:44 -------- d-----w- C:\FRST
2014-05-18 06:33 . 2014-05-18 06:33 -------- d-----w- C:\TDSSKiller_Quarantine
2014-05-16 07:06 . 2014-05-16 07:06 255488 ----a-w- c:\users\almonte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AodbeARMHelper.exe
2014-05-03 06:28 . 2014-05-03 06:28 57344 ----a-r- c:\users\almonte\AppData\Roaming\Microsoft\Installer\{88D489A4-D954-414F-9F49-117EFB372951}\_A2A8F60BF71B_4A7D_94E7_DD1F6B6EB4A3.exe
2014-05-03 06:13 . 2014-05-03 06:13 53248 ----a-r- c:\users\almonte\AppData\Roaming\Microsoft\Installer\{9AA761E6-CA51-4FF2-A552-D51638BF0595}\_F522ED7EA612_4117_B86D_78467DE01E30.exe
2014-05-03 06:12 . 2014-05-03 06:12 -------- d-----w- c:\program files (x86)\Liquid Entertainment
2014-05-03 06:12 . 2014-05-03 06:12 -------- d-----w- c:\program files (x86)\Common Files\InstallShield
2014-04-28 16:44 . 2014-04-28 16:44 -------- d-----w- c:\users\almonte\AppData\Roaming\Unity
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-04-09 08:38 . 2014-04-09 08:39 93696 ----a-w- c:\windows\system32\drivers\ew_jucdcacm.sys
2014-04-09 08:38 . 2014-04-09 08:39 85504 ----a-w- c:\windows\system32\drivers\ew_jubusenum.sys
2014-04-09 08:38 . 2014-04-09 08:39 55296 ----a-w- c:\windows\system32\drivers\ew_jucdcecm.sys
2014-04-09 08:38 . 2014-04-09 08:39 29184 ----a-w- c:\windows\system32\drivers\ew_juextctrl.sys
2014-04-09 08:38 . 2014-04-09 08:39 196608 ----a-w- c:\windows\system32\drivers\ew_juwwanecm.sys
2014-04-09 08:38 . 2014-04-09 08:39 1490656 ----a-w- c:\windows\system32\WdfCoInstaller01007.dll
2014-04-09 08:38 . 2014-04-09 08:39 1490656 ----a-w- c:\windows\system32\drivers\WdfCoInstaller01007.dll
2014-04-09 08:38 . 2014-04-09 08:39 999936 ----a-w- c:\windows\system32\drivers\mod7700.sys
2014-04-09 08:38 . 2014-04-09 08:39 32768 ----a-w- c:\windows\system32\drivers\ewdcsc.sys
2014-04-09 08:38 . 2014-04-09 08:39 256000 ----a-w- c:\windows\system32\drivers\ewusbnet.sys
2014-04-09 08:38 . 2014-04-09 08:39 13952 ----a-w- c:\windows\system32\drivers\ew_usbenumfilter.sys
2014-04-09 08:38 . 2014-04-09 08:39 121600 ----a-w- c:\windows\system32\drivers\ewusbmdm.sys
2014-04-09 08:38 . 2014-04-09 08:39 117248 ----a-w- c:\windows\system32\drivers\ew_hwusbdev.sys
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[7] 2010-11-21 . FE70103391A64039A921DBFFF9C7AB1B . 1008128 . . [6.1.7601.17514] .. c:\windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
[-] 2013-08-15 . 2C353B6CE0C8D03225CAA2AF33B68D79 . 1008640 . . [6.1.7601.17514] .. c:\windows\system32\user32.dll
.
[-] 2013-08-15 . 861C4346F9281DC0380DE72C8D55D6BE . 833024 . . [6.1.7601.17514] .. c:\windows\SysWOW64\user32.dll
[7] 2010-11-21 . 5E0DB2D8B2750543CD2EBB9EA8E6CDD3 . 833024 . . [6.1.7601.17514] .. c:\windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\users\almonte\AppData\Roaming\uTorrent\uTorrent.exe" [2014-04-29 1270352]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-02-10 20922016]
"WmiPrv"="c:\users\almonte\AppData\Roaming\.minecraft\WmiPrv\WmiPrvSE.exe" [2014-05-18 580608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-02-25 689744]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
"YouCam Mirage"="c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe" [2010-08-20 136488]
"YouCam Tray"="c:\program files (x86)\CyberLink\YouCam\YouCamTray.exe" [2010-08-20 162912]
"NSU_agent"="c:\program files (x86)\Nokia\Nokia Software Updater\nsu3ui_agent.exe" [2012-02-28 190768]
.
c:\users\almonte\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
AodbeARMHelper.exe [2014-5-16 255488]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
R2 Globe Tattoo Broadband. RunOuc;Globe Tattoo Broadband. OUC;c:\program files (x86)\Globe Tattoo Broadband\UpdateDog\ouc.exe;c:\program files (x86)\Globe Tattoo Broadband\UpdateDog\ouc.exe [x]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys;c:\windows\SYSNATIVE\DRIVERS\ew_hwusbdev.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbnet.sys [x]
R3 nmwcdnsucx64;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsucx64.sys;c:\windows\SYSNATIVE\drivers\nmwcdnsucx64.sys [x]
R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys;c:\windows\SYSNATIVE\drivers\nmwcdnsux64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 HWDeviceService64.exe;HWDeviceService64.exe;c:\programdata\DatacardService\HWDeviceService64.exe;c:\programdata\DatacardService\HWDeviceService64.exe [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jubusenum.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-05-16 02:58 1077576 ----a-w- c:\program files (x86)\Google\Chrome\Application\34.0.1847.137\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2014-05-18 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3332921106-3208867521-1591249988-1000Core.job
- c:\users\almonte\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-10-28 16:00]
.
2014-05-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3332921106-3208867521-1591249988-1000UA.job
- c:\users\almonte\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-10-28 16:00]
.
2014-05-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-09-11 11:11]
.
2014-05-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-09-11 11:11]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1CryptoProviderIcons]
@="{24808826-C2BF-4269-B3BA-89D1D5F431A4}"
[HKEY_CLASSES_ROOT\CLSID\{24808826-C2BF-4269-B3BA-89D1D5F431A4}]
2014-05-16 07:06 2967040 ----a-w- c:\programdata\Microsoft\Crypto\RSA64\CryptoProvider.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2014-04-25 02:03 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2014-04-25 02:03 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2014-04-25 02:03 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2014-04-25 02:03 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2014-04-25 02:03 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.ideacts.com/cms/CMSConnect/C3MServeruninstall.aspx?GUID=f9fbdbe1-a984-41c8-8639-25ce55311e23&CafeCode=MAKATI-0749&UNINSTDT=09/17/2013 06:37 PM&IsOffLine=1&CountryId=180
uDefault_Search_URL = hxxp://www.google.com/ie
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1 192.168.1.1
TCP: Interfaces\{1115B9EF-2B7B-4517-B5B2-86E7D9150A8E}: NameServer = 10.188.62.1 10.188.191.1
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{41564952-412D-5637-00A7-7A786E7484D7} - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-Diner Dash 5 - Boom Collectors Edition1.0 - d:\\uninstall.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.9"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil9f.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil9f.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]
@Denied: (A 2) (Everyone)
@="IFlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2014-05-19  09:22:20
ComboFix-quarantined-files.txt  2014-05-19 01:22
ComboFix2.txt  2014-05-19 00:54
.
Pre-Run: 57,373,523,968 bytes free
Post-Run: 57,333,141,504 bytes free
.
- - End Of File - - 10A4EFC72DE43622D94B5977EC413B4A
A36C5E4F47E84449FF07ED3517B43A31
 
 
 
 
The computer runs normally and the browser is ok it do not crash.
but the detection of AcorIEHelper.dll        detection  : TR/Crypt.Xpack.66455 and users32.DLL             detection : HEUR/Modified.Systemfile is still there  and the security alert i cant remove it

Edited by carmella04, 18 May 2014 - 08:55 PM.


#15 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:01:16 AM

Posted 20 May 2014 - 03:20 AM

Hello carmella04

Malwarebytes Anti-Rootkit

1.Download Malwarebytes Anti-Rootkit
2.Unzip the contents to a folder in a convenient location.
3.Open the folder where the contents were unzipped and run mbar.exe
4.Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
5.Click on the Cleanup button to remove any threats and reboot if prompted to do so.
6.Wait while the system shuts down and the cleanup process is performed.
7.Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
8.If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:
  • •Internet access
    •Windows Update
    •Windows Firewall
9.If there are additional problems with your system, such as any of those listed above or other system issues, then run the 'fixdamage' tool included with Malwarebytes Anti-Rootkit and reboot.
10.Verify that your system is now functioning normally.


--RogueKiller--

Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit
  • Quit all programs that you may have started.
  • Please disconnect any external drives from the computer before you run this scan!
  • For Vista or Windows 7, right-click and select "Run as Administrator to start"
  • For Windows XP, double-click to start.
  • Wait until Prescan has finished ...
  • Then Click on "Scan" button
  • Wait until the Status box shows "Scan Finished"
  • click on "delete"
  • Wait until the Status box shows "Deleting Finished"
  • Click on "Report" and copy/paste the content of the Notepad into your next reply.
  • the scan will make two reports the one I would like to see is called RKreport[2].txt on your Desktop
  • Exit/Close RogueKiller+
send me the reports made from MBAR and Roguekiller and also let me know how the computer is doing at this time.

Gringo

Edited by gringo_pr, 20 May 2014 - 03:20 AM.

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users